unsnooze 1.19.1 → 1.19.2

package/CHANGELOG.md

@@ -1,5 +1,94 @@
 # Changelog
 
+## 1.19.2 — 2026-09-27
+
+Setup on Windows no longer creates a Scheduled Task. That task is what
+Microsoft Defender flagged as a Trojan.
+
+### Website redesign
+
+- The new night-shift design now covers the homepage, documentation, changelog,
+  and feedback page, with responsive layouts and reduced-motion support.
+- Release metadata refreshes every five minutes so the site follows published
+  npm versions. Failed feedback-board reads now show an error instead of
+  loading indefinitely.
+- Windows setup and troubleshooting docs describe the on-demand daemon.
+
+### Codex wake recovery
+
+- Team/business stops with a null credits balance now retain the exhausted
+  five-hour window's reset instead of being held as a workspace credit wall.
+- If Codex consumes Enter as a pasted newline, verification retries Enter
+  up to three times while the exact wake prompt remains in the composer.
+  Each retry rechecks pane ownership and agent liveness. The old banner is
+  not re-recorded as a new stop, and the wake text is never pasted twice.
+  An unconfirmed submission is left visible for manual inspection.
+
+### No Scheduled Task on Windows
+
+A user reported that Microsoft Defender flagged `unsnooze setup` as
+`Trojan:Win32/Commando.A!ml` as it created the `\unsnooze` Scheduled Task. It
+was a false positive, but an understandable one. Setup ran
+`schtasks /create /f /sc onlogon /tr "node.exe …\AppData\Roaming\npm\…\unsnooze.js daemon"`:
+an interpreter told to run a script out of `%APPDATA%` at every logon, which is
+exactly how malware persists, and `Commando.A!ml` is Defender's
+machine-learning verdict on command lines like that one. A Run key or a
+Startup-folder entry reads the same way, so the daemon uses none of them now.
+The task rarely worked anyway: from a shell that is not elevated, `schtasks`
+refuses an `onlogon` task with "Access is denied", and setup said it was
+installed regardless.
+
+On Windows the daemon is now an ordinary background process:
+
+- **Setup starts it.** Saying yes to guarding GUI sessions (or running
+  `unsnooze install --daemon`) starts the daemon at once and records that
+  choice in `~/.unsnooze/daemon-on-demand`. Nothing is registered with Windows.
+- **It is started again on demand.** Every agent launched through the
+  PowerShell wrappers, and every Claude Code StopFailure hook, starts the
+  daemon if it is not running. After a restart it is back as soon as you use
+  an agent.
+- **One runs at a time.** The daemon keeps a heartbeat pidfile
+  (`~/.unsnooze/daemon.pid`), and a second daemon stands down at once. Once the
+  heartbeat is five minutes old the file no longer counts, whoever its pid
+  belongs to by then, so a pid Windows recycles after a sign-out cannot keep
+  the daemon from starting. A resumer lock left behind by a daemon that was
+  killed is cleared too, so it cannot stall every resume.
+- **It carries no session with it.** Started from inside a Claude Code
+  session (by the hook), it used to inherit that session's environment,
+  including `CLAUDECODE=1`, Claude Code's nested-session guard. Every Claude
+  session it revived would then have refused to start. Background processes
+  now drop the variables that mark one session; your own settings, such as
+  `CLAUDE_CONFIG_DIR` and `CLAUDE_CODE_USE_BEDROCK`, are kept. They also run in
+  your home directory, not the project that happened to start them, which
+  Windows would otherwise refuse to delete or rename until sign-out. The
+  transient resumer the hook starts gets the same treatment, on every
+  platform.
+- **No console windows.** A background daemon has no console. The `git` calls
+  it makes when a session stops and wakes, and the agent a revival starts,
+  now run hidden instead of each popping up a window of its own.
+- **Its output goes to `~/.unsnooze/daemon.log`**, as the launchd daemon's
+  does, so a crash leaves a trace.
+- **Re-running setup restarts it.** `unsnooze install --daemon` stops the
+  running daemon and starts a fresh one. That is how it picks up a new
+  version, or a `PATH` that now finds an agent, and `unsnooze doctor` now
+  says so instead of pointing at `schtasks`.
+
+If you use only the Codex app or IDE on Windows, nothing you do passes through
+a wrapper or the hook. After signing in, run `unsnooze install --daemon` (or
+launch any wrapped agent) to start the daemon.
+
+`unsnooze uninstall` removes the marker first, then stops the daemon, so
+nothing can start it again halfway through; a daemon that was only starting at
+that moment sees the marker gone and exits. It also deletes a `\unsnooze`
+Scheduled Task left by an earlier version, after checking that one exists, so
+a machine that never had one only ever sees a read-only query. If the delete
+is refused (a task created from an administrator shell can need one to
+remove), it prints the command to run. Setup does not go looking for that
+task: that would mean running `schtasks` again. A daemon such a task already
+started keeps running until you sign out; from the next sign-in the task only
+starts the same on-demand daemon, which the pidfile keeps to one. macOS and
+Linux are unchanged (launchd / systemd).
+
 ## 1.19.1 — 2026-09-21
 
 A Codex usage reading that was averaged down, a headless Codex revival

package/README.md

@@ -265,7 +265,8 @@ the continued conversation stays visible in the GUI's own history. (Resuming
 *inside* the GUI panel isn't possible today: no extension/app exposes an
 IPC/URI that can send a prompt.)
 
-Enable it in `unsnooze setup` (installs a launchd agent / systemd user unit),
+Enable it in `unsnooze setup` (installs a launchd agent / systemd user unit;
+on Windows the daemon is started on demand instead — see [Windows](#windows)),
 or run `unsnooze install --daemon` / `unsnooze daemon` yourself. Turn it off
 anytime with `unsnooze config set guiWatch off`.
 
@@ -384,7 +385,8 @@ unsnooze config set <k> <v>            # e.g. autoResume off
 unsnooze logs [-f]                     # what unsnooze has been doing
 unsnooze update                        # update unsnooze itself
 unsnooze daemon                        # persistent GUI-session watcher (usually run
-                                       # by launchd/systemd via `install --daemon`)
+                                       # by launchd/systemd via `install --daemon`;
+                                       # on Windows, started on demand)
 unsnooze report [agent]                # capture a pane to report an undetected banner
 unsnooze uninstall [--purge]           # remove wrappers + hooks (+ state with --purge)
 unsnooze help                          # full command list (also -h / --help)
@@ -767,17 +769,26 @@ Windows, WSL is still the better home.
 ### Windows
 
 Native Windows works: PowerShell wrappers, a cmd-safe StopFailure hook, and a
-logon-triggered Scheduled Task for the daemon. Install as usual and run
-`unsnooze doctor` to confirm.
-
-Three honest caveats. The daemon is started at logon but not restarted if it
-dies — Task Scheduler is not a supervisor the way launchd and systemd are — so
-after upgrading unsnooze, log out and back in (or run `unsnooze daemon`
-yourself). The daemon also keeps the `PATH` it was born with: an agent whose
-install directory changes on update (the Codex Desktop/Store runtime lives
-under `%LOCALAPPDATA%\OpenAI\Codex\bin\<hash>`) can vanish from the daemon's
-view while your shell still finds it — unsnooze looks that directory up at
-launch time, `unsnooze doctor` prints what each agent resolves to, and
+daemon started on demand. Install as usual and run `unsnooze doctor` to confirm.
+
+unsnooze registers nothing to run at sign-in on Windows — no Scheduled Task, Run
+key or Startup-folder entry. (Up to 1.19.1 it created a logon Scheduled Task,
+and Microsoft Defender flagged setup as `Trojan:Win32/Commando.A!ml` for it;
+`unsnooze uninstall` removes one left behind.)
+Setup starts the daemon instead, and every agent you launch from PowerShell and
+every Claude Code StopFailure hook starts it again whenever it is not running,
+so after a restart it is back as soon as you use an agent. If you only use the
+Codex app or IDE, nothing you do passes through a wrapper or the hook: run
+`unsnooze install --daemon` after signing in to start it.
+
+Three honest caveats. Nothing supervises the daemon the way launchd and systemd
+do, and a running daemon keeps the code it started with, so after upgrading
+unsnooze re-run `unsnooze install --daemon` (or sign out and back in). The
+daemon also keeps the `PATH` it was born with: an agent whose install directory
+changes on update (the Codex Desktop/Store runtime lives under
+`%LOCALAPPDATA%\OpenAI\Codex\bin\<hash>`) can vanish from the daemon's view
+while your shell still finds it — unsnooze looks that directory up at launch
+time, `unsnooze doctor` prints what each agent resolves to, and
 `UNSNOOZE_CODEX_BIN` (or `UNSNOOZE_CLAUDE_BIN`, …) pins a path; point it at an
 `.exe`, since Node cannot launch a `.cmd` shim directly. And stored-password
 fleet hosts still need Git-for-Windows or WSL `ssh`; native `ssh.exe` requires

