aiterm-mcp 0.60.1 → 0.61.0

package/dist/core.js

@@ -1,3 +1,4 @@
+import { parseClaudeOperationMarker } from "./claude-operation-marker.js";
 /**
  * core — CLI/MCP が共有する純粋ロジック層（Node/TS 版）。
  *
@@ -13,10 +14,15 @@ import * as path from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import * as rtk from "./rtk.js";
+import { closeExpectedExecution, parseExecutionNativeSessions, executionNativeBindingSchema } from "./execution-close.js";
+import { executionPointSchema } from "./execution-contract.js";
+import { withExecutionInterruptEffectScope, bindExecutionNativeTarget, beforeExecutionEffect, bindExecutionCreatedLaunch, executionCreatedNativeBinding, hasExecutionCreationScope, assertExecutionContext, withExecutionPreparation, captureExecutionSendBoundary, readExecutionSendBoundary } from "./execution-effect.js";
+import { ExecutionError } from "./execution-wire.js";
+import { readExecutionParentProcess } from "./execution-parent-process.js";
 import { isCursorMcpClient } from "aiterm-steer-delivery";
 import { paneTokenHint } from "./harnesses/pane-tokens.js";
 import { unfinishedDeliveriesOwnedBy } from "./parent-delivery-owners.js";
-import { readRuntimeProcesses, processSubtree, parentProcess, processIdentity, backgroundProcesses, lazyRelayProcess, aitermProcessProbe, windowsConsoleHost, processElapsedSeconds } from "./process-runtime.js";
+import { readRuntimeProcesses, readProcessIdentities, processSubtree, parentProcess, processIdentity, backgroundProcesses, lazyRelayProcess, aitermProcessProbe, windowsConsoleHost, processElapsedSeconds } from "./process-runtime.js";
 import { liveNodeExecutable } from "./live-node.js";
 import { AitermError, telemetryOwnedFailure, ownTelemetryFailure } from "./errors.js";
 import { isWin, SOCKDIR, tmuxCommand, sendPsmuxPayload, loadPtyBufferChunk, pasteBufferBaseArgs, tmuxNewSession, openPsmuxServerToDesktop, registeredSessionEnvironment, attachCommand, normalizePaneCommand, atomicShellMultiline, appendMarkSentinel, markShellCommand, settlePaneLog, paneCwdArgument, sessionEnvironmentLaunch, } from "./tmux-runtime.js";
@@ -25,10 +31,10 @@ import { catalogUnavailable } from "./model-catalog.js";
 import { FastModeError, fastModeFailure } from "./fast-mode.js";
 import { readFileOrNull, restoreJsonSetting, withUserConfigLock } from "./user-config.js";
 import { isDeepStrictEqual } from "node:util";
-import { grokAuthPlan, grokAuthStatus, grokAuthPane, GROK_MODEL_DEFAULTS, realGrokHome, resolveAndValidateGrokAuth, assertGrokModelAvailable, grokModelChoices, grokModelFromFooter, grokFooterModelName, grokModelDefaultsFromBody, restoreGrokModelDefaults, grokEventsTranscript, latestGrokCompletion, grokTurnSettled, observeGrokDone, buildGrokAgentCmd, grokLaunchNote, grokEnvTokens, grokTuiReady, grokTuiBusy, grokPaneObservation, grokRateLimitDialog, grokPromptAwaitingAccept, grokUnacceptedPromptRestored, grokStartupAction, grokLaunchBlockingDialog, assertGrokSandboxNotRejected, GROK_COMPOSER_MARKER_RE, grokFooterHasConfiguration, grokTranscriptText, createGrokAgentMetadata, } from "./harnesses/grok.js";
-import { codexAuthPlan, codexAuthStatus, codexAuthPane, realCodexHome, readCodexConfigPins, bindCodexTranscriptSession, latestCodexCompletion, codexTurnSettled, codexRunningTurn, observeCodexDone, buildCodexAgentCmd, codexLaunchNote, codexTuiReady, codexPaneObservation, codexTuiBusy, codexHelperProcess, codexRateLimitModelSwitchDialog, codexApprovalDialog, codexStartupAction, CODEX_COMPOSER_MARKER_RE, codexModelChoice, codexEffortChoice, codexMoreReasoningChoice, codexTranscriptText, createCodexAgentMetadata, codexModelChoices, codexFastCommandOffered, codexFooterShowsFast, codexServiceTierNotices, restoreCodexDefaults, restoreCodexDefaultInFile, } from "./harnesses/codex.js";
-import { claudeAuthPlan, claudeAuthStatus, claudeAuthPane, OPERATION_ID_RE, CLAUDE_RESULT_MAX_BYTES, CLAUDE_EFFORTS, agentManagedClaudeSettingsPath, agentClaudeResultPath, agentClaudeOperationPath, agentClaudeApprovalReceiptPath, agentClaudeDispatchReceiptPath, validateOperationId, readClaudeResultText, assertClaudeAuthenticationReady, claudeModelChoices, claudeConfigDir, claudeFastIndicatorShown, claudeFastResult, buildClaudeAgentCmd, claudeLaunchNote, claudeTuiReady, claudePaneObservation, claudeUsageLimit, claudeLiveSelectMenu, claudeModelPicker, claudeModelPickerRow, claudeModelSwitchConfirm, claudeModelSwitchResult, claudeStartupAction, claudeLoginMethodMenu, CLAUDE_COMPOSER_MARKER_RE, createClaudeAgentMetadata, claudeSessionTranscriptPath, claudeApiErrorFromLine, claudeApiErrorAfter, } from "./harnesses/claude.js";
-import { cursorAuthPlan, cursorAuthStatus, cursorAuthPane, bindCursorTranscriptSession, cursorTurnBoundary, latestCursorCompletion, observeCursorDone, cursorTranscriptText, assertCursorAuthenticationReady, assertCursorModelAvailable, cursorModelChoices, cursorModelIsFastVariant, cursorFastParameter, cursorHeaderShowsFast, cursorPickerView, cursorEffortSelected, cursorParameterRows, cursorUserConfigPath, CURSOR_DEFAULT_MODEL_KEYS, realCursorHome, buildCursorAgentCmd, cursorAgentArgv, cursorPwshArgv, cursorPwshLaunchLine, cursorPromptWithLineage, createCursorAgentMetadata, cursorLaunchNote, cursorEffortNavigation, cursorTuiReady, cursorPaneObservation, cursorPromptHooksRunning, cursorUsageLimit, CURSOR_SUBMIT_SEQUENCE, CURSOR_COMPOSER_CONTENT_MARKER_RE, validateCursorModelEffort, } from "./harnesses/cursor.js";
+import { grokAuthPlan, grokAuthStatus, grokAuthPane, GROK_MODEL_DEFAULTS, realGrokHome, resolveAndValidateGrokAuth, assertGrokModelAvailable, grokModelChoices, grokModelFromFooter, grokFooterModelName, grokModelDefaultsFromBody, restoreGrokModelDefaults, grokEventsTranscript, latestGrokCompletion, grokTurnSettled, observeGrokDone, buildGrokAgentCmd, grokLaunchNote, grokEnvTokens, grokTuiReady, grokTuiBusy, grokPaneObservation, GROK_INTERRUPT_KEY, grokRateLimitDialog, grokPromptAwaitingAccept, grokUnacceptedPromptRestored, grokStartupAction, grokLaunchBlockingDialog, assertGrokSandboxNotRejected, GROK_COMPOSER_MARKER_RE, grokFooterHasConfiguration, grokTranscriptText, createGrokAgentMetadata, } from "./harnesses/grok.js";
