botmux 2.111.0 → 2.112.0

package/dist/core/data-dir.js

@@ -0,0 +1,48 @@
+/**
+ * Resolve Botmux's durable data directory from one canonical precedence rule.
+ *
+ * The daemon writes `~/.botmux/.data-dir` on startup so bare-shell CLI
+ * invocations can follow custom deployments. Every durable-state reader that
+ * may run outside an injected session must use this helper; otherwise a
+ * migration writer and an execution guard can silently consult different
+ * stores.
+ */
+import { existsSync, lstatSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+function effectiveHome(env, explicit) {
+    return explicit ?? env.HOME ?? env.USERPROFILE ?? homedir();
+}
+/**
+ * Priority: SESSION_DATA_DIR > daemon breadcrumb > ~/.botmux/data.
+ *
+ * A breadcrumb is accepted only when it is a small regular file containing
+ * an absolute path to an existing directory. It deliberately does not require
+ * a sessions*.json file: a fresh daemon owns its dataDir before the first
+ * conversation, and migration state must already follow that ownership.
+ */
+export function resolveBotmuxDataDir(options = {}) {
+    const env = options.env ?? process.env;
+    const explicit = env.SESSION_DATA_DIR?.trim();
+    if (explicit)
+        return resolve(explicit);
+    const configDir = join(effectiveHome(env, options.homeDir), '.botmux');
+    const breadcrumb = join(configDir, '.data-dir');
+    try {
+        const stat = lstatSync(breadcrumb);
+        if (stat.isFile() && !stat.isSymbolicLink() && stat.size <= 4096) {
+            const candidate = readFileSync(breadcrumb, 'utf-8').trim();
+            if (candidate && isAbsolute(candidate) && existsSync(candidate)) {
+                const target = statSync(candidate);
+                if (target.isDirectory())
+                    return resolve(candidate);
+            }
+        }
+    }
+    catch {
+        // Missing, stale, unreadable, or malformed breadcrumbs fall back to the
+        // stable user data directory. They never redirect to a relative path.
+    }
+    return join(configDir, 'data');
+}
+//# sourceMappingURL=data-dir.js.map

package/dist/core/data-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-dir.js","sourceRoot":"","sources":["../../src/core/data-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQtD,SAAS,aAAa,CAAC,GAAsB,EAAE,QAAiB;IAC9D,OAAO,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAuC,EAAE;IAEzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YACjE,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,WAAW,EAAE;oBAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,sEAAsE;IACxE,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC"}

package/dist/core/inflight-input-tracker.d.ts

@@ -19,10 +19,12 @@
  * silently lost message. A false-idle blip mid-turn clears the in-flight set
  * early and degrades to the old lose-on-crash behavior for that turn only.
  */
-import type { CodexAppTurnInput } from '../types.js';
+import type { CodexAppTurnInput, VcMeetingImTurnOrigin } from '../types.js';
 export type InflightItem = {
     content: string;
     turnId?: string;
+    dispatchAttempt?: number;
+    vcMeetingImTurnOrigin?: VcMeetingImTurnOrigin;
     codexAppInput?: CodexAppTurnInput;
 };
 export declare class InflightInputTracker {
@@ -38,7 +40,7 @@ export declare class InflightInputTracker {
      *  Appends (rather than replaces) so a double exit before the respawn
      *  consumes the stash can't drop the earlier batch. Returns how many
      *  items were newly stashed by THIS exit. */
-    onCliExit(): number;
+    onCliExit(shouldCarry?: (item: InflightItem) => boolean): number;
     /** A fresh CLI is spawning: hand back everything that must be re-queued,
      *  and reset the in-flight set (a brand-new process can't have anything
      *  in flight — covers a previous life whose exit event never fired, e.g.

package/dist/core/inflight-input-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inflight-input-tracker.d.ts","sourceRoot":"","sources":["../../src/core/inflight-input-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEnG,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,SAAS,CAAsB;IAEvC,6CAA6C;IAC7C,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAIjC;;2DAEuD;IACvD,cAAc,IAAI,IAAI;IAItB;;;iDAG6C;IAC7C,SAAS,IAAI,MAAM;IAMnB;;;gCAG4B;IAC5B,aAAa,IAAI,YAAY,EAAE;CAIhC"}
+{"version":3,"file":"inflight-input-tracker.d.ts","sourceRoot":"","sources":["../../src/core/inflight-input-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC,CAAC;AAEF,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,SAAS,CAAsB;IAEvC,6CAA6C;IAC7C,OAAO,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAIjC;;2DAEuD;IACvD,cAAc,IAAI,IAAI;IAItB;;;iDAG6C;IAC7C,SAAS,CAAC,WAAW,GAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAoB,GAAG,MAAM;IAO5E;;;gCAG4B;IAC5B,aAAa,IAAI,YAAY,EAAE;CAIhC"}

package/dist/core/inflight-input-tracker.js

@@ -36,11 +36,12 @@ export class InflightInputTracker {
      *  Appends (rather than replaces) so a double exit before the respawn
      *  consumes the stash can't drop the earlier batch. Returns how many
      *  items were newly stashed by THIS exit. */
-    onCliExit() {
-        const n = this.unacked.length;
-        if (n > 0)
-            this.carryOver.push(...this.unacked.splice(0));
-        return n;
+    onCliExit(shouldCarry = () => true) {
+        const exiting = this.unacked.splice(0);
+        const carried = exiting.filter(shouldCarry);
+        if (carried.length > 0)
+            this.carryOver.push(...carried);
+        return carried.length;
     }
     /** A fresh CLI is spawning: hand back everything that must be re-queued,
      *  and reset the in-flight set (a brand-new process can't have anything

package/dist/core/inflight-input-tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"inflight-input-tracker.js","sourceRoot":"","sources":["../../src/core/inflight-input-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,MAAM,OAAO,oBAAoB;IACvB,OAAO,GAAmB,EAAE,CAAC;IAC7B,SAAS,GAAmB,EAAE,CAAC;IAEvC,6CAA6C;IAC7C,OAAO,CAAC,IAAkB;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;2DAEuD;IACvD,cAAc;QACZ,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;;iDAG6C;IAC7C,SAAS;QACP,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;gCAG4B;IAC5B,aAAa;QACX,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"inflight-input-tracker.js","sourceRoot":"","sources":["../../src/core/inflight-input-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAYH,MAAM,OAAO,oBAAoB;IACvB,OAAO,GAAmB,EAAE,CAAC;IAC7B,SAAS,GAAmB,EAAE,CAAC;IAEvC,6CAA6C;IAC7C,OAAO,CAAC,IAAkB;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;2DAEuD;IACvD,cAAc;QACZ,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;;iDAG6C;IAC7C,SAAS,CAAC,cAA+C,GAAG,EAAE,CAAC,IAAI;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED;;;gCAG4B;IAC5B,aAAa;QACX,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;CACF"}

package/dist/core/inject-queue-policy.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Worker inject-queue policy — pure decision functions for how the TUI
+ * injection queue (`pendingInjections`) interacts with user-message flushing.
+ *
+ * `barrier=true` marks an injection that carries a cwd move (e.g. `/cd`):
+ * the CLI process is still executing in its OLD working directory until that
+ * line has actually been typed in and consumed, even though botmux's own
+ * session record already reflects the NEW directory. Any user message
+ * written before the barrier drains would land in the CLI while it's still
+ * sitting in the old cwd — silently wrong, and easy to miss because nothing
+ * throws.
+ *
+ * Two call sites need the exact same judgement:
+ *  - `markPromptReady()` (idle path): once idle, should we drain
+ *    `pendingInjections` before `pendingMessages`?
+ *  - `flushPending()` (type-ahead path): type-ahead-capable adapters
+ *    (Claude family) call `flushPending()` straight from `sendToPty()` even
+ *    while the CLI is BUSY — that path bypasses `markPromptReady()` entirely,
+ *    so it needs its own barrier check or a `/cd` queued while busy would be
+ *    overtaken by the very next type-ahead user message.
+ *
+ * Extracted here (instead of inlined at both call sites in the very large
+ * worker.ts) so the queueing policy has a unit-testable surface independent
+ * of PTY/backend/session state.
+ */
+export interface PendingInjection {
+    command: string;
+    /** True when this injection carries a cwd move (e.g. `/cd`) and must drain before any user message. */
+    barrier: boolean;
+}
+/**
+ * True when a user-message flush (`flushPending()`) must be deferred because
+ * a barrier injection is still queued. Applies to BOTH the idle flush path and
+ * the type-ahead path — a barrier blocks user writes regardless of how the
+ * flush was triggered.
+ */
+export declare function shouldDeferUserFlush(pending: readonly PendingInjection[]): boolean;
+/**
+ * True when, on reaching idle, the injection queue should be drained before
+ * the user-message queue. A barrier anywhere in the queue means injections go
+ * first; non-barrier injections alone don't need to preempt user messages.
+ */
+export declare function shouldFlushInjectionsFirst(pending: readonly PendingInjection[]): boolean;
+/** Writer-state snapshot for deciding whether an injection flush may START.
+ *  All fields are other writers that own (or may own) the PTY input line. */
+export interface InjectionFlushGate {
+    /** An injection flush is already draining (re-entrancy mutex). */
+    injectionFlushing: boolean;
+    /** A user-message flush holds its mutex. markPromptReady can fire while a
+     *  flush is mid-write (spurious idle during startup-command quiescence or a
+     *  slow submit-verify window) and would otherwise start typing an injection
+     *  into a composer that already holds half a user message. flushPending
+     *  checks `injectionFlushing` in the opposite direction — the exclusion must
+     *  be symmetric or it isn't an exclusion. */
+    userFlushing: boolean;
+    /** Native /rename owns the TUI until its confirmation, beyond the raw write
+     *  window itself. */
+    sessionRenameInFlight: boolean;
+    /** A literal command-line write (text → beat → Enter) is in flight. */
+    commandLineWritesPending: number;
+    /** Launch failed into a bare shell — never type commands into it. */
+    bareShellLaunchBlocked: boolean;
+}
+/**
+ * True when `flushPendingInjections()` may begin draining the queue. Deferred
+ * injections are not lost: the queue persists and the next genuine
+ * `markPromptReady()` re-kicks the drain once the competing writer is done.
+ */
+export declare function canStartInjectionFlush(gate: InjectionFlushGate): boolean;
+//# sourceMappingURL=inject-queue-policy.d.ts.map

package/dist/core/inject-queue-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inject-queue-policy.d.ts","sourceRoot":"","sources":["../../src/core/inject-queue-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,GAAG,OAAO,CAElF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,GAAG,OAAO,CAExF;AAED;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;iDAK6C;IAC7C,YAAY,EAAE,OAAO,CAAC;IACtB;yBACqB;IACrB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,wBAAwB,EAAE,MAAM,CAAC;IACjC,qEAAqE;IACrE,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAMxE"}

package/dist/core/inject-queue-policy.js

@@ -0,0 +1,30 @@
+/**
+ * True when a user-message flush (`flushPending()`) must be deferred because
+ * a barrier injection is still queued. Applies to BOTH the idle flush path and
+ * the type-ahead path — a barrier blocks user writes regardless of how the
+ * flush was triggered.
+ */
+export function shouldDeferUserFlush(pending) {
+    return pending.some(i => i.barrier);
+}
+/**
+ * True when, on reaching idle, the injection queue should be drained before
+ * the user-message queue. A barrier anywhere in the queue means injections go
+ * first; non-barrier injections alone don't need to preempt user messages.
+ */
+export function shouldFlushInjectionsFirst(pending) {
+    return pending.some(i => i.barrier);
+}
+/**
+ * True when `flushPendingInjections()` may begin draining the queue. Deferred
+ * injections are not lost: the queue persists and the next genuine
+ * `markPromptReady()` re-kicks the drain once the competing writer is done.
+ */
+export function canStartInjectionFlush(gate) {
+    return !gate.injectionFlushing
+        && !gate.userFlushing
+        && !gate.sessionRenameInFlight
+        && gate.commandLineWritesPending === 0
+        && !gate.bareShellLaunchBlocked;
+}
+//# sourceMappingURL=inject-queue-policy.js.map

package/dist/core/inject-queue-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inject-queue-policy.js","sourceRoot":"","sources":["../../src/core/inject-queue-policy.ts"],"names":[],"mappings":"AA+BA;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoC;IACvE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAoC;IAC7E,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAuBD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,OAAO,CAAC,IAAI,CAAC,iBAAiB;WACzB,CAAC,IAAI,CAAC,YAAY;WAClB,CAAC,IAAI,CAAC,qBAAqB;WAC3B,IAAI,CAAC,wBAAwB,KAAK,CAAC;WACnC,CAAC,IAAI,CAAC,sBAAsB,CAAC;AACpC,CAAC"}

package/dist/core/maintenance.d.ts

@@ -16,7 +16,7 @@ export interface MaintenanceDeps {
     isLocalDev: () => boolean;
     /** Current on-disk botmux version (read fresh — changes after runUpdate). */
     currentVersion: () => string;
-    /** Updates the owning npm/pnpm global install (download/install only). */
+    /** Updates the owning npm/pnpm/Bun global install (download/install only). */
     runUpdate: () => void;
     writeIntent: (intent: RestartIntent) => void;
     /** Spawn a detached `botmux restart` (this process is then killed by pm2). */

package/dist/core/maintenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/core/maintenance.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG/E,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAQ7F,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAChD,SAAS,EAAE,MAAM,gBAAgB,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA6C9D;AAMD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CASpE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAM9E;AAID;2CAC2C;AAC3C,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAE1C;uEACuE;AACvE,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,iBAA8C,GAAG,IAAI,CAUlG;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,IAAI,MAAM,CAItD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,GACjB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAGjC;AAWD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CA4BrF;AAqCD,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,IAAI,CAavC;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}
+{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../src/core/maintenance.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG/E,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAQ7F,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAChD,SAAS,EAAE,MAAM,gBAAgB,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA6C9D;AAMD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CASpE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAM9E;AAID;2CAC2C;AAC3C,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAE1C;uEACuE;AACvE,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,iBAA8C,GAAG,IAAI,CAWlG;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,IAAI,MAAM,CAItD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,GACjB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAGjC;AAWD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CA4BrF;AAqCD,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,IAAI,CAavC;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/core/maintenance.js

@@ -6,7 +6,7 @@
  * At the scheduled local time (Asia/Shanghai, once/day) it:
  *  - checks the cross-daemon busy gate (anyDaemonBusy) — a session mid-CLI-turn
  *    anywhere defers the run to the next day (no retry);
- *  - auto-update (npm/pnpm global): update the package with its owning package
+ *  - auto-update (npm/pnpm/Bun global): update the package with its owning package
  *    manager, then restart
  *    to apply iff the version actually changed;
  *  - auto-restart: just restart.
@@ -131,8 +131,9 @@ export function globalInstallUpdateCwd() {
 export function installLatestBotmuxSync(plan = resolveGlobalInstallPlan()) {
     const result = spawnSync(plan.command, plan.args, {
         cwd: globalInstallUpdateCwd(),
+        env: { ...process.env, ...plan.env },
         stdio: 'inherit',
-        shell: process.platform === 'win32', // resolve npm.cmd / pnpm.cmd
+        shell: process.platform === 'win32', // resolve npm.cmd / pnpm.cmd / bun.exe
     });
     if (result.error)
         throw result.error;

package/dist/core/maintenance.js.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../../src/core/maintenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAA0B,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAsB,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAwBzD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO;QAAE,OAAO,CAAC,0CAA0C;IAEjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEnC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1E,KAAK,CAAC,UAAU,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO;IAEnC,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACtB,GAAG,CAAC,sEAAsE,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,+DAA+D,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACpC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,GAAG,CAAC,gBAAgB,MAAM,MAAM,KAAK,uBAAuB,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,0BAA0B,KAAK,SAAS,MAAM,+CAA+C,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,6DAA6D;AAE7D,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,CAAmB;IACtE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,8BAA8B;AAE9B;2CAC2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;uEACuE;AACvE,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,uBAAuB,CAAC,OAA0B,wBAAwB,EAAE;IAC1F,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;QAChD,GAAG,EAAE,sBAAsB,EAAE;QAC7B,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,6BAA6B;KACnE,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,wBAAwB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B;IAC3C,2EAA2E;IAC3E,gDAAgD;IAChD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAgB,EAChB,SAAkB;IAElB,IAAI,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;IAC3E,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,QAAQ,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,iBAA0B;IAC7E,MAAM,OAAO,GAAG,yBAAyB,EAAE,CAAC;IAC5C,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5B,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,uBAAuB,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,SAAS,CAAC,CAAC,iEAAiE;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAC5F,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;QACvD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,8EAA8E;QAC9E,uEAAuE;QACvE,qFAAqF;QACrF,GAAG,EAAE,sBAAsB,EAAE;KAC9B,CAAC,CAAC;IACH,uEAAuE;IACvE,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,8EAA8E;IAC9E,qEAAqE;IACrE,qCAAqC;IACrC,IAAI,WAA0C,CAAC;IAC/C,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,WAAW;QAChD,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAC/D,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;QAC9B,UAAU,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE;QACrC,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;YAC/B,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAChD,CAAC,CAAC,aAAa,EAAE;QACnB,SAAS,EAAE,GAAG,EAAE;YACd,WAAW,KAAK,wBAAwB,EAAE,CAAC;YAC3C,oEAAoE;YACpE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,+CAA+C;YAC/C,gBAAgB,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE;gBACrD,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvC,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACnD,cAAc,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,aAAa,EAAE,WAAW,EAAE,iBAAiB,CAAC;QACzF,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,GAAG,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,IAAI,KAAiC,CAAC;AAEtC,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB;IAC9B,IAAI,KAAK;QAAE,OAAO;IAClB,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,CAAC;YAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC;IACF,oEAAoE;IACpE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACnC,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC/C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,KAAK,EAAE,CAAC;QAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC;IAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../../src/core/maintenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAA0B,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAsB,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAwBzD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO;QAAE,OAAO,CAAC,0CAA0C;IAEjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEnC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1E,KAAK,CAAC,UAAU,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO;IAEnC,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACtB,GAAG,CAAC,sEAAsE,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnB,GAAG,CAAC,+DAA+D,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACpC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,GAAG,CAAC,gBAAgB,MAAM,MAAM,KAAK,uBAAuB,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,0BAA0B,KAAK,SAAS,MAAM,+CAA+C,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,6DAA6D;AAE7D,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,CAAmB;IACtE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,8BAA8B;AAE9B;2CAC2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;uEACuE;AACvE,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,uBAAuB,CAAC,OAA0B,wBAAwB,EAAE;IAC1F,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;QAChD,GAAG,EAAE,sBAAsB,EAAE;QAC7B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;QACpC,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,uCAAuC;KAC7E,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,wBAAwB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B;IAC3C,2EAA2E;IAC3E,gDAAgD;IAChD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAgB,EAChB,SAAkB;IAElB,IAAI,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;IAC3E,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,QAAQ,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,iBAA0B;IAC7E,MAAM,OAAO,GAAG,yBAAyB,EAAE,CAAC;IAC5C,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5B,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,uBAAuB,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,SAAS,CAAC,CAAC,iEAAiE;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAC5F,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;QACvD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,8EAA8E;QAC9E,uEAAuE;QACvE,qFAAqF;QACrF,GAAG,EAAE,sBAAsB,EAAE;KAC9B,CAAC,CAAC;IACH,uEAAuE;IACvE,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,8EAA8E;IAC9E,qEAAqE;IACrE,qCAAqC;IACrC,IAAI,WAA0C,CAAC;IAC/C,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,WAAW;QAChD,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAC/D,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;QAC9B,UAAU,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE;QACrC,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;YAC/B,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAChD,CAAC,CAAC,aAAa,EAAE;QACnB,SAAS,EAAE,GAAG,EAAE;YACd,WAAW,KAAK,wBAAwB,EAAE,CAAC;YAC3C,oEAAoE;YACpE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,+CAA+C;YAC/C,gBAAgB,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE;gBACrD,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvC,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACnD,cAAc,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,aAAa,EAAE,WAAW,EAAE,iBAAiB,CAAC;QACzF,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,GAAG,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,IAAI,KAAiC,CAAC;AAEtC,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB;IAC9B,IAAI,KAAK;QAAE,OAAO;IAClB,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,CAAC;YAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC;IACF,oEAAoE;IACpE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACnC,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC/C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,KAAK,EAAE,CAAC;QAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC;IAAC,CAAC;AACzD,CAAC"}

package/dist/core/managed-origin-capability.d.ts

@@ -0,0 +1,30 @@
+export declare const RELAY_ORIGIN_CAPABILITY_BASENAME = ".botmux-origin-capability.json";
+export interface ManagedOriginCapabilityClaim {
+    sessionId: string;
+    capability: string;
+    turnId?: string;
+    dispatchAttempt?: number;
+}
+/**
+ * Per-session path used by macOS read-isolated CLIs to read only their own
+ * rotating daemon-IPC capability. Hashing keeps an untrusted session id out of
+ * the path while still letting the worker and CLI derive the same filename.
+ * The parent is denied wholesale by the Seatbelt profile; only this exact file
+ * is carved back in for the owning session.
+ */
+export declare function managedOriginCapabilityPath(dataDir: string, sessionId: string): string;
+/**
+ * Atomically replace a capability file without following an attacker-planted
+ * destination symlink. The generic atomic writer intentionally follows
+ * symlinks for user-managed dotfiles; authority files need the opposite
+ * contract so an isolated child cannot redirect the worker's next rotation.
+ */
+export declare function replaceManagedOriginCapabilityFile(filePath: string, body: string): void;
+/**
+ * Read the current origin claim from the per-session sandbox relay (Linux) or
+ * the exact Seatbelt carve-out (macOS). A file is only transport: the daemon
+ * still compares the token with its live worker registry, so stale files and
+ * forged tuple fields never confer authority.
+ */
+export declare function readManagedOriginCapability(dataDir: string, sessionId: string | undefined, relayDir?: string): ManagedOriginCapabilityClaim | null;
+//# sourceMappingURL=managed-origin-capability.d.ts.map

package/dist/core/managed-origin-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-origin-capability.d.ts","sourceRoot":"","sources":["../../src/core/managed-origin-capability.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,gCAAgC,mCAAmC,CAAC;AAEjF,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGtF;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBvF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,CAAC,EAAE,MAAM,GAChB,4BAA4B,GAAG,IAAI,CAwCrC"}

package/dist/core/managed-origin-capability.js

@@ -0,0 +1,88 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { dirname, join } from 'node:path';
+export const RELAY_ORIGIN_CAPABILITY_BASENAME = '.botmux-origin-capability.json';
+/**
+ * Per-session path used by macOS read-isolated CLIs to read only their own
+ * rotating daemon-IPC capability. Hashing keeps an untrusted session id out of
+ * the path while still letting the worker and CLI derive the same filename.
+ * The parent is denied wholesale by the Seatbelt profile; only this exact file
+ * is carved back in for the owning session.
+ */
+export function managedOriginCapabilityPath(dataDir, sessionId) {
+    const digest = createHash('sha256').update(sessionId).digest('hex');
+    return join(dataDir, 'read-isolation', `origin-${digest}.json`);
+}
+/**
+ * Atomically replace a capability file without following an attacker-planted
+ * destination symlink. The generic atomic writer intentionally follows
+ * symlinks for user-managed dotfiles; authority files need the opposite
+ * contract so an isolated child cannot redirect the worker's next rotation.
+ */
+export function replaceManagedOriginCapabilityFile(filePath, body) {
+    const parent = dirname(filePath);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const parentStat = lstatSync(parent);
+    if (!parentStat.isDirectory() || parentStat.isSymbolicLink()) {
+        throw new Error(`managed origin capability parent is not a real directory: ${parent}`);
+    }
+    const temp = `${filePath}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+    try {
+        writeFileSync(temp, body, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+        // rename replaces the destination directory entry itself; unlike opening
+        // filePath, it does not dereference an existing destination symlink.
+        renameSync(temp, filePath);
+    }
+    catch (error) {
+        try {
+            unlinkSync(temp);
+        }
+        catch { /* temp may not have been created */ }
+        throw error;
+    }
+}
+/**
+ * Read the current origin claim from the per-session sandbox relay (Linux) or
+ * the exact Seatbelt carve-out (macOS). A file is only transport: the daemon
+ * still compares the token with its live worker registry, so stale files and
+ * forged tuple fields never confer authority.
+ */
+export function readManagedOriginCapability(dataDir, sessionId, relayDir) {
+    if (!sessionId)
+        return null;
+    const relay = !!relayDir;
+    const path = relay
+        ? join(relayDir, RELAY_ORIGIN_CAPABILITY_BASENAME)
+        : managedOriginCapabilityPath(dataDir, sessionId);
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (!relay && parsed.sessionId !== sessionId)
+            return null;
+        const capability = typeof parsed.capability === 'string'
+            ? parsed.capability
+            : parsed.token;
+        if (typeof capability !== 'string' || !/^[a-f0-9]{32,128}$/i.test(capability)) {
+            return null;
+        }
+        const turnId = typeof parsed.turnId === 'string'
+            && parsed.turnId.length > 0
+            && parsed.turnId.length <= 256
+            ? parsed.turnId
+            : undefined;
+        const dispatchAttempt = typeof parsed.dispatchAttempt === 'number'
+            && Number.isSafeInteger(parsed.dispatchAttempt)
+            && parsed.dispatchAttempt > 0
+            ? parsed.dispatchAttempt
+            : undefined;
+        return {
+            sessionId,
+            capability,
+            ...(turnId ? { turnId } : {}),
+            ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=managed-origin-capability.js.map

package/dist/core/managed-origin-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-origin-capability.js","sourceRoot":"","sources":["../../src/core/managed-origin-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,GAC1E,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AASjF;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe,EAAE,SAAiB;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,MAAM,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAAgB,EAAE,IAAY;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChF,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,SAA6B,EAC7B,QAAiB;IAEjB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,IAAI,CAAC,QAAS,EAAE,gCAAgC,CAAC;QACnD,CAAC,CAAC,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAMnD,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACtD,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACjB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;eAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;eACxB,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;YAC9B,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;eAC7D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;eAC5C,MAAM,CAAC,eAAe,GAAG,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,SAAS;YACT,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/core/role-library.d.ts

@@ -0,0 +1,15 @@
+/** 角色库根：v0 固定约定，不做配置。 */
+export declare function roleLibraryRoot(): string;
+/**
+ * botmux cd 的目标目录硬校验（调用方是模型，不可信）：
+ * realpath 归一化（防 ../ 与符号链接逃逸）→ 必须位于角色库根之下
+ * （文件系统身份 dev+ino 比较，防前缀兄弟目录与大小写变体绕过）→ 必须是已存在的目录。
+ */
+export declare function validateRoleLibraryPath(input: string, rootOverride?: string): {
+    ok: true;
+    resolvedPath: string;
+} | {
+    ok: false;
+    error: string;
+};
+//# sourceMappingURL=role-library.d.ts.map

package/dist/core/role-library.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-library.d.ts","sourceRoot":"","sources":["../../src/core/role-library.ts"],"names":[],"mappings":"AAIA,yBAAyB;AACzB,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAiBD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA4BnE"}

package/dist/core/role-library.js

@@ -0,0 +1,75 @@
+import { realpathSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+/** 角色库根：v0 固定约定，不做配置。 */
+export function roleLibraryRoot() {
+    return join(homedir(), 'botmux-roles');
+}
+/** 文件系统身份包含判断（dev+ino）：从 childReal 逐级向上，某祖先与 rootReal 同一目录即包含。
+ *  不依赖字符串大小写语义——大小写敏感/不敏感卷、darwin/linux 行为一致。
+ *  childReal === rootReal 时首个检查从其父目录开始，天然拒绝根本身。 */
+function isContainedIn(childReal, rootReal) {
+    const root = statSync(rootReal);
+    let cur = childReal;
+    while (true) {
+        const parent = dirname(cur);
+        if (parent === cur)
+            return false;
+        const st = statSync(parent);
+        if (st.dev === root.dev && st.ino === root.ino)
+            return true;
+        cur = parent;
+    }
+}
+/**
+ * botmux cd 的目标目录硬校验（调用方是模型，不可信）：
+ * realpath 归一化（防 ../ 与符号链接逃逸）→ 必须位于角色库根之下
+ * （文件系统身份 dev+ino 比较，防前缀兄弟目录与大小写变体绕过）→ 必须是已存在的目录。
+ */
+export function validateRoleLibraryPath(input, rootOverride) {
+    const raw = (input ?? '').trim();
+    if (!raw)
+        return { ok: false, error: 'empty_path' };
+    // 维持「单行注入」不变量（与 slash 校验的 multiline_rejected 对称）：拒绝内嵌
+    // 控制字符，防止 /cd 路径把第二条命令伪装进注入的 text→Enter 窗口。范围覆盖全部
+    // C0 控制字符 + DEL（\x00-\x1f\x7f），不只是 \r\n——tab、ESC（\x1b，可能携带
+    // 终端转义序列）、backspace 等同样能在 sendRawCommandLine 的 text→Enter 窗口里
+    // 污染 TUI 输入行。
+    if (/[\x00-\x1f\x7f]/.test(raw))
+        return { ok: false, error: 'invalid_path_chars' };
+    // `~` 展开，与 IM /cd 的 validateWorkingDir 行为一致：调用方（模型）常写带引号的
+    // "~/botmux-roles/..."（shell 不展开），不该因此误报 dir_not_found。裸 `~` 展开后
+    // 是 home 本身，仍会被下面的包含性判断拒绝。
+    const expanded = raw === '~' ? homedir()
+        : raw.startsWith('~/') ? join(homedir(), raw.slice(2))
+            : raw;
+    let rootReal;
+    try {
+        rootReal = realpathSync(rootOverride ?? roleLibraryRoot());
+    }
+    catch {
+        return { ok: false, error: 'role_library_missing' };
+    }
+    let real;
+    try {
+        real = realpathSync(expanded);
+    }
+    catch {
+        return { ok: false, error: 'dir_not_found' };
+    }
+    // 库内符号链接可能指向含换行等控制字符的目录名，把 raw 处的干净校验洗掉——
+    // resolvedPath 是最终写回调用方（进而可能被注入）的值，必须同样校验。
+    if (/[\x00-\x1f\x7f]/.test(real))
+        return { ok: false, error: 'invalid_path_chars' };
+    if (!isContainedIn(real, rootReal))
+        return { ok: false, error: 'outside_role_library' };
+    try {
+        if (!statSync(real).isDirectory())
+            return { ok: false, error: 'not_a_directory' };
+    }
+    catch {
+        return { ok: false, error: 'dir_not_found' };
+    }
+    return { ok: true, resolvedPath: real };
+}
+//# sourceMappingURL=role-library.js.map

