botmux 2.111.0 → 2.111.1-canary.0

package/README.en.md

@@ -81,9 +81,10 @@ Compared to OpenClaw-style approaches built on Agent SDKs:
 ```bash
 npm install -g botmux
 # or: pnpm add -g botmux
+# or: bun add -g botmux
 ```
 
-Manual and scheduled updates keep using the npm or pnpm global location that owns the running botmux install. Unknown install layouts are never silently updated with npm.
+Manual and scheduled updates keep using the npm, pnpm, or Bun global location that owns the running botmux install. Unknown install layouts are never silently updated with npm.
 
 > Requires **Node.js ≥ 22**, with at least one AI coding CLI installed and authenticated (`claude` / `codex` / `cursor-agent` / `gemini` / `opencode` / `coco` / `agy` / `kimi` / `grok` / `kiro-cli` on your PATH). Installing **tmux** too is recommended (enables session persistence automatically).
 
@@ -232,7 +233,7 @@ On mobile/tablet, a floating shortcut toolbar provides Esc, Ctrl+C, Tab, arrow k
 
 ### Multi-Bot Collaboration
 
-Run multiple Lark bots on a single machine, each mapped to a different CLI. In the same group chat, messages are routed via @mention — each bot gets its own isolated CLI process. With a single bot in the group, it responds automatically without @. In a regular (non-topic) group, `@<bot1> @<bot2> /t xxx` spawns one independent thread per mentioned bot anchored at the same message. Send `@<bot1> @<bot2> /introduce` once so they register each other's open_id; afterwards each bot can explicitly @-mention the others from within its own session (commands: [📖 Docs · Slash Commands](https://deepcoldy.github.io/botmux/en/slash-commands)).
+Run multiple Lark bots on a single machine, each mapped to a different CLI. In the same group chat, messages are routed via @mention — each bot gets its own isolated CLI process. In a 1:1 group (you + one bot) it responds automatically without @; multi-person groups require @ by default (the per-bot "Group @ policy" can relax this inside owned topics or group-wide). In a regular (non-topic) group, `@<bot1> @<bot2> /t xxx` spawns one independent thread per mentioned bot anchored at the same message. Send `@<bot1> @<bot2> /introduce` once so they register each other's open_id; afterwards each bot can explicitly @-mention the others from within its own session (commands: [📖 Docs · Slash Commands](https://deepcoldy.github.io/botmux/en/slash-commands)).
 
 ### Multi-Topic Collaboration
 
@@ -325,6 +326,7 @@ When a CLI spawns inside a botmux session it automatically gets
 - `botmux quoted <message_id>` — when the user @ed the bot via Lark's quote-reply UI, fetch the quoted message on demand
 - `botmux bots list` — discover bots + their `open_id`s
 - `botmux schedule` — manage scheduled tasks
+- `botmux-workflow` — orchestrate bounded multi-step work with natural language or `/workflow`, then save successful runs for reuse
 
 These capabilities are wired via `--append-system-prompt` and Skill
 descriptions, so the agent picks them up automatically. Compared to
@@ -344,10 +346,9 @@ Gemini / OpenCode / Antigravity / GitHub Copilot), with no MCP protocol support
 - Disband or leave a chat (associated sessions auto-closed)
 - **Session Insights** (owner-only, read-only): parse each session's transcript to view action spans / work timeline / context curve / failure aggregates + diagnostic suggestions; send `/insight` in chat for the current session's summary card
 - **Workflows console**:
-  - Run List (5 s poll) + Run Detail with summary, dangling-work red panel, node/activity table, event timeline, and a **parallel-execution timeline** (attempt-level), auto-stopping polling once the run reaches a terminal state
-  - **Cancel a run directly from the dashboard**; approve / reject `humanGate` with reviewer comments
-  - **Workflow Catalog**: lists every workflow under `~/.botmux/workflows/`, drills into schema / dependency graph, and triggers a new run from the UI (with params input)
-  - IM approval / cancel cards remain available; `botmux workflow` CLI subcommands also keep working
+  - v3 Run List and Run Detail show the DAG, node states, decisions, and attempt terminal logs, and stop polling at terminal state
+  - **Cancel v3 runs directly from the dashboard**; trusted Lark cards in the bound topic handle `humanGate`, retry, and grant decisions
+  - Create, run, save, and reuse workflows in Lark with natural language or `/workflow`; the v2 Dashboard/Catalog has been retired
 
 <img src="docs/dashboard.png" alt="botmux dashboard" width="800" />
 
@@ -367,6 +368,15 @@ Gemini / OpenCode / Antigravity / GitHub Copilot), with no MCP protocol support
 
 ---
 
+### Multi-step Workflow (v3)
+
+- Say “research three competitors and write a report” or “chain A/B/C and run it automatically.” The bot lightly confirms Workflow intent, clarifies the goal, builds a bounded DAG, and executes it.
+- Use `/workflow <goal>` for an explicit start, and `/workflow list|show|cancel` to inspect or cancel runs.
+- Save a successful run with `/workflow save last weekly-report`, then reuse it with `/workflow run weekly-report region=sg`; only missing required parameters are requested.
+- The v2 runtime is retired. Legacy definitions and run history retain only offline `botmux template migrate-v3` / `archive-runs` migration and archive tooling.
+
+---
+
 ### Per-Bot Environment Variables (run a bot on GLM / a third-party provider)
 
 Each `bots.json` entry can define its own `env` object, injected into **that bot's CLI process**. Typical use: run one bot on a GLM Coding Plan / third-party Anthropic·OpenAI-compatible provider while another keeps using official Claude — just point the former at the provider's endpoint and key:

package/README.md

@@ -94,7 +94,7 @@ botmux 可以管理 CLI 无关的自定义 Skill Registry，并按 bot 配置在
 
 ### 多机器人协作
 
-同一台机器上可运行多个飞书机器人，每个机器人可对应不同的 CLI。同一群聊中通过 @mention 路由消息，仅有一个机器人时无需 @ 自动响应；多机器人时 `@<bot1> @<bot2> /t xxx` 可让每个被 @ 的机器人在同一条消息上各自独立开新话题。先发一次 `@<bot1> @<bot2> /introduce` 让它们互相登记 open_id，之后各 bot 就能在自己的会话里显式 @mention 对方协作（命令详见 [📖 文档 · 斜杠命令](https://deepcoldy.github.io/botmux/slash-commands)）。
+同一台机器上可运行多个飞书机器人，每个机器人可对应不同的 CLI。同一群聊中通过 @mention 路由消息，仅「你 + 1 个机器人」的 1v1 群无需 @ 自动响应，多人群默认必须 @（可通过「群聊 @ 策略」配置话题内免 @ / 全群免 @）；多机器人时 `@<bot1> @<bot2> /t xxx` 可让每个被 @ 的机器人在同一条消息上各自独立开新话题。先发一次 `@<bot1> @<bot2> /introduce` 让它们互相登记 open_id，之后各 bot 就能在自己的会话里显式 @mention 对方协作（命令详见 [📖 文档 · 斜杠命令](https://deepcoldy.github.io/botmux/slash-commands)）。
 
 ### 多话题协作模式
 
@@ -183,6 +183,7 @@ CLI 进入 botmux 会话时自动获得 `~/.botmux/bin` 在 PATH 中，以及一
 - `botmux quoted <message_id>` — 用户用引用 UI @ 机器人时，按需读取被引用的那条消息
 - `botmux bots list` — 查询当前群聊的机器人及 open_id
 - `botmux schedule` — 增删改查定时任务
+- `botmux-workflow` — 用自然语言或 `/workflow` 编排有界多步任务；成功 run 可保存为 Saved Workflow 并复用
 
 这些能力通过 `--append-system-prompt` 注入和 Skill 描述自动引导 agent 使用。Skill + CLI 的组合相比 Anthropic 官方 Telegram channel 那套 MCP 方案：CLI 启动不用做 MCP 握手、不占用工具列表 token，且对 Claude Code / Codex / Cursor / Gemini / OpenCode / Antigravity / GitHub Copilot 通用 —— 只要 CLI 能读 system prompt 跑 shell 命令就行，不依赖任何 MCP 协议支持。
 
@@ -196,10 +197,9 @@ CLI 进入 botmux 会话时自动获得 `~/.botmux/bin` 在 PATH 中，以及一
 - 解散群聊、bot 退群（关联会话自动清理）
 - **会话洞察**（owner-only，只读）：解析各会话 transcript，看动作 span / 工作时序 / 上下文曲线 / 失败聚合 + 诊断建议；聊天里发 `/insight` 可取当前会话摘要卡
 - **Workflows 管控面**：
-  - Run List 5s 轮询；Run Detail 看 summary / dangling 红区 / node-activity 表 / event timeline / **并发执行 timeline**（attempt 级时序），到 terminal 自动停轮询
-  - **Dashboard 内可直接 cancel run**、批准/拒绝 humanGate（approve/reject + 评论）
-  - **Workflow Catalog**：列所有 `~/.botmux/workflows/` 下的 workflow，点进去看 schema / 依赖图，直接在 UI 触发 run（带 params 输入）
-  - IM 卡片（cancel / approve / reject）仍可用；CLI 子命令也保留
+  - v3 Run List 与 Run Detail 展示 DAG、节点状态、决策记录和 attempt 终端日志，到 terminal 自动停轮询
+  - **Dashboard 内可直接 cancel v3 run**；humanGate / retry / grant 继续通过绑定话题里的可信飞书卡片处理
+  - 新流程统一在飞书用自然语言或 `/workflow` 创建、运行、保存和复用；v2 Dashboard/Catalog 已下线
 
 <img src="docs/dashboard.png" alt="botmux dashboard" width="800" />
 
@@ -225,9 +225,10 @@ CLI 进入 botmux 会话时自动获得 `~/.botmux/bin` 在 PATH 中，以及一
 ```bash
 npm install -g botmux
 # 或：pnpm add -g botmux
+# 或：bun add -g botmux
 ```
 
-botmux 的手动/定时更新会识别当前全局安装归属，并继续使用同一个 npm 或 pnpm 安装位置；无法安全识别的安装方式不会自动回退到 npm。
+botmux 的手动/定时更新会识别当前全局安装归属，并继续使用同一个 npm、pnpm 或 Bun 安装位置；无法安全识别的安装方式不会自动回退到 npm。
 
 > 要求 **Node.js ≥ 22**，且本地已装好并登录至少一种 AI 编程 CLI（`claude` / `codex` / `cursor-agent` / `gemini` / `opencode` / `coco` / `agy` / `grok` / `kiro-cli` 等在 PATH 中）。推荐顺手装 **tmux**（装了自动启用会话常驻）。
 
@@ -366,6 +367,15 @@ botmux 会自动开启机器人能力、长连接事件模式并订阅基础事
 
 ---
 
+### 多步 Workflow（v3）
+
+- 直接用自然语言说“调研三家竞品并出报告”“把 A/B/C 串起来自动做”，bot 会先轻确认是否切换到 Workflow，再澄清、编排并执行有界 DAG。
+- 明确要编排时可发 `/workflow <目标>`；查看/取消 run 用 `/workflow list|show|cancel`。
+- 成功 run 可用 `/workflow save last 周报` 固化；之后 `/workflow run 周报 region=sg` 复用，缺少的必填参数会单独补问。
+- v2 runtime 已下线。旧定义与历史 run 只保留 `botmux template migrate-v3` / `archive-runs` 离线迁移归档入口。
+
+---
+
 ### Bot 级环境变量（接入 GLM / 第三方服务商）
 
 每个 `bots.json` 条目都可以配置独立的 `env` 对象，注入到**该 bot 的 CLI 进程**。典型用途：让某个 bot 跑 GLM Coding Plan / 第三方 Anthropic·OpenAI 兼容服务商，另一个 bot 仍跑官方 Claude——只需给前者填上服务商的端点和 key：

package/dist/adapters/adopt-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adopt-route.d.ts","sourceRoot":"","sources":["../../src/adapters/adopt-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,gCAAgC;AAChC,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AA8CD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,EAC3C,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,EAAE,CAiBV;AAID;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgC5B;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC1E,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA+C7B"}
+{"version":3,"file":"adopt-route.d.ts","sourceRoot":"","sources":["../../src/adapters/adopt-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,gCAAgC;AAChC,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AA8CD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,EAC3C,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,EAAE,CAiBV;AAID;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAiC5B;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC1E,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA+C7B"}

package/dist/adapters/adopt-route.js

@@ -11,6 +11,7 @@
  */
 import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
+import { fetchDaemonIpc } from '../core/daemon-ipc-auth.js';
 // ── 祖先 PID 收集 ──────────────────────────────────────────────────────────────
 /**
  * 读取某进程的父 PID。
@@ -94,7 +95,7 @@ export async function queryAdoptSession(ipcPort, pid) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), 2000);
     try {
-        const res = await fetch(`http://127.0.0.1:${ipcPort}/api/adopt-session/${pid}`, { signal: controller.signal });
+        const res = await fetchDaemonIpc(ipcPort, `/api/adopt-session/${pid}`, { signal: controller.signal });
         if (!res.ok)
             return null;
         const body = (await res.json());

package/dist/adapters/adopt-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"adopt-route.js","sourceRoot":"","sources":["../../src/adapters/adopt-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAYvC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,sBAAsB;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,+CAA+C;QAC/C,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,oCAAoC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;YACjE,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,UAA2C,EAC3C,QAAiB;IAEjB,MAAM,MAAM,GAAG,UAAU,IAAI,iBAAiB,CAAC;IAC/C,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE5C,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,CAAE,iBAAiB;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,CAAa,KAAK;QACjD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,GAAW;IAEX,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,oBAAoB,OAAO,sBAAsB,GAAG,EAAE,EACtD,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAC9B,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;QAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IACE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAC/B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAC/B,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,EACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAMvC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,+CAA+C;IAC/C,MAAM,UAAU,GAA2D,EAAE,CAAC;IAC9E,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAI,KAAgD,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC3C,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC;YAAC,IAAI,GAAG,KAAK,CAAC;QAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,OAAO,YAAY,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"adopt-route.js","sourceRoot":"","sources":["../../src/adapters/adopt-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAY5D,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,sBAAsB;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,+CAA+C;QAC/C,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,oCAAoC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;YACjE,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,UAA2C,EAC3C,QAAiB;IAEjB,MAAM,MAAM,GAAG,UAAU,IAAI,iBAAiB,CAAC;IAC/C,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE5C,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,CAAE,iBAAiB;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,CAAa,KAAK;QACjD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,GAAW;IAEX,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,cAAc,CAC9B,OAAO,EACP,sBAAsB,GAAG,EAAE,EAC3B,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAC9B,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;QAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IACE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAC/B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAC/B,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,EACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAMvC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,+CAA+C;IAC/C,MAAM,UAAU,GAA2D,EAAE,CAAC;IAC9E,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAI,KAAgD,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC3C,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC;YAAC,IAAI,GAAG,KAAK,CAAC;QAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,OAAO,YAAY,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/adapters/backend/sandbox.d.ts

@@ -42,6 +42,16 @@ export interface SandboxPlan {
      *  (daemon-produced, e.g. skill plugin dirs) — bound AFTER the privacy masks so
      *  a broad hideDir can't break skill delivery. */
     readonlyRoots?: string[];
+    /** Daemon-generated private roots re-bound writable AFTER credential masks.
+     * Used for the current bot's isolated CLI home only; never accepts user
+     * config. */
+    trustedWritableRoots?: string[];
+    /** Crown-jewel masks emitted after trusted writable carve-outs. */
+    finalHideDirs?: string[];
+    finalHideFiles?: {
+        path: string;
+        empty: string;
+    }[];
     /** User-configured read-only inputs (per-bot sandboxReadonlyPaths). Bound BEFORE
      *  the privacy masks so hidePaths always win over them — an entry overlapping a
      *  masked path must never re-expose the real content. */
@@ -144,6 +154,11 @@ export interface SandboxSpawn {
  *  canonicalized dataDir under a symlink home would escape home-upper via `..` —
  *  fall back to the canonical base so it can't. */
 export declare function sandboxedClaudeDataDir(sessionId: string, realDataDir: string): string;
+/** Credential roots that must never be readable inside the file sandbox.
+ * Relay mode is the only credentialed send path; otherwise an agent could
+ * unset BOTMUX_SEND_RELAY and execute an absolute botmux binary against the
+ * real bots.json/send-cred files exposed by the HOME overlay lowerdir. */
+export declare function sandboxCredentialHidePaths(home: string, botmuxHome?: string): string[];
 /**
  * Whether the LOCAL bwrap file sandbox applies to this spawn at all.
  * - macOS enforces `sandbox: true` via the Seatbelt write-sandbox instead.
@@ -187,6 +202,10 @@ export declare function prepareSandbox(opts: {
     /** Runtime-generated roots that should be visible read-only inside bwrap.
      *  Trusted (daemon-produced) — bound after the privacy masks. */
     readonlyRoots?: readonly string[];
+    /** Daemon-derived private roots to re-open writable after mandatory masks. */
+    trustedWritablePaths?: readonly string[];
+    /** Credential paths to re-mask after trusted writable carve-outs. */
+    finalHidePaths?: readonly string[];
     /** User-configured extra read-only inputs (per-bot sandboxReadonlyPaths).
      *  Bound before the privacy masks (masks win) and rejected when they would
      *  shadow the home/project overlay roots. */
@@ -243,6 +262,9 @@ export interface RelayRequest {
     videos?: unknown;
     videoCovers?: unknown;
     flags?: unknown;
+    originTurnId?: unknown;
+    originDispatchAttempt?: unknown;
+    originCapability?: unknown;
 }
 export interface ValidatedRelay {
     contentName: string;
@@ -252,6 +274,9 @@ export interface ValidatedRelay {
     videoNames: string[];
     videoCoverNames: string[];
     flags: string[];
+    originTurnId?: string;
+    originDispatchAttempt?: number;
+    originCapability?: string;
 }
 /**
  * PURE validation of an outbox relay request (schema + flag allowlist only — no
@@ -294,6 +319,21 @@ export declare function materializeOutboxFile(outbox: string, name: string, dest
  */
 export declare function buildRelayHostEnv(baseEnv: NodeJS.ProcessEnv, preparedContentFile?: string): NodeJS.ProcessEnv;
 export declare function startOutboxWatcher(outbox: string, baseEnv: NodeJS.ProcessEnv, sessionId: string, opts?: {
+    /** Host-side authorization for a relay's claimed origin capability. When
+     *  absent the relay still runs, but carries NO durable origin — a missing
+     *  hook must never let the sandbox promote its own origin fields. */
+    authorize?: (claim: {
+        capability?: string;
+    }) => {
+        ok: true;
+        origin: {
+            turnId?: string;
+            dispatchAttempt?: number;
+        };
+    } | {
+        ok: false;
+        error: string;
+    };
     cliPath?: string;
 }): () => void;
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/adapters/backend/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/sandbox.ts"],"names":[],"mappings":"AAkCA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAqB1G;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;gFACgF;AAChF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQnD;AAqCD,MAAM,WAAW,WAAW;IAC1B;0FACsF;IACtF,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB;2DACuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C;;sEAEkE;IAClE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;sDAEkD;IAClD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;6DAEyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CA6B5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAU7E;AAoCD;;;8DAG8D;AAC9D,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GACvE,MAAM,EAAE,CAaV;AAUD;+DAC+D;AAC/D,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB;;;mFAG+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;mDAWmD;AACnD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAIrF;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC;;sFAEkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;2EACuE;IACvE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;oEAEgE;IAChE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;qEACiE;IACjE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;iDAE6C;IAC7C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,yEAAyE;IACzE,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GAAG,YAAY,GAAG,IAAI,CAqJtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,IAAI,CAsBjJ;AAiCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAoCzF;AAOD,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AASD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA4D1H;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,mBAAmB,CAAC,EAAE,MAAM,GAC3B,MAAM,CAAC,UAAU,CAcnB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9B,MAAM,IAAI,CAyGZ"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/sandbox.ts"],"names":[],"mappings":"AAkCA;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAqB1G;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;gFACgF;AAChF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQnD;AAqCD,MAAM,WAAW,WAAW;IAC1B;0FACsF;IACtF,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB;2DACuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C;;sEAEkE;IAClE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;sDAEkD;IAClD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;iBAEa;IACb,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnD;;6DAEyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAoC5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAU7E;AAoCD;;;8DAG8D;AAC9D,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GACvE,MAAM,EAAE,CAaV;AAUD;+DAC+D;AAC/D,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB;;;mFAG+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;mDAWmD;AACnD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAIrF;AAED;;;0EAG0E;AAC1E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,SAAwB,GAAG,MAAM,EAAE,CAWrG;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC;;sFAEkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;2EACuE;IACvE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;oEAEgE;IAChE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;qEACiE;IACjE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,qEAAqE;IACrE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;iDAE6C;IAC7C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,yEAAyE;IACzE,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GAAG,YAAY,GAAG,IAAI,CAsMtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,IAAI,CAsBjJ;AAiCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAoCzF;AAOD,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AASD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0F1H;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,mBAAmB,CAAC,EAAE,MAAM,GAC3B,MAAM,CAAC,UAAU,CAcnB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ;;yEAEqE;IACrE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KACvC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACnE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CACb,GACL,MAAM,IAAI,CAmIZ"}

package/dist/adapters/backend/sandbox.js

@@ -146,6 +146,16 @@ export function buildSandboxArgs(plan) {
         a.push('--tmpfs', dir);
     for (const f of plan.hideFiles)
         a.push('--ro-bind', f.empty, f.path);
+    // Re-open only daemon-derived private roots (for example this bot's own
+    // BOT_HOME) after their parent BOTMUX_HOME was blanked.
+    for (const root of plan.trustedWritableRoots ?? [])
+        a.push('--bind', root, root);
+    // A private root can itself contain a credential that the sandbox must not
+    // recover (notably send-cred.json). Re-deny those after the carve-out.
+    for (const dir of plan.finalHideDirs ?? [])
+        a.push('--tmpfs', dir);
+    for (const f of plan.finalHideFiles ?? [])
+        a.push('--ro-bind', f.empty, f.path);
     // Session-scoped TRUSTED runtime inputs, e.g. generated skill/plugin dirs —
     // after the masks so a broad hideDir can't blank skill delivery.
     for (const root of plan.readonlyRoots ?? [])
@@ -304,6 +314,22 @@ export function sandboxedClaudeDataDir(sessionId, realDataDir) {
     const rel = raw.startsWith('..') ? relative(resolveSandboxMountPath(homedir()), realDataDir) : raw;
     return join(VARTMP_ROOT, sessionId, 'home-upper', rel);
 }
+/** Credential roots that must never be readable inside the file sandbox.
+ * Relay mode is the only credentialed send path; otherwise an agent could
+ * unset BOTMUX_SEND_RELAY and execute an absolute botmux binary against the
+ * real bots.json/send-cred files exposed by the HOME overlay lowerdir. */
+export function sandboxCredentialHidePaths(home, botmuxHome = join(home, '.botmux')) {
+    // Mask the entire botmux state root. Exact-file masks are insufficient:
+    // setup/update creates timestamped bots.json backups, including ones created
+    // after a long-lived sandbox starts. Trusted skill roots and the per-session
+    // outbox are explicitly re-bound after privacy masks by buildSandboxArgs.
+    return [...new Set([
+            join(home, '.botmux'),
+            botmuxHome,
+            join(home, '.lark-cli'),
+            join(home, '.lark-cli-bots'),
+        ])].sort();
+}
 /** Proxy env vars forwarded into the sandbox so the CLI reaches the API even on
  *  the tmux backend (which otherwise only forwards a fixed whitelist). */
 const PROXY_ENV_KEYS = ['http_proxy', 'https_proxy', 'HTTP_PROXY', 'HTTPS_PROXY', 'no_proxy', 'NO_PROXY', 'all_proxy', 'ALL_PROXY'];
@@ -339,6 +365,7 @@ export function prepareSandbox(opts) {
     if (!ensureSandboxDeps(needFuse))
         return null;
     const dataDir = resolveSandboxMountPath(opts.dataDir);
+    const botmuxHome = dirname(dataDir);
     const sessionRoot = join(dataDir, 'sandboxes', opts.sessionId);
     const outbox = join(sessionRoot, 'outbox');
     const shimBin = join(sessionRoot, 'shimbin');
@@ -354,6 +381,14 @@ export function prepareSandbox(opts) {
     for (const d of [outbox, shimBin, empties])
         mkdirSync(d, { recursive: true });
     const home = resolveSandboxMountPath(homedir());
+    // Masking BOTMUX_HOME is mandatory for the credential boundary.  A layout
+    // that makes it `/` or the whole user home cannot be masked without erasing
+    // the sandbox runtime itself, so refuse the spawn instead of silently
+    // exposing the custom session/config root.
+    if (botmuxHome === '/' || botmuxHome === home) {
+        console.error(`[sandbox] unsafe SESSION_DATA_DIR layout: BOTMUX_HOME resolves to ${botmuxHome}`);
+        return null;
+    }
     // BOTMUX_SANDBOX_SRC overrides the LOWER project source for spike testing only.
     const projectSource = resolveSandboxMountPath(process.env.BOTMUX_SANDBOX_SRC || opts.sourceWorkingDir);
     const projectMount = resolveSandboxMountPath(opts.sourceWorkingDir);
@@ -385,14 +420,25 @@ export function prepareSandbox(opts) {
     const shim = join(shimBin, 'botmux');
     writeFileSync(shim, `#!/bin/sh\nexec node ${JSON.stringify(distCliJs())} "$@"\n`);
     chmodSync(shim, 0o755);
-    // Per-bot privacy masks: existing dirs → tmpfs blank; everything else → empty
-    // read-only placeholder file. No defaults (caller passes hidePaths explicitly).
+    // Credential masks are mandatory; per-bot privacy masks extend them.
+    // Existing dirs → tmpfs blank; everything else → empty read-only placeholder.
     // `~` resolves like the docs' examples (`~/.ssh`) — an unexpanded tilde would
     // fail existsSync and mask a literal `~/...` path, leaving the real one readable.
     const hideDirs = [];
     const hideFiles = [];
+    const finalHideDirs = [];
+    const finalHideFiles = [];
     let emptyIdx = 0;
-    for (const raw of opts.hidePaths ?? []) {
+    const customBotsConfig = process.env.BOTS_CONFIG?.trim();
+    const credentialPaths = [
+        // SESSION_DATA_DIR may live outside ~/.botmux.  Its parent is the
+        // authoritative BOTMUX_HOME everywhere else (send-cred, per-bot homes,
+        // sessions/receipts); mask that exact root so a custom location cannot be
+        // recovered through the sandbox's initial read-only bind of `/`.
+        ...sandboxCredentialHidePaths(home, botmuxHome),
+        ...(customBotsConfig ? [resolve(customBotsConfig)] : []),
+    ];
+    for (const raw of [...credentialPaths, ...(opts.hidePaths ?? [])]) {
         if (!raw || typeof raw !== 'string')
             continue;
         const p = expandTilde(raw, home);
@@ -413,11 +459,33 @@ export function prepareSandbox(opts) {
             hideFiles.push({ path: p, empty });
         }
     }
+    for (const raw of opts.finalHidePaths ?? []) {
+        if (!raw || typeof raw !== 'string')
+            continue;
+        const p = expandTilde(raw, home);
+        let isDir = false;
+        try {
+            isDir = existsSync(p) && statSync(p).isDirectory();
+        }
+        catch { /* */ }
+        if (isDir) {
+            finalHideDirs.push(p);
+        }
+        else {
+            const empty = join(empties, `mask-${emptyIdx++}`);
+            try {
+                writeFileSync(empty, '');
+            }
+            catch { /* */ }
+            finalHideFiles.push({ path: p, empty });
+        }
+    }
     // CLI auth/login paths kept real+writable (token refresh / login must persist,
     // unlike isolated project edits). Resolve `~` and bind only existing paths — a
     // missing auth file isn't a valid mountpoint (the CLI must be logged in on the
     // host; login-from-scratch inside the sandbox isn't supported).
     const authReal = resolveExistingPaths(opts.authPaths, home);
+    const trustedWritableRoots = resolveExistingPaths(opts.trustedWritablePaths, home);
     const readonlyRoots = resolveExistingPaths(opts.readonlyRoots, home);
     const userReadonlyRoots = resolveUserReadonlyRoots(opts.userReadonlyPaths, home, projectMount);
     const plan = {
@@ -429,6 +497,9 @@ export function prepareSandbox(opts) {
         hideDirs,
         hideFiles,
         authReal,
+        trustedWritableRoots,
+        finalHideDirs,
+        finalHideFiles,
         readonlyRoots,
         userReadonlyRoots,
         net: opts.net !== false,
@@ -459,6 +530,18 @@ export function prepareSandbox(opts) {
         BOTMUX_SEND_RELAY: outbox, // routes `botmux send` to the daemon outbox watcher
         PATH: `/run/sbxbin:${process.env.PATH ?? ''}`, // /run/sbxbin first so `botmux` = the relay shim
     };
+    // The daemon discovery dir lives under the masked BOTMUX_HOME, so the only
+    // way an in-sandbox CLI can dial the daemon's loopback IPC (session-scoped,
+    // capability-gated routes like the v3 workflow relay) is this port marker.
+    // Not a credential: every route it reaches authenticates independently.
+    if (process.env.BOTMUX_DAEMON_IPC_PORT) {
+        env.BOTMUX_DAEMON_IPC_PORT = process.env.BOTMUX_DAEMON_IPC_PORT;
+    }
+    // Never inherit a custom credential config path into the sandbox. Its host
+    // path is masked above as defense in depth, while unsetenv prevents an
+    // absolute botmux/lark client from being pointed at it explicitly.
+    args.push('--unsetenv', 'BOTS_CONFIG');
+    args.push('--unsetenv', 'BOTMUX_HOST_RELAY_AUTHORIZED');
     // Forward proxy vars so the CLI reaches the API on the tmux backend too.
     for (const k of PROXY_ENV_KEYS) {
         const v = process.env[k];
@@ -731,7 +814,36 @@ export function validateRelayRequest(req) {
         }
         return { ok: false, error: `flag not allowed: ${f}` };
     }
-    return { ok: true, value: {
+    const originTurnId = req.originTurnId === undefined
+        ? undefined
+        : typeof req.originTurnId === 'string' && req.originTurnId.trim() && req.originTurnId.length <= 256
+            ? req.originTurnId
+            : null;
+    if (originTurnId === null)
+        return { ok: false, error: 'originTurnId must be a non-empty bounded string' };
+    const originDispatchAttempt = req.originDispatchAttempt === undefined
+        ? undefined
+        : typeof req.originDispatchAttempt === 'number'
+            && Number.isSafeInteger(req.originDispatchAttempt)
+            && req.originDispatchAttempt > 0
+            ? req.originDispatchAttempt
+            : null;
+    if (originDispatchAttempt === null)
+        return { ok: false, error: 'originDispatchAttempt must be a positive safe integer' };
+    if (originDispatchAttempt !== undefined && originTurnId === undefined) {
+        return { ok: false, error: 'originDispatchAttempt requires originTurnId' };
+    }
+    const originCapability = req.originCapability === undefined
+        ? undefined
+        : typeof req.originCapability === 'string'
+            && /^[a-f0-9]{32,128}$/i.test(req.originCapability)
+            ? req.originCapability
+            : null;
+    if (originCapability === null)
+        return { ok: false, error: 'originCapability must be a bounded hex token' };
+    return {
+        ok: true,
+        value: {
             contentName: req.contentFile,
             preparedContentName,
             cardName,
@@ -739,7 +851,11 @@ export function validateRelayRequest(req) {
             videoNames,
             videoCoverNames,
             flags,
-        } };
+            ...(originTurnId !== undefined ? { originTurnId } : {}),
+            ...(originDispatchAttempt !== undefined ? { originDispatchAttempt } : {}),
+            ...(originCapability !== undefined ? { originCapability } : {}),
+        },
+    };
 }
 /**
  * TOCTOU-safe copy of an outbox file (`outbox/<name>`, name already validated as
@@ -811,6 +927,7 @@ export function buildRelayHostEnv(baseEnv, preparedContentFile) {
 }
 export function startOutboxWatcher(outbox, baseEnv, sessionId, opts = {}) {
     const cli = opts.cliPath ?? distCliJs();
+    const authorize = opts.authorize;
     const inFlight = new Set();
     // Host-private staging — a sibling of the outbox, NOT bound into the sandbox.
     const staging = join(dirname(outbox), 'relay-staging');
@@ -860,6 +977,11 @@ export function startOutboxWatcher(outbox, baseEnv, sessionId, opts = {}) {
                 finish(id, reqPath, name, staged, 1, '', `relay rejected: ${v.error}`);
                 continue;
             }
+            const authorization = authorize?.({ capability: v.value.originCapability });
+            if (authorization && !authorization.ok) {
+                finish(id, reqPath, name, staged, 2, '', `relay rejected: ${authorization.error}`);
+                continue;
+            }
             try {
                 mkdirSync(staging, { recursive: true });
             }
@@ -948,9 +1070,30 @@ export function startOutboxWatcher(outbox, baseEnv, sessionId, opts = {}) {
                 ...videoCoverPaths.flatMap(a => ['--video-covers', a]),
                 '--session-id', sessionId, // forced — sandbox cannot target another session
             ];
-            const child = spawn(process.execPath, [cli, 'send', ...hostArgs], {
-                env: buildRelayHostEnv(baseEnv, preparedContentPath),
-            });
+            // Fail closed: a durable origin (turnId/dispatchAttempt) may come ONLY
+            // from a host-side authorize decision. The sandbox controls every byte of
+            // the relay request, so its originTurnId/dispatchAttempt are never trusted
+            // — without an authorize hook the relay runs with no durable origin.
+            const trustedOrigin = authorization?.ok ? authorization.origin : undefined;
+            // Master's relay host env (BOTMUX_SEND_RELAY stripped + prepared-content
+            // local-link mode) is the base for the watcher-spawned host re-exec.
+            const requestEnv = {
+                ...buildRelayHostEnv(baseEnv, preparedContentPath),
+                BOTMUX_SESSION_ID: sessionId,
+            };
+            // The host re-exec itself is trusted (the sandbox child has this marker
+            // explicitly unset). Scrub any inherited durable-origin markers first,
+            // then re-apply only what the host authorized; cmdSend still re-validates
+            // the exact receipt/IM origin carried below.
+            requestEnv.BOTMUX_HOST_RELAY_AUTHORIZED = '1';
+            delete requestEnv.BOTMUX_TURN_ID;
+            delete requestEnv.BOTMUX_DISPATCH_ATTEMPT;
+            if (trustedOrigin?.turnId !== undefined)
+                requestEnv.BOTMUX_TURN_ID = trustedOrigin.turnId;
+            if (trustedOrigin?.dispatchAttempt !== undefined) {
+                requestEnv.BOTMUX_DISPATCH_ATTEMPT = String(trustedOrigin.dispatchAttempt);
+            }
+            const child = spawn(process.execPath, [cli, 'send', ...hostArgs], { env: requestEnv });
             let out = '', err = '';
             child.stdout.on('data', d => { out += d; });
             child.stderr.on('data', d => { err += d; });