agent-relay-runner 0.129.6 → 0.129.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-runner",
-  "version": "0.129.6",
+  "version": "0.129.9",
   "description": "Unified provider lifecycle runner for Agent Relay",
   "type": "module",
   "bin": {
@@ -22,9 +22,9 @@
     "directory": "runner"
   },
   "dependencies": {
-    "agent-relay-providers": "0.104.4",
-    "agent-relay-sdk": "0.2.125",
-    "callmux": "0.23.0"
+    "agent-relay-providers": "0.104.5",
+    "agent-relay-sdk": "0.2.127",
+    "callmux": "0.24.2"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-relay-runner",
   "description": "Thin Agent Relay runner bridge for Claude Code",
-  "version": "0.129.6",
+  "version": "0.129.9",
   "agentRelayContracts": {
     "providerPluginProtocol": 1
   }

package/plugins/claude/monitors/relay-monitor.provisioned.mjs

@@ -56,8 +56,8 @@ var RUNNER_PROMPT_TEMPLATE_DEFAULTS = [
     category: "runner",
     title: "Runner Workspace Lifecycle Note",
     description: "Lifecycle note injected by the runner for isolated workspaces.",
-    template: lines("[agent-relay] Isolated workspace: you are in a git worktree on branch {{branch}}, based on {{baseRef}} \u2014 NOT the main checkout. Other agents may work in parallel and land to {{baseRef}}, so {{baseRef}} will move under you. That is expected; don't fight it.", "Do NOT push this branch yourself \u2014 not with `git push`, not with `tl push` or any other push wrapper, and do not manually rebase or merge. A steward may be auto-rebasing this branch in the background; pushing concurrently races it and can leave the worktree mid-rebase. Just commit your work here. When the task is done, call `relay_task_deliver` with disposition `complete`, a summary, commits, and passing `typecheck` + `test` gates when the diff touches code/test/config paths. Relay records the typed delivery on the Task, skips code gates for empty/docs-only diffs, then rebases onto the latest {{baseRef}}, lands your work, and pushes for you.", "After `relay_task_deliver` accepts a complete delivery, the workspace status becomes `ready` \u2014 this is the NORMAL, healthy hand-off state, NOT an escalation or a stall. Relay auto-merges clean rebases roughly every 2 minutes; a steward agent is spawned (after a short delay) ONLY if it can't land deterministically, so seeing no steward means it's working, not stuck. Stop your turn after delivery and go idle; do NOT wait or poll the steward queue. Relay wakes you with `landed-success` when your branch lands and refreshes, or `landed-failure` if landing fatally fails. On success you'll be on a fresh rebased branch whose name gains a `--N` suffix \u2014 expected, keep working there. Never `cd` into the main checkout, and never merge/push/resolve conflicts yourself \u2014 Relay and the steward own all of that. `agent-relay workspace status` anytime shows your current state and the exact next step."),
-    defaultTemplate: lines("[agent-relay] Isolated workspace: you are in a git worktree on branch {{branch}}, based on {{baseRef}} \u2014 NOT the main checkout. Other agents may work in parallel and land to {{baseRef}}, so {{baseRef}} will move under you. That is expected; don't fight it.", "Do NOT push this branch yourself \u2014 not with `git push`, not with `tl push` or any other push wrapper, and do not manually rebase or merge. A steward may be auto-rebasing this branch in the background; pushing concurrently races it and can leave the worktree mid-rebase. Just commit your work here. When the task is done, call `relay_task_deliver` with disposition `complete`, a summary, commits, and passing `typecheck` + `test` gates when the diff touches code/test/config paths. Relay records the typed delivery on the Task, skips code gates for empty/docs-only diffs, then rebases onto the latest {{baseRef}}, lands your work, and pushes for you.", "After `relay_task_deliver` accepts a complete delivery, the workspace status becomes `ready` \u2014 this is the NORMAL, healthy hand-off state, NOT an escalation or a stall. Relay auto-merges clean rebases roughly every 2 minutes; a steward agent is spawned (after a short delay) ONLY if it can't land deterministically, so seeing no steward means it's working, not stuck. Stop your turn after delivery and go idle; do NOT wait or poll the steward queue. Relay wakes you with `landed-success` when your branch lands and refreshes, or `landed-failure` if landing fatally fails. On success you'll be on a fresh rebased branch whose name gains a `--N` suffix \u2014 expected, keep working there. Never `cd` into the main checkout, and never merge/push/resolve conflicts yourself \u2014 Relay and the steward own all of that. `agent-relay workspace status` anytime shows your current state and the exact next step."),
+    template: lines("[agent-relay] Isolated workspace: you are in a git worktree on branch {{branch}}, based on {{baseRef}} \u2014 NOT the main checkout. Other agents may work in parallel and land to {{baseRef}}, so {{baseRef}} will move under you. That is expected; don't fight it.", "While iterating, self-validate by running only the tests affected by your change \u2014 use your project's affected-test command if it has one; the full test gate still runs automatically at delivery, so scoping down while you iterate is safe.", "Do NOT push this branch yourself \u2014 not with `git push`, not with `tl push` or any other push wrapper, and do not manually rebase or merge. A steward may be auto-rebasing this branch in the background; pushing concurrently races it and can leave the worktree mid-rebase. Just commit your work here. When the task is done, call `relay_task_deliver` with disposition `complete`, a summary, commits, and passing `typecheck` + `test` gates when the diff touches code/test/config paths. Relay records the typed delivery on the Task, skips code gates for empty/docs-only diffs, then rebases onto the latest {{baseRef}}, lands your work, and pushes for you.", "After `relay_task_deliver` accepts a complete delivery, the workspace status becomes `ready` \u2014 this is the NORMAL, healthy hand-off state, NOT an escalation or a stall. Relay auto-merges clean rebases roughly every 2 minutes; a steward agent is spawned (after a short delay) ONLY if it can't land deterministically, so seeing no steward means it's working, not stuck. Stop your turn after delivery and go idle; do NOT wait or poll the steward queue. Relay wakes you with `landed-success` when your branch lands and refreshes, or `landed-failure` if landing fatally fails. On success you'll be on a fresh rebased branch whose name gains a `--N` suffix \u2014 expected, keep working there. Never `cd` into the main checkout, and never merge/push/resolve conflicts yourself \u2014 Relay and the steward own all of that. `agent-relay workspace status` anytime shows your current state and the exact next step."),
+    defaultTemplate: lines("[agent-relay] Isolated workspace: you are in a git worktree on branch {{branch}}, based on {{baseRef}} \u2014 NOT the main checkout. Other agents may work in parallel and land to {{baseRef}}, so {{baseRef}} will move under you. That is expected; don't fight it.", "While iterating, self-validate by running only the tests affected by your change \u2014 use your project's affected-test command if it has one; the full test gate still runs automatically at delivery, so scoping down while you iterate is safe.", "Do NOT push this branch yourself \u2014 not with `git push`, not with `tl push` or any other push wrapper, and do not manually rebase or merge. A steward may be auto-rebasing this branch in the background; pushing concurrently races it and can leave the worktree mid-rebase. Just commit your work here. When the task is done, call `relay_task_deliver` with disposition `complete`, a summary, commits, and passing `typecheck` + `test` gates when the diff touches code/test/config paths. Relay records the typed delivery on the Task, skips code gates for empty/docs-only diffs, then rebases onto the latest {{baseRef}}, lands your work, and pushes for you.", "After `relay_task_deliver` accepts a complete delivery, the workspace status becomes `ready` \u2014 this is the NORMAL, healthy hand-off state, NOT an escalation or a stall. Relay auto-merges clean rebases roughly every 2 minutes; a steward agent is spawned (after a short delay) ONLY if it can't land deterministically, so seeing no steward means it's working, not stuck. Stop your turn after delivery and go idle; do NOT wait or poll the steward queue. Relay wakes you with `landed-success` when your branch lands and refreshes, or `landed-failure` if landing fatally fails. On success you'll be on a fresh rebased branch whose name gains a `--N` suffix \u2014 expected, keep working there. Never `cd` into the main checkout, and never merge/push/resolve conflicts yourself \u2014 Relay and the steward own all of that. `agent-relay workspace status` anytime shows your current state and the exact next step."),
     variables: ["branch", "baseRef"]
   },
   {

package/plugins/claude/skills/pair/SKILL.md

@@ -20,7 +20,11 @@ agent-relay /pair codex "Debug flaky tests"
 agent-relay /pair status
 agent-relay /pair accept PAIR_ID
 agent-relay /pair reject PAIR_ID
-agent-relay /pair send PAIR_ID "What do you see?"
+agent-relay /pair send PAIR_ID --stdin <<'EOF'
+What do you see?
+EOF
 ```
 
 Report the command output briefly. If the CLI cannot detect this session's agent id, rerun with `--agent AGENT_ID` or `--from AGENT_ID` using the Agent Relay ID shown in session context.
+
+Always pass the message body via a quoted heredoc into `--stdin` (or `--body-file PATH`), never inline in the shell command: backticks / `$(...)` in a body are otherwise command-substituted by your shell before `agent-relay` runs (#1263).

package/plugins/codex/skills/pair/SKILL.md

@@ -19,7 +19,11 @@ agent-relay /pair codex "Debug flaky tests"
 agent-relay /pair status
 agent-relay /pair accept PAIR_ID
 agent-relay /pair reject PAIR_ID
-agent-relay /pair send PAIR_ID "What do you see?"
+agent-relay /pair send PAIR_ID --stdin <<'EOF'
+What do you see?
+EOF
 ```
 
 Report the command output briefly. If the CLI cannot detect this session's agent id, rerun with `--agent AGENT_ID` or `--from AGENT_ID` using the Agent Relay ID shown in session context.
+
+Always pass the message body via a quoted heredoc into `--stdin` (or `--body-file PATH`), never inline in the shell command: backticks / `$(...)` in a body are otherwise command-substituted by your shell before `agent-relay` runs (#1263).

package/src/adapter.ts

@@ -256,6 +256,9 @@ export interface ProviderAdapter {
   // Interrupt the in-flight turn without ending the session (ESC for Claude's
   // tmux pane, turn/interrupt for the Codex app-server). Provider-independent at
   // the runner boundary; each adapter does what its provider actually supports.
+  // Contract: abort the turn, never drain it and never attempt Relay-side rollback.
+  // Tool side effects already applied (including partial file writes) remain for the
+  // agent to reconcile. Redirect waits for provider idle before starting a clean turn.
   interrupt?(process: ManagedProcess): Promise<Record<string, unknown> | void>;
   // Out-of-band activity probe for the busy-state reconciler: returns the real
   // provider activity when the runner's claim state may have gone stale (e.g. the
@@ -277,7 +280,11 @@ export interface ProviderAdapter {
   publishPassiveTelemetry?(): Promise<void>;
   // `options.readyTimeoutMs` lets the runner widen the provider-ready wait for the
   // first (cold-start) delivery vs. a fast re-attempt after a ready signal (#329).
-  deliverInitialPrompt?(process: ManagedProcess, prompt: string, options?: { readyTimeoutMs?: number }): Promise<void>;
+  // `options.isInitial` (default true) tells the adapter whether this delivery is the
+  // agent's genuine first turn — the runner passes false from the dashboard
+  // prompt-injection / continue paths (#1228) so a mid-session nudge isn't mislabeled
+  // as the initial prompt.
+  deliverInitialPrompt?(process: ManagedProcess, prompt: string, options?: { readyTimeoutMs?: number; isInitial?: boolean }): Promise<void>;
   // When true, the adapter seeds the spawn-time initial prompt as a launch argument
   // (Claude's positional `claude "<prompt>"`), so it's already delivered the instant the
   // session starts. The runner must then NOT also deliver it post-launch via

package/src/adapters/claude-tmux.ts

@@ -4,17 +4,20 @@
 // The adapter (./claude) keeps the lifecycle decisions; this module owns the
 // mechanical tmux interactions they ride on. Public symbols are re-exported from
 // ./claude so existing import paths (including claude.test.ts) keep resolving.
-import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { sanitizeFsName } from "agent-relay-sdk/fs-name";
 import { shellEscape as shellQuote } from "agent-relay-sdk/shell-utils";
 import { tmuxCommand, tmuxHasSession } from "agent-relay-sdk/tmux-utils";
 import { claudePaneLooksReady } from "./claude-status-detectors";
-import { launcherScriptPathForSession } from "../session-scratch";
+import { launcherGatePathForSession, launcherScriptPathForSession } from "../session-scratch";
 
 export const CLAUDE_TMUX_SUBMIT_DELAY_MS = 250;
 export const CLAUDE_TMUX_SUBMIT_KEY = "C-m";
 export const CLAUDE_TMUX_READY_TIMEOUT_MS = 10_000;
+const TMUX_SOCKET_HASH_LENGTH = 20;
+const TMUX_SOCKET_PATH_SAFE_BYTES = 100;
 
 export function tmuxSessionName(prefix: string, instanceId: string, label?: string): string {
   if (label) return `${prefix}-${sanitizeFsName(label, { replacement: "-", collapse: false, lowercase: true })}`;
@@ -22,11 +25,46 @@ export function tmuxSessionName(prefix: string, instanceId: string, label?: stri
 }
 
 export function tmuxSocketName(sessionName: string): string {
-  const socketName = sanitizeFsName(`agent-relay-${sessionName}`, { replacement: "-", collapse: false, lowercase: true });
+  // `tmux -L` puts this value at <TMUX_TMPDIR>/tmux-<uid>/<socket>. Unix
+  // socket paths are limited to roughly 104-108 bytes, so a display-oriented
+  // session name must never flow into the path unbounded. Hash the complete
+  // session identity (including the orchestrator's agent/spawn suffix) into a
+  // fixed-size token; the readable session name remains unchanged in tmux/UI.
+  const token = createHash("sha256").update(sessionName).digest("hex").slice(0, TMUX_SOCKET_HASH_LENGTH);
+  const socketName = `agent-relay-${token}`;
   assertTmuxSocketPathFits(socketName);
   return socketName;
 }
 
+// Pre-#1353 socket selector, used only for one-way cleanup when a runner first
+// starts after upgrading. Do not assert its path length: an overlong legacy
+// name is exactly what the new fixed-size selector is designed to escape.
+export function legacyTmuxSocketName(sessionName: string): string {
+  return sanitizeFsName(`agent-relay-${sessionName}`, { replacement: "-", collapse: false, lowercase: true });
+}
+
+export function createOrReuseTmuxSession(sessionName: string, socketName: string, tmuxArgs: string[]): void {
+  Bun.spawnSync(tmuxCommand(socketName, "kill-session", "-t", sessionName), {
+    stdin: "ignore", stdout: "ignore", stderr: "ignore",
+  });
+  // Upgrade cleanup: a pre-#1353 runner used the readable session name as its
+  // selector. Best-effort removal prevents a legacy pane surviving beside its
+  // replacement; an overlong legacy selector can fail here harmlessly.
+  Bun.spawnSync(tmuxCommand(legacyTmuxSocketName(sessionName), "kill-session", "-t", sessionName), {
+    stdin: "ignore", stdout: "ignore", stderr: "ignore",
+  });
+  const result = Bun.spawnSync(tmuxCommand(socketName, ...tmuxArgs), {
+    stdin: "ignore", stdout: "pipe", stderr: "pipe",
+  });
+  const stderr = result.stderr.toString().trim();
+  // A restart can race a still-live predecessor. Reuse the uniquely named,
+  // confirmed session rather than failing the healthy agent on "duplicate".
+  const reusable = /duplicate session/i.test(stderr) && tmuxHasSession(sessionName, socketName);
+  if (result.exitCode !== 0 && !reusable) {
+    throw new Error(`tmux session creation failed: ${stderr || `exit code ${result.exitCode}`}`);
+  }
+}
+
 export function tmuxSocketPath(socketName: string, socketDir = defaultTmuxSocketDir()): string {
   return join(socketDir, socketName);
 }
@@ -34,8 +72,22 @@ export function tmuxSocketPath(socketName: string, socketDir = defaultTmuxSocket
 export function assertTmuxSocketPathFits(socketName: string, socketDir = defaultTmuxSocketDir()): void {
   const path = tmuxSocketPath(socketName, socketDir);
   const bytes = Buffer.byteLength(path);
-  if (bytes < 108) return;
-  throw new Error(`derived name too long for tmux socket; pass a short \`label\` (socket path is ${bytes} bytes; must be < 108)`);
+  if (bytes <= TMUX_SOCKET_PATH_SAFE_BYTES) return;
+  throw new Error(`tmux socket directory is too long (socket path is ${bytes} bytes; must be <= ${TMUX_SOCKET_PATH_SAFE_BYTES}); shorten TMUX_TMPDIR`);
+}
+
+// A single failed `has-session` can be transient (and historically was at the
+// Unix socket path boundary). Call after an initial miss and only declare the
+// session gone if a delayed confirmation misses too.
+export async function confirmTmuxSessionGone(
+  sessionName: string,
+  socketName?: string,
+  delayMs = 250,
+  hasSession: (session: string, socket?: string) => boolean = tmuxHasSession,
+): Promise<boolean> {
+  if (hasSession(sessionName, socketName)) return false;
+  await Bun.sleep(delayMs);
+  return !hasSession(sessionName, socketName);
 }
 
 function defaultTmuxSocketDir(): string {
@@ -104,23 +156,69 @@ export async function submitTextToTmux(sessionName: string, text: string, socket
 // tmux new-session has a hard command-length limit that includes every argv item,
 // including `-e KEY=value`. The launcher script keeps tmux argv bounded by carrying
 // both env payloads (profile JSON, tokens, etc.) and the provider command/prompt.
-export function writeLauncherScript(sessionName: string, env: Record<string, string>, shellCmd: string): string {
+//
+// `gateFifo`, when given, is read from (blocking) before the real command execs
+// (#1317): the caller creates the FIFO before the tmux session exists, attaches
+// `pipe-pane` once the pane is up, then writes to the FIFO to release the gate.
+// That guarantees no provider output can be produced before pipe-pane is capturing
+// it — a process that dies in milliseconds previously produced a 0-byte log because
+// pipe-pane was attached in a separate call *after* the session (and its command)
+// had already started. If the FIFO doesn't exist (e.g. mkfifo unavailable), the
+// redirection fails, bash prints a warning and continues straight to `exec` — same
+// racy-but-working behavior as before this fix, not a hard failure.
+export function writeLauncherScript(sessionName: string, env: Record<string, string>, shellCmd: string, gateFifo?: string): string {
   const scriptPath = launcherScriptPathForSession(sessionName);
   const launcherDir = dirname(scriptPath); mkdirSync(launcherDir, { recursive: true, mode: 0o700 }); chmodSync(launcherDir, 0o700);
   const exports = Object.entries(env)
     .map(([key, value]) => `export ${shellEnvKey(key)}=${shellQuote(value)}`)
     .join("\n");
-  writeFileSync(scriptPath, `#!/usr/bin/env bash\n${exports ? `${exports}\n` : ""}exec ${shellCmd}\n`, { mode: 0o700 });
+  const gate = gateFifo ? `read -r _ < ${shellQuote(gateFifo)} || true\n` : "";
+  writeFileSync(scriptPath, `#!/usr/bin/env bash\n${exports ? `${exports}\n` : ""}${gate}exec ${shellCmd}\n`, { mode: 0o700 });
   return scriptPath;
 }
 