+import { codexAuthPlan, codexAuthStatus, codexAuthPane, realCodexHome, readCodexConfigPins, bindCodexTranscriptSession, latestCodexCompletion, codexTurnSettled, codexRunningTurn, codexInterruptionRecord, observeCodexDone, buildCodexAgentCmd, codexLaunchNote, codexTuiReady, codexPaneObservation, CODEX_INTERRUPT_KEY, codexTuiBusy, codexHelperProcess, codexRateLimitModelSwitchDialog, codexApprovalDialog, codexStartupAction, CODEX_COMPOSER_MARKER_RE, codexModelChoice, codexEffortChoice, codexMoreReasoningChoice, codexTranscriptText, createCodexAgentMetadata, codexModelChoices, codexFastCommandOffered, codexFooterShowsFast, codexServiceTierNotices, restoreCodexDefaults, restoreCodexDefaultInFile, } from "./harnesses/codex.js";
+import { claudeAuthPlan, claudeAuthStatus, claudeAuthPane, OPERATION_ID_RE, CLAUDE_RESULT_MAX_BYTES, CLAUDE_EFFORTS, agentManagedClaudeSettingsPath, agentClaudeResultPath, agentClaudeOperationPath, agentClaudeApprovalReceiptPath, agentClaudeDispatchReceiptPath, validateOperationId, readClaudeResultText, assertClaudeAuthenticationReady, claudeModelChoices, claudeConfigDir, claudeFastIndicatorShown, claudeFastResult, buildClaudeAgentCmd, claudeLaunchNote, claudeTuiReady, claudePaneObservation, CLAUDE_INTERRUPT_KEY, claudeUsageLimit, claudeLiveSelectMenu, claudeModelPicker, claudeModelPickerRow, claudeModelSwitchConfirm, claudeModelSwitchResult, claudeStartupAction, claudeLoginMethodMenu, CLAUDE_COMPOSER_MARKER_RE, createClaudeAgentMetadata, claudeSessionTranscriptPath, claudeApiErrorFromLine, claudeApiErrorAfter, } from "./harnesses/claude.js";
+import { cursorAuthPlan, cursorAuthStatus, cursorAuthPane, bindCursorTranscriptSession, cursorTurnBoundary, latestCursorCompletion, observeCursorDone, cursorTranscriptText, assertCursorAuthenticationReady, assertCursorModelAvailable, cursorModelChoices, cursorModelIsFastVariant, cursorFastParameter, cursorHeaderShowsFast, cursorPickerView, cursorEffortSelected, cursorParameterRows, cursorUserConfigPath, CURSOR_DEFAULT_MODEL_KEYS, realCursorHome, buildCursorAgentCmd, cursorAgentArgv, cursorPwshArgv, cursorPwshLaunchLine, cursorPromptWithLineage, createCursorAgentMetadata, cursorLaunchNote, cursorEffortNavigation, cursorTuiReady, cursorPaneObservation, CURSOR_INTERRUPT_KEY, cursorPromptHooksRunning, cursorUsageLimit, CURSOR_SUBMIT_SEQUENCE, CURSOR_COMPOSER_CONTENT_MARKER_RE, validateCursorModelEffort, } from "./harnesses/cursor.js";
 import { interimFromNow, readInterimWords, recordInterimBoundary } from "./interim-words.js";
 import { codexSeatTurn, observeSteerDone, readSteerEntry, recordSteer } from "./steer-follow.js";
 import { resolveAgentBin, resolveThroughlineBin, runThroughlineHandoffContext, isWindowsNativeExecutable, agentBinForPaneShell, resolveWinPaneShell } from "./agent-resolver.js";
@@ -191,7 +197,7 @@ export function termiosIsCooked(sttyOutput) {
     return tokens.includes("icanon") || tokens.includes("echo");
 }
 function paneTtyOf(name) {
-    const r = tmux("display-message", "-p", "-t", name, "#{pane_tty}");
+    const r = tmux("display-message", "-p", "-t", `=${name}:`, "#{pane_tty}");
     if (r.code !== 0)
         return null;
     const tty = r.stdout.trim();
@@ -203,6 +209,7 @@ function paneTtyOf(name) {
  * agent が tty 上に実在しない時は触らない（ready gate が入力受付不能として止める）。
  */
 export async function ensureAgentOwnsPaneInput(name, kind) {
+    assertExecutionContext(name);
     if (isWin)
         return [];
     const tty = paneTtyOf(name);
@@ -240,6 +247,13 @@ export async function ensureAgentOwnsPaneInput(name, kind) {
         const ttyFlag = process.platform === "linux" ? "-F" : "-f";
         const stty = spawnSync("/bin/stty", [ttyFlag, tty, "-a"], { encoding: "utf8", timeout: 5000, env: psEnv });
         if (stty.status === 0 && termiosIsCooked(stty.stdout ?? "")) {
+            // stty is a native mutation outside tmux's command gate. Recheck the
+            // captured device and the shared request generation/fence immediately
+            // before dispatch; a replaced pane must not inherit the old tty repair.
+            beforeExecutionEffect(name, () => {
+                if (paneTtyOf(name) !== tty)
+                    throw new ExecutionError("EXECUTION_STALE_GENERATION");
+            });
             const set = spawnSync("/bin/stty", [ttyFlag, tty, "raw", "-echo"], { encoding: "utf8", timeout: 5000, env: psEnv });
             if (set.status !== 0) {
                 throw new AitermError(`AGENT_TTY_COOKED session=${name}\n` +
@@ -667,6 +681,7 @@ function rtkRewrite(text) {
 // WSL launcher (bash.exe) に解決されてしまうため、Git for Windows の bash.exe を
 // 明示解決する（WSL 非依存の裁定に従う）。AITERM_BASH で上書き可。
 export function openSession(name, shell = "bash", envVars = []) {
+    assertExecutionContext(name);
     shell = resolveWinPaneShell(shell);
     for (const key of envVars) {
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
@@ -823,6 +838,7 @@ function prepareSendText(text, o) {
     return text;
 }
 export function send(name, text, o = {}) {
+    assertExecutionContext(name);
     assertSessionName(name);
     const enter = o.enter ?? true;
     if (!sessionExists(name))
@@ -948,10 +964,20 @@ export function send(name, text, o = {}) {
     }
 }
 export function sendKey(name, key, o = {}) {
+    const result = sendKeyResult(name, key, o);
+    return `sent key ${result.key} to ${result.session_id}`;
+}
+/** Native transport acknowledgement only. This does not observe a turn stop,
+ * a launch/conversation identity, or permission to retry a failed delivery.
+ */
+export function sendKeyResult(name, key, o = {}) {
+    assertExecutionContext(name);
     assertSessionName(name);
     if (!sessionExists(name))
         throw new AitermError(`session '${name}' が無い`, 2);
     const k = KEYMAP[key.toLowerCase()] ?? key;
+    const receipt = () => ({ schema: "aiterm.pty-key-result.v1", session_id: name, key: k,
+        outcome: "accepted", interruption: "unconfirmed", session_preserved: "unconfirmed" });
     if (!o.preserveAgentOperation && managedClaudeOperation(name) !== undefined && k !== "C-c") {
         throw new AitermError("aiterm相関付きClaude agent sessionではturn相関を壊さないC-cだけをpty_keyで送れます。" +
             "他の対話操作はpty_send（自動dispatch）、終了はpty_closeを使ってください。", 2);
@@ -964,10 +990,303 @@ export function sendKey(name, key, o = {}) {
             raw: true,
             preserveAgentOperation: o.preserveAgentOperation,
         });
-        return `sent key ${k} to ${name}`;
+        return receipt();
+    }
+    const result = tmux("send-keys", "-t", name, k);
+    if (result.code !== 0)
+        throw new AitermError("制御キー送信を確認できません。自動再送やcloseへの切替はしていません。", 2);
+    return receipt();
+}
+// Interrupt needs the recorded harness/name/launch, not auth readiness or
+// transcript/operation proof. An expired login must not block the cancel key.
+function readInterruptionTarget(name) {
+    try {
+        const files = fs.readdirSync(agentsDir()).filter(file => file.startsWith(name + ".") && file.endsWith(".agent.json"));
+        if (files.length !== 1)
+            return null;
+        const meta = JSON.parse(fs.readFileSync(path.join(agentsDir(), files[0]), "utf8"));
+        return meta.aiterm_session === name && ["codex", "claude", "cursor", "grok"].includes(meta.kind)
+            && typeof meta.launch_id === "string" && LAUNCH_ID_RE.test(meta.launch_id) ? { kind: meta.kind, launch_id: meta.launch_id } : null;
+    }
+    catch {
+        return null;
     }
-    tmux("send-keys", "-t", name, k);
-    return `sent key ${k} to ${name}`;
+}
+/** Immediate stop-button operation. No run/actor/claim journal or completion
+ * proof is required to send the harness's normal cancel key. The native session ID prevents a same-name
+ * replacement from receiving the key. This never closes or clears a session. */
+export function interruptSessionNow(name, expectedLaunchId) {
+    assertSessionName(name);
+    const listing = observeExecutionNativeSessions();
+    if (listing.state !== "known")
+        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+    const native = listing.sessions.find(session => session.session_id === name);
+    if (!native)
+        return { session_id: name, outcome: "idle" };
+    const meta = readInterruptionTarget(name);
+    if (!meta || !["codex", "claude", "cursor", "grok"].includes(meta.kind))
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const key = meta.kind === "codex" ? CODEX_INTERRUPT_KEY : meta.kind === "claude" ? CLAUDE_INTERRUPT_KEY
+        : meta.kind === "cursor" ? CURSOR_INTERRUPT_KEY : GROK_INTERRUPT_KEY;
+    // A normal Ctrl+C can quit an idle CLI. Use its existing immediate pane
+    // observation, never repeated Ctrl+C or kill as an escalation.
+    if (key === "C-c") {
+        const screen = captureScreen(name, AGENT_TUI_READY_LINES);
+        const state = (meta.kind === "cursor" ? cursorPaneObservation(screen) : grokPaneObservation(screen)).state;
+        if (state === "idle")
+            return { session_id: name, outcome: "idle" };
+        if (state !== "busy")
+            throw new ExecutionError("EXECUTION_UNCONFIRMED");
+    }
+    return withExecutionInterruptEffectScope(name, native.native_id, () => {
+        if (expectedLaunchId && readInterruptionTarget(name)?.launch_id !== expectedLaunchId)
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+    }, () => {
+        bindExecutionNativeTarget(name, native.native_id);
+        beforeExecutionEffect(name);
+        const result = tmux("send-keys", "-t", native.native_id, key);
+        if (result.code !== 0)
+            throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+        return { schema: "aiterm.pty-key-result.v1", session_id: name, key, outcome: "accepted",
+            interruption: "unconfirmed", session_preserved: "unconfirmed" };
+    }, key);
+}
+export function interruptionLaunchId(name) {
+    assertSessionName(name);
+    return readInterruptionTarget(name)?.launch_id ?? null;
+}
+/** Private minimal harness primitive. The caller already owns the current
+ * run's native admission frame. No public pty_key guard bypass is exposed to
+ * Bridge/model args, and agent_stop remains disconnected until preservation
+ * and interruption/fence evidence are implemented. Never close or retry.
+ */
+export function interruptExpectedAgentRun(input) {
+    const point = executionPointSchema.parse(input), name = point.launch.session_id;
+    assertExecutionContext(name);
+    if (!point.boundary)
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const verifyRun = (meta) => {
+        if (meta.kind === "codex") {
+            if (!point.boundary.turn_id)
+                throw new ExecutionError("EXECUTION_UNSUPPORTED");
+            const record = codexInterruptionRecord(meta);
+            if (!record)
+                throw new ExecutionError("EXECUTION_UNSUPPORTED");
+            if (record.boundary.type !== "task_started" || record.boundary.turn_id !== point.boundary.turn_id)
+                throw new ExecutionError("EXECUTION_CONFLICT");
+            return record;
+        }
+        else if (meta.kind === "claude") {
+            const marker = readClaudeOperationMarker(meta);
+            if (!matchesClaudeInterruptionMarker(marker, point))
+                throw new ExecutionError("EXECUTION_UNSUPPORTED");
+            // Anonymous identity is the v2 marker's original reservation, not a
+            // native turn. Keep its file identity stable through the physical gate.
+            return marker.operationId === null ? observeManagedClaudeInterruption(point) : marker;
+        }
+        else
+            throw new ExecutionError("EXECUTION_UNSUPPORTED"); // no guessed C-c/Esc for Cursor/Grok
+    };
+    const current = () => {
+        const observed = observeExecutionSessionGeneration(name);
+        if (!observed.exists || !observed.launch_id)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        if (observed.launch_id !== point.launch.launch_id)
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+        const meta = loadAgentMetadata(name);
+        if (meta.launch_id !== point.launch.launch_id)
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+        const run = verifyRun(meta);
+        const process = observeExecutionParentProcess(name);
+        const actor = process?.harness_process;
+        if (process?.schema !== "aiterm.execution-parent-process.v1" || !isDeepStrictEqual(process.source?.launch, point.launch)
+            || process.harness !== agentHarness(meta.kind) || !actor || !Number.isSafeInteger(actor.pid) || actor.pid < 1
+            || !Number.isFinite(Date.parse(actor.started_identity)) || !meta.execution_native)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        const after = observeExecutionSessionGeneration(name), last = loadAgentMetadata(name);
+        if (!after.exists || after.launch_id !== point.launch.launch_id || last.kind !== meta.kind
+            || !isDeepStrictEqual(last.execution_native, meta.execution_native))
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+        if (!isDeepStrictEqual(verifyRun(last), run))
+            throw new ExecutionError("EXECUTION_CONFLICT");
+        return { actor, native: meta.execution_native, kind: meta.kind, run };
+    };
+    const before = current();
+    bindExecutionNativeTarget(name, before.native.native_id);
+    beforeExecutionEffect(name, () => {
+        if (!isDeepStrictEqual(current(), before))
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+    });
+    // This address came from the same expected-generation native stamp, rather
+    // than a reusable name. Claude's operation marker is read, never cleared.
