botmux 2.111.0 → 2.112.0

package/dist/core/worker-pool.js

@@ -28,6 +28,7 @@ import { botLocale, localeForBot, t as tr } from '../i18n/index.js';
 import { claudeJsonlPathForSession } from '../adapters/cli/claude-code.js';
 import { findUniqueClaudeSessionByCwd } from './session-discovery.js';
 import { buildMarkdownCard, buildContextualReplyCard } from '../im/lark/md-card.js';
+import { renderBrandTemplate } from '../im/lark/brand-template.js';
 import { replyToDocComment, chunkCommentText, unsubscribeDocFile, removeCommentReaction } from '../im/lark/doc-comment.js';
 import { listDocSubscriptionsForSession, removeDocSubscription } from '../services/doc-subs-store.js';
 import { TmuxBackend } from '../adapters/backend/tmux-backend.js';
@@ -39,6 +40,9 @@ import { getBot, getAllBots, resolveBrandLabel } from '../bot-registry.js';
  *  isolated persistent panes so a suspend→resume reattach (same id) is
  *  distinguishable from a pane surviving a daemon restart (different id). */
 const DAEMON_BOOT_ID = randomUUID();
+export function getDaemonBootId() {
+    return DAEMON_BOOT_ID;
+}
 function daemonCardLocalHomeLinkMode(ds) {
     // The daemon is outside file/read isolation. Never use its host namespace
     // to disambiguate isolated or remote output; lexical repair performs no
@@ -62,11 +66,15 @@ import { emitSessionLifecycleHook, emitSessionStateTransitionHook } from '../ser
 import { anchorUsageForDaemonSession, recordOwnershipForDaemonSession, recordUsageForDaemonSession, reconcileUsageForDaemonSession } from '../services/usage-ledger.js';
 import { isStructuredBridgeAdoptCli } from '../services/structured-bridge-clis.js';
 import { ensureGatewayEntry } from './plugins/mcp/gateway-installer.js';
-import { sessionKey, sessionAnchorId, isDocNativeSession } from './types.js';
+import { activeSessionKey, sessionKey, sessionAnchorId, isDocNativeSession } from './types.js';
 import { DONE_REACTION_EMOJI_TYPE } from './pending-response.js';
 import { buildTerminalUrl } from './terminal-url.js';
 import { prependBotmuxBin } from './botmux-wrapper.js';
 import { usageLimitStateKey } from '../utils/cli-usage-limit.js';
+import { evaluateVcMeetingManagedSend, resolveVcMeetingImTurnOrigin, } from '../services/vc-meeting-send-policy.js';
+import { finishVcMeetingImReply, prepareVcMeetingDeliveryReply, prepareVcMeetingImReply, } from '../services/vc-meeting-im-reply.js';
+import { neutralizeLarkAtTags } from '../services/send-policy.js';
+import { recordVcMeetingListenerMessage } from '../services/vc-meeting-listener-message-store.js';
 import { isLocalCliOpenEnabled, isLocalCliOpenReady } from '../services/local-cli-opener.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -365,6 +373,11 @@ export function cardUsageLimit(ds) {
     return ds.lastScreenStatus === 'limited' ? ds.usageLimit : undefined;
 }
 function scheduleUsageLimitCardPatch(ds) {
+    // Dedicated VC receivers keep limit state for dashboard/audit only. A timer
+    // must never revive or mutate an old/manual Lark card after the synchronous
+    // screen_update path has already suppressed auxiliary UI.
+    if (ds.session.vcMeetingReceiver)
+        return;
     if (ds.lastScreenStatus !== 'limited')
         return;
     const port = ds.workerPort ?? ds.session.webPort;
@@ -520,6 +533,10 @@ export function recallFrozenCards(ds) {
  * that so the card keeps live-patching afterwards even when the bot opted out.
  */
 export async function postFreshStreamingCard(ds, sessionReply) {
+    // Receiver terminals can contain meeting-derived private context. Never
+    // publish one into the listener chat as a streaming-card side channel.