package/bin/unsnooze.js

@@ -223,81 +223,107 @@ async function main() {
     case 'daemon': {
       // Persistent resumer + transcript watcher: detects and revives limit
       // stops from GUI surfaces (VS Code extension, desktop apps) where no
-      // shell wrapper or multiplexer pane exists. Run via launchd/systemd or a shell.
+      // shell wrapper or multiplexer pane exists. Run via launchd/systemd, on
+      // demand on native Windows (spawn.js ensureDaemon), or from a shell.
       // Exit 0 on load failure: with launchd KeepAlive a crash here means an
       // instant-respawn crash-loop for the whole upgrade window.
       const resumerMod = await safeImport('../src/resumer.js');
       const watcherMod = await safeImport('../src/watcher.js');
-      if (!resumerMod || !watcherMod) return 0;
+      const spawnMod = await safeImport('../src/spawn.js');
+      if (!resumerMod || !watcherMod || !spawnMod) return 0;
       const { runResumer } = resumerMod;
       const { createWatcher } = watcherMod;
       const controller = new AbortController();
       process.on('SIGTERM', () => controller.abort());
       process.on('SIGINT', () => controller.abort());
-      // Self-heal pre-1.12 autostart units: they lack PATH, so this daemon
-      // cannot find tmux and every revival dies. Healing rewrites the unit
-      // and reloads it — which intentionally kills THIS process; the
-      // supervisor restarts us under the fixed unit. One-time: healed units
-      // pass the check forever after.
-      const installMod = await safeImport('../src/install.js');
-      if (installMod?.healDaemonAutostart) {
-        try {
-          const healed = installMod.healDaemonAutostart();
-          if (healed) {
-            const lm = await safeImport('../src/logger.js');
-            lm?.log('daemon', `autostart unit lacked PATH — regenerated ${healed}, reloading (self-heal)`);
-          }
-        } catch { /* heal is best-effort — a broken unit must not block the daemon */ }
-      }
-      // daemon.log is launchd/systemd-captured stdout+stderr. launchd holds
-      // an open fd on it for our whole lifetime, so rotation must be
-      // copy-truncate: renaming would leave launchd appending to the renamed
-      // inode forever, with no fresh daemon.log until the next respawn.
-      const loggerMod = await safeImport('../src/logger.js');
-      const configMod = await safeImport('../src/config.js');
-      if (loggerMod && configMod) {
-        const { join } = await import('node:path');
-        loggerMod.copyTruncateIfLarge(join(configMod.STATE_DIR, 'daemon.log'));
+      // Native Windows has no launchd/systemd to keep this a single instance,
+      // and the wrappers and the hook can both start one at once. Claim the
+      // pidfile before doing anything else: a daemon that finds a live one
+      // already running exits here, and one that later finds itself replaced
+      // stands down. --on-demand (how ensureDaemon starts it) also ties the
+      // daemon to its marker, so uninstall ends it rather than sign-out.
+      const onDemand = rest.includes('--on-demand');
+      let releaseDaemon = null;
+      if (process.platform === 'win32') {
+        const wanted = onDemand ? () => spawnMod.onDemandWanted() : () => true;
+        if (!wanted()) return 0;   // uninstalled between the start and now
+        releaseDaemon = spawnMod.claimDaemon({ onLost: () => controller.abort(), wanted });
+        if (!releaseDaemon) {
+          // Reaches a terminal only when a user ran `unsnooze daemon` by hand;
+          // an on-demand start has nowhere to print.
+          const pid = spawnMod.runningDaemonPid();
+          console.error(`unsnooze: the daemon is already running${pid ? ` (pid ${pid})` : ''} — not starting another`);
+          return 0;
+        }
       }
-      // Version-skew guard: when npm swaps the package underneath us, exit
-      // cleanly so launchd/systemd restart the daemon on the fresh code.
-      // Interval stays at 15 minutes on purpose — a tighter loop raises the
-      // odds of restarting INTO a half-installed package, which is the
-      // crash-loop the unit throttles exist to survive.
-      // Exiting is only safe under a supervisor. `unsnooze daemon` run from a
-      // shell has nothing to restart it, so there it warns and keeps watching
-      // rather than ending GUI watching silently.
-      const updMod = await safeImport('../src/update-check.js');
-      const notifyMod = await safeImport('../src/notify.js');
-      if (updMod?.hasVersionSkew) {
-        let warnedSkew = false;
-        setInterval(() => {
-          const action = updMod.daemonSkewAction({
-            skewed: updMod.hasVersionSkew(),
-            // Unknown means assume supervised: that is how the daemon is
-            // installed for all but a handful of users, and it preserves the
-            // long-standing behavior when install.js could not be loaded.
-            supervised: installMod?.isSupervised ? installMod.isSupervised() : true,
-            alreadyWarned: warnedSkew,
-          });
-          if (action === 'restart') controller.abort();
-          else if (action === 'warn') {
-            warnedSkew = true;
-            const msg = 'package was upgraded on disk but this daemon is not supervised — '
-              + 'still running the old code; restart it to pick up the new version';
-            loggerMod?.log('daemon', msg);
-            notifyMod?.notify('unsnooze needs a restart', msg, { priority: 4 });
-          }
-        }, 15 * 60_000).unref();
+      // From the claim on, every way out gives it back.
+      try {
+        // Self-heal pre-1.12 autostart units: they lack PATH, so this daemon
+        // cannot find tmux and every revival dies. Healing rewrites the unit
+        // and reloads it — which intentionally kills THIS process; the
+        // supervisor restarts us under the fixed unit. One-time: healed units
+        // pass the check forever after.
+        const installMod = await safeImport('../src/install.js');
+        if (installMod?.healDaemonAutostart) {
+          try {
+            const healed = installMod.healDaemonAutostart();
+            if (healed) {
+              const lm = await safeImport('../src/logger.js');
+              lm?.log('daemon', `autostart unit lacked PATH — regenerated ${healed}, reloading (self-heal)`);
+            }
+          } catch { /* heal is best-effort — a broken unit must not block the daemon */ }
+        }
+        // daemon.log is launchd/systemd-captured stdout+stderr. launchd holds
+        // an open fd on it for our whole lifetime, so rotation must be
+        // copy-truncate: renaming would leave launchd appending to the renamed
+        // inode forever, with no fresh daemon.log until the next respawn.
+        const loggerMod = await safeImport('../src/logger.js');
+        const configMod = await safeImport('../src/config.js');
+        if (loggerMod && configMod) {
+          const { join } = await import('node:path');
+          loggerMod.copyTruncateIfLarge(join(configMod.STATE_DIR, 'daemon.log'));
+        }
+        // Version-skew guard: when npm swaps the package underneath us, exit
+        // cleanly so launchd/systemd restart the daemon on the fresh code.
+        // Interval stays at 15 minutes on purpose — a tighter loop raises the
+        // odds of restarting INTO a half-installed package, which is the
+        // crash-loop the unit throttles exist to survive.
+        // Exiting is only safe under a supervisor. `unsnooze daemon` run from a
+        // shell has nothing to restart it, so there it warns and keeps watching
+        // rather than ending GUI watching silently.
+        const updMod = await safeImport('../src/update-check.js');
+        const notifyMod = await safeImport('../src/notify.js');
+        if (updMod?.hasVersionSkew) {
+          let warnedSkew = false;
+          setInterval(() => {
+            const action = updMod.daemonSkewAction({
+              skewed: updMod.hasVersionSkew(),
+              // Unknown means assume supervised: that is how the daemon is
+              // installed for all but a handful of users, and it preserves the
+              // long-standing behavior when install.js could not be loaded.
+              supervised: installMod?.isSupervised ? installMod.isSupervised() : true,
+              alreadyWarned: warnedSkew,
+            });
+            if (action === 'restart') controller.abort();
+            else if (action === 'warn') {
+              warnedSkew = true;
+              const msg = 'package was upgraded on disk but this daemon is not supervised — '
+                + 'still running the old code; '
+                + (onDemand ? 'run `unsnooze install --daemon` to restart it' : 'restart it to pick up the new version');
+              loggerMod?.log('daemon', msg);
+              notifyMod?.notify('unsnooze needs a restart', msg, { priority: 4 });
+            }
+          }, 15 * 60_000).unref();
+        }
+        // Daily update check from the daemon: GUI-only users never run CLI
+        // commands, so this is what gets them the "new version" desktop toast.
+        const { spawnDetached } = spawnMod;
+        spawnDetached(['_update-check']);
+        setInterval(() => spawnDetached(['_update-check']), 24 * 3_600_000).unref();
+        return await runResumer({ persistent: true, watcher: createWatcher(), signal: controller.signal });
+      } finally {
+        releaseDaemon?.();
       }
-      // Daily update check from the daemon: GUI-only users never run CLI
-      // commands, so this is what gets them the "new version" desktop toast.
-      const spawnMod = await safeImport('../src/spawn.js');
-      if (!spawnMod) return 0;
-      const { spawnDetached } = spawnMod;
-      spawnDetached(['_update-check']);
-      setInterval(() => spawnDetached(['_update-check']), 24 * 3_600_000).unref();
-      return runResumer({ persistent: true, watcher: createWatcher(), signal: controller.signal });
     }
     case 'help':
     case '-h':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unsnooze",
-  "version": "1.19.1",
+  "version": "1.19.2",
   "description": "Automatically resume Claude Code, Codex CLI, Grok, Qwen Code, Kimi CLI, OpenCode, Antigravity, and Cursor CLI sessions when 5-hour or weekly usage limits reset—on macOS, Linux and Windows, with or without a terminal multiplexer.",
   "keywords": [
     "claude",

package/src/agents/codex.js

@@ -14,6 +14,7 @@ import { openSync, readSync, closeSync, readdirSync, statSync, existsSync } from
 import { join, basename } from 'node:path';
 import { CODEX_DIR } from '../config.js';
 import { findOnPath } from '../which.js';
+import { stripVTControlCharacters } from 'node:util';
 
 // Since the 2026 unified ChatGPT desktop app absorbed the Codex app, the codex
 // binary ships INSIDE the app bundle and many machines have no standalone
@@ -101,6 +102,26 @@ export const patterns = {
   transientPatterns: [/stream error/i, /exceeded retry limit/i],
 };
 
+// A submitted user turn uses the same › glyph as the composer. Only accept
+// the LAST prompt, followed directly by a blank line and Codex's status footer.
+// ponytail: truncated/collapsed pastes cannot be proved; leave those for the user.
+export function pendingCodexPrompt(text, message) {
+  if (!message) return false;
+  const lines = stripVTControlCharacters(text).split('\n');
+  const start = lines.findLastIndex(line => /^\s*›/.test(line));
+  if (start < 0) return false;
+  const tail = lines.slice(start + 1);
+  const footer = tail.findIndex((line, i) => i > 0 && !tail[i - 1].trim()
+    && (/\s·\s/.test(line) || /(?:\d+% context left|\? for shortcuts)/.test(line)));
+  if (footer < 0) return false;
+  if (tail.slice(footer + 1).some(line => line.trim()
+    && !/(?:\d+% context left|\? for shortcuts)/.test(line))) return false;
+  // Ignore wrapping and the extra newline swallowed by paste-burst handling.
+  const compact = value => value.replace(/\s/g, '');
+  const draft = [lines[start].replace(/^\s*›\s?/, ''), ...tail.slice(0, footer)].join('\n');
+  return compact(draft) === compact(message);
+}
+
 // Sessions live in ~/.codex/sessions/YYYY/MM/DD/rollout-{ts}-{THREAD}.jsonl;
 // the first JSONL line carries the session cwd. Conservative: no cwd match →
 // null (the resumer then uses `codex resume --last`, which codex itself scopes

package/src/agents/opencode.js

@@ -51,10 +51,11 @@ export const patterns = {
   terminalPatterns: [/insufficient credits/i, /out of credits/i],
 };
 
+// windowsHide: the console-less daemon calls this too (see workspace.js).
 function runSessionList() {
   return execFileSync(process.env.UNSNOOZE_OPENCODE_BIN || 'opencode',
     ['session', 'list', '--format', 'json'],
-    { timeout: 5000, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+    { timeout: 5000, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
 }
 
 // `opencode session list --format json` — sessions live in a SQLite db, so ask

package/src/config.js

@@ -258,9 +258,24 @@ export const MUX_NAMES = ['tmux', 'zellij', 'herdr', 'cmux', 'headless'];
 // Where a headless revive tees the agent's output. There is no pane to scroll
 // back through, so the log is the only record of what an unattended run did.
 export const HEADLESS_LOG_DIR = join(STATE_DIR, 'headless');
-// The daemon's Windows Task Scheduler entry (install.js creates it; doctor names it).
+// The logon Scheduled Task that unsnooze <= 1.19.1 registered for the daemon.
+// Nothing creates it any more (see DAEMON_ON_DEMAND); uninstall still removes
+// one an older install left behind.
 export const WINDOWS_TASK_NAME = 'unsnooze';
 
+// The daemon on native Windows. There is no launchd/systemd to hand it to, and
+// every way of starting a program at sign-in — a Scheduled Task, a Run key, the
+// Startup folder — is what antivirus heuristics are trained to call malware
+// persistence: Microsoft Defender flagged `schtasks /create /sc onlogon` as
+// Trojan:Win32/Commando.A!ml. So nothing is registered with Windows. This
+// marker is the whole record (install --daemon writes it), and while it exists
+// the wrappers and the StopFailure hook start the daemon whenever it is not
+// running.
+export const DAEMON_ON_DEMAND = join(STATE_DIR, 'daemon-on-demand');
+// Which daemon is running (Windows only). Its mtime is a heartbeat, so a pid
+// that Windows recycled after a crash or a sign-out is not mistaken for it.
+export const DAEMON_PIDFILE = join(STATE_DIR, 'daemon.pid');
+
 // Pane scanning
 export const PANE_SCAN_LINES = envInt('UNSNOOZE_PANE_SCAN_LINES', 12);
 export const CAPTURE_LINES = envInt('UNSNOOZE_CAPTURE_LINES', 200);

package/src/doctor.js

@@ -20,7 +20,7 @@ import { fishConfigPath } from './fish.js';
 import { listAgents } from './agents/index.js';
 import { getConfig } from './settings.js';
 import { resolveBin } from './which.js';
-import { WINDOWS_TASK_NAME, CLAUDE_DIR, CODEX_DIR } from './config.js';
+import { CLAUDE_DIR, CODEX_DIR } from './config.js';
 
 const log = makeLogger('doctor');
 
@@ -345,12 +345,11 @@ export function agentBinFindings({
 } = {}) {
   const findings = [];
   const envVar = id => `UNSNOOZE_${String(id).toUpperCase()}_BIN`;
-  // Two commands, not `a && b`: && only exists from PowerShell 7, and the
+  // One command, never `a && b`: && only exists from PowerShell 7, and the
   // Windows PowerShell 5.1 that ships with the OS is a supported shell.
   const windowsNote = platform === 'win32'
-    ? `\n  the daemon's Scheduled Task keeps the PATH it had at logon; after an agent update, run\n`
-      + `  schtasks /end /tn ${WINDOWS_TASK_NAME}\n`
-      + `  schtasks /run /tn ${WINDOWS_TASK_NAME}   (or sign out and in)`
+    ? `\n  the daemon keeps the PATH of whatever started it; once this shell finds the agent,\n`
+      + `  restart it from here with: unsnooze install --daemon   (or sign out and back in)`
     : '';
   for (const agent of agents) {
     if (!agent?.id || !enabled(agent.id)) continue;

package/src/hook.js

@@ -16,7 +16,7 @@ import { parseResetTime, resetAtMs } from './time-parser.js';
 import { upsertSession } from './state.js';
 import { latestRateLimitFromTranscript } from './watchers/claude.js';
 import { getMultiplexer } from './multiplexer.js';
-import { spawnResumerIfNeeded } from './spawn.js';
+import { spawnResumerIfNeeded, ensureDaemon } from './spawn.js';
 import { makeLogger } from './logger.js';
 import { addressHash } from './lease.js';
 import { prepareCalibrationSample, applyCalibrationToState } from './usage.js';
@@ -56,11 +56,15 @@ export function hookContext(env = process.env, payload = {}) {
   return { muxName, pane, paneOwner };
 }
 
-export async function runHook(rest = []) {
+export async function runHook(rest = [], { ensureDaemonFn = ensureDaemon } = {}) {
   try {
     const agentIdx = rest.indexOf('--agent');
     const agent = getAgent(agentIdx !== -1 ? rest[agentIdx + 1] : 'claude');
     if (!getConfig(`agents.${agent.id}`)) return 0;   // agent disabled in settings
+    // Nothing keeps the daemon running on native Windows (see ensureDaemon),
+    // and the hook is the one entry point GUI Claude sessions pass through —
+    // so it makes sure the daemon is up. A no-op everywhere else.
+    ensureDaemonFn();
     const raw = await readStdin();
     let payload = {};
     try { payload = JSON.parse(raw); } catch { /* tolerate non-JSON */ }

package/src/install.js

@@ -14,14 +14,14 @@
 import { readFileSync, writeFileSync, renameSync, existsSync, copyFileSync, rmSync, mkdirSync, unlinkSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { homedir, userInfo } from 'node:os';
-import { join, dirname, delimiter } from 'node:path';
-import { CLAUDE_SETTINGS, STATE_DIR, WINDOWS_TASK_NAME } from './config.js';
+import { join, dirname, basename, delimiter } from 'node:path';
+import { CLAUDE_SETTINGS, STATE_DIR, WINDOWS_TASK_NAME, DAEMON_ON_DEMAND } from './config.js';
 import { getConfig, configFileExists } from './settings.js';
 import { xmlEscape } from './notify.js';
 import { installGrokHooks, uninstallGrokHooks } from './agents/grok.js';
 import { getAgent } from './agents/index.js';
 import { findCsgProcesses, findCsgAutostarts } from './doctor.js';
-import { UNSNOOZE_BIN, stopResumer } from './spawn.js';
+import { UNSNOOZE_BIN, stopResumer, restartDaemon, stopDaemon } from './spawn.js';
 import { uninstallStatuslineShim } from './usage.js';
 import { powershellProfilePath } from './powershell.js';
 import { fishConfigPath } from './fish.js';
@@ -248,11 +248,12 @@ export function installFishBlock(content, agents = ['claude'], bin = UNSNOOZE_BI
 // GUI sessions (VS Code extension, desktop apps) never pass through the shell
 // wrappers, so their limit stops are only caught while `unsnooze daemon` is
 // alive. Autostart keeps it alive: a launchd user agent on macOS, a systemd
-// user unit on Linux/WSL.
+// user unit on Linux/WSL. Native Windows deliberately gets neither a unit nor
+// a Scheduled Task — the daemon is started on demand there (DAEMON_ON_DEMAND).
 
 export const DAEMON_LABEL = 'com.unsnooze.daemon';
-// Task Scheduler has no reverse-DNS convention and shows this name to the user
-// in taskschd.msc, so it is a plain word rather than the launchd label.
+// The Scheduled Task name unsnooze <= 1.19.1 used; kept for the uninstall that
+// removes one left behind.
 export { WINDOWS_TASK_NAME };
 
 // Is this process running under the supervisor we install, rather than from
@@ -269,14 +270,15 @@ export { WINDOWS_TASK_NAME };
 export function isSupervised({ platform = process.platform, env = process.env } = {}) {
   if (platform === 'darwin') return env.XPC_SERVICE_NAME === DAEMON_LABEL;
   if (platform === 'linux') return typeof env.INVOCATION_ID === 'string' && env.INVOCATION_ID !== '';
-  // win32 stays false on purpose, even though we now install a Scheduled Task.
-  // launchd KeepAlive and systemd Restart=always bring the daemon straight
-  // back; a logon-triggered task does not restart anything until the next
-  // logon. Answering true here would let the version-skew guard exit 0 into
-  // nothing and stop Windows watching silently — the exact failure mode of
-  // issue #8, just with a different trigger. The cost is that a Windows daemon
-  // keeps running pre-upgrade code until the user logs back in; that is the
-  // lesser of the two, and `unsnooze doctor` reports the skew.
+  // win32 stays false on purpose. launchd KeepAlive and systemd Restart=always
+  // bring the daemon straight back; on Windows it is only started again by the
+  // next wrapped launch or StopFailure hook, which may be hours away. Answering
+  // true here would let the version-skew guard exit 0 into nothing and stop
+  // Windows watching silently — the exact failure mode of issue #8, just with a
+  // different trigger. The cost is that a Windows daemon keeps running
+  // pre-upgrade code until it is restarted (a sign-out, or re-running
+  // `unsnooze install --daemon`); that is the lesser of the two, and
+  // `unsnooze doctor` reports the skew.
   return false;
 }
 
@@ -434,20 +436,49 @@ function defaultActivate(cmd, args) {
   }
 }
 
+// Native Windows keeps its "unit" in the state dir: a marker that asks for the
+// daemon to be started on demand. `dir` relocates it, as it does the unit dir
+// elsewhere.
+function onDemandMarker(dir) {
+  return dir ? join(dir, basename(DAEMON_ON_DEMAND)) : DAEMON_ON_DEMAND;
+}
+
+const ON_DEMAND_NOTE = 'While this file exists, the unsnooze daemon is started on demand — by the\n'
+  + 'agent wrappers and the StopFailure hook — whenever it is not running. Nothing\n'
+  + 'is registered to run at sign-in. `unsnooze uninstall` removes this file.\n';
+
+// unsnooze <= 1.19.1 registered the daemon as a logon Scheduled Task. Nothing
+// creates one now, but an install from then may still have it; uninstall
+// removes it. Ask before deleting, so a machine that never had one — most of
+// them: creating it needed an elevated shell — only ever sees a read-only
+// query. /f so the delete is not an interactive prompt. 'removed', 'stuck'
+// (it exists but the delete failed — a task created from an elevated shell
+// can need one to delete), or null when there was none.
+export function removeLegacyScheduledTask({ activate = defaultActivate } = {}) {
+  if (!activate('schtasks', ['/query', '/tn', WINDOWS_TASK_NAME])) return null;
+  return activate('schtasks', ['/delete', '/f', '/tn', WINDOWS_TASK_NAME]) ? 'removed' : 'stuck';
+}
+
 export function installDaemonAutostart({
   platform = process.platform, dir = null, activate = defaultActivate, path = undefined,
+  start = restartDaemon,
 } = {}) {
-  // Native Windows has no unit *file* — the Task Scheduler holds the record —
-  // so it is handled before the file-based platforms below. It matters more
-  // here than anywhere else: the transcript watcher lives in the daemon, and
-  // headless has no pane monitor to fall back on, so without this a Windows
-  // machine only ever catches limit stops through the StopFailure hook.
+  // Native Windows matters more than anywhere: the transcript watcher lives in
+  // the daemon, and headless has no pane monitor to fall back on. But nothing
+  // is registered with Windows to start it. Up to 1.19.1 this created a logon
+  // Scheduled Task (`schtasks /create /sc onlogon /tr "node … daemon"`), and
+  // Microsoft Defender flagged setup as Trojan:Win32/Commando.A!ml for it —
+  // an interpreter running a script from %APPDATA% at every logon is exactly
+  // how malware persists, and any logon entry (Run key, Startup folder) reads
+  // the same way. Without elevation schtasks refused the task anyway. So the
+  // daemon is started now, and started again on demand (spawn.js ensureDaemon).
   if (platform === 'win32') {
-    // /f overwrites an existing task rather than failing with "already exists",
-    // which is what re-running setup does every time.
-    activate('schtasks', ['/create', '/f', '/tn', WINDOWS_TASK_NAME, '/sc', 'onlogon',
-      '/tr', `"${process.execPath}" "${UNSNOOZE_BIN}" daemon`]);
-    return `Scheduled Task \\${WINDOWS_TASK_NAME}`;
+    const marker = onDemandMarker(dir);
+    atomicWrite(marker, ON_DEMAND_NOTE);
+    // Same interlock as the unit platforms below: the real starter only runs
+    // for the marker it would actually read.
+    if (start !== restartDaemon || marker === DAEMON_ON_DEMAND) start();
+    return marker;
   }
   const target = autostartUnitPath({ platform, dir });
   if (!target) return null;
@@ -528,11 +559,30 @@ export function healDaemonAutostart({
   return installDaemonAutostart({ platform, dir, activate, path: better });
 }
 