+    const result = tmux("send-keys", "-t", before.native.native_id, "Escape");
+    if (result.code !== 0)
+        throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+    return { schema: "aiterm.pty-key-result.v1", session_id: name, key: "Escape", outcome: "accepted",
+        interruption: "unconfirmed", session_preserved: "unconfirmed" };
+}
+/** Private, read-only native record/identity evidence. This is deliberately not
+ * an agent_stop result or finish proof. Even an exact native abort plus stable
+ * observed identities does not establish the old invocation/parent-return
+ * fence, or prevent a concurrent endpoint switch after these observations.
+ */
+export function observeExpectedAgentRunInterruption(input) {
+    const point = executionPointSchema.parse(input), name = point.launch.session_id;
+    if (point.boundary && !point.boundary.turn_id && !point.boundary.steer_id
+        && loadAgentMetadata(name).kind === "claude")
+        return observeManagedClaudeInterruption(point);
+    if (!point.boundary?.turn_id)
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const snapshot = () => {
+        const generation = observeExecutionSessionGeneration(name), meta = loadAgentMetadata(name);
+        if (!generation.exists || !generation.launch_id || !meta.execution_native)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        if (generation.launch_id !== point.launch.launch_id || meta.launch_id !== point.launch.launch_id)
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+        if (meta.kind !== "codex")
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        const process = observeExecutionParentProcess(name);
+        const actor = process?.harness_process, record = codexInterruptionRecord(meta);
+        if (process?.schema !== "aiterm.execution-parent-process.v1" || !isDeepStrictEqual(process.source?.launch, point.launch)
+            || process.harness !== "codex-cli" || !actor || !Number.isSafeInteger(actor.pid) || actor.pid < 1
+            || !Number.isFinite(Date.parse(actor.started_identity)) || !record)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        const after = observeExecutionSessionGeneration(name), last = loadAgentMetadata(name);
+        if (!after.exists || after.launch_id !== point.launch.launch_id || last.kind !== meta.kind
+            || !isDeepStrictEqual(last.execution_native, meta.execution_native))
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+        return { native: meta.execution_native, actor, record };
+    };
+    const before = snapshot(), after = snapshot();
+    if (!isDeepStrictEqual(before, after))
+        throw new ExecutionError("EXECUTION_CONFLICT");
+    const boundary = after.record.boundary;
+    const state = boundary.turn_id !== point.boundary.turn_id ? "other_run"
+        : boundary.type === "turn_aborted" && boundary.reason === "interrupted" ? "interrupted"
+            : boundary.type === "task_started" ? "running" : boundary.type === "task_complete" ? "completed" : "unconfirmed";
+    return { schema: "aiterm.native-interruption-observation.v1", run: point,
+        native: after.native, harness: "codex-cli", harness_process: after.actor,
+        endpoint: { session_id: after.record.session_id, record_file: after.record.file },
+        recorded_state: state, native_boundary: boundary,
+        invocation_fence: "unknown", session_preserved: "unconfirmed" };
+}
+/** Existing Aiterm managed-operation provenance, not a native processing-start
+ * or interruption proof. Reservation/receipt creation precedes input sending;
+ * neither a marker nor its removal proves the CLI accepted or aborted it.
+ * Keep the caller's original Point/cursor, never the current event-file size,
+ * cached vendor conversation ID, latest job or another managed operation.
+ */
+function matchesClaudeInterruptionMarker(marker, point) {
+    const boundary = point.boundary;
+    return !!marker && !!boundary && boundary.turn_id === null && boundary.steer_id === null
+        && marker.operationId === boundary.operation_id
+        && (marker.operationId !== null || marker.eventCursor !== null)
+        && (marker.eventCursor === null || marker.eventCursor === boundary.event_cursor);
+}
+function observeManagedClaudeInterruption(point) {
+    const name = point.launch.session_id, operation = point.boundary?.operation_id;
+    if (!point.boundary || point.boundary.turn_id !== null || point.boundary.steer_id !== null)
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const files = (meta) => {
+        const marker = agentClaudeOperationPath(name, point.launch.launch_id);
+        const receipt = operation ? agentClaudeDispatchReceiptPath(name, point.launch.launch_id, operation) : null;
+        const identity = (file, empty) => {
+            const stat = fs.lstatSync(file, { bigint: true });
+            if (!stat.isFile() || (empty && stat.size !== 0n) || !Number.isSafeInteger(Number(stat.dev)) || !Number.isSafeInteger(Number(stat.ino)))
+                throw new ExecutionError("EXECUTION_UNSUPPORTED");
+            return { device: Number(stat.dev), inode: Number(stat.ino), size: stat.size, mtime: stat.mtimeNs, ctime: stat.ctimeNs };
+        };
+        try {
+            const before = { marker: identity(marker, false), receipt: receipt ? identity(receipt, true) : null };
+            if (!matchesClaudeInterruptionMarker(readClaudeOperationMarker(meta), point))
+                throw new ExecutionError("EXECUTION_UNSUPPORTED");
+            const after = { marker: identity(marker, false), receipt: receipt ? identity(receipt, true) : null };
+            if (!isDeepStrictEqual(before, after))
+                throw new ExecutionError("EXECUTION_CONFLICT");
+            return after;
+        }
+        catch (error) {
+            if (error instanceof ExecutionError)
+                throw error;
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        }
+    };
+    const snapshot = () => {
+        const generation = observeExecutionSessionGeneration(name), meta = loadAgentMetadata(name);
+        if (!generation.exists || !generation.launch_id || meta.kind !== "claude" || !meta.execution_native)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        if (generation.launch_id !== point.launch.launch_id || meta.launch_id !== point.launch.launch_id)
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+        const beforeFiles = files(meta);
+        const process = observeExecutionParentProcess(name);
+        const actor = process?.harness_process;
+        if (process?.schema !== "aiterm.execution-parent-process.v1" || !isDeepStrictEqual(process.source?.launch, point.launch)
+            || process.harness !== "claude-code" || !actor || !Number.isSafeInteger(actor.pid) || actor.pid < 1
+            || !Number.isFinite(Date.parse(actor.started_identity)))
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        const after = observeExecutionSessionGeneration(name), last = loadAgentMetadata(name);
+        if (!after.exists || after.launch_id !== point.launch.launch_id || last.kind !== meta.kind
+            || !isDeepStrictEqual(last.execution_native, meta.execution_native))
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+        const afterFiles = files(last);
+        if (!isDeepStrictEqual(beforeFiles, afterFiles))
+            throw new ExecutionError("EXECUTION_CONFLICT");
+        return { native: meta.execution_native, actor, files: afterFiles };
+    };
+    const before = snapshot(), after = snapshot();
+    if (!isDeepStrictEqual(before, after))
+        throw new ExecutionError("EXECUTION_CONFLICT");
+    const reference = (file) => ({ device: file.device, inode: file.inode });
+    const common = { run: point, native: after.native, harness: "claude-code", harness_process: after.actor,
+        recorded_state: "unconfirmed", invocation_fence: "unknown", session_preserved: "unconfirmed" };
+    if (!operation)
+        return { ...common, schema: "aiterm.claude-anonymous-interruption-observation.v1",
+            endpoint: { session_id: null, operation_marker: reference(after.files.marker), dispatch_receipt: null },
+            native_boundary: { type: "anonymous_turn_reserved", event_cursor: point.boundary.event_cursor },
+            marker_protocol: "aiterm.claude-operation-marker.v2", loaded_hook: "unconfirmed" };
+    return { ...common, schema: "aiterm.claude-managed-interruption-observation.v1",
+        endpoint: { session_id: null, operation_marker: reference(after.files.marker), dispatch_receipt: reference(after.files.receipt) },
+        native_boundary: { type: "managed_operation_reserved", operation_id: operation } };
+}
+/** Select the current native run for an explicit expected launch. The cursor
+ * is the existing native rollout's task_started byte boundary, NOT an alias for a
+ * dispatch/before_send receipt. Callers must retain that distinction; the
+ * cascade controller reports missing canonical aliases rather than rekeying.
+ * No metadata update, native key, latest-job lookup or cached vendor fallback.
+ */
+export function selectExpectedAgentRunInterruption(input, candidates) {
+    const launch = executionPointSchema.shape.launch.parse(input), name = launch.session_id;
+    const generation = observeExecutionSessionGeneration(name), meta = loadAgentMetadata(name);
+    if (!generation.exists || !generation.launch_id)
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    if (generation.launch_id !== launch.launch_id || meta.launch_id !== launch.launch_id)
+        throw new ExecutionError("EXECUTION_STALE_GENERATION");
+    if (meta.kind === "claude") {
+        const marker = readClaudeOperationMarker(meta);
+        if (!marker)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        const references = executionPointSchema.array().parse(candidates ? Array.isArray(candidates) ? candidates : [candidates] : []);
+        const point = references.find(value => isDeepStrictEqual(value.launch, launch) && matchesClaudeInterruptionMarker(marker, value));
+        if (!point)
+            throw new ExecutionError("EXECUTION_UNSUPPORTED");
+        // An existing operation receipt can supply its own canonical boundary.
+        // Pick a matching recorded reference, not a latest job or inferred native
+        // alias. Other work/Points do not veto Esc; unresolved aliases stay open.
+        // This managed reservation is still unconfirmed, never native running.
+        return observeManagedClaudeInterruption(point);
+    }
+    if (meta.kind !== "codex")
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const record = codexInterruptionRecord(meta);
+    if (!record || record.boundary.type !== "task_started")
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    const point = { launch, boundary: { event_cursor: record.event_cursor,
+            turn_id: record.boundary.turn_id, operation_id: null, steer_id: null } };
+    const observation = observeExpectedAgentRunInterruption(point);
+    const last = codexInterruptionRecord(loadAgentMetadata(name));
+    if (!isDeepStrictEqual(last, record) || observation.recorded_state !== "running")
+        throw new ExecutionError("EXECUTION_CONFLICT");
+    return observation;
 }
 // end 以下で最大の UTF-8 文字境界を返す（B3）。末尾が不完全なマルチバイト列なら、その開始位置まで
 // 戻す。pipe-pane が多バイト文字の途中でフラッシュした瞬間の増分読みで先頭/末尾が U+FFFD 化するのを防ぐ。
@@ -1328,6 +1647,56 @@ export function observeSession(name, cursor) {
     };
     return result;
 }
+/** Internal generation admission read: same strict session listing/managed
+ * metadata as observeSession, without screen or OS-process activity sampling.
+ * No public tool is added. Call synchronously immediately before an effect.
+ */
+export function observeSessionGeneration(name) {
+    assertSessionName(name);
+    const exists = listSessionsResult().sessions.some(session => session.session_id === name);
+    return { schema: "aiterm.pty-observe-result.v1", session_id: name, exists,
+        launch_id: exists ? tryLoadAgentMetadata(name)?.launch_id ?? null : null };
+}
+/** Private guarded-runtime read. Legacy metadata without an original native
+ * creator stamp remains a present but unverified generation, never enrolled
+ * from a current same-name PID or cached vendor session.
+ */
+export function observeExecutionSessionGeneration(name) {
+    assertSessionName(name);
+    const result = (exists, launch_id) => ({ schema: "aiterm.pty-observe-result.v1",
+        session_id: name, exists, launch_id });
+    const before = observeExecutionNativeCreationScope();
+    if (before.state !== "known")
+        throw new ExecutionError("EXECUTION_UNCONFIRMED");
+    const native = before.sessions.find(value => value.session_id === name);
+    if (!native)
+        return result(false, null);
+    const meta = tryLoadAgentMetadata(name), proof = meta?.execution_native;
+    if (!meta || !proof || !before.server || proof.native_id !== native.native_id
+        || !isDeepStrictEqual(proof.server, before.server))
+        return result(true, null);
+    const after = observeExecutionNativeCreationScope(), last = tryLoadAgentMetadata(name);
+    if (after.state !== "known" || !isDeepStrictEqual(after.server, proof.server)
+        || after.sessions.find(value => value.session_id === name)?.native_id !== proof.native_id
+        || last?.launch_id !== meta.launch_id || !isDeepStrictEqual(last.execution_native, proof))
+        return result(true, null);
+    return result(true, meta.launch_id);
+}
+/** Private source-provenance snapshot. It deliberately omits screen, argv,
+ * environment and cached vendor_session_id. No public tool is added. The
+ * consumer proves its native serving MCP process descends from this unique
+ * harness in this same process table, and separately verifies the endpoint.
+ */
+export function observeExecutionParentProcess(name) {
+    assertSessionName(name);
+    return readExecutionParentProcess(name, {
+        present: () => listSessionsResult().sessions.some(session => session.session_id === name),
+        metadata: () => tryLoadAgentMetadata(name),
+        pane: () => tmux("display-message", "-p", "-t", name, "#{pane_pid}\t#{pane_dead}"),
+        processes: readRuntimeProcesses,
+        select: (meta, rows, pid) => ({ harness: agentHarness(meta.kind), processes: selectHarnessProcesses(meta, rows, processSubtree(rows, pid)) }),
+    });
+}
 export function listSessionsResult(envKeys = []) {
     for (const key of envKeys) {
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
@@ -1515,6 +1884,7 @@ function closeSessionInternal(name, observeDependency = true, o = {}) {
     return `closed ${name}`;
 }
 export function closeSession(name) {
+    assertExecutionContext(name);
     return closeSessionInternal(name, true);
 }
 /**
@@ -1525,6 +1895,7 @@ export function closeSession(name) {
  * already_closedとなり、close完了を文字列解析なしで確定できる。
  */
 export function closeSessionResult(name) {
+    assertExecutionContext(name);
     assertSessionName(name);
     const existed = sessionExists(name);
     closeSessionInternal(name, true, { letHarnessExit: true });
@@ -1534,7 +1905,78 @@ export function closeSessionResult(name) {
         outcome: existed ? "closed" : "already_closed",
     };
 }
+/** Cascade-stop adapter only: caller must already own the shared issued close
+ * slot across every serving mutation path. No graceful idle wait, name-only
+ * kill, cleanup of a replacement's metadata, or retry. Not publicly mounted.
+ */
+export function observeExecutionNativeSessions() {
+    const result = tmux("list-sessions", "-F", "#{session_id}\t#{session_name}");
+    if (result.code === 0)
+        return parseExecutionNativeSessions(result.stdout);
+    // A generic connection/list failure cannot prove absence.
+    if (/^no server running on /i.test(result.stderr.trim()))
+        return { state: "known", sessions: [] };
+    return { state: "unknown" };
+}
+/** Existing POSIX server owner plus complete session listing. No screen,
+ * cached generation, new process, server bootstrap or native mutation.
+ */
+export function observeExecutionNativeCreationScope() {
+    if (isWin)
+        return { state: "unknown" };
+    try {
+        const read = () => tmux("list-sessions", "-F", "#{pid}\t#{session_id}\t#{session_name}");
+        const first = read();
+        if (first.code !== 0)
+            return /^no server running on /i.test(first.stderr.trim())
+                ? { state: "known", sessions: [], server: null } : { state: "unknown" };
+        const rows = first.stdout.trim().split(/\r?\n/).filter(Boolean).map(line => line.split("\t"));
+        if (!rows.length)
+            return { state: "known", sessions: [], server: null };
+        const pid = Number(rows[0][0]);
+        if (!Number.isSafeInteger(pid) || pid < 1 || rows.some(row => row.length !== 3 || row[0] !== String(pid)))
+            return { state: "unknown" };
+        const parsed = parseExecutionNativeSessions(rows.map(row => `${row[1]}\t${row[2]}`).join("\n"));
+        if (parsed.state !== "known")
+            return parsed;
+        const before = readProcessIdentities([pid]), afterListing = read(), after = readProcessIdentities([pid]);
+        if (before.length !== 1 || before[0].pid !== pid || !before[0].started_identity || after.length !== 1
+            || after[0].pid !== pid || after[0].started_identity !== before[0].started_identity
+            || afterListing.code !== 0 || afterListing.stdout !== first.stdout)
+            return { state: "unknown" };
+        return { ...parsed, server: { pid, started_identity: before[0].started_identity } };
+    }
+    catch {
+        return { state: "unknown" };
+    }
+}
+/** Own the shared issued close slot before calling this primitive. */
+export function closeExpectedAgentSession(expected) {
+    assertExecutionContext(expected.session_id);
+    const initial = observeExecutionSessionGeneration(expected.session_id);
+    if (initial.exists && initial.launch_id === null)
+        throw new ExecutionError("EXECUTION_UNSUPPORTED");
+    if (initial.exists && initial.launch_id !== expected.launch_id)
+        throw new ExecutionError("EXECUTION_STALE_GENERATION");
+    closeExpectedExecution(expected, {
+        sessions() {
+            const current = observeExecutionSessionGeneration(expected.session_id);
+            if (current.exists && current.launch_id !== expected.launch_id)
+                throw new ExecutionError("EXECUTION_STALE_GENERATION");
+            return observeExecutionNativeCreationScope();
+        },
+        launch(name) {
+            const current = observeExecutionSessionGeneration(name);
+            return current.exists && current.launch_id ? { session_id: name, launch_id: current.launch_id } : null;
+        },
+        kill(nativeId) {
+            bindExecutionNativeTarget(expected.session_id, nativeId);
+            return tmux("kill-session", "-t", nativeId);
+        },
+    });
+}
 export function killAll() {
+    assertExecutionContext(null);
     // agentsはAITERM_STATE_BASEを共有する別socketの席も含み得る。終了対象はこのsocketから確定する。
     const sessions = new Set();
     const listed = tmux("list-sessions", "-F", "#{session_name}");
@@ -1640,6 +2082,8 @@ function createAgentLineageContext(kind, sessionId, seed) {
 }
 export function runAgentApproval(options) {
     const { action, session_id: name, approval_choice: selected, observed_prompt_digest: expected } = options;
+    if (action === "respond")
+        assertExecutionContext(name);
     assertSessionName(name);
     if (action === "inspect" && (selected !== undefined || expected !== undefined))
         throw new AitermError("inspectでは承認選択とdigestを指定できません", 2);
@@ -1710,10 +2154,17 @@ let agentTuiReadyStableSamplesTestOverride = null;
 function writeClaudeOperationMarker(meta, operationId) {
     if (meta.kind !== "claude")
         throw new AitermError("operation_id はClaude agent sessionだけで使用できます", 2);
-    writeJson0600(agentClaudeOperationPath(meta.aiterm_session, meta.launch_id), {
-        schema: "aiterm.claude-operation-marker.v1",
-        operation_id: operationId === null ? null : validateOperationId(operationId),
-    });
+    const operation = operationId === null ? null : validateOperationId(operationId);
+    // Only the same private request frame can supply this anonymous reference.
+    // Unmounted/legacy execution keeps v1; never infer a cursor from file size.
+    const captured = operation === null ? readExecutionSendBoundary(meta.aiterm_session) : null;
+    if (captured && (!isDeepStrictEqual(captured.launch, { session_id: meta.aiterm_session, launch_id: meta.launch_id })
+        || !captured.boundary || captured.boundary.operation_id !== null || captured.boundary.turn_id !== null
+        || captured.boundary.steer_id !== null))
+        throw new ExecutionError("EXECUTION_CONFLICT");
+    withExecutionPreparation(meta.aiterm_session, () => writeJson0600(agentClaudeOperationPath(meta.aiterm_session, meta.launch_id), captured ? {
+        schema: "aiterm.claude-operation-marker.v2", operation_id: null, event_cursor: captured.boundary.event_cursor,
+    } : { schema: "aiterm.claude-operation-marker.v1", operation_id: operation }));
 }
 function readClaudeOperationMarker(meta) {
     if (meta.kind !== "claude")
@@ -1741,14 +2192,12 @@ function readClaudeOperationMarker(meta) {
         catch {
             throw new AitermError("Claude operation markerを読めません", 2);
         }
-        const keys = value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value).sort() : [];
-        if (keys.join(",") !== "operation_id,schema" ||
-            value.schema !== "aiterm.claude-operation-marker.v1" ||
-            (value.operation_id !== null &&
-                (typeof value.operation_id !== "string" || !OPERATION_ID_RE.test(value.operation_id)))) {
+        try {
+            return parseClaudeOperationMarker(value);
+        }
+        catch {
             throw new AitermError("Claude operation markerが不正です", 2);
         }
-        return { operationId: value.operation_id };
     }
     finally {
         fs.closeSync(fd);
@@ -1892,6 +2341,8 @@ function assertExpectedClaudeOperation(meta, expectedOperationId) {
     return active;
 }
 export function runClaudeApproval({ action, session_id: name, operation_id: operationIdInput, approval_choice: approvalChoice, observed_prompt_digest: observedPromptDigest, }) {
+    if (action === "respond")
+        assertExecutionContext(name);
     assertSessionName(name);
     if (!sessionExists(name))
         throw new AitermError(`session '${name}' が無い`, 2);
@@ -2435,7 +2886,13 @@ function loadAgentMetadata(name) {
     const deliveryFields = m.initial_prompt_delivery === undefined ? {} : {
         initial_prompt_delivery: m.initial_prompt_delivery, initial_prompt_cursor: m.initial_prompt_cursor,
     };
-    const executableFields = m.agent_executable === undefined ? {} : { agent_executable: m.agent_executable };
+    const parsedNative = m.execution_native === undefined ? null : executionNativeBindingSchema.safeParse(m.execution_native);
+    if (parsedNative && !parsedNative.success)
+        throw new AitermError("agent native bindingが不正です", 2);
+    const executableFields = {
+        ...(m.agent_executable === undefined ? {} : { agent_executable: m.agent_executable }),
+        ...(parsedNative?.success ? { execution_native: parsedNative.data } : {}),
+    };
     // 席のファストの状態と、起動・設定替えで渡したmodel（ADR 0114）。この項目より前の版が書いた控えには無い。
     const fastFields = {
         ...(typeof m.fast === "boolean" ? { fast: m.fast } : {}),
@@ -3421,7 +3878,11 @@ async function waitAgentTuiReadyImpl(kind, sample, sleepFn, opts = {}) {
         else {
             readyStreak = 0;
             settledStreak = 0;
-            if (isAgentTuiActionRequired(kind, lastScreen))
+            // The one keep-current key can be accepted before the TUI redraws.
+            // Wait for that exact handled modal to disappear; never resend its key.
+            const recoveringModal = opts.codexRateLimitRecovery && kind === "codex"
+                && codexRateLimitModelSwitchDialog(lastScreen) !== null;
+            if (isAgentTuiActionRequired(kind, lastScreen) && !recoveringModal)
                 return { ready: false, samples, lastScreen };
         }
         if (now() >= deadline) {
@@ -3454,7 +3915,7 @@ function agentTurnSettled(meta) {
     return false;
 }
 async function waitAgentTuiReady(name, meta, timeoutMs = AGENT_TUI_READY_TIMEOUT_MS, o = {}) {
-    const result = await waitAgentTuiReadyImpl(meta.kind, () => captureScreen(name, AGENT_TUI_READY_LINES), sleep, { timeoutMs, launchLine: agentLaunchLines.get(name), ...(o.settledTurn ? { turnSettled: () => agentTurnSettled(meta) } : {}) });
+    const result = await waitAgentTuiReadyImpl(meta.kind, () => captureScreen(name, AGENT_TUI_READY_LINES), sleep, { timeoutMs, codexRateLimitRecovery: o.codexRateLimitRecovery, launchLine: agentLaunchLines.get(name), ...(o.settledTurn ? { turnSettled: () => agentTurnSettled(meta) } : {}) });
     if (result.ready)
         agentLaunchLines.delete(name);
     return result;
@@ -3795,6 +4256,7 @@ async function prepareAgentInput(name, meta, options) {
     return { status: "ready", reason: "composer_ready" };
 }
 export async function sendInitialAgentPrompt(name, text, o = {}) {
+    assertExecutionContext(name);
     assertSessionName(name);
     loadAgentMetadata(name);
     // 起動時promptの準備中に届いたpty_sendは、起動時promptを送り終えてから振り分ける（ADR 0088）。
@@ -3824,6 +4286,9 @@ async function sendInitialAgentPromptInLock(name, text, o) {
         prepareSendText(promptText, { raw: false });
         await o.before_send?.({ session_id: name, launch_id: meta.launch_id, vendor: meta.kind,
             harness: agentHarness(meta.kind), event_cursor: startOffset, operation_id: null });
+        captureExecutionSendBoundary({ launch: { session_id: name, launch_id: meta.launch_id }, boundary: {
+                event_cursor: startOffset, operation_id: null, turn_id: null, steer_id: null
+            } });
         if (meta.kind === "claude") {
             prepareSendText(text, { raw: false });
             reserveAnonymousClaudeTurn(meta);
@@ -3972,11 +4437,11 @@ async function recoverCodexRateLimitModelSwitch(name, meta) {
 async function waitAgentTuiReadyAfterCodexRateLimitRecovery(name, meta, timeoutMs, o = {}) {
     let codexRateLimitModelSwitch = await recoverCodexRateLimitModelSwitch(name, meta);
     // 上限のmodalを閉じた直後は、画面が落ち着くのを11回の確かめで待つ。
-    let ready = await waitAgentTuiReady(name, meta, timeoutMs, codexRateLimitModelSwitch ? {} : o);
+    let ready = await waitAgentTuiReady(name, meta, timeoutMs, codexRateLimitModelSwitch ? { codexRateLimitRecovery: true } : o);
     if (!ready.ready && !codexRateLimitModelSwitch) {
         codexRateLimitModelSwitch = await recoverCodexRateLimitModelSwitch(name, meta);
         if (codexRateLimitModelSwitch)
-            ready = await waitAgentTuiReady(name, meta, timeoutMs);
+            ready = await waitAgentTuiReady(name, meta, timeoutMs, { codexRateLimitRecovery: true });
     }
     return { ready, codexRateLimitModelSwitch };
 }
@@ -4069,6 +4534,8 @@ function launchAuthProcess(name, meta) {
  * （別のアカウントへ入り直す時と、期限切れを状態から見抜けない時のため）。資格情報を消すことはせず、置き換えは公式CLIが行う。
  */
 export async function authenticateAgent(kind, options) {
+    if (options.action !== "status" || options.session_id !== undefined)
+        assertExecutionContext(options.session_id);
     const result = (status, session, message, pane) => ({ schema: "aiterm.agent-auth-result.v1", harness: agentHarness(kind),
         status, session_id: session, url: pane?.url ?? null, user_code: pane?.user_code ?? null,
         input_required: pane?.input_required ?? false, message: message ?? pane?.message ?? null });
@@ -4891,6 +5358,7 @@ async function applyLaunchFast(name, meta) {
     }
 }
 export async function configureAgent(name, opts) {
+    assertExecutionContext(name);
     assertSessionName(name);
     const model = opts.model?.trim() || null;
     const effort = opts.reasoning_effort?.trim() || null;
@@ -4941,8 +5409,10 @@ async function configureAgentInLock(name, model, effort, fast) {
     const rememberModel = () => {
         if (!model)
             return;
-        meta.model = model;
-        writeAgentMetadata(meta);
+        withExecutionPreparation(name, () => {
+            meta.model = model;
+            writeAgentMetadata(meta);
+        });
     };
     // fast: true は、modelやeffortを替える前に対応を確かめる（断る時は何も変えない）。
     let fastVerified = false;
@@ -5222,6 +5692,7 @@ async function assertCursorPromptNotHookBlocked(name) {
     } while (performance.now() < deadline || (performance.now() < hookDeadline && cursorPromptHooksRunning(screen)));
 }
 export async function dispatchAgentTurn(name, text, o = {}) {
+    assertExecutionContext(name);
     assertSessionName(name);
     loadAgentMetadata(name);
     return withAgentSendLock(name, () => dispatchAgentTurnInLock(name, text, o));
@@ -5309,6 +5780,9 @@ async function dispatchAgentTurnInLock(name, text, o) {
     prepareSendText(dispatchText, { raw: o.raw });
     await o.before_send?.({ session_id: name, launch_id: meta.launch_id, vendor: meta.kind,
         harness: agentHarness(meta.kind), event_cursor: startOffset, operation_id: operationId });
+    captureExecutionSendBoundary({ launch: { session_id: name, launch_id: meta.launch_id }, boundary: {
+            event_cursor: startOffset, operation_id: operationId, turn_id: null, steer_id: null
+        } });
     recordInterimBoundary(meta, startOffset, operationId);
     if (meta.kind === "claude") {
         // durable／anonymousを分岐する前に同じsend preflightを通す。拒否されるpromptの
@@ -5462,6 +5936,7 @@ async function clearClaudeSelectMenuBeforeInput(name) {
  * 同じsessionへの送信は1本ずつ通し、重なった後の1通は前の1通が終わってから振り分け直す（ADR 0088）。
  */
 export async function sendAgentMessage(name, text, o = {}) {
+    assertExecutionContext(name);
     assertSessionName(name);
     loadAgentMetadata(name);
     // 前置きは、順番待ちにも入力受付の待ちにも入る前に確かめる（外れた時に待たせない）。
@@ -5596,6 +6071,8 @@ async function steerRunningTurn(name, meta, text, o) {
     return receipt;
 }
 export async function runClaudeOperation({ session_id: name, action, operation_id: operationIdInput, text, before_send, }) {
+    if (action === "issue")
+        assertExecutionContext(name);
     assertSessionName(name);
     if (action !== "issue" && action !== "recover") {
         throw new AitermError('action は "issue" または "recover" を指定してください', 2);
@@ -5802,6 +6279,7 @@ function existingAgentLaunchResult(kind, sid, model, effort) {
     ];
 }
 export function openAgent(kind, opts = {}) {
+    assertExecutionContext(opts.session_name);
     const label = agentLabel(kind);
     // 前提検証は session を作る前に全部済ませる（失敗の残骸 session を作らない）。
     // model/effort → bin → cwd の順: model/effort 検証は CLI 不在の端末でも同じ結果になる（テスト可能性）。
@@ -5942,23 +6420,37 @@ export function openAgent(kind, opts = {}) {
     let launchNote = "";
     try {
         const lineageContext = createAgentLineageContext(kind, sid, lineageSeed);
-        const meta = agentDone
-            ? kind === "claude"
-                ? createClaudeAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", launchOperationId, launchRequestDigest, lineageContext, model, effort)
-                : kind === "codex"
-                    ? createCodexAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", { model, effort }, writeScope, lineageContext)
-                    : kind === "cursor"
-                        ? createCursorAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", writeScope, lineageContext)
-                        : createGrokAgentMetadata(kind, sid, cwd, opts.prompt ? "pending" : "none", grokAuthPath, writeScope, lineageContext)
-            : null;
-        if (meta) {
-            meta.agent_executable = bin;
-            // 席は通常の速度で始まる（Claude Code・Codexは起動の引数で明示する）。fast版のmodel IDで起こした時だけtrue。
-            meta.fast = opts.fast_state === true;
-            meta.model = opts.base_model !== undefined ? opts.base_model : model;
-            writeAgentMetadata(meta);
-            agentMetadataNegativeCache.delete(sid);
-        }
+        if (hasExecutionCreationScope())
+            beforeExecutionEffect(sid);
+        const meta = withExecutionPreparation(sid, () => {
+            const meta = agentDone
+                ? kind === "claude"
+                    ? createClaudeAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", launchOperationId, launchRequestDigest, lineageContext, model, effort)
+                    : kind === "codex"
+                        ? createCodexAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", { model, effort }, writeScope, lineageContext)
+                        : kind === "cursor"
+                            ? createCursorAgentMetadata(sid, cwd, opts.prompt ? "pending" : "none", writeScope, lineageContext)
+                            : createGrokAgentMetadata(kind, sid, cwd, opts.prompt ? "pending" : "none", grokAuthPath, writeScope, lineageContext)
+                : null;
+            if (meta) {
+                // Metadata constructors publish their internally generated launch ID.
+                // Stamp its exact native creator before binding and any later input.
+                if (hasExecutionCreationScope())
+                    meta.execution_native = executionCreatedNativeBinding(sid);
+                meta.agent_executable = bin;
+                // 席は通常の速度で始まる（Claude Code・Codexは起動の引数で明示する）。fast版のmodel IDで起こした時だけtrue。
+                meta.fast = opts.fast_state === true;
+                meta.model = opts.base_model !== undefined ? opts.base_model : model;
+                // The new physical shell is already pinned by its actual create receipt.
+                // Validate it before publishing metadata, then bind this internally
+                // generated managed launch. Model arguments cannot select this ID.
+                writeAgentMetadata(meta);
+                agentMetadataNegativeCache.delete(sid);
+            }
+            return meta;
+        });
+        if (meta && hasExecutionCreationScope())
+            bindExecutionCreatedLaunch({ session_id: sid, launch_id: meta.launch_id });
         launchNote = buildAgentLaunchNote(kind, model, effort, meta);
         let full;
         if (paneShell === "pwsh" && meta) {
@@ -5982,7 +6474,7 @@ export function openAgent(kind, opts = {}) {
         });
     }
     catch (e) {
-        const failure = telemetryOwnedFailure("AITERM.VENDOR_LAUNCHER_FAILED", e);
+        const failure = e instanceof ExecutionError ? e : telemetryOwnedFailure("AITERM.VENDOR_LAUNCHER_FAILED", e);
         // 起動コマンドを投入できなかった session は空のまま残る＝残骸を作らない。片付けてから元エラーを伝える。
         try {
             closeSessionInternal(sid, false);
@@ -6020,6 +6512,7 @@ export class AgentLaunchPromptError extends AitermError {
     }
 }
 export async function openAgentWithInitialPrompt(kind, opts = {}) {
+    assertExecutionContext(opts.session_name);
     const mission = opts.prompt ?? null;
     const sourceSessionId = opts.throughline_source_session ?? null;
     const supplementFile = opts.throughline_supplement_file ?? null;