+    if (ds.session.vcMeetingReceiver)
+        return false;
     if (isDocNativeSession(ds))
         return false;
     const port = ds.workerPort ?? ds.session.webPort;
@@ -1006,6 +1023,11 @@ export function ensureClaudeFolderTrust(workingDir, stateJsonPath = join(homedir
 // ─── Kill worker ────────────────────────────────────────────────────────────
 export function killWorker(ds) {
     clearUsageLimitState(ds);
+    // A managed-turn capability belongs to one concrete worker generation.
+    // Retiring (or observing the absence of) that generation must revoke the
+    // daemon-side copy synchronously; the worker may never get a chance to send
+    // its ordered revoke IPC on close/crash paths.
+    ds.managedTurnOrigin = undefined;
     if (!ds.worker || ds.worker.killed) {
         // No live worker to receive {type:'close'}, so its destroySession() — which
         // tears down the persistent backing session (tmux/herdr/zellij) — never
@@ -1030,6 +1052,7 @@ export function killWorker(ds) {
     ds.worker = null;
     ds.workerPort = null;
     ds.workerToken = null;
+    ds.workerViewToken = null;
 }
 /**
  * Tear down a persistent backing session (tmux/herdr/zellij) directly from the
@@ -1098,8 +1121,11 @@ function reclaimParkedCrashDiagnostic(ds) {
     catch { /* absent — benign */ }
 }
 export function suspendWorker(ds, reason = 'suspended_idle') {
-    if (!ds.worker || ds.worker.killed)
+    if (!ds.worker || ds.worker.killed) {
+        // There is no live generation that can still own this capability.
+        ds.managedTurnOrigin = undefined;
         return false;
+    }
     if (!isSuspendableBackendType(ds.initConfig?.backendType))
         return false;
     const w = ds.worker;
@@ -1116,6 +1142,8 @@ export function suspendWorker(ds, reason = 'suspended_idle') {
     ds.worker = null;
     ds.workerPort = null;
     ds.workerToken = null;
+    ds.workerViewToken = null;
+    ds.managedTurnOrigin = undefined;
     // Screen state describes the process we just stopped. Keeping it would make
     // the dashboard hydrate this process-less logical session as idle/working.
     ds.lastScreenStatus = undefined;
@@ -1212,7 +1240,7 @@ export async function closeSession(sessionId) {
         catch (err) {
             logger.warn(`[doc-comment] cleanup on close failed for ${sessionId.slice(0, 8)}: ${err?.message ?? err}`);
         }
-        activeSessionsRegistry?.delete(sessionKey(sessionAnchorId(ds), ds.larkAppId));
+        activeSessionsRegistry?.delete(activeSessionKey(ds));
         killedLive = true;
         if (!ds.exitEventEmitted) {
             ds.exitEventEmitted = true;
@@ -1341,6 +1369,8 @@ targetScope, opts) {
     const ds = findActiveBySessionId(sessionId);
     if (!ds)
         return { ok: false, error: 'session_not_active' };
+    if (ds.session.vcMeetingReceiver)
+        return { ok: false, error: 'vc_receiver_not_relayable' };
     // Anchor-based identity. A thread-scope session in the SAME chat (different
     // root) is a legitimate cross-topic move, so we refuse only when the target
     // anchor equals the source anchor (relaying a session onto itself). Replaces
@@ -1525,16 +1555,21 @@ function codexAppInputForSession(ds, input, turnId) {
 /** Send one normal (non-raw) worker turn while applying the per-bot Codex App
  * clean-input gate at message acceptance time. This freezes the sidecar onto
  * the IPC item, so later config flips do not mutate an already queued turn. */
-export function sendWorkerInput(ds, payload, turnId) {
+export function sendWorkerInput(ds, payload, turnId, opts = {}) {
     if (!ds.worker || ds.worker.killed)
         return false;
     const normalized = typeof payload === 'string' ? { content: payload } : payload;
     const codexAppInput = codexAppInputForSession(ds, normalized.codexAppInput, turnId);
+    const vcMeetingImTurnOrigin = resolveVcMeetingImTurnOrigin(ds.session, turnId);
     ds.worker.send({
         type: 'message',
         content: normalized.content,
         ...(codexAppInput ? { codexAppInput } : {}),
         ...(turnId ? { turnId } : {}),
+        ...(opts.dispatchAttempt !== undefined ? { dispatchAttempt: opts.dispatchAttempt } : {}),
+        ...(vcMeetingImTurnOrigin
+            ? { vcMeetingImTurnOrigin }
+            : {}),
     });
     return true;
 }
@@ -1559,16 +1594,26 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     const t = tag(ds);
     let resume = false;
     let initTurnId;
+    let initDispatchAttempt;
     if (typeof resumeOrTurnId === 'string') {
         initTurnId = resumeOrTurnId;
     }
     else if (typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null) {
         resume = resumeOrTurnId.resume === true;
         initTurnId = resumeOrTurnId.turnId;
+        initDispatchAttempt = resumeOrTurnId.dispatchAttempt;
     }
     else {
         resume = resumeOrTurnId;
     }
+    // An empty prompt is a pure worker reattach/restore, not a newly accepted
+    // user turn. Never inherit the previous reply target in that case: doing so
+    // would re-publish stale per-turn authority (notably an explicit meeting IM
+    // origin) into a fresh worker lifetime after a daemon restart. Non-empty
+    // prompts keep the historical fallback for callers that accepted a turn
+    // before they learned to pass its id explicitly.