-export function uninstallDaemonAutostart({ platform = process.platform, dir = null, activate = defaultActivate } = {}) {
+export function uninstallDaemonAutostart({
+  platform = process.platform, dir = null, activate = defaultActivate, stop = stopDaemon,
+  say = () => {},
+} = {}) {
   if (platform === 'win32') {
-    // /f so a missing task is not an interactive prompt on an uninstall path.
-    activate('schtasks', ['/delete', '/f', '/tn', WINDOWS_TASK_NAME]);
-    return `Scheduled Task \\${WINDOWS_TASK_NAME}`;
+    const removed = [];
+    // The marker first, so nothing starts the daemon again once it is stopped
+    // (and an on-demand daemon that is only now starting sees it gone).
+    const marker = onDemandMarker(dir);
+    if (existsSync(marker)) {
+      try { unlinkSync(marker); removed.push(marker); } catch { /* still there — not reported as removed */ }
+    }
+    const live = marker === DAEMON_ON_DEMAND;
+    if (stop !== stopDaemon || live) stop();
+    // The interlock again: a relocated marker is a fixture, and the machine's
+    // real Task Scheduler is none of its business.
+    const act = (activate === defaultActivate && !live) ? () => false : activate;
+    const legacy = removeLegacyScheduledTask({ activate: act });
+    if (legacy === 'removed') removed.push(`Scheduled Task \\${WINDOWS_TASK_NAME}`);
+    else if (legacy === 'stuck') {
+      say(`could not delete the Scheduled Task \\${WINDOWS_TASK_NAME} an earlier version created; `
+        + `from an administrator shell run: schtasks /delete /tn ${WINDOWS_TASK_NAME} /f`);
+    }
+    return removed.length ? removed.join(' and ') : null;
   }
   if (platform === 'darwin') {
     const target = join(dir || autostartDir(platform), `${DAEMON_LABEL}.plist`);
@@ -696,8 +746,21 @@ export function cmdInstall(rest, { agents = enabledAgents() } = {}) {
 
   // 4. Daemon autostart (GUI-session watching), opt-in via --daemon / wizard.
   if (opts.daemon) {
-    const target = installDaemonAutostart();
-    if (target) console.log(`unsnooze: daemon autostart installed (${target}) — GUI sessions are watched`);
+    // On Windows the start's outcome is kept, so the message can be honest.
+    let started = null;
+    const target = installDaemonAutostart(process.platform === 'win32'
+      ? { start: () => { started = restartDaemon(); } } : {});
+    if (target && process.platform === 'win32') {
+      if (started) console.log(`unsnooze: daemon started in the background (pid ${started}) — GUI sessions are watched`);
+      else console.log('unsnooze: the daemon did not start — run `unsnooze daemon` to see why');
+      console.log('unsnooze: nothing is registered to run at sign-in (no Scheduled Task); your wrapped');
+      console.log('unsnooze: agents and the Claude hook start the daemon again whenever it is not running');
+      // A task left by 1.19.1 or earlier is deliberately not looked for here:
+      // node.exe spawning schtasks.exe is the pairing Defender reacted to, and
+      // setup should spawn nothing of the kind. Such a task only starts this
+      // same daemon at sign-in, which the pidfile tolerates; uninstall removes
+      // it.
+    } else if (target) console.log(`unsnooze: daemon autostart installed (${target}) — GUI sessions are watched`);
     else console.log('unsnooze: daemon autostart is not supported on this platform');
   }
 
@@ -724,7 +787,16 @@ export function cmdUninstall(rest) {
   const opts = parseArgs(rest);
   const explicitRc = rest.includes('--zshrc');
 
-  // Stop the resumer/daemon first so it cannot keep writing state after hooks
+  // Whatever starts the daemon goes first — the launchd/systemd unit, or on
+  // Windows the marker the wrappers and the hook consult — so nothing can
+  // start it again mid-uninstall. On Windows this order also stops the daemon
+  // while its pidfile still proves which process it is, not after
+  // stopResumer has killed it and left a pid that may already be someone
+  // else's.
+  const autostart = uninstallDaemonAutostart({ say: m => console.log(`unsnooze: ${m}`) });
+  if (autostart) console.log(`unsnooze: daemon autostart removed (${autostart})`);
+
+  // Stop the resumer/daemon so it cannot keep writing state after hooks
   // are gone (zombie-daemon-running-deleted-code failure mode).
   try {
     const result = stopResumer();
@@ -780,9 +852,6 @@ export function cmdUninstall(rest) {
     }
   }
 
-  const autostart = uninstallDaemonAutostart();
-  if (autostart) console.log(`unsnooze: daemon autostart removed (${autostart})`);
-
   // Restore Claude statusLine if our usage shim was chained in.
   try {
     const r = uninstallStatuslineShim({ settingsPath: opts.settings });

package/src/launcher.js

@@ -8,7 +8,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { getMultiplexer } from './multiplexer.js';
 import { getAgent } from './agents/index.js';
 import { getConfig, resolveLaunchExtraArgs } from './settings.js';
-import { spawnDetached, monitorSpawnArgs } from './spawn.js';
+import { spawnDetached, monitorSpawnArgs, ensureDaemon } from './spawn.js';
 import { makeLogger } from './logger.js';
 import { createLeaseId, processBirth, writeLease, removeLease } from './lease.js';
 import { recordOwnedSession } from './mux-sessions.js';
@@ -36,6 +36,16 @@ export function resolvePaneOwner(muxName, env = process.env) {
   return null;
 }
 
+// A headless revival runs this launcher detached, with no console and no
+// terminal on any stdio. On Windows the agent would then be given a console
+// window of its own — an empty window popping up on the desktop at every
+// reset, which closing kills the revival. Hide it there. Whenever a terminal
+// is attached nothing changes: the agent, a console program, shares the
+// launcher's console, and windowsHide only affects a console Windows creates.
+export function hideAgentWindow(streams = process) {
+  return !(streams.stdin?.isTTY || streams.stdout?.isTTY || streams.stderr?.isTTY);
+}
+
 function runUnwatched(agent, args, reason) {
   if (reason) process.stderr.write(`unsnooze: ${reason}\n`);
   return runPassthrough(agent, args);
@@ -49,7 +59,9 @@ function runPassthrough(agent, args) {
   return r.status ?? 1;
 }
 
-export function runLauncher(args, agentId = 'claude', { processBirthFn = processBirth } = {}) {
+export function runLauncher(args, agentId = 'claude', {
+  processBirthFn = processBirth, ensureDaemonFn = ensureDaemon,
+} = {}) {
   const agent = getAgent(agentId);
 
   // Recursion / nested-launch guard: inside an unsnooze-managed session, a
@@ -122,6 +134,12 @@ export function runLauncher(args, agentId = 'claude', { processBirthFn = process
     }
   }
 
+  // Nothing keeps the daemon running on native Windows (see ensureDaemon), so
+  // every watched launch makes sure it is. Here, past the re-exec above, so a
+  // launch that wraps itself asks once, not twice. A no-op everywhere else,
+  // and until `install --daemon` has asked for the daemon.
+  ensureDaemonFn();
+
   const rawPane = mux.currentPaneId();
   const paneOwner = resolvePaneOwner(mux.name, process.env);
   // A backend may know it cannot safely address the pane it is sitting in —
@@ -179,7 +197,7 @@ export function runLauncher(args, agentId = 'claude', { processBirthFn = process
   // the reason, never as a crash with no exit code for the resumer to read.
   let child;
   try {
-    child = spawn(agent.bin, args, { stdio: 'inherit', env: childEnv });
+    child = spawn(agent.bin, args, { stdio: 'inherit', env: childEnv, windowsHide: hideAgentWindow() });
   } catch (err) {
     return launchFailed(agent, err);
   }

package/src/monitor.js

@@ -18,6 +18,7 @@ import {
 } from './config.js';
 import { detectLimit, isBusy, overloadMatch, modelRemedy } from './patterns.js';
 import { getAgent } from './agents/index.js';
+import { pendingCodexPrompt } from './agents/codex.js';
 import { getConfig } from './settings.js';
 import { notify } from './notify.js';
 import { parseResetTime, resetAtMs, sourceRank } from './time-parser.js';
@@ -327,6 +328,16 @@ export function createMonitor({
     const visible = mux.capturePaneVisible
       ? await mux.capturePaneVisible(pane).catch(() => '')
       : text;
+    if (agent.id === 'codex' && Object.values(readState().sessions).some(rec =>
+      rec.agent === 'codex' && rec.mux === muxName && rec.pane === pane
+      && rec.paneOwner === paneOwner && (rec.leaseId ?? null) === leaseId
+      && ['resuming', 'failed'].includes(rec.status)
+      && pendingCodexPrompt(visible, rec.pendingPrompt))) {
+      // The resumer owns this unsubmitted draft. Its old banner is not a new
+      // stop; refreshing detectedAt here would invalidate the submit retry.
+      firstTick = false;
+      return;
+    }
     if (agent.menu && agent.menu.isPrompt(visible, PANE_SCAN_LINES)) {
       if (!getConfig('menuAutoAnswer')) {
         // Watch-only mode: record the stop (reset time may not be visible

package/src/resumer.js

@@ -16,6 +16,7 @@ import {
 } from './config.js';
 import { detectLimit, isBusy, modelRemedy } from './patterns.js';
 import { getAgent } from './agents/index.js';
+import { pendingCodexPrompt } from './agents/codex.js';
 import { parseResetTime, resetAtMs, nextProbeDelayMs } from './time-parser.js';
 import {
   readState, updateState, setStatus, dueSessions, activeStopped,
@@ -224,7 +225,7 @@ function paneStopOwner(rec, state = readState()) {
 // One live pane can accept one wake. Legacy/subagent detections outside the
 // short ingest-dedupe window are therefore collapsed here: the newest active
 // stop owns the target and older active records become explicit history.
-function claimStopForResume(rec) {
+function claimStopForResume(rec, pendingPrompt = null) {
   const cutoff = stopEpisodeAt(rec);
   let claimed = false;
   updateState(state => {
@@ -254,6 +255,7 @@ function claimStopForResume(rec) {
         // single point where unsnooze takes ownership of a stop, whether the
         // wake is typed, driven through the menu, or reopened.
         resumedBy: 'unsnooze',
+        pendingPrompt, submitRetries: 0,
       });
       claimed = true;
     }
@@ -713,7 +715,7 @@ export async function dispatchOne(rec, {
       // assessPane is asynchronous. Close the final human/provider-resume race
       // after assessment and immediately before the keystroke.
       if (finishIfClaudeProgressed(rec, agent)) return 'already-resumed';
-      if (!claimStopForResume(rec)) return 'stale';
+      if (!claimStopForResume(rec, agent.id === 'codex' ? resumeMessage : null)) return 'stale';
       await mux.sendText(rec.pane, resumeMessage);
       log(`${key}: sent continue via ${rec.mux} ${rec.paneOwner ?? '-'}:${rec.pane}`);
       notifyContext();
@@ -874,11 +876,11 @@ function recordVerifyRetry(rec, lastError) {
   let applied;
   if (verifyRetries >= MAX_VERIFY_RETRIES) {
     const attempts = (rec.attempts || 0) + 1;
-    applied = transitionStopEpisode(rec, 'stopped', {
+    applied = transitionStopEpisode(rec, rec.pendingPrompt ? 'failed' : 'stopped', {
       attempts,
       // Same backoff (and same manual exemption) as routed retries.
       resetAt: rec.manual ? Date.now() : Date.now() + retryBackoffMs(attempts),
-      lastError,
+      lastError: rec.pendingPrompt ? `${lastError} — wake submission unconfirmed; inspect the Codex pane` : lastError,
       verifyRetries: 0, resumeEpisodeAt: null,
     }, { expect: ['resuming'] });
   } else {
@@ -917,6 +919,29 @@ export async function verifyOne(key, { resolveMux = resolveRecordMux } = {}) {
   catch (err) {
     return recordVerifyRetry(rec, `verify capture: ${err.message}`);
   }
+  // A delayed TUI can process text and Enter as a single paste burst (#30).
+  // Recover only our exact draft, never type it again or treat the banner
+  // above it as a fresh refusal. Re-check the normal ownership/busy gates
+  // and the stop episode immediately before every additional Enter.
+  if (agent.id === 'codex' && pendingCodexPrompt(text, rec.pendingPrompt)) {
+    const a = await assessPane(rec, agent, { mux });
+    const current = readState().sessions[key];
+    if (!current || current.status !== 'resuming' || !samePaneTarget(current, rec)
+      || stopEpisodeAt(current) !== stopEpisodeAt(rec)) return 'stale';
+    if (a.busy) return 'pending';
+    if ((rec.submitRetries || 0) >= 3 || !a.authorized || typeof mux.sendKey !== 'function') {
+      transitionStopEpisode(rec, 'failed', {
+        lastError: 'wake prompt not submitted — inspect the Codex pane and press Enter to continue',
+      }, { expect: ['resuming'] });
+      return 'held';
+    }
+    if (!pendingCodexPrompt(a.text, rec.pendingPrompt)) return 'pending';
+    if (!transitionStopEpisode(rec, 'resuming', { submitRetries: (rec.submitRetries || 0) + 1 },
+      { expect: ['resuming'] })) return 'stale';
+    try { await mux.sendKey(rec.pane, 'Enter'); }
+    catch (err) { log(`${key}: submit retry failed: ${err.message}`); }
+    return 'pending';
+  }
   const d = detectLimit(text, PANE_SCAN_LINES, agent.patterns);
   if (d.hit || (agent.menu && agent.menu.isPrompt(text, PANE_SCAN_LINES))) {
     // Limit not actually reset — reschedule from the fresh banner.

package/src/spawn.js

@@ -1,22 +1,78 @@
 // Detached-process helpers shared by launcher, hook, and monitor.
 
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync, unlinkSync } from 'node:fs';
+import {
+  existsSync, readFileSync, unlinkSync, writeFileSync, statSync, utimesSync, openSync, closeSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { join, dirname } from 'node:path';
-import { RESUMER_LOCK } from './config.js';
+import { RESUMER_LOCK, DAEMON_ON_DEMAND, DAEMON_PIDFILE, STATE_DIR, ensureStateDir } from './config.js';
 import { makeLogger } from './logger.js';
 
 const log = makeLogger('spawn');
 
 export const UNSNOOZE_BIN = join(dirname(dirname(fileURLToPath(import.meta.url))), 'bin', 'unsnooze.js');
 
-export function spawnDetached(args, env = {}) {
-  const child = spawn(process.execPath, [UNSNOOZE_BIN, ...args], {
+// Variables that describe one agent session rather than the user. Claude Code
+// sets the first group for every command and hook it runs, and CLAUDECODE is
+// its nested-session guard: a claude started with it set refuses to run
+// ("cannot be launched inside another Claude Code session"). The launcher sets
+// the second group for the agent it wraps. A process that outlives the session
+// that started it must carry neither, because every revival it launches
+// inherits its environment. User configuration — CLAUDE_CONFIG_DIR,
+// CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_GIT_BASH_PATH, TMUX — is kept.
+const SESSION_ENV = new Set([
+  'CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT', 'CLAUDE_CODE_CHILD_SESSION', 'CLAUDE_CODE_SSE_PORT',
+  'CLAUDE_CODE_SESSION_ID', 'CLAUDE_SESSION_ID', 'CLAUDE_PROJECT_DIR', 'CLAUDE_ENV_FILE',
+  'UNSNOOZE_ACTIVE', 'UNSNOOZE_MUX', 'UNSNOOZE_PANE', 'UNSNOOZE_PANE_OWNER', 'UNSNOOZE_LEASE_ID',
+  'UNSNOOZE_CWD',
+]);
+
+// Windows environment names are case-insensitive, and a copied process.env
+// keeps whatever case the variable was set with.
+export function standaloneEnv(env = process.env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (!SESSION_ENV.has(key.toUpperCase())) out[key] = value;
+  }
+  return out;
+}
+
+// spawnDetached's options, apart so they can be tested without a child.
+// `standalone` is for processes that outlive the session that started them —
+// the daemon and a transient resumer: no session markers, and the home
+// directory rather than the project the session happened to be in (on Windows
+// a live process's working directory cannot be deleted or renamed, so a
+// daemon started from a project would pin that folder until sign-out).
+export function detachedSpawnOptions({ env = {}, standalone = false, logFd = null } = {}) {
+  return {
     detached: true,
-    stdio: 'ignore',
-    env: { ...process.env, ...env },
-  });
+    stdio: logFd == null ? 'ignore' : ['ignore', logFd, logFd],
+    env: { ...(standalone ? standaloneEnv() : process.env), ...env },
+    ...(standalone ? { cwd: homedir() } : {}),
+  };
+}
+
+// `logFile` appends the child's stdout/stderr to a file instead of discarding
+// them: a daemon with no supervisor to capture its output would otherwise leave
+// no trace of a crash.
+export function spawnDetached(args, env = {}, { standalone = false, logFile = null, execPath = process.execPath } = {}) {
+  let logFd = null;
+  if (logFile) {
+    try { logFd = openSync(logFile, 'a', 0o600); } catch { /* no log, not no child */ }
+  }
+  let child;
+  try {
+    child = spawn(execPath, [UNSNOOZE_BIN, ...args], detachedSpawnOptions({ env, standalone, logFd }));
+  } finally {
+    // The child has its own copy of the descriptor.
+    if (logFd != null) { try { closeSync(logFd); } catch { /* already closed */ } }
+  }
+  // spawn() reports ENOENT, EACCES, EAGAIN and EMFILE as an 'error' event after
+  // it has returned. Unheard, that is an uncaught exception in the caller —
+  // the launcher, with the user's agent already running.
+  child.on('error', err => log(`could not start ${args[0]}: ${err.message}`));
   child.unref();
   return child.pid;
 }
@@ -51,7 +107,9 @@ export function spawnResumerIfNeeded() {
       if (Number.isFinite(pid) && pidAlive(pid)) return null;
     }
   } catch { /* unreadable lock — let the daemon sort it out */ }
-  const pid = spawnDetached(['_resumer']);
+  // Standalone: it is spawned from inside a session (the hook, a pane's
+  // monitor) and outlives it, and a headless revival inherits its environment.
+  const pid = spawnDetached(['_resumer'], {}, { standalone: true });
   log(`spawned resumer pid ${pid}`);
   return pid;
 }
@@ -63,7 +121,8 @@ export function stopResumer() {
   try {
     if (!existsSync(RESUMER_LOCK)) return { stopped: false, pid: null, reason: 'no-lock' };
     pid = parseInt(readFileSync(RESUMER_LOCK, 'utf-8'), 10);
-    if (Number.isFinite(pid) && pidAlive(pid)) {
+    // A stale lock can name a recycled pid — this very process included.
+    if (Number.isFinite(pid) && pid !== process.pid && pidAlive(pid)) {
       try { process.kill(pid, 'SIGTERM'); } catch { /* raced with exit */ }
       log(`stopped resumer pid ${pid}`);
       try { unlinkSync(RESUMER_LOCK); } catch { /* gone */ }
@@ -77,3 +136,197 @@ export function stopResumer() {
     return { stopped: false, pid, reason: err.message };
   }
 }
+
+// --- the on-demand daemon (native Windows) ----------------------------------
+// launchd and systemd keep the daemon alive on macOS and Linux. Windows gets no
+// equivalent, on purpose — see DAEMON_ON_DEMAND in config.js — so there the
+// daemon is an ordinary background process that the wrappers and the
+// StopFailure hook start whenever it is not running.
+
+// How often a running daemon refreshes its pidfile, and how old the refresh may
+// be before the file stops counting as proof of life. Five missed beats, so a
+// busy moment is never mistaken for death. A machine waking from a long sleep
+// can briefly look daemon-less; the worst that does is start a second daemon,
+// which the first yields to on its next beat (claimDaemon).
+export const DAEMON_HEARTBEAT_MS = 60_000;
+export const DAEMON_STALE_MS = 5 * DAEMON_HEARTBEAT_MS;
+
+function readPidfile(path) {
+  try { return parseInt(readFileSync(path, 'utf-8'), 10); } catch { return NaN; }
+}
+
+// The pid of the daemon that is demonstrably running, else null. A live pid
+// alone proves nothing on Windows: pids are recycled quickly, and a sign-out or
+// a crash leaves the file behind to name whichever process gets that pid next.
+// The daemon touches the file every minute, so a stale one is ignored whoever
+// its pid belongs to now.
+export function runningDaemonPid({ path = DAEMON_PIDFILE, now = Date.now(), alive = pidAlive } = {}) {
+  const pid = readPidfile(path);
+  if (!alive(pid)) return null;
+  try {
+    return now - statSync(path).mtimeMs <= DAEMON_STALE_MS ? pid : null;
+  } catch {
+    return null;   // vanished between the read and the stat
+  }
+}
+
+// `wx` creates the file a moment before the claimant's pid is written into it.
+// A file that young with no pid yet is somebody mid-claim, not a leftover.
+const CLAIM_GRACE_MS = 2_000;
+
+function midClaim(path, now = Date.now()) {
+  try {
+    return readFileSync(path, 'utf-8').trim() === '' && now - statSync(path).mtimeMs < CLAIM_GRACE_MS;
+  } catch {
+    return false;
+  }
+}
+
+// The daemon's half of the pidfile. Starters race — a wrapper and the hook can
+// both find no daemon and both start one — so each new daemon claims the file,
+// and a daemon that finds a live one already there stands down before doing
+// anything. `wx` like the resumer lock; a stale file is replaced. Returns a
+// release() for shutdown, or null when this daemon must not run.
+//
+// While held, the heartbeat keeps the claim fresh, and calls onLost() — the
+// daemon should exit — once the file names another pid (this daemon looked
+// dead through a long sleep and a newer one took over, or two claims raced:
+// one daemon, whichever claimed last), once the file has been missing on two
+// beats in a row (one unreadable moment, say an antivirus scan, is not proof),
+// or once wanted() says the daemon is no longer asked for.
+export function claimDaemon({
+  path = DAEMON_PIDFILE, pid = process.pid, running = runningDaemonPid,
+  heartbeatMs = DAEMON_HEARTBEAT_MS, onLost = () => {}, wanted = () => true,
+  lock = RESUMER_LOCK,
+} = {}) {
+  ensureStateDir(dirname(path));
+  let claimed = false;
+  for (let attempt = 0; attempt < 2 && !claimed; attempt++) {
+    try {
+      writeFileSync(path, String(pid), { flag: 'wx', mode: 0o600 });
+      claimed = true;
+    } catch {
+      const previous = readPidfile(path);
+      const holder = running({ path });
+      if (holder === pid) claimed = true;
+      else if (holder) {
+        log(`daemon pid ${holder} is already running — pid ${pid} not starting another`);
+        return null;
+      } else if (midClaim(path)) {
+        log(`another daemon is claiming ${path} — pid ${pid} not starting another`);
+        return null;
+      } else {
+        // The previous daemon is gone: dead, or its pid now someone else's.
+        // TerminateProcess and sign-out skip its cleanup, so the resumer lock
+        // it held still names that pid — and on Windows, where the holder
+        // cannot be checked with ps, a recycled pid there would be honored
+        // forever and no resume would ever run again.
+        if (Number.isFinite(previous) && readPidfile(path) === previous && readPidfile(lock) === previous) {
+          try { unlinkSync(lock); } catch { /* released meanwhile */ }
+          log(`cleared the resumer lock left by daemon pid ${previous}`);
+        }
+        try { unlinkSync(path); } catch { /* raced with another claimant */ }
+      }
+    }
+  }
+  if (!claimed) {
+    log(`could not claim ${path} — pid ${pid} not starting`);
+    return null;
+  }
+  let misses = 0;
+  const beat = setInterval(() => {
+    const named = readPidfile(path);
+    let why = null;
+    if (!wanted()) why = 'it is no longer wanted';
+    else if (Number.isFinite(named) && named !== pid) why = `${path} now names pid ${named}`;
+    else if (!Number.isFinite(named) && ++misses >= 2) why = `${path} is gone`;
+    if (why) {
+      clearInterval(beat);
+      log(`daemon pid ${pid} standing down: ${why}`);
+      onLost();
+      return;
+    }
+    if (Number.isFinite(named)) {
+      misses = 0;
+      try { const t = new Date(); utimesSync(path, t, t); } catch { /* the next beat retries */ }
+    }
+  }, heartbeatMs);
+  beat.unref();
+  return () => {
+    clearInterval(beat);
+    if (readPidfile(path) === pid) {
+      try { unlinkSync(path); } catch { /* already gone */ }
+    }
+  };
+}
+
+// Is the on-demand daemon still asked for? `install --daemon` writes the
+// marker and `uninstall` removes it.
+export function onDemandWanted(marker = DAEMON_ON_DEMAND) {
+  return existsSync(marker);
+}
+
+// Where the on-demand daemon's own stdout/stderr go — the file launchd writes
+// them to elsewhere, which bin/unsnooze.js rotates when the daemon starts.
+const DAEMON_LOG = join(STATE_DIR, 'daemon.log');
+
+function spawnOnDemandDaemon(args) {
+  return spawnDetached(args, {}, { standalone: true, logFile: DAEMON_LOG });
+}
+
+// Start the daemon unless it is already running — native Windows only, and
+// only once `unsnooze install --daemon` has asked for it (the marker). The
+// wrappers and the StopFailure hook call this, and between them they run
+// whenever an agent does, so the daemon is back soon after a sign-in without
+// anything registered to start at logon. Never throws: it sits on the launch
+// path, where a failure must cost the daemon and nothing else.
+//
+// --on-demand ties the daemon to the marker: it exits when the marker goes
+// (uninstall), where a daemon somebody runs by hand keeps running.
+export function ensureDaemon({
+  platform = process.platform, marker = DAEMON_ON_DEMAND,
+  running = runningDaemonPid, spawner = spawnOnDemandDaemon,
+} = {}) {
+  try {
+    if (platform !== 'win32' || !existsSync(marker) || running()) return null;
+    const pid = spawner(['daemon', '--on-demand']);
+    log(`daemon not running — started it on demand (pid ${pid})`);
+    return pid;
+  } catch (err) {
+    log(`could not start the daemon on demand: ${err.message}`);
+    return null;
+  }
+}
+
+// Stop the on-demand daemon (uninstall, and the restart `install --daemon`
+// does). Only a daemon proven live by its heartbeat is signalled — a stale
+// file's pid may be anybody's by now — and never this process, which a pid
+// recycled inside the heartbeat window could be. The file goes either way, so
+// a live daemon too stale to prove itself stands down at its next beats.
+// Returns the pid that was signalled, or null.
+export function stopDaemon({
+  path = DAEMON_PIDFILE, running = runningDaemonPid, lock = RESUMER_LOCK,
+  kill = (pid, signal) => process.kill(pid, signal),
+} = {}) {
+  const found = running({ path });
+  const pid = found === process.pid ? null : found;
+  if (pid) {
+    try { kill(pid, 'SIGTERM'); } catch { /* raced with its exit */ }
+    log(`stopped daemon pid ${pid}`);
+    // On Windows that was TerminateProcess: nothing of the daemon's own ran,
+    // so a resumer lock it held still names it (see claimDaemon).
+    if (readPidfile(lock) === pid) {
+      try { unlinkSync(lock); } catch { /* already gone */ }
+    }
+  }
+  try { unlinkSync(path); } catch { /* none to remove */ }
+  return pid;
+}
+
+// What `install --daemon` does on Windows, as launchctl unload+load does on
+// macOS: a daemon already running keeps the code and PATH it started with, so
+// re-running setup is how a user hands it new ones.
+export function restartDaemon() {
+  stopDaemon();
+  return ensureDaemon();
+}

package/src/watchers/codex.js

@@ -98,10 +98,14 @@ function rolloutLimitError(line) {
 }
 
 function emptyPremium(rl) {
-  return rl.limit_id === 'premium' && rl.primary === null && rl.secondary === null
-    && rl.credits?.has_credits === false && rl.credits?.unlimited === false
-    && rl.credits?.balance != null && rl.credits.balance !== ''
-    && Number(rl.credits.balance) === 0;
+  if (!(rl.limit_id === 'premium' && rl.primary === null && rl.secondary === null
+    && rl.credits?.has_credits === false && rl.credits?.unlimited === false)) return false;
+  if (rl.credits?.balance != null && rl.credits.balance !== '') {
+    return Number(rl.credits.balance) === 0;
+  }
+  // Workspace plans (Business/Team) send the same empty bucket with no balance
+  // at all, and say why in rate_limit_reached_type instead.
+  return workspaceWall(rl.rate_limit_reached_type);
 }
 
 // rate_limit_reached_type names WHY the server refused, never a window. The
@@ -289,7 +293,11 @@ export function parseRolloutLines(lines, { path, offset } = {}) {
         // human, exactly as parseSnapshot filed it.
         error.limitType = 'model';
         error.resetLine = null;
-      } else if (error.limitType === 'unknown') {
+      } else if (error.limitType === 'unknown'
+        // A workspace-wall banner over a spent window: the snapshot already
+        // weighed the reason against the window, and the window's reset
+        // brings the allowance back. Other model limits keep their label.
+        || (error.limitType === 'model' && workspaceWall(stop.reachedType))) {
         error.limitType = stop.limitType;
       }
     }

package/src/wizard.js

@@ -77,14 +77,18 @@ export async function runWizard() {
   });
   if (p.isCancel(notifications)) return cancelled();
 
-  // GUI watching: only meaningful where an autostart daemon can run. Windows
-  // joined that list with the Task Scheduler unit — and needs it most, since
-  // headless has no pane monitor and the transcript watcher lives in the daemon.
+  // GUI watching: only meaningful where the daemon can run. Windows needs it
+  // most, since headless has no pane monitor and the transcript watcher lives
+  // in the daemon — and there it is started on demand, with nothing registered
+  // to run at sign-in (see DAEMON_ON_DEMAND in config.js).
   let guiWatch = false;
   if (['darwin', 'linux', 'win32'].includes(process.platform)) {
+    const how = process.platform === 'win32'
+      ? 'started on demand by your agents — nothing runs at sign-in'
+      : (process.platform === 'darwin' ? 'launchd' : 'systemd');
     const answer = await p.confirm({
       message: 'Also guard GUI sessions (Claude Code in VS Code/desktop, Codex app/IDE)?\n'
-        + '  Installs a small background daemon (launchd/systemd/Task Scheduler) that watches session\n'
+        + `  Runs a small background daemon (${how}) that watches session\n`
         + '  files for limit stops; revived sessions open in the configured multiplexer and stay visible in\n'
         + '  the GUI\'s own history.',
       initialValue: DEFAULTS.guiWatch,

package/src/workspace.js

@@ -7,9 +7,12 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 
+// windowsHide: this runs in the daemon and the resumer, which have no console
+// on Windows, so git would otherwise flash a console window of its own at
+// every stop and every wake.
 function git(cwd, args) {
   return execFileSync('git', ['-C', cwd, ...args], {
-    stdio: ['ignore', 'pipe', 'ignore'], timeout: 1500,
+    stdio: ['ignore', 'pipe', 'ignore'], timeout: 1500, windowsHide: true,
   }).toString().trim();
 }