package/dist/core/role-library.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-library.js","sourceRoot":"","sources":["../../src/core/role-library.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,yBAAyB;AACzB,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED;;mDAEmD;AACnD,SAAS,aAAa,CAAC,SAAiB,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,GAAG,GAAG,SAAS,CAAC;IACpB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5D,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,YAAqB;IAErB,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACpD,sDAAsD;IACtD,kDAAkD;IAClD,2DAA2D;IAC3D,8DAA8D;IAC9D,cAAc;IACd,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACnF,0DAA0D;IAC1D,iEAAiE;IACjE,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;QACtC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC,GAAG,CAAC;IACR,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,QAAQ,GAAG,YAAY,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC,CAAC;IAAC,CAAC;IACnE,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAAC,CAAC;IAC9D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IACtC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAAC,CAAC;IACvD,0CAA0C;IAC1C,2CAA2C;IAC3C,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACpF,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IACxF,IAAI,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAAC,CAAC;IAC1F,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAAC,CAAC;IACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC"}

package/dist/core/session-cwd.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Shared helper for repinning a topic session's working directory.
+ * Extracted from the `/cd` command handler so the upcoming dashboard IPC
+ * `cd` route (Task 9) can reuse the exact same daemon-record write path.
+ */
+import type { DaemonSession } from './types.js';
+/**
+ * 重钉一个话题会话的工作目录（daemon 记录 = 唯一事实源）：
+ * 内存（ds.workingDir / ds.session.workingDir）+ sessions 文件落盘。
+ * 注意统一存 resolvedPath（修正 /cd 历史行为：曾存用户原始输入如 "~/x"，
+ * 现改为 validateWorkingDir 产出的已展开/已归一化绝对路径）。
+ */
+export declare function repinSessionWorkingDir(ds: DaemonSession, resolvedPath: string): void;
+//# sourceMappingURL=session-cwd.d.ts.map

package/dist/core/session-cwd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cwd.d.ts","sourceRoot":"","sources":["../../src/core/session-cwd.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAQpF"}

package/dist/core/session-cwd.js

@@ -0,0 +1,17 @@
+import * as sessionStore from '../services/session-store.js';
+/**
+ * 重钉一个话题会话的工作目录（daemon 记录 = 唯一事实源）：
+ * 内存（ds.workingDir / ds.session.workingDir）+ sessions 文件落盘。
+ * 注意统一存 resolvedPath（修正 /cd 历史行为：曾存用户原始输入如 "~/x"，
+ * 现改为 validateWorkingDir 产出的已展开/已归一化绝对路径）。
+ */
+export function repinSessionWorkingDir(ds, resolvedPath) {
+    ds.workingDir = resolvedPath;
+    ds.session.workingDir = resolvedPath;
+    // cwd 变了，riff 多仓 stamp（选择卡多选时写入）随之失效——保留会让下次
+    // refork 仍按旧仓库组合推导、无视新目录。IM /cd 与 IPC cd 路由共用本函数，
+    // 两条改 cwd 的路径都必须清。
+    ds.session.riffRepoDirs = undefined;
+    sessionStore.updateSession(ds.session);
+}
+//# sourceMappingURL=session-cwd.js.map

package/dist/core/session-cwd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cwd.js","sourceRoot":"","sources":["../../src/core/session-cwd.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAiB,EAAE,YAAoB;IAC5E,EAAE,CAAC,UAAU,GAAG,YAAY,CAAC;IAC7B,EAAE,CAAC,OAAO,CAAC,UAAU,GAAG,YAAY,CAAC;IACrC,6CAA6C;IAC7C,kDAAkD;IAClD,mBAAmB;IACnB,EAAE,CAAC,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IACpC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/dist/core/session-manager.d.ts

@@ -297,13 +297,16 @@ export declare function ensureTerminalWorkerPort(ds: DaemonSession): Promise<num
  *                          a fresh thread session); refuse rather than clobber
  *   - 'adopt_unsupported' — adopt sessions are torn down by /close and have
  *                          no resume semantics
+ *   - 'vc_receiver_managed' — dedicated meeting receivers are reconstructed
+ *                          through the meeting membership/hub lifecycle; a
+ *                          manual resume could resurrect a stale member epoch
  */
 export declare function resumeSession(sessionId: string, activeSessions: Map<string, DaemonSession>): Promise<{
     ok: true;
     ds: DaemonSession;
 } | {
     ok: false;
-    error: 'not_found' | 'not_closed' | 'anchor_occupied' | 'adopt_unsupported';
+    error: 'not_found' | 'not_closed' | 'anchor_occupied' | 'adopt_unsupported' | 'vc_receiver_managed';
     activeSessionId?: string;
 }>;
 export declare function executeScheduledTask(task: ScheduledTask, activeSessions: Map<string, DaemonSession>, refreshCliVersion: (...args: any[]) => boolean): Promise<void>;