+    const initAttributionTurnId = initTurnId
+        ?? (prompt.length > 0 ? ds.currentReplyTarget?.turnId : undefined);
     // A fork() whose cwd no longer exists emits an unhandled 'error' (spawn
     // ENOENT) that crashes the WHOLE daemon (→ pm2 crash-loop). Fall back to
     // home so a stale session workingDir can never take the daemon down.
@@ -1637,6 +1682,8 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         ds.worker = null;
         ds.workerPort = null;
         ds.workerToken = null;
+        ds.workerViewToken = null;
+        ds.managedTurnOrigin = undefined;
     }
     // Re-establishing a worker ends the cold-resume-suspended state: clear the
     // persisted marker so a future restart no longer treats this session's
@@ -1680,7 +1727,9 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             LARK_APP_SECRET: botCfg.larkAppSecret,
         },
     });
-    const startupState = { ready: false, failureNotified: false };
+    const startupState = {
+        ready: false, failureNotified: false, initTurnId, initDispatchAttempt,
+    };
     // A fork-level failure (spawn ENOENT, etc.) emits 'error'; without a handler
     // the unhandled event crashes the daemon. It also happens before worker IPC
     // exists, so this daemon-side branch must be the user-visible fallback.
@@ -1690,13 +1739,23 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         if (startupState.failureNotified)
             return;
         startupState.failureNotified = true;
+        // A dedicated VC receiver has no auxiliary Lark output channel. Durable
+        // failures stay on the receipt/lease chain, and exact IM turns may only
+        // produce their ledgered final reply — never a fork diagnostic.
+        if (ds.session.vcMeetingReceiver) {
+            logger.info(`[${t}] VC receiver fork failure kept out of auxiliary Lark UI `
+                + `turn=${initTurnId?.slice(0, 12) ?? '-'} attempt=${initDispatchAttempt}: ${reason}`);
+            return;
+        }
         const cliName = getCliDisplayName(agentCfg.cliId);
         const message = tr('worker.start_failed', { cliName, reason }, botLocale(botCfg));
         emitSessionLifecycleHook(ds, 'session.requires_attention', {
             reason: 'worker_fork_error',
             message: reason,
         });
-        void cb.sessionReply(sessionAnchorId(ds), message, 'text', ds.larkAppId, fallbackTurnId(ds, initTurnId)).catch(replyErr => logger.error(`[${t}] Failed to deliver worker fork error to Lark: ${replyErr}`));
+        void cb.sessionReply(sessionAnchorId(ds), message, 'text', ds.larkAppId, fallbackTurnId(ds, initTurnId), ds.session.vcMeetingReceiver
+            ? { sourceSessionId: ds.session.sessionId }
+            : undefined).catch(replyErr => logger.error(`[${t}] Failed to deliver worker fork error to Lark: ${replyErr}`));
     });
     // Pipe worker stdout/stderr to daemon logger.
     // Both go through logger.info → daemon.log (not error.log). Worker stderr
@@ -1717,11 +1776,12 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         }
     });
     // Send init config — use per-bot settings
-    const promptCodexAppInput = codexAppInputForSession(ds, promptPayload.codexAppInput, initTurnId ?? ds.currentReplyTarget?.turnId);
+    const promptCodexAppInput = codexAppInputForSession(ds, promptPayload.codexAppInput, initAttributionTurnId);
     const initMsg = {
         type: 'init',
         sessionId: ds.session.sessionId,
         chatId: ds.chatId,
+        chatType: ds.chatType,
         rootMessageId: sessionAnchorId(ds),
         workingDir: cwd,
         cliId: agentCfg.cliId,
@@ -1775,7 +1835,9 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         botName: bot.botName,
         botOpenId: bot.botOpenId,
         locale: botLocale(botCfg),
-        turnId: initTurnId ?? ds.currentReplyTarget?.turnId,
+        turnId: initAttributionTurnId,
+        dispatchAttempt: initDispatchAttempt,
+        vcMeetingImTurnOrigin: resolveVcMeetingImTurnOrigin(ds.session, initAttributionTurnId),
         pluginBindings: botCfg.plugins,
         skillPolicy: botCfg.skills,
     };
@@ -1834,6 +1896,13 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
 function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureNotified: false }) {
     const cb = requireCallbacks();
     const t = tag(ds);
+    const workerGeneration = (ds.workerGeneration ?? 0) + 1;
+    ds.workerGeneration = workerGeneration;
+    // Managed turn authority is issued by one concrete worker lifetime. A
+    // replacement must advertise a fresh capability before daemon-mediated
+    // exits may use it; carrying the old value across a restore/refork would
+    // let stale per-turn authority escape its generation.
+    ds.managedTurnOrigin = undefined;
     // Source authorization belongs to one worker lifetime. A replacement worker
     // must announce its own Hermes sources before any stamped final_output is
     // trusted; `/clear` rebinds within the same lifetime accumulate afterwards.
@@ -1843,14 +1912,59 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
     // Worker messages without a turn of their own (first streaming card, crash
     // notices) anchor to the session's current reply-target turn so a shared
     // fold-back topic keeps them in-thread instead of leaking top-level.
-    const scopedReply = (content, msgType, turnId) => cb.sessionReply(sessionAnchorId(ds), content, msgType, ds.larkAppId, fallbackTurnId(ds, turnId));
+    const scopedReply = (content, msgType, turnId, opts) => cb.sessionReply(sessionAnchorId(ds), content, msgType, ds.larkAppId, fallbackTurnId(ds, turnId), ds.session.vcMeetingReceiver
+        ? { ...opts, sourceSessionId: ds.session.sessionId }
+        : opts);
+    const ordinaryManagedSuppression = (turnId, dispatchAttempt) => {
+        const armedThrough = turnId ? ds.suppressedFinalOutputTurns?.get(turnId) : undefined;
+        return dispatchAttempt !== undefined
+            && armedThrough !== undefined
+            && dispatchAttempt <= armedThrough;
+    };
+    /** Auxiliary worker UI is never an authorized output channel for a dedicated
+     * VC receiver. Dashboard/audit state is still updated before these guards. */
+    const managedAuxUiSuppressed = (turnId, dispatchAttempt) => {
+        if (ds.session.vcMeetingReceiver)
+            return true;
+        return ordinaryManagedSuppression(turnId, dispatchAttempt);
+    };
+    /** final_output is the sole exception: listener_thread and exact IM replies
+     * may proceed into the durable action ledger; silent/stale attempts do not. */
+    const managedFinalOutputSuppressed = (turnId, dispatchAttempt) => {
+        if (!ds.session.vcMeetingReceiver) {
+            return ordinaryManagedSuppression(turnId, dispatchAttempt);
+        }
+        // Resolve every Lark-facing worker event against durable origin state. The
+        // receipt freezes responseMode, so terminal→idle updates and daemon restore
+        // cannot become loud merely because an in-memory suppression map was
+        // cleared/lost. Missing attribution on a dedicated receiver fails closed.
+        const decision = evaluateVcMeetingManagedSend(config.session.dataDir, {
+            receiverSessionId: ds.session.sessionId,
+            receiverSession: true,
+            turnId,
+            dispatchAttempt,
+            currentImTurnOrigin: resolveