botmux 2.106.0 → 2.106.1-canary.0

package/README.en.md

@@ -15,14 +15,14 @@
   <a href="#design-philosophy">Design</a> &middot;
   <a href="#key-advantages">Advantages</a> &middot;
   <a href="#5-minute-setup">Quick Start</a> &middot;
-  <a href="https://github.com/deepcoldy/botmux/tree/master/docs-site/docs/en"><b>📖 Docs</b></a>
+  <a href="https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/"><b>📖 Docs</b></a>
 </p>
 
 [中文](README.md) | English
 
 **Plug any AI coding CLI into Feishu/Lark — every DM, group or topic gets its own CLI session, with live-streaming cards, a web terminal, and zero glue code.**
 
-> 📖 **Full docs** (commands / config / best practices / troubleshooting): **<https://github.com/deepcoldy/botmux/tree/master/docs-site/docs/en>** — this README only covers why and how to get started fast.
+> 📖 **Full docs** (commands / config / best practices / troubleshooting): **<https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/>** — this README only covers why and how to get started fast.
 
 | Lark Streaming Cards | Web Terminal | tmux Session Management | Multi-Bot Collaboration |
 |:-:|:-:|:-:|:-:|
@@ -223,7 +223,7 @@ On mobile/tablet, a floating shortcut toolbar provides Esc, Ctrl+C, Tab, arrow k
 
 ### Multi-Bot Collaboration
 
-Run multiple Lark bots on a single machine, each mapped to a different CLI. In the same group chat, messages are routed via @mention — each bot gets its own isolated CLI process. With a single bot in the group, it responds automatically without @. In a regular (non-topic) group, `@<bot1> @<bot2> /t xxx` spawns one independent thread per mentioned bot anchored at the same message. Send `@<bot1> @<bot2> /introduce` once so they register each other's open_id; afterwards each bot can explicitly @-mention the others from within its own session (commands: [📖 Docs · Slash Commands](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/slash-commands.md)).
+Run multiple Lark bots on a single machine, each mapped to a different CLI. In the same group chat, messages are routed via @mention — each bot gets its own isolated CLI process. With a single bot in the group, it responds automatically without @. In a regular (non-topic) group, `@<bot1> @<bot2> /t xxx` spawns one independent thread per mentioned bot anchored at the same message. Send `@<bot1> @<bot2> /introduce` once so they register each other's open_id; afterwards each bot can explicitly @-mention the others from within its own session (commands: [📖 Docs · Slash Commands](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/slash-commands)).
 
 ### Multi-Topic Collaboration
 
@@ -387,16 +387,16 @@ Notes:
 
 The full reference — commands, config, best practices, troubleshooting — lives in the docs site; not duplicated here —
 
-### 👉 https://github.com/deepcoldy/botmux/tree/master/docs-site/docs/en
+### 👉 https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/
 
 | Topic | Docs |
 |-------|------|
-| Slash commands / CLI commands / agent-facing subcommands | [Commands](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/slash-commands.md) |
-| `bots.json` fields / env vars / file locations | [Configuration](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/bots-json.md) |
-| Multi-CLI adapters (incl. wrapper / gateway integration) | [Adapters](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/adapters.md) |
-| Scenario-based best practices (Oncall / alerting-ops / solo dev / team) | [Best Practices](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/best-practices.md) |
-| Common pitfalls / FAQ | [Pitfalls](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/pitfalls.md) · [FAQ](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/faq.md) |
-| Features: scheduled tasks / Oncall / Dashboard / multi-bot / session relay | [Schedule](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/schedule.md) · [Oncall](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/oncall.md) · [Dashboard](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/dashboard.md) · [Multi-bot](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/multi-bot.mdx) · [Relay](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/en/relay.md) |
+| Slash commands / CLI commands / agent-facing subcommands | [Commands](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/slash-commands) |
+| `bots.json` fields / env vars / file locations | [Configuration](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/bots-json) |
+| Multi-CLI adapters (incl. wrapper / gateway integration) | [Adapters](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/adapters) |
+| Scenario-based best practices (Oncall / alerting-ops / solo dev / team) | [Best Practices](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/best-practices) |
+| Common pitfalls / FAQ | [Pitfalls](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/pitfalls) · [FAQ](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/faq) |
+| Features: scheduled tasks / Oncall / Dashboard / multi-bot / session relay | [Schedule](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/schedule) · [Oncall](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/oncall) · [Dashboard](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/dashboard) · [Multi-bot](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/multi-bot) · [Relay](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/relay) |
 
 ## Contributing
 

package/README.md

@@ -12,7 +12,7 @@
 </p>
 
 <p align="center">
-  <a href="#设计理念">设计理念</a> · <a href="#核心优势">核心优势</a> · <a href="#5-分钟快速接入">快速接入</a> · <a href="https://github.com/deepcoldy/botmux/tree/master/docs-site/docs/zh"><b>📖 文档</b></a>
+  <a href="#设计理念">设计理念</a> · <a href="#核心优势">核心优势</a> · <a href="#5-分钟快速接入">快速接入</a> · <a href="https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/"><b>📖 文档</b></a>
 </p>
 
 <p align="center">
@@ -23,7 +23,7 @@
 
 **飞书 + AI 编程 CLI——私聊 / 群聊 / 话题，每个会话一个独立 CLI 进程，实时流式回传。** Daemon 监听飞书消息，为每个新会话自动启动独立 CLI 进程（Claude Code / Codex / Cursor / Gemini / OpenCode / Antigravity / GitHub Copilot / Kimi Code），提供实时流式卡片和可交互 Web 终端。
 
-> 📖 **完整文档**（命令 / 配置 / 最佳实践 / 排错）：**<https://github.com/deepcoldy/botmux/tree/master/docs-site/docs/zh>** ——本 README 只讲为什么用它和怎么快速上手。
+> 📖 **完整文档**（命令 / 配置 / 最佳实践 / 排错）：**<https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/>** ——本 README 只讲为什么用它和怎么快速上手。
 
 ## 演示
 
@@ -92,7 +92,7 @@ botmux 可以管理 CLI 无关的自定义 Skill Registry，并按 bot 配置在
 
 ### 多机器人协作
 
-同一台机器上可运行多个飞书机器人，每个机器人可对应不同的 CLI。同一群聊中通过 @mention 路由消息，仅有一个机器人时无需 @ 自动响应；多机器人时 `@<bot1> @<bot2> /t xxx` 可让每个被 @ 的机器人在同一条消息上各自独立开新话题。先发一次 `@<bot1> @<bot2> /introduce` 让它们互相登记 open_id，之后各 bot 就能在自己的会话里显式 @mention 对方协作（命令详见 [📖 文档 · 斜杠命令](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/slash-commands.md)）。
+同一台机器上可运行多个飞书机器人，每个机器人可对应不同的 CLI。同一群聊中通过 @mention 路由消息，仅有一个机器人时无需 @ 自动响应；多机器人时 `@<bot1> @<bot2> /t xxx` 可让每个被 @ 的机器人在同一条消息上各自独立开新话题。先发一次 `@<bot1> @<bot2> /introduce` 让它们互相登记 open_id，之后各 bot 就能在自己的会话里显式 @mention 对方协作（命令详见 [📖 文档 · 斜杠命令](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/slash-commands)）。
 
 ### 多话题协作模式
 
@@ -384,16 +384,16 @@ PersonalAgent 默认配好事件订阅 + bot 能力，正常情况下不用动
 
 命令、配置、最佳实践、排错的完整内容都在文档站，这里不再重复 ——
 
-### 👉 https://github.com/deepcoldy/botmux/tree/master/docs-site/docs/zh
+### 👉 https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/
 
 | 主题 | 文档 |
 |------|------|
-| 斜杠命令 / CLI 命令 / 会话内子命令 | [命令参考](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/slash-commands.md) |
-| `bots.json` 字段 / 环境变量 / 文件位置 | [配置参考](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/bots-json.md) |
-| 多 CLI 适配器（含 wrapper / 网关接入） | [适配器](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/adapters.md) |
-| 按场景的最佳实践（Oncall / 报警运维 / 个人研发 / 多人协作） | [最佳实践](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/best-practices.md) |
-| 常见踩坑 / FAQ 排错 | [踩坑](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/pitfalls.md) · [FAQ](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/faq.md) |
-| 功能详解：定时任务 / Oncall / Dashboard / 多机器人协作 / 会话接力 | [定时](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/schedule.md) · [Oncall](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/oncall.md) · [Dashboard](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/dashboard.md) · [多 bot](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/multi-bot.mdx) · [接力](https://github.com/deepcoldy/botmux/blob/master/docs-site/docs/zh/relay.md) |
+| 斜杠命令 / CLI 命令 / 会话内子命令 | [命令参考](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/slash-commands) |
+| `bots.json` 字段 / 环境变量 / 文件位置 | [配置参考](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/bots-json) |
+| 多 CLI 适配器（含 wrapper / 网关接入） | [适配器](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/adapters) |
+| 按场景的最佳实践（Oncall / 报警运维 / 个人研发 / 多人协作） | [最佳实践](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/best-practices) |
+| 常见踩坑 / FAQ 排错 | [踩坑](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/pitfalls) · [FAQ](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/faq) |
+| 功能详解：定时任务 / Oncall / Dashboard / 多机器人协作 / 会话接力 | [定时](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/schedule) · [Oncall](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/oncall) · [Dashboard](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/dashboard) · [多 bot](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/multi-bot) · [接力](https://bytedance.aiforce.cloud/app/app_4k9smq6rdxher/relay) |
 
 ## 贡献
 

package/dist/adapters/backend/sandbox.d.ts

@@ -1,3 +1,4 @@
+export declare function sandboxVartmpRoot(): string;
 /**
  * Mount an overlayfs: reads fall through to `lower` (real, zero copy); writes
  * copy-up into `upper` (the landable changeset). `work` is overlayfs scratch on
@@ -123,7 +124,7 @@ export interface SandboxSpawn {
     outbox: string;
     /** Project overlay UPPER dir — THE LANDABLE CHANGESET (used by sandbox-land). */
     workDir: string;
-    /** HOME overlay UPPER dir (/var/tmp/botmux-sbx/<sid>/home-upper). The sandboxed
+    /** HOME overlay UPPER dir (/var/tmp/botmux-sbx-<uid>/<sid>/home-upper). The sandboxed
      *  CLI's $HOME writes — INCLUDING its session jsonl under CLAUDE_CONFIG_DIR —
      *  land here (invisible at the real path). The worker redirects its bridge/idle
      *  watch into this via sandboxedClaudeDataDir() so it sees the CLI's turns. */
@@ -149,10 +150,12 @@ export declare function sandboxedClaudeDataDir(sessionId: string, realDataDir: s
  * is off / unsupported / a required overlay mount fails (fail-safe = the worker
  * treats null as a hard error and does NOT silently run unsandboxed).
  *
- * Layout under <dataDir>/sandboxes/<sessionId>/: outbox, shimbin, proj-upper
- * (the landable changeset), proj-work, proj-merged, home-merged. The HOME
- * overlay's upper/work live under /var/tmp/botmux-sbx/<sessionId>/ because
- * overlayfs forbids upper/work inside the lower (= the real home).
+ * Layout under <dataDir>/sandboxes/<sessionId>/: shimbin, proj-upper (the
+ * landable changeset), proj-work, proj-merged, home-merged. The HOME overlay's
+ * upper/work and the daemon-mediated outbox live under
+ * /var/tmp/botmux-sbx-<uid>/<sessionId>/ because overlayfs forbids upper/work inside
+ * the lower (= the real home), and keeping the outbox outside HOME avoids a
+ * nested bind under the HOME overlay on bwrap hosts that hang on that pattern.
  */
 export declare function prepareSandbox(opts: {
     /** Whether the sandbox is on for THIS session (per-bot BotConfig.sandbox OR
@@ -194,7 +197,10 @@ export declare function prepareSandbox(opts: {
  * path back so the watcher can keep servicing the live CLI's `botmux send`, plus
  * the workDir (upper changeset for landing) and a cleanup that tears the residue
  * down at close/exit. Returns null if the session has no sandbox tree on disk
- * (never sandboxed). Linux-only, mirrors prepareSandbox's layout.
+ * (never sandboxed). Linux-only, mirrors prepareSandbox's layout. New sessions
+ * keep outbox under /var/tmp/botmux-sbx-<uid>/<sid>/outbox; fall back to legacy
+ * /var/tmp/botmux-sbx/<sid>/outbox or <dataDir>/sandboxes/<sid>/outbox for
+ * sessions that were already running before the layout changed.
  */
 export declare function attachSandboxOutbox(opts: {
     sessionId: string;
@@ -269,6 +275,14 @@ export declare function validateRelayRequest(req: RelayRequest): {
  * be swapped under us. Returns false (reject) on symlink / non-regular / any error.
  */
 export declare function materializeOutboxFile(outbox: string, name: string, dest: string): boolean;
+/**
+ * TOCTOU-safe read of the `.req.json` trigger file itself. The request file is
+ * also sandbox-controlled input, so it needs the same hardening as content and
+ * attachments: no symlinks, no FIFO/device files, no blocking opens, and a small
+ * size cap before JSON.parse. Returns null on any unsafe/non-regular/oversized
+ * input so the watcher can reject and keep its event loop moving.
+ */
+export declare function readRelayRequestFile(reqPath: string): string | null;
 /**
  * Daemon/worker-side outbox watcher. The sandboxed `botmux send` (relay mode)
  * drops `<id>.req.json`; we validate (validateRelayRequest) and then MATERIALIZE

package/dist/adapters/backend/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/sandbox.ts"],"names":[],"mappings":"AAkCA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAqB1G;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;gFACgF;AAChF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQnD;AAqCD,MAAM,WAAW,WAAW;IAC1B;0FACsF;IACtF,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB;2DACuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C;;sEAEkE;IAClE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;sDAEkD;IAClD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;6DAEyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CA6B5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAU7E;AAoCD;;;8DAG8D;AAC9D,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GACvE,MAAM,EAAE,CAaV;AAUD;+DAC+D;AAC/D,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB;;;mFAG+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;mDAWmD;AACnD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAIrF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC;;sFAEkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;2EACuE;IACvE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;oEAEgE;IAChE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;qEACiE;IACjE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;iDAE6C;IAC7C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,yEAAyE;IACzE,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GAAG,YAAY,GAAG,IAAI,CAqJtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,IAAI,CAsBjJ;AAiCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAoCzF;AAOD,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AASD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAsC1H;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,IAAI,CAuF5G"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/sandbox.ts"],"names":[],"mappings":"AAkCA,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AA6CD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAqB1G;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;gFACgF;AAChF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQnD;AAqCD,MAAM,WAAW,WAAW;IAC1B;0FACsF;IACtF,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB;2DACuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C;;sEAEkE;IAClE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;sDAEkD;IAClD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;6DAEyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CA6B5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAU7E;AAoCD;;;8DAG8D;AAC9D,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GACvE,MAAM,EAAE,CAaV;AAUD;+DAC+D;AAC/D,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB;;;mFAG+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;mDAWmD;AACnD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAIrF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC;;sFAEkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;2EACuE;IACvE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;oEAEgE;IAChE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;qEACiE;IACjE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;iDAE6C;IAC7C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,yEAAyE;IACzE,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GAAG,YAAY,GAAG,IAAI,CAuJtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,IAAI,CA8BjJ;AAkCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAoCzF;AAOD,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AASD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAsC1H;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBzF;AAID;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,IAAI,CAyF5G"}

package/dist/adapters/backend/sandbox.js

@@ -20,14 +20,61 @@
  * sandbox-exec approach and is handled elsewhere.
  */
 import { homedir } from 'node:os';
-import { mkdirSync, existsSync, writeFileSync, chmodSync, readdirSync, readFileSync, rmSync, statSync, realpathSync, openSync, fstatSync, readSync, writeSync, closeSync, constants as fsConstants } from 'node:fs';
+import { mkdirSync, existsSync, writeFileSync, chmodSync, readdirSync, readFileSync, rmSync, statSync, lstatSync, realpathSync, openSync, fstatSync, readSync, writeSync, closeSync, constants as fsConstants } from 'node:fs';
 import { atomicWriteFileSync } from '../../utils/atomic-write.js';
 import { join, dirname, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
 /** Host root for the HOME overlay's upper/work — MUST be OUTSIDE the home lower
- *  (overlayfs forbids upper/work inside lower). */
-const VARTMP_ROOT = '/var/tmp/botmux-sbx';
+ *  (overlayfs forbids upper/work inside lower). Keep it per-uid: /var/tmp is a
+ *  shared multi-user surface, and a global 0700 root would let the first user
+ *  that starts sandbox block every other Unix user on the same machine. */
+const LEGACY_VARTMP_ROOT = '/var/tmp/botmux-sbx';
+export function sandboxVartmpRoot() {
+    const uid = process.getuid?.() ?? 0;
+    return `/var/tmp/botmux-sbx-${uid}`;
+}
+function legacySandboxVartmpDir(sessionId) {
+    return join(LEGACY_VARTMP_ROOT, sessionId);
+}
+function sandboxVartmpDir(sessionId) {
+    return join(sandboxVartmpRoot(), sessionId);
+}
+function sandboxHomeUpperDir(sessionId) {
+    const next = join(sandboxVartmpDir(sessionId), 'home-upper');
+    const legacy = join(legacySandboxVartmpDir(sessionId), 'home-upper');
+    // Published versions stored HOME upper under the global /var/tmp/botmux-sbx.
+    // A daemon upgrade may reattach a still-running tmux sandbox whose bwrap
+    // namespace continues writing that old overlay upper. If the new per-uid upper
+    // does not exist, keep the bridge pointed at the legacy path.
+    if (existsSync(legacy) && !existsSync(next))
+        return legacy;
+    return next;
+}
+/** Create a daemon-private directory and repair legacy/default mkdir modes.
+ *  Anything under /var/tmp is on a shared multi-user surface, while the outbox
+ *  carries in-flight Lark message bodies/attachments. Refuse to proceed unless
+ *  the path is a real directory owned by this daemon user, and group/other bits
+ *  are gone after chmod. */
+function ensurePrivateDir(dir) {
+    try {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const lst = lstatSync(dir);
+        if (lst.isSymbolicLink() || !lst.isDirectory())
+            return false;
+        const stBefore = statSync(dir);
+        const uid = process.getuid?.();
+        if (typeof uid === 'number' && stBefore.uid !== uid)
+            return false;
+        chmodSync(dir, 0o700); // repair dirs created before this hardening or under a loose umask
+        const st = statSync(dir);
+        return st.isDirectory() && (typeof uid !== 'number' || st.uid === uid) && (st.mode & 0o077) === 0;
+    }
+    catch (err) {
+        console.error(`[sandbox] failed to prepare private dir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+}
 // ───────────────────────────── overlay primitives ────────────────────────────
 /**
  * Mount an overlayfs: reads fall through to `lower` (real, zero copy); writes
@@ -302,7 +349,7 @@ export function sandboxEnabled() {
 export function sandboxedClaudeDataDir(sessionId, realDataDir) {
     const raw = relative(homedir(), realDataDir);
     const rel = raw.startsWith('..') ? relative(resolveSandboxMountPath(homedir()), realDataDir) : raw;
-    return join(VARTMP_ROOT, sessionId, 'home-upper', rel);
+    return join(sandboxHomeUpperDir(sessionId), rel);
 }
 /** Proxy env vars forwarded into the sandbox so the CLI reaches the API even on
  *  the tmux backend (which otherwise only forwards a fixed whitelist). */
@@ -312,10 +359,12 @@ const PROXY_ENV_KEYS = ['http_proxy', 'https_proxy', 'HTTP_PROXY', 'HTTPS_PROXY'
  * is off / unsupported / a required overlay mount fails (fail-safe = the worker
  * treats null as a hard error and does NOT silently run unsandboxed).
  *
- * Layout under <dataDir>/sandboxes/<sessionId>/: outbox, shimbin, proj-upper
- * (the landable changeset), proj-work, proj-merged, home-merged. The HOME
- * overlay's upper/work live under /var/tmp/botmux-sbx/<sessionId>/ because
- * overlayfs forbids upper/work inside the lower (= the real home).
+ * Layout under <dataDir>/sandboxes/<sessionId>/: shimbin, proj-upper (the
+ * landable changeset), proj-work, proj-merged, home-merged. The HOME overlay's
+ * upper/work and the daemon-mediated outbox live under
+ * /var/tmp/botmux-sbx-<uid>/<sessionId>/ because overlayfs forbids upper/work inside
+ * the lower (= the real home), and keeping the outbox outside HOME avoids a
+ * nested bind under the HOME overlay on bwrap hosts that hang on that pattern.
  */
 export function prepareSandbox(opts) {
     if (!opts.enabled)
@@ -329,7 +378,6 @@ export function prepareSandbox(opts) {
         return null;
     const dataDir = resolveSandboxMountPath(opts.dataDir);
     const sessionRoot = join(dataDir, 'sandboxes', opts.sessionId);
-    const outbox = join(sessionRoot, 'outbox');
     const shimBin = join(sessionRoot, 'shimbin');
     const empties = join(sessionRoot, 'empties');
     const projUpper = join(sessionRoot, 'proj-upper'); // THE LANDABLE CHANGESET
@@ -337,9 +385,12 @@ export function prepareSandbox(opts) {
     const projMerged = join(sessionRoot, 'proj-merged');
     const homeMerged = join(sessionRoot, 'home-merged'); // merged may live under sessionRoot
     // HOME overlay upper/work MUST be OUTSIDE the home lower (overlayfs constraint).
-    const vartmp = join(VARTMP_ROOT, opts.sessionId);
+    const vartmp = sandboxVartmpDir(opts.sessionId);
+    const outbox = join(vartmp, 'outbox');
     const homeUpper = join(vartmp, 'home-upper');
     const homeWork = join(vartmp, 'home-work');
+    if (!ensurePrivateDir(sandboxVartmpRoot()) || !ensurePrivateDir(vartmp) || !ensurePrivateDir(outbox))
+        return null;
     for (const d of [outbox, shimBin, empties])
         mkdirSync(d, { recursive: true });
     const home = resolveSandboxMountPath(homedir());
@@ -475,6 +526,10 @@ export function prepareSandbox(opts) {
                 rmSync(vartmp, { recursive: true, force: true });
             }
             catch { /* */ }
+            try {
+                rmSync(legacySandboxVartmpDir(opts.sessionId), { recursive: true, force: true });
+            }
+            catch { /* */ }
         },
     };
 }
@@ -487,25 +542,37 @@ export function prepareSandbox(opts) {
  * path back so the watcher can keep servicing the live CLI's `botmux send`, plus
  * the workDir (upper changeset for landing) and a cleanup that tears the residue
  * down at close/exit. Returns null if the session has no sandbox tree on disk
- * (never sandboxed). Linux-only, mirrors prepareSandbox's layout.
+ * (never sandboxed). Linux-only, mirrors prepareSandbox's layout. New sessions
+ * keep outbox under /var/tmp/botmux-sbx-<uid>/<sid>/outbox; fall back to legacy
+ * /var/tmp/botmux-sbx/<sid>/outbox or <dataDir>/sandboxes/<sid>/outbox for
+ * sessions that were already running before the layout changed.
  */
 export function attachSandboxOutbox(opts) {
     if (process.platform !== 'linux')
         return null;
     const dataDir = resolveSandboxMountPath(opts.dataDir);
     const sessionRoot = join(dataDir, 'sandboxes', opts.sessionId);
-    const outbox = join(sessionRoot, 'outbox');
+    const vartmp = sandboxVartmpDir(opts.sessionId);
+    const newOutbox = join(vartmp, 'outbox');
+    const legacyVartmpOutbox = join(legacySandboxVartmpDir(opts.sessionId), 'outbox');
+    const legacyOutbox = join(sessionRoot, 'outbox');
     const projUpper = join(sessionRoot, 'proj-upper');
-    if (!existsSync(outbox) && !existsSync(projUpper))
+    if (!existsSync(newOutbox) && !existsSync(legacyVartmpOutbox) && !existsSync(legacyOutbox) && !existsSync(projUpper))
         return null; // never sandboxed
+    const outbox = existsSync(newOutbox) ? newOutbox : (existsSync(legacyVartmpOutbox) ? legacyVartmpOutbox : (existsSync(legacyOutbox) ? legacyOutbox : newOutbox));
     // Ensure the outbox exists (the watcher reads it); never (re)mount here.
-    try {
-        mkdirSync(outbox, { recursive: true });
+    if (outbox === newOutbox) {
+        if (!ensurePrivateDir(sandboxVartmpRoot()) || !ensurePrivateDir(vartmp) || !ensurePrivateDir(outbox))
+            return null;
     }
-    catch { /* */ }
+    else if (outbox === legacyVartmpOutbox) {
+        if (!ensurePrivateDir(legacySandboxVartmpDir(opts.sessionId)) || !ensurePrivateDir(outbox))
+            return null;
+    }
+    else if (!ensurePrivateDir(outbox))
+        return null;
     const projMerged = join(sessionRoot, 'proj-merged');
     const homeMerged = join(sessionRoot, 'home-merged');
-    const vartmp = join(VARTMP_ROOT, opts.sessionId);
     return {
         outbox,
         workDir: projUpper,
@@ -520,6 +587,10 @@ export function attachSandboxOutbox(opts) {
                 rmSync(vartmp, { recursive: true, force: true });
             }
             catch { /* */ }
+            try {
+                rmSync(legacySandboxVartmpDir(opts.sessionId), { recursive: true, force: true });
+            }
+            catch { /* */ }
         },
     };
 }
@@ -534,13 +605,17 @@ function reclaimSandbox(dataDir, sid) {
     }
     catch { /* */ }
     try {
-        rmSync(join(VARTMP_ROOT, sid), { recursive: true, force: true });
+        rmSync(join(sandboxVartmpRoot(), sid), { recursive: true, force: true });
+    }
+    catch { /* */ }
+    try {
+        rmSync(legacySandboxVartmpDir(sid), { recursive: true, force: true });
     }
     catch { /* */ }
 }
 /** Scan the process table for sandbox session-ids referenced by any running
  *  process's argv. A live bwrap's bind/overlay paths contain `sandboxes/<sid>`
- *  and `botmux-sbx/<sid>`, so this physically detects which sandbox dirs are
+ *  and `botmux-sbx-<uid>/<sid>`, so this physically detects which sandbox dirs are
  *  still in use — by overlay sessions AND old clone-model sessions alike. Used as
  *  a hard guard so the sweep never deletes a dir out from under a live CLI. */
 function liveSandboxSids() {
@@ -552,7 +627,7 @@ function liveSandboxSids() {
     catch {
         return live;
     }
-    const re = /(?:sandboxes|botmux-sbx)\/([^/\0]+)/g;
+    const re = /(?:sandboxes|botmux-sbx(?:-[^/\0]+)?)\/([^/\0]+)/g;
     for (const pid of pids) {
         if (!/^\d+$/.test(pid))
             continue;
@@ -602,9 +677,9 @@ export function sweepOrphanSandboxes(dataDir, activeSessionIds) {
         return;
     } // no sandboxes dir yet
     // Grace before reclaiming an ACTIVE-but-unmounted sandbox: a worker that just
-    // (re)spawned creates the outbox/shimbin dirs a few syscalls BEFORE it mounts
-    // the overlay. Without this, a sweep firing in that tiny window would nuke an
-    // in-progress session's outbox. Non-active orphans are reclaimed immediately
+    // (re)spawned creates the sandbox dirs a few syscalls BEFORE it mounts the
+    // overlay. Without this, a sweep firing in that tiny window would nuke an
+    // in-progress session's shimbin/project tree. Non-active orphans are reclaimed immediately
     // (no live worker can be mid-spawn for a session that isn't active).
     const ACTIVE_DEAD_GRACE_MS = 60_000;
     const now = Date.now();
@@ -749,6 +824,49 @@ export function materializeOutboxFile(outbox, name, dest) {
             closeSync(outFd);
     }
 }
+const RELAY_REQUEST_MAX_BYTES = 64 * 1024;
+/**
+ * TOCTOU-safe read of the `.req.json` trigger file itself. The request file is
+ * also sandbox-controlled input, so it needs the same hardening as content and
+ * attachments: no symlinks, no FIFO/device files, no blocking opens, and a small
+ * size cap before JSON.parse. Returns null on any unsafe/non-regular/oversized
+ * input so the watcher can reject and keep its event loop moving.
+ */
+export function readRelayRequestFile(reqPath) {
+    let fd;
+    try {
+        fd = openSync(reqPath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+    }
+    catch {
+        return null;
+    }
+    try {
+        const st = fstatSync(fd);
+        if (!st.isFile())
+            return null;
+        if (st.size > RELAY_REQUEST_MAX_BYTES)
+            return null;
+        const chunks = [];
+        let total = 0;
+        const buf = Buffer.alloc(Math.min(8192, RELAY_REQUEST_MAX_BYTES));
+        for (;;) {
+            const n = readSync(fd, buf, 0, buf.length, null);
+            if (n <= 0)
+                break;
+            total += n;
+            if (total > RELAY_REQUEST_MAX_BYTES)
+                return null;
+            chunks.push(Buffer.from(buf.subarray(0, n)));
+        }
+        return Buffer.concat(chunks, total).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 /**
  * Daemon/worker-side outbox watcher. The sandboxed `botmux send` (relay mode)
  * drops `<id>.req.json`; we validate (validateRelayRequest) and then MATERIALIZE
@@ -768,7 +886,7 @@ export function startOutboxWatcher(outbox, baseEnv, sessionId) {
     const finish = (id, reqPath, name, staged, code, stdout, stderr) => {
         // 原子写：沙盒侧 CLI 在 existsSync 轮询这个 res.json，rename 保证它读到完整 JSON。
         try {
-            atomicWriteFileSync(join(outbox, `${id}.res.json`), JSON.stringify({ code, stdout, stderr }));
+            atomicWriteFileSync(join(outbox, `${id}.res.json`), JSON.stringify({ code, stdout, stderr }), { mode: 0o600 });
         }
         catch { /* */ }
         try {
@@ -799,8 +917,13 @@ export function startOutboxWatcher(outbox, baseEnv, sessionId) {
             const id = name.slice(0, -'.req.json'.length);
             const staged = [];
             let req;
+            const reqText = readRelayRequestFile(reqPath);
+            if (reqText === null) {
+                finish(id, reqPath, name, staged, 1, '', 'relay rejected: request not a regular file or too large');
+                continue;
+            }
             try {
-                req = JSON.parse(readFileSync(reqPath, 'utf8'));
+                req = JSON.parse(reqText);
             }
             catch {
                 finish(id, reqPath, name, staged, 1, '', 'relay: bad json');
@@ -812,7 +935,8 @@ export function startOutboxWatcher(outbox, baseEnv, sessionId) {
                 continue;
             }
             try {
-                mkdirSync(staging, { recursive: true });
+                mkdirSync(staging, { recursive: true, mode: 0o700 });
+                chmodSync(staging, 0o700);
             }
             catch { /* */ }
             // Materialize content (TOCTOU-safe) into the private staging dir.