+// Create the gate FIFO before the tmux session starts. Best-effort: if `mkfifo`
+// is unavailable, the launcher script's `read < fifo` simply fails-and-continues
+// (see writeLauncherScript), so callers don't need to branch on this return value.
+export function createLauncherGate(gateFifo: string): void {
+  try { rmSync(gateFifo, { force: true }); } catch {}
+  Bun.spawnSync(["mkfifo", "-m", "600", gateFifo], { stdin: "ignore", stdout: "ignore", stderr: "ignore" });
+}
+
+// Release a launcher gate created by `createLauncherGate`, unblocking the
+// launcher script's `read`. Opening a FIFO for writing blocks until a reader is
+// present, so this runs the write in a short-lived subprocess with a timeout
+// guard: if nothing ever reads the FIFO (session/launcher failed to start), we
+// give up rather than hang the caller forever.
+export async function releaseLauncherGate(gateFifo: string, timeoutMs = 5_000): Promise<void> {
+  try {
+    const proc = Bun.spawn(["sh", "-c", `printf x > ${shellQuote(gateFifo)}`], {
+      stdin: "ignore", stdout: "ignore", stderr: "ignore",
+    });
+    const timedOut = await Promise.race([
+      proc.exited.then(() => false),
+      Bun.sleep(timeoutMs).then(() => true),
+    ]);
+    if (timedOut) {
+      try { proc.kill(); } catch {}
+    }
+  } catch {
+    // best-effort — a stuck launcher gate is no worse than the pre-#1317 race.
+  } finally {
+    try { rmSync(gateFifo, { force: true }); } catch {}
+  }
+}
+
 function shellEnvKey(key: string): string {
   if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) return key;
   throw new Error(`invalid environment variable name for Claude launcher: ${key}`);
 }
 
 export function tmuxEnvKeys(env: Record<string, string>, providerEnv: Record<string, string>): string[] {
-  const keys = new Set<string>();
+  // #1222 — PATH is always carried through, not just AGENT_RELAY_/CLAUDE_ vars, so the
+  // launcher script's exported PATH (runtime bin dir prepended by buildSpawnArgs) reaches
+  // the tmux pane instead of whatever ambient PATH the tmux server happened to inherit.
+  const keys = new Set<string>(["PATH"]);
   for (const key of Object.keys(env)) {
     if (key.startsWith("AGENT_RELAY_") || key.startsWith("CLAUDE_")) {
       keys.add(key);

package/src/adapters/claude.ts

@@ -1,9 +1,10 @@
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { delimiter, join, resolve } from "node:path";
 import { type Message } from "agent-relay-sdk";
 import { shellEscape as shellQuote } from "agent-relay-sdk/shell-utils";
 import { tmuxCommand, tmuxHasSession } from "agent-relay-sdk/tmux-utils";
+import { runtimePath } from "agent-relay-sdk/runtime-prefix";
 import { profileAllowsRelayFeature, type ManagedProcess, type ProviderAdapter, type ProviderConfig, type ProviderStatusUpdate, type RunnerSpawnConfig, type SemanticStatus, type SpawnArgs } from "../adapter";
 import { computeLivenessSignal, type LivenessInputs } from "../liveness";
 import type { LivenessSignal } from "agent-relay-sdk";
@@ -14,8 +15,9 @@ import { claudeProbeActivity, readManagedClaudeStatus, resolveClaudePid, type Cl
 import { evaluateClaudePromptGatePane, initialClaudePromptGatePaneState, type ClaudePromptGatePaneState } from "./claude-prompt-gates";
 import { claudeActivityFromProbeAndPane, claudePaneLooksReady, claudePaneIsBusy, claudeRateLimitStatus, claudeConnectionRetryStatus, claudeModelUnavailableStatus } from "./claude-status-detectors";
 import { ClaudeSessionCapture, collectClaudeTranscriptArchiveSegment, collectClaudeTranscriptSessionEvents } from "./claude-session-capture";
-import { CLAUDE_TMUX_READY_TIMEOUT_MS, captureTmuxPane, submitTextToTmux, tmuxEnvKeys, tmuxSessionName, tmuxSocketName, waitForClaudeInputReady, writeLauncherScript } from "./claude-tmux";
+import { CLAUDE_TMUX_READY_TIMEOUT_MS, captureTmuxPane, confirmTmuxSessionGone, createLauncherGate, createOrReuseTmuxSession, releaseLauncherGate, submitTextToTmux, tmuxEnvKeys, tmuxSessionName, tmuxSocketName, waitForClaudeInputReady, writeLauncherScript } from "./claude-tmux";
 import { claudePermissionPromptHandler } from "./claude-permission";
+import { launcherGatePathForSession } from "../session-scratch";
 
 export class ClaudeAdapter implements ProviderAdapter {
   readonly provider = "claude";
@@ -314,13 +316,18 @@ export class ClaudeAdapter implements ProviderAdapter {
         ...(command === "claude" && process.env.CLAUDE_CODE_OAUTH_TOKEN && !config.env?.CLAUDE_CODE_OAUTH_TOKEN
           ? { CLAUDE_CODE_OAUTH_TOKEN: process.env.CLAUDE_CODE_OAUTH_TOKEN }
           : {}),
+        // #1222 — spawned sessions otherwise inherit whatever PATH the host login shell
+        // happens to provide, which may not include the agent-relay CLI. Prepend the
+        // runtime bin dir (layout-agnostic for npm and git-checkout installs, #1305) so
+        // the worker can always self-land/check version, without dropping the host PATH.
+        PATH: [runtimePath(), config.env?.PATH ?? process.env.PATH ?? ""].filter(Boolean).join(delimiter),
         AGENT_RELAY_PROVIDER: "claude",
         ...(config.effort ? { CLAUDE_CODE_EFFORT_LEVEL: config.effort } : {}),
       },
     };
   }
 
-  buildTmuxArgs(config: RunnerSpawnConfig, spawnArgs: SpawnArgs): { sessionName: string; socketName: string; args: string[]; launcherScript: string } {
+  buildTmuxArgs(config: RunnerSpawnConfig, spawnArgs: SpawnArgs): { sessionName: string; socketName: string; args: string[]; launcherScript: string; gateFifo?: string } {
     const sessionName = config.tmuxSession || tmuxSessionName(config.providerConfig.headless.tmuxPrefix, config.instanceId, config.label);
     const socketName = tmuxSocketName(sessionName);
     const shellCmd = [spawnArgs.command, ...spawnArgs.args].map(shellQuote).join(" ");
@@ -330,33 +337,32 @@ export class ClaudeAdapter implements ProviderAdapter {
     const env: Record<string, string> = {};
     for (const key of envKeys) if (spawnArgs.env[key] !== undefined) env[key] = spawnArgs.env[key]!;
 
+    // Only gate the launch behind pipe-pane attachment when there's a log file to
+    // protect (#1317) — no point serializing dev/interactive spawns that never
+    // read AGENT_RELAY_LOG_FILE.
+    const gateFifo = spawnArgs.env.AGENT_RELAY_LOG_FILE ? launcherGatePathForSession(sessionName) : undefined;
+
     // tmux new-session has a hard command-length limit that includes every argv item,
     // including `-e KEY=value`. Keep tmux argv bounded by putting both env payloads
     // (profile JSON, tokens, etc.) and the provider command/prompt in a session script.
-    const launcherScript = writeLauncherScript(sessionName, env, shellCmd);
+    const launcherScript = writeLauncherScript(sessionName, env, shellCmd, gateFifo);
     tmuxArgs.push("-c", spawnArgs.cwd, `bash ${shellQuote(launcherScript)}`);
-    return { sessionName, socketName, args: tmuxArgs, launcherScript };
+    return { sessionName, socketName, args: tmuxArgs, launcherScript, gateFifo };
   }
 
   private async spawnHeadless(config: RunnerSpawnConfig, spawnArgs: SpawnArgs): Promise<ManagedProcess> {
-    const { sessionName, socketName, args: tmuxArgs, launcherScript } = this.buildTmuxArgs(config, spawnArgs);
+    const { sessionName, socketName, args: tmuxArgs, launcherScript, gateFifo } = this.buildTmuxArgs(config, spawnArgs);
     this.modelUnavailableReported = false;
     this.connectionRetryActive = false;
     this.promptGatePaneState = initialClaudePromptGatePaneState();
 
-    Bun.spawnSync(tmuxCommand(socketName, "kill-session", "-t", sessionName), {
-      stdin: "ignore", stdout: "ignore", stderr: "ignore",
-    });
-
-    const result = Bun.spawnSync(tmuxCommand(socketName, ...tmuxArgs), {
-      stdin: "ignore",
-      stdout: "pipe",
-      stderr: "pipe",
-    });
+    // Create the gate FIFO *before* the session exists — the launcher script blocks
+    // on reading it, so no output can be produced until we release it below (#1317).
+    if (gateFifo) createLauncherGate(gateFifo);
 
-    if (result.exitCode !== 0) {
-      const stderr = result.stderr.toString().trim();
-      throw new Error(`tmux session creation failed: ${stderr || `exit code ${result.exitCode}`}`);
+    try { createOrReuseTmuxSession(sessionName, socketName, tmuxArgs); } catch (error) {
+      if (gateFifo) await releaseLauncherGate(gateFifo);
+      throw error;
     }
 
     this.watchTmuxSession(sessionName, socketName);
@@ -369,6 +375,10 @@ export class ClaudeAdapter implements ProviderAdapter {
       });
     }
 
+    // Release the gate now that pipe-pane is attached (or there's nothing to
+    // protect) — the pane's launcher script was blocked on this since it started.
+    if (gateFifo) await releaseLauncherGate(gateFifo);
+
     return {
       pid: undefined, process: undefined, meta: {
         env: spawnArgs.env,
@@ -385,11 +395,21 @@ export class ClaudeAdapter implements ProviderAdapter {
 
   private watchTmuxSession(sessionName: string, socketName?: string): void {
     if (this.tmuxWatcher) clearInterval(this.tmuxWatcher);
-    this.tmuxWatcher = setInterval(() => {
+    let goneConfirmationPending = false;
+    const watcher = setInterval(() => {
       if (!tmuxHasSession(sessionName, socketName)) {
-        clearInterval(this.tmuxWatcher!);
-        this.tmuxWatcher = undefined;
-        this.statusCb("offline");
+        if (goneConfirmationPending) return;
+        goneConfirmationPending = true;
+        void confirmTmuxSessionGone(sessionName, socketName).then((gone) => {
+          // A respawn can replace the watcher while this delayed confirmation
+          // is in flight. Never let the predecessor callback stop its successor.
+          if (this.tmuxWatcher !== watcher) return;
+          goneConfirmationPending = false;
+          if (!gone) return;
+          clearInterval(watcher);
+          this.tmuxWatcher = undefined;
+          this.statusCb("offline");
+        });
         return;
       }
       if (this.modelUnavailableReported) return;
@@ -431,6 +451,7 @@ export class ClaudeAdapter implements ProviderAdapter {
         if (promptGate.status) this.statusCb(promptGate.status);
       }
     }, 2000);
+    this.tmuxWatcher = watcher;
   }
 
   // Best-effort: a failed auto-dismiss must not wedge the pane watcher.
@@ -448,7 +469,6 @@ export class ClaudeAdapter implements ProviderAdapter {
       clearInterval(this.tmuxWatcher);
       this.tmuxWatcher = undefined;
     }
-
     if (opts.graceful && tmuxHasSession(sessionName, socketName)) {
       await submitTextToTmux(sessionName, CLAUDE_EXIT_COMMAND, socketName);
 

package/src/adapters/codex-client.ts

@@ -81,6 +81,18 @@ interface AccountRateLimitsResponse {
 
 export const CODEX_APP_CLIENT_EVENT_CAP = 5_000;
 
+// #1339: every JSON-RPC method the app-server exposes acknowledges promptly — turn/start
+// returns the created turn immediately (turn progress/completion arrive later as separate
+// notifications), compact/start acks and reports completion via thread/compacted, etc. So a
+// request whose response never arrives (a half-open socket, a lost frame, an app-server that
+// wedged mid-handling) is always a fault, never normal latency. Without a ceiling, request()
+// would hang forever; because deliver() awaits turnStart under the runner's single-flight
+// `delivering` latch, one hung request permanently wedges the whole input pump — the agent
+// looks "unresponsive": input is accepted but no turn ever starts and nothing new drains.
+// Reject after this ceiling so the hang surfaces (logged delivery failure) and the pump
+// recovers by re-queuing. Generous vs. the sub-second normal ack, so no false timeouts.
+export const CODEX_APP_CLIENT_REQUEST_TIMEOUT_MS = 30_000;
+
 export class CodexAppClient {
   private ws!: WebSocket;
   private nextId = 1;
@@ -90,7 +102,11 @@ export class CodexAppClient {
   private connected = false;
   private connectionListeners = new Set<(connected: boolean) => void>();
 
-  constructor(private readonly url: string, private readonly log: (msg: string) => void = () => {}) {}
+  constructor(
+    private readonly url: string,
+    private readonly log: (msg: string) => void = () => {},
+    private readonly requestTimeoutMs: number = CODEX_APP_CLIENT_REQUEST_TIMEOUT_MS,
+  ) {}
 
   async connect(): Promise<void> {
     if (this.connected) return;
@@ -223,7 +239,22 @@ export class CodexAppClient {
     const id = this.nextId++;
     const payload: JsonRpcRequest = { id, method, params };
     const promise = new Promise<T>((resolve, reject) => {
-      this.pending.set(id, { resolve, reject });
+      // #1339: cap the wait so a response that never arrives can't hang forever. The timer
+      // is armed here and cleared by settle() the moment the matching frame lands (or the
+      // socket closes and onclose rejects every pending). unref so a pending request never
+      // by itself keeps the process alive.
+      const timer = setTimeout(() => {
+        if (!this.pending.has(id)) return;
+        this.pending.delete(id);
+        this.log(`request timed out after ${this.requestTimeoutMs}ms: ${method} (id=${id})`);
+        reject(new Error(`codex request timed out after ${this.requestTimeoutMs}ms: ${method}`));
+      }, this.requestTimeoutMs);
+      (timer as { unref?: () => void }).unref?.();
+      const settle = (fn: (value: any) => void) => (value: unknown) => {
+        clearTimeout(timer);
+        fn(value);
+      };
+      this.pending.set(id, { resolve: settle(resolve), reject: settle(reject) });
     });
     this.ws.send(JSON.stringify(payload));
     return promise;

package/src/adapters/codex.ts

@@ -3,6 +3,7 @@ import { isRecord, stringValue } from "agent-relay-sdk";
 import { isPidAlive, killPid, processTreePids, processTreePidsFromTable, waitForPidsExit } from "agent-relay-sdk/process-utils";
 import { profileAllowsRelayFeature, providerMessageText, relayContext, type ManagedProcess, type ProviderAdapter, type ProviderConfig, type ProviderPermissionDecisionInput, type ProviderSessionEvent, type ProviderStatusUpdate, type RunnerSpawnConfig, type SpawnArgs, type TerminalAttachSpec } from "../adapter";
 import { workspaceDepsNoteFromEnv } from "../relay-instructions";
+import { CODEX_TURN_IN_PROGRESS_MESSAGE } from "../runner-helpers";
 import { tomlString } from "../relay-mcp";
 import { assembleLaunch, bundledCodexSkillDirs, bundledSkillConfigArgs, materializeLaunchAssembly } from "../launch-assembly";
 import { logger } from "../logger";
@@ -62,6 +63,9 @@ export class CodexAdapter implements ProviderAdapter {
   // Active turn id for the main thread, captured from turn/started so an interrupt
   // can target the in-flight turn. Cleared on turn/completed.
   private activeTurnId?: string;
+  // #1339: the turn id we last logged a delivery-deferral for, so the once-per-turn "held
+  // behind active turn" notice isn't repeated on every ~1s runner retry during that turn.
+  private deferredForTurnId?: string;
   // #653: monotonic id for a turn we synthesize from live item activity when a real
   // turn/started never reached us — so a working Codex agent isn't reported `idle`.
   private syntheticTurnSeq = 0;
@@ -331,13 +335,16 @@ export class CodexAdapter implements ProviderAdapter {
     };
   }
 
-  async deliverInitialPrompt(process: ManagedProcess, prompt: string, _options?: { readyTimeoutMs?: number }): Promise<void> {
-    const text = prompt.trim(); // _options.readyTimeoutMs (#329) is a Claude-TUI concern; ignored here
+  async deliverInitialPrompt(process: ManagedProcess, prompt: string, options?: { readyTimeoutMs?: number; isInitial?: boolean }): Promise<void> {
+    const text = prompt.trim(); // options.readyTimeoutMs (#329) is a Claude-TUI concern; ignored here
     if (!text) return;
     const threadId = await ensureCodexThread(process);
+    // #1228: only a genuine first turn gets the initial-prompt label — a mid-session
+    // dashboard continue/injection (isInitial: false) is delivered as a plain turn.
+    const isInitial = options?.isInitial !== false;
     let input = [
       codexLaunchContext(process),
-      "[agent-relay initial prompt from dashboard]",
+      ...(isInitial ? ["[agent-relay initial prompt from dashboard]"] : []),
       text,
     ].filter(Boolean).join("\n\n");
     if (codexRelayContextEnabled(process) && !process.meta?.relayContextSent) {
@@ -351,6 +358,21 @@ export class CodexAdapter implements ProviderAdapter {
 
   async deliver(process: ManagedProcess, messages: Message[]): Promise<void> {
     const threadId = await ensureCodexThread(process);
+    // #1339: Codex has no queue-while-busy. Claude's transports (tmux paste / monitor stdout)
+    // land in the CLI's own input buffer, which the CLI drains after the current turn; a Codex
+    // turn/start issued mid-turn has no such buffer — the app-server drops it (or wedges),
+    // so a relay message arriving during a turn is silently lost. Reject BEFORE composing text
+    // (so no relay/launch-context side effects are consumed on a message we didn't send): the
+    // runner re-queues and re-drains once the active turn ends, giving Claude-parity queueing.
+    // A trailing agent-visible turn/completed clears activeTurnId; probeActivity (polled every
+    // 4s) clears it too if that event is ever missed, so this can't wedge on a stale turn id.
+    if (this.activeTurnId) {
+      if (this.deferredForTurnId !== this.activeTurnId) {
+        this.deferredForTurnId = this.activeTurnId;
+        logger.info("codex", `holding ${messages.length} relay message${messages.length === 1 ? "" : "s"} behind active turn ${this.activeTurnId}; will deliver after it completes`);
+      }
+      throw new Error(CODEX_TURN_IN_PROGRESS_MESSAGE);
+    }
     let text = [codexLaunchContext(process), providerMessageText(messages)].filter(Boolean).join("\n\n");
     if (codexRelayContextEnabled(process) && !process.meta?.relayContextSent) {
       text = codexRelayContextBlock() + "\n\n" + text;

package/src/busy-reconciler.ts

@@ -4,6 +4,7 @@ const BUSY_RECONCILE_POLL_MS = 4_000;
 const BUSY_RECONCILE_IDLE_CONFIRM = 8;
 const BUSY_RECONCILE_IDLE_CONFIRM_NO_BUSY = 15;
 const INTERRUPT_RECONCILE_DELAY_MS = 1_500;
+const PROVIDER_TURN_CLEAR_TIMEOUT_MS = 60_000;
 
 interface BusyReconcilerDeps {
   isStopped(): boolean;
@@ -24,6 +25,7 @@ export class BusyReconciler {
   private idleStreak = 0;
   private timer?: ReturnType<typeof setInterval>;
   private sawBusy = false;
+  private readonly providerTurnClearWaiters = new Set<(error?: Error) => void>();
 
   constructor(private readonly deps: BusyReconcilerDeps) {}
 
@@ -55,6 +57,28 @@ export class BusyReconciler {
     }, INTERRUPT_RECONCILE_DELAY_MS);
   }
 
+  /** Await the same provider-turn-clear signal maintained by status events and the
+   * interrupt backstop. Redirect uses this boundary before starting its next turn. */
+  waitForProviderTurnClear(timeoutMs = PROVIDER_TURN_CLEAR_TIMEOUT_MS): Promise<void> {
+    if (!this.deps.hasProviderTurn()) return Promise.resolve();
+    return new Promise<void>((resolve, reject) => {
+      let timeout: ReturnType<typeof setTimeout>;
+      const finish = (error?: Error) => {
+        clearTimeout(timeout);
+        this.providerTurnClearWaiters.delete(finish);
+        if (error) reject(error); else resolve();
+      };
+      timeout = setTimeout(() => finish(new Error("timed out waiting for interrupted provider turn to clear")), timeoutMs);
+      timeout.unref?.();
+      this.providerTurnClearWaiters.add(finish);
+    });
+  }
+
+  providerTurnCleared(): void {
+    if (this.deps.hasProviderTurn()) return;
+    for (const finish of [...this.providerTurnClearWaiters]) finish();
+  }
+
   private async run(): Promise<void> {
     const probe = this.deps.probeActivity();
     if (this.deps.isStopped() || !this.deps.hasProcess() || !probe) {

package/src/config.ts

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { DEFAULT_RELAY_URL, RELAY_TOKEN_HEADER, errMessage, stringValue } from "agent-relay-sdk";
@@ -294,7 +294,8 @@ export function writeProviderConfig(provider: string, config: ProviderConfig, ho
   const dir = providersDir(home);
   mkdirSync(dir, { recursive: true });
   const path = join(dir, `${provider}.json`);
-  writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+  chmodSync(path, 0o600);
   return { ...config, path };
 }
 

package/src/profile-home.ts

@@ -1,13 +1,15 @@
-import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, symlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { sanitizeFsName } from "agent-relay-sdk/fs-name";
-import type { ProvisioningMcpServer, SpawnProvider } from "agent-relay-sdk";
+import { isRecord, type ProvisioningMcpServer, type SpawnProvider } from "agent-relay-sdk";
 import { getManifest } from "agent-relay-providers";
 import { profileAllowsRelayFeature, type RunnerSpawnConfig } from "./adapter";
 import { claudeRelayManual } from "./relay-instructions";
 import { providerHomeRootFromEnv } from "./config";
 import { applyClaudeConfigPromptGatePreventions } from "./adapters/claude-prompt-gates";
+import { writeProviderHomeMarker } from "./provider-home-marker";
+import { reclaimProviderHomeTombstone } from "./provider-home-tombstone";
 
 type ProviderHome = {
   path: string;
@@ -94,7 +96,20 @@ const BOOTSTRAP_HOOKS = new Map<string, BootstrapHook>();
 function prepareProviderHome(provider: SpawnProvider, config: RunnerSpawnConfig): ProviderHome | undefined {
   if (!profileRequiresIsolatedHome(provider, config)) return undefined;
   const target = providerHomePath(provider, config);
+  // #1256 spawn-side reclaim — FIRST recover any quarantine tombstone the reaper left for
+  // this exact instanceId (atomic rename back to `target`), BEFORE creating a fresh home.
+  // This makes reconnection always safe (a reconnecting/resuming agent recovers its home)
+  // and lets a crash-stranded tombstone self-heal. A lost reclaim race just falls through
+  // to a fresh mkdir below — never a corrupt home.
+  reclaimProviderHomeTombstone(target);
   mkdirSync(target, { recursive: true });
+  // #1256 — stamp the owner-marker so the server's age-tier reaper can later reclaim
+  // this home if it becomes orphaned, but only ever on THIS host (cross-host safety).
+  writeProviderHomeMarker(target, {
+    provider,
+    profile: sanitizePathPart(config.agentProfile?.name || config.profile || "profile"),
+    instanceId: sanitizePathPart(config.instanceId || config.runnerId),
+  });
   const hook = BOOTSTRAP_HOOKS.get(provider);
   if (hook) hook(target, config);
   const manifest = getManifest(provider);
@@ -117,7 +132,7 @@ function bootstrapClaudeFirstRun(claudeHome: string, config: RunnerSpawnConfig):
   if (profileAllowsRelayFeature(config, "context") && !profileAllowsHostGlobalInstructions(config)) {
     writeClaudeRelayManual(claudeHome);
   }
-  seedClaudeConfigIfMissing(claudeHome, config);
+  ensureClaudeConfigSeed(claudeHome, config);
 }
 
 BOOTSTRAP_HOOKS.set("codex", bootstrapCodexFirstRun);
@@ -130,12 +145,91 @@ export function providerSourceHome(provider: string): string {
   return (envVar && process.env[envVar]) || join(homedir(), configDir);
 }
 
-function seedClaudeConfigIfMissing(claudeHome: string, config: RunnerSpawnConfig): void {
+function ensureClaudeConfigSeed(claudeHome: string, config: RunnerSpawnConfig): void {
   const path = join(claudeHome, ".claude.json");
-  if (existsSync(path)) return;
   const host = readHostClaudeConfig();
   const seed = applyClaudeConfigPromptGatePreventions({}, host, config);
-  writeFileSync(path, JSON.stringify(seed, null, 2), { mode: 0o600 });
+  if (!existsSync(path)) {
+    writeJsonAtomic(path, seed);
+    return;
+  }
+  // #1368/#harden — the isolated home is instance-keyed and PERSISTS across resumes/reconnects, so a
+  // relaunch (e.g. auto-resume after a tmux/provider exit) reuses the existing `.claude.json` and
+  // never re-runs the absent-file seed above. Re-heal every prompt-gate key the seed would have
+  // applied on a fresh home (onboarding, theme, bypass-permissions, workspace-trust): a resumed
+  // config stale/missing on ANY of them boots straight into that gate's interactive prompt, can't
+  // answer headlessly, and crash-loops the agent offline. A corrupt/unparseable/non-object existing
+  // file can't be surgically merged — its prior contents are unrecoverable anyway — so it gets a
+  // full reseed instead of bailing and leaving every gate unguarded; a well-formed file gets a
+  // sibling-preserving merge.
+  const existing = readExistingClaudeConfig(path);
+  if (!existing) {
+    writeJsonAtomic(path, seed);
+    return;
+  }
+  if (mergeClaudeConfigGates(existing, seed)) writeJsonAtomic(path, existing);
+}
+
+// Parses an existing `.claude.json`. Returns undefined when the file is unparseable JSON or not a
+// plain object, signaling the caller to reseed fully rather than merge into it.
+function readExistingClaudeConfig(path: string): Record<string, unknown> | undefined {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8")) as unknown;
+    return isRecord(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// Idempotently re-applies every key the seed computed onto an already-existing, well-formed config,
+// without touching any sibling key the provider has written since first spawn (session history,
+// other project entries, etc.). Boolean gate keys (hasCompletedOnboarding, bypassPermissionsModeAccepted,
+// and the two workspace-trust flags) are forced to `true` whenever they aren't already `true`, so a
+// stale `false` is promoted the same as a missing key. Non-boolean keys (theme, lastOnboardingVersion)
+// are only filled in when entirely absent, so a value the provider or user has since set is never
+// clobbered. `seed` already reflects each prevention's own gating (e.g. bypassPermissionsModeAccepted
+// is simply absent unless approvalMode is "open"), so a guarded profile is never forced into it here.
+// Returns whether anything changed.
+function mergeClaudeConfigGates(existing: Record<string, unknown>, seed: Record<string, unknown>): boolean {
+  let dirty = false;
+  for (const [key, value] of Object.entries(seed)) {
+    if (key === "projects") continue;
+    if (typeof value === "boolean") {
+      if (existing[key] !== true) {
+        existing[key] = true;
+        dirty = true;
+      }
+    } else if (existing[key] === undefined) {
+      existing[key] = value;
+      dirty = true;
+    }
+  }
+  if (isRecord(seed.projects)) {
+    const existingProjects = isRecord(existing.projects) ? existing.projects : {};
+    for (const [projectPath, seedEntry] of Object.entries(seed.projects)) {
+      if (!isRecord(seedEntry)) continue;
+      const existingEntry = isRecord(existingProjects[projectPath]) ? existingProjects[projectPath] : {};
+      for (const [entryKey, entryValue] of Object.entries(seedEntry)) {
+        if (typeof entryValue !== "boolean") continue;
+        if (existingEntry[entryKey] !== true) {
+          existingEntry[entryKey] = true;
+          dirty = true;
+        }
+      }
+      existingProjects[projectPath] = existingEntry;
+    }
+    existing.projects = existingProjects;
+  }
+  return dirty;
+}
+
+// Atomic write: temp file in the SAME directory, then rename(2). A crash or kill mid-write leaves
+// only an orphaned temp file — never a truncated/corrupt `.claude.json` — because rename only ever
+// swaps in a complete file.
+function writeJsonAtomic(path: string, value: unknown): void {
+  const tmpPath = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+  writeFileSync(tmpPath, JSON.stringify(value, null, 2), { mode: 0o600 });
+  renameSync(tmpPath, path);
 }
 
 function readHostClaudeConfig(): Record<string, unknown> | undefined {

package/src/provider-home-marker.ts

@@ -0,0 +1,126 @@
+// Owner-marker for isolated provider-config homes (#1256 age-tier / #1253 cross-host
+// safety). A small JSON file written into each home root when it is materialized. It
+// records which relay instance OWNS the home so the server's periodic reaper can safely
+// age-reap a genuinely-orphaned home (no registered agent) WITHOUT ever touching a home
+// that belongs to a different relay instance / remote host that happens to share the
+// same on-disk layout.
+//
+// KEY CORRECTNESS INVARIANT: the marker is WRITTEN here by the runner/child-spawn path
+// but READ by the server-side reaper (src/provider-home-gc.ts). Both must derive THIS
+// instance's owner identity the same way, or the reaper would either never match its own
+// homes (no reclaim) or match a foreign one (unsafe delete). The single source of truth
+// is resolveLocalOrchestratorId() (src/upgrade-local-id.ts) — the canonical
+// orchestrator-id anchor honoring the orchestrator.json `id`, the
+// AGENT_RELAY_ORCHESTRATOR_ID env override, and finally the hostname. Bare os.hostname()
+// is NOT collision-resistant (#1256 finding 2): two hosts/containers sharing a hostname
+// but running separate Relay instances would each see the other's home as "own-host, no
+// agent" and delete a LIVE home after the TTL. The runner child and the relay server run
+// with the same HOME/env on the same instance, so resolveLocalOrchestratorId() agrees
+// across them; a different relay instance resolves a different id, which is exactly the
+// cross-instance reap guard. `host` (bare hostname) is retained as an informational field
+// only — never the authoritative own-owner match.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { resolveLocalOrchestratorId } from "agent-relay-sdk";
+
+export const PROVIDER_HOME_MARKER_FILENAME = ".agent-relay-home.json";
+export const PROVIDER_HOME_MARKER_VERSION = 1;
+
+export interface ProviderHomeMarker {
+  /** Marker schema version. Only the exact known version (1) is ever trusted. */
+  v: number;
+  /**
+   * Authoritative owning-instance identity — resolveLocalOrchestratorId(). The one
+   * anchor shared by the marker writer (runner) and reader (server reaper); the reaper
+   * age-reaps ONLY homes whose `owner` equals this instance's own id.
+   */
+  owner: string;
+  /** Informational only: bare os.hostname() at write time. NOT the authoritative match. */
+  host: string;
+  provider: string;
+  profile: string;
+  instanceId: string;
+  /** Epoch ms the home was first materialized (stable across re-materialization). */
+  createdAt: number;
+}
+
+/**
+ * THIS instance's authoritative owner identity. The one anchor shared by the marker
+ * writer and reader — collision-resistant across hosts that share a hostname (#1256
+ * finding 2). Must resolve identically on the runner (write) and server (read) sides.
+ */
+export function providerHomeOwnerId(): string {
+  return resolveLocalOrchestratorId();
+}
+
+export function providerHomeMarkerPath(homePath: string): string {
+  return join(homePath, PROVIDER_HOME_MARKER_FILENAME);
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.length > 0;
+}
+
+/**
+ * Read + strictly validate a home's owner-marker. Returns null on
+ * missing/unreadable/unparseable/malformed — the reaper treats null as "unmarked →
+ * never age-reap" (conservative). Validation (#1256 finding 3) rejects unless:
+ *   - `v` is EXACTLY the known schema version (1) — not merely "a number", so a marker
+ *     from an unknown/future/0 schema is never trusted.
+ *   - every required identity field is a NON-EMPTY string (empty strings are rejected;
+ *     a partially-written/blank marker must never be treated as authoritative).
+ *   - `createdAt` is a finite number.
+ * The reaper additionally confirms the marker actually describes THIS directory
+ * (provider/profile/instanceId path-segment match) and that `owner` is this instance —
+ * see src/provider-home-gc.ts. Any failure → skip, never reap.
+ */
+export function readProviderHomeMarker(homePath: string): ProviderHomeMarker | null {
+  try {
+    const parsed = JSON.parse(readFileSync(providerHomeMarkerPath(homePath), "utf8")) as Partial<ProviderHomeMarker>;
+    if (
+      !parsed ||
+      parsed.v !== PROVIDER_HOME_MARKER_VERSION ||
+      !isNonEmptyString(parsed.owner) ||
+      !isNonEmptyString(parsed.host) ||
+      !isNonEmptyString(parsed.provider) ||
+      !isNonEmptyString(parsed.profile) ||
+      !isNonEmptyString(parsed.instanceId) ||
+      typeof parsed.createdAt !== "number" ||
+      !Number.isFinite(parsed.createdAt)
+    ) {
+      return null;
+    }
+    return parsed as ProviderHomeMarker;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Write the owner-marker into a materialized home root. Idempotent: safe to call on
+ * every (re)materialization; a pre-existing valid marker's createdAt is preserved so
+ * the recorded age is stable. Best-effort — a home we can't mark simply stays
+ * un-age-reapable, which is the safe failure mode.
+ */
+export function writeProviderHomeMarker(
+  homePath: string,
+  fields: { provider: string; profile: string; instanceId: string },
+  now: number = Date.now(),
+): void {
+  const existing = existsSync(homePath) ? readProviderHomeMarker(homePath) : null;
+  const marker: ProviderHomeMarker = {
+    v: PROVIDER_HOME_MARKER_VERSION,
+    owner: providerHomeOwnerId(),
+    host: hostname(),
+    provider: fields.provider,
+    profile: fields.profile,
+    instanceId: fields.instanceId,
+    createdAt: existing?.createdAt ?? now,
+  };
+  try {
+    writeFileSync(providerHomeMarkerPath(homePath), JSON.stringify(marker), { mode: 0o600 });
+  } catch {
+    // best-effort; leave the home unmarked (safe: unmarked homes are never age-reaped)
+  }
+}

package/src/provider-home-tombstone.ts

@@ -0,0 +1,131 @@
+// Quarantine/delete tombstone naming + spawn-side reclaim for provider-home GC (#1256).
+//
+// The reaper NEVER rename-then-immediately-rm's a home. Instead it decouples the
+// destructive delete from any live registration with a quarantine window and two disjoint
+// sibling name-spaces, both of which the candidate scanner excludes:
+//
+//   `<instanceId>.reaping-<quarantineMs>-<seq>`   RECLAIM-able quarantine tombstone.
+//       Pass A of the reaper renames an eligible orphan here (no rm). A spawning runner
+//       that materializes the SAME instanceId reclaims it (atomic rename back to the live
+//       path) BEFORE creating a fresh home — so a reconnecting/resuming agent always
+//       recovers its home, and a crash-stranded tombstone self-heals on the next spawn.
+//
+//   `<instanceId>.deleting-<nowMs>-<seq>`          COMMITTED delete-staging dir.
+//       Pass B, only for tombstones quarantined past the quarantine TTL and still with no
+//       live owner, atomically renames the `.reaping-*` tombstone to a `.deleting-*` name
+//       and THEN rm's it. The spawn-side reclaim only ever touches `.reaping-*`, never a
+//       `.deleting-*`, so this rename is the single filesystem linearization point of the
+//       delete-vs-spawn-reclaim race:
+//         - reclaim wins  → `.reaping-*` → live path; Pass B's stage rename ENOENTs and
+//           aborts. The home is live and intact.
+//         - Pass B wins   → `.reaping-*` → `.deleting-*`; the racing spawn finds no
+//           `.reaping-*` and builds a clean fresh home at the live path. Pass B rm's the
+//           `.deleting-*` (the dead agent's old copy). No half-deleted live home is ever
+//           possible.
+//
+// The two infixes are deliberately disjoint and both end-anchored + numeric so a real
+// instanceId (a UUID / `<host>-<provider>-<label>-<uuid8>`) is never mistaken for one.
+import { existsSync, readdirSync, renameSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { readProviderHomeMarker } from "./provider-home-marker";
+
+export const TOMBSTONE_INFIX = ".reaping-";
+export const DELETING_INFIX = ".deleting-";
+
+// End-anchored + numeric: `<instanceId>.reaping-<quarantineMs>-<seq>`. The leading `.+`
+// is greedy, so an instanceId that itself happens to contain `.reaping-<n>` still parses
+// to the correct (full) leaf — the structured, end-anchored suffix is what we added.
+const TOMBSTONE_NAME_RE = /^(.+)\.reaping-(\d+)-(\d+)$/;
+const DELETING_NAME_RE = /^(.+)\.deleting-(\d+)-(\d+)$/;
+
+export interface ParsedTombstone {
+  instanceId: string;
+  quarantineMs: number;
+  seq: number;
+}
+
+/** Reclaim-able quarantine tombstone name for `instanceId` quarantined at `quarantineMs`. */
+export function tombstoneName(instanceId: string, quarantineMs: number, seq: number): string {
+  return `${instanceId}${TOMBSTONE_INFIX}${quarantineMs}-${seq}`;
+}
+
+/** Committed delete-staging dir name — a name the spawn-side reclaim NEVER touches. */
+export function deletingName(instanceId: string, nowMs: number, seq: number): string {
+  return `${instanceId}${DELETING_INFIX}${nowMs}-${seq}`;
+}
+
+export function isTombstoneName(name: string): boolean {
+  return TOMBSTONE_NAME_RE.test(name);
+}
+
+export function isDeletingName(name: string): boolean {
+  return DELETING_NAME_RE.test(name);
+}
+
+/** Any reaper-owned staging name (either name-space) — excluded from candidate scanning. */
+export function isReaperStagingName(name: string): boolean {
+  return isTombstoneName(name) || isDeletingName(name);
+}
+
+export function parseTombstone(name: string): ParsedTombstone | null {
+  const m = TOMBSTONE_NAME_RE.exec(name);
+  if (!m) return null;
+  const quarantineMs = Number(m[2]);
+  const seq = Number(m[3]);
+  if (!Number.isFinite(quarantineMs) || !Number.isFinite(seq)) return null;
+  return { instanceId: m[1] as string, quarantineMs, seq };
+}
+
+/**
+ * Spawn-side reclaim (the key #1256 safety property). Called at materialization time,
+ * BEFORE the fresh home is created at `homePath`. If a quarantine tombstone
+ * (`<homePath>.reaping-*`) exists for this exact instanceId, atomically rename it back to
+ * `homePath` so a reconnecting/resuming agent recovers its home and a crash-stranded
+ * tombstone self-heals. Returns `homePath` when a tombstone was reclaimed, else null (the
+ * caller then creates a fresh home). Best-effort and NEVER throws — a lost reclaim race
+ * simply yields a fresh home, never a corrupt one.
+ *
+ * ONLY ever reclaims `.reaping-*` tombstones — never a `.deleting-*` staging dir, which the
+ * reaper has already committed to deleting (reclaiming one could race a live rm and revive
+ * a half-deleted dir at the live path). That disjointness is the whole point of the two
+ * name-spaces.
+ */
+export function reclaimProviderHomeTombstone(homePath: string): string | null {
+  try {
+    // A live/fresh home already sits here — never clobber it with an old tombstone.
+    if (existsSync(homePath)) return null;
+    const parent = dirname(homePath);
+    const leaf = basename(homePath);
+    let entries: string[];
+    try {
+      entries = readdirSync(parent);
+    } catch {
+      return null;
+    }
+    const matches = entries
+      .map((name) => ({ name, parsed: parseTombstone(name) }))
+      .filter((e): e is { name: string; parsed: ParsedTombstone } => e.parsed !== null && e.parsed.instanceId === leaf)
+      // Collision guard: an entry whose OWN marker names the full entry name as its
+      // instanceId is a live home that merely looks like a tombstone (a real instanceId that
+      // happens to end in the tombstone name-shape) — never reclaim it as `leaf`'s home. A
+      // genuine tombstone of `leaf` carries a marker with instanceId === `leaf`, never its
+      // own (longer) tombstone name. Unmarked entries fall through (a materialized home is
+      // always marked, so an unmarked match is a genuine attribution-tier tombstone).
+      .filter((e) => readProviderHomeMarker(join(parent, e.name))?.instanceId !== e.name)
+      .sort((a, b) => b.parsed.quarantineMs - a.parsed.quarantineMs || b.parsed.seq - a.parsed.seq);
+    for (const match of matches) {
+      try {
+        renameSync(join(parent, match.name), homePath);
+        return homePath;
+      } catch {
+        // Lost this rename (the reaper staged it to `.deleting-*`, or another spawn grabbed
+        // it): if the path now exists someone else reclaimed it; otherwise try the next
+        // (older) tombstone, and failing all, fall through to a fresh home.
+        if (existsSync(homePath)) return homePath;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}

package/src/relay-mcp-proxy.ts

@@ -280,7 +280,13 @@ export class RelayMcpProxy {
       })));
     }
 
-    if (relay.body) return Response.json(relay.body);
+    // #1418: propagate the relay's actual status (e.g. 413 payload-too-large, 400 validation,
+    // 403 auth) instead of the default 200 `Response.json` gives an untouched status option —
+    // a hard rejection silently reads as a normal 200 response to anything downstream that
+    // branches on HTTP status rather than parsing the JSON-RPC `error` field, masking a large
+    // delivery's outright rejection as an ambiguous "success". `forwardRaw` below already gets
+    // this right; `tools/call` was the one path that didn't.
+    if (relay.body) return Response.json(relay.body, { status: relay.status || 200 });
     // Relay down and not bufferable: a real error the agent must see (and can retry).
     return Response.json(jsonRpcError(id, -32002, `relay unreachable: ${relay.transportError ?? `status ${relay.status}`}`));
   }

package/src/relay-mcp.ts

@@ -85,14 +85,37 @@ export function tomlString(value: string): string {
 // project-cwd `.mcp.json` is never discovered (its enable modal can't wedge a headless
 // agent). Whatever the assembler decides host mode should keep is injected here explicitly;
 // strict then preserves exactly that set and nothing else.
+import { existsSync } from "node:fs";
+import { dirname, join, resolve as resolvePath } from "node:path";
+import { fileURLToPath } from "node:url";
 import { SHARED_CALLMUX_TOOL_CALL_TIMEOUT_MS, type ProvisioningMcpServer } from "agent-relay-sdk";
 
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// #1301 — a bare `command: "callmux"` resolves off PATH, which can drift from the version
+// this package pins (root/runner/orchestrator all pin the same `callmux` dependency). npm
+// (and bun/pnpm workspaces) always link a dependency's declared bin to `node_modules/.bin/<name>`
+// at whichever ancestor directory it resolves/hoists to — the same layout-agnostic-bin
+// invariant #1305/#1222 rely on for the agent-relay CLI itself — so walk up from this
+// module's own location to find the PINNED bridge binary instead of trusting PATH. Falls
+// back to the bare name (old behavior) only if no bundled bin is found anywhere above.
+export function resolveCallmuxBin(startDir: string = __dirname): string {
+  let dir = resolvePath(startDir);
+  while (true) {
+    const candidate = join(dir, "node_modules", ".bin", "callmux");
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) return "callmux";
+    dir = parent;
+  }
+}
+
 // The shared-listener bridge as a provider-neutral stdio server descriptor: a `callmux bridge`
 // child fronting the host's shared listener, with per-agent `--cwd "$WORKTREE"` for session-cwd
 // isolation (#672). It flows through the existing claude/codex stdio injection unchanged.
 export function sharedMcpBridgeServer(url: string, cwd: string): ProvisioningMcpServer {
   return {
-    command: "callmux",
+    command: resolveCallmuxBin(),
     args: ["bridge", "--url", url, "--cwd", cwd, "--call-timeout", String(SHARED_CALLMUX_TOOL_CALL_TIMEOUT_MS)],
   };
 }

package/src/runner-core.ts

@@ -689,7 +689,7 @@ export class AgentRunner {
     this.deliveringInitialPrompt = true;
     const attempt = (this.initialPromptAttempts += 1);
     try {
-      this.recordInjectedPrompt(prompt); await this.options.adapter.deliverInitialPrompt(this.process, prompt, { readyTimeoutMs });
+      this.recordInjectedPrompt(prompt); await this.options.adapter.deliverInitialPrompt(this.process, prompt, { readyTimeoutMs, isInitial: true });
       this.pendingInitialPrompt = undefined;
     } catch (error) {
       const giveUp = attempt >= MAX_INITIAL_PROMPT_ATTEMPTS;
@@ -816,9 +816,17 @@ export class AgentRunner {
         providerResult = await this.options.adapter.clearContext(this.process);
       } else if (type === "agent.interrupt") {
         if (!this.options.adapter.interrupt || !this.process) throw new Error("provider does not support interrupt");
-        this.sessionLog("interrupt requested from dashboard");
-        providerResult = await this.options.adapter.interrupt(this.process);
-        this.busyReconciler.scheduleInterruptReconcile();
+        const redirect = params.redirect && typeof params.redirect === "object" && !Array.isArray(params.redirect)
+          ? params.redirect as Record<string, unknown>
+          : undefined;
+        const hasProviderTurn = this.claims.activeWork().some((work) => work.kind === "provider-turn");
+        if (hasProviderTurn || !redirect) {
+          this.sessionLog(`interrupt requested via ${typeof params.requestedVia === "string" ? params.requestedVia : "dashboard"}`);
+          providerResult = await this.options.adapter.interrupt(this.process);
+          this.busyReconciler.scheduleInterruptReconcile();
+        }
+        if (redirect && hasProviderTurn) await this.busyReconciler.waitForProviderTurnClear();
+        if (redirect) providerResult = { interrupt: providerResult, redirect: await this.injectPrompt(redirect) };
       } else if (type === "agent.injectContext") {
         if (!this.process) throw new Error("provider process is unavailable");
         providerResult = await this.injectContext(params);
@@ -934,7 +942,9 @@ export class AgentRunner {
     // Mark so the matching UserPromptSubmit echo isn't double-posted: a chat-box
     // prompt already created its own session message shown in the dashboard.
     this.recordInjectedPrompt(prompt.trim());
-    await this.options.adapter.deliverInitialPrompt(this.process, prompt);
+    // #1228: prompt injection is a manual dashboard "continue"/chat-box send, not the
+    // agent's genuine first turn — never label it as the initial prompt.
+    await this.options.adapter.deliverInitialPrompt(this.process, prompt, { isInitial: false });
     return { injected: true, messageId, attachmentCount: attachments.length };
   }
 
@@ -956,7 +966,8 @@ export class AgentRunner {
       return;
     }
     this.recordInjectedPrompt(text.trim());
-    await this.options.adapter.deliverInitialPrompt(this.process, text).catch((error) => {
+    // #1228: this resolves a held AskUserQuestion mid-session — never the initial prompt.
+    await this.options.adapter.deliverInitialPrompt(this.process, text, { isInitial: false }).catch((error) => {
       this.sessionLog(`failed to inject AskUserQuestion answer for ${input.approvalId}: ${errMessage(error)}`);
     });
   }
@@ -1049,6 +1060,9 @@ export class AgentRunner {
 
       const nativeSelfResume = this.nativeSelfResume.active;
       if (nativeSelfResume && getManifest(this.options.provider)?.resume?.supported) {
+        // suppressPrompt only applies (and only matters) on the no-resumeId branch below — see the
+        // gate-hardening note at the tmux-exit-auto-resume call site further down for why it's a
+        // no-op whenever resumeId is set, and what actually keeps a resume off the bypass gate.
         await recoverNativeSelfResumeExit({ handoff: nativeSelfResume, tracker: this.nativeSelfResume, providerSessionId: this.providerSessionId, status, diagnostics, now, publishTimeline: (event) => this.publishRunnerTimelineEvent(event), setTerminalProviderExit: (marker) => { this.terminalProviderExit = marker; }, setProviderStatus: (update) => this.setProviderStatus(update), restartProvider: (resumeId) => this.restartProvider(resumeId ? { resumeId } : { suppressPrompt: true }), publishStatus: () => this.publishStatus(), scheduleDrain: () => this.scheduleDrain() });
         return;
       }
@@ -1178,6 +1192,13 @@ export class AgentRunner {
       await Bun.sleep(delayMs);
       if (this.stopped || this.exitCommandInProgress) return;
       try {
+        // #1368/#harden — a resume relaunch always carries a resumeId here, so passing
+        // suppressPrompt would be a no-op (it's only consumed under !resumeId, see spawnProvider).
+        // What actually keeps a skip-permissions resume off the interactive "Bypass Permissions
+        // mode" gate: the config-seed re-heal in profile-home.ts, which idempotently re-applies
+        // every prompt-gate key on the persisted, instance-keyed provider config home before each
+        // launch, plus the adapter's always-on pane-gate send-keys watcher as a fallback if a gate
+        // still renders.
         await this.restartProvider(restartResumeId ? { resumeId: restartResumeId } : undefined);
         this.publishStatus();
         this.scheduleDrain();
@@ -1444,6 +1465,7 @@ export class AgentRunner {
     if (typeof update !== "string") {
       for (const kind of update.clear ?? []) this.claims.clearWorkKind(kind);
     }
+    if (!this.claims.activeWork().some((work) => work.kind === "provider-turn")) this.busyReconciler.providerTurnCleared();
     // #329: the provider just went idle (ready). If a first initial-prompt delivery timed out on
     // a cold-start TUI, re-attempt now — the ready wait should resolve almost immediately.
     if (status === "idle" && this.pendingInitialPrompt && !this.deliveringInitialPrompt) {
@@ -1849,6 +1871,7 @@ export class AgentRunner {
     if (!this.claims.activeWork().some((w) => w.kind === "provider-turn")) return;
     this.sessionLog(`force-clearing stuck provider-turn (${reason})`);
     this.claims.clearWorkKind("provider-turn");
+    this.busyReconciler.providerTurnCleared();
     this.currentTurnId = undefined;
     this.compactionMidTurn = false;
     this.publishStatus();
@@ -1886,6 +1909,7 @@ export class AgentRunner {
         this.compactionMidTurn = false;
         this.busyReconciler.disarm();
         this.stopReasoningTail();
+        this.busyReconciler.providerTurnCleared();
       }
       this.publishStatus();
     }

package/src/runner-helpers.ts

@@ -287,9 +287,16 @@ export function commandTimeoutMs(params: Record<string, unknown>, fallback = 10_
   return Math.min(raw, 60_000);
 }
 
+// #1339: the Codex adapter rejects a delivery attempted while a turn is already in progress
+// (Codex has no queue-while-busy the way Claude's input buffer does), so the runner re-queues
+// and re-drains once the turn ends. That rejection is expected flow control, not a fault — the
+// drain loop retries roughly once a second during a long turn, so it must not spam the log.
+export const CODEX_TURN_IN_PROGRESS_MESSAGE = "codex turn in progress; deferring delivery until it completes";
+
 export function shouldLogDeliveryFailure(error: unknown): boolean {
   const message = errMessage(error);
-  return message !== providerMonitorUnavailableMessage("claude");
+  return message !== providerMonitorUnavailableMessage("claude")
+    && message !== CODEX_TURN_IN_PROGRESS_MESSAGE;
 }
 
 export function runtimeTokenRenewDelayMs(expiresAtSeconds: number, nowMs = Date.now()): number | undefined {

package/src/session-scratch.ts

@@ -129,6 +129,13 @@ export function launcherScriptPathForSession(sessionName: string, launcherDir?:
   return join(resolveLauncherDir(launcherDir), `${sanitized}.sh`);
 }
 
+// Named-pipe path the launcher script blocks on before exec'ing the real provider
+// command (#1317) — lets the caller attach `tmux pipe-pane` while the pane is still
+// idle, so a process that exits within milliseconds can't slip output past it.
+export function launcherGatePathForSession(sessionName: string, launcherDir?: string): string {
+  return `${launcherScriptPathForSession(sessionName, launcherDir)}.gate`;
+}
+
 function dedupeBases(bases: Array<string | undefined>): string[] {
   const seen = new Set<string>();
   const out: string[] = [];
@@ -169,6 +176,7 @@ export function reapSessionLauncher(target: SessionLauncherTarget): string[] {
   for (const path of dedupePaths([
     target.launcherScript,
     target.tmuxSession ? launcherScriptPathForSession(target.tmuxSession, target.launcherDir) : undefined,
+    target.tmuxSession ? launcherGatePathForSession(target.tmuxSession, target.launcherDir) : undefined,
   ])) {
     try {
       const exists = statSync(path).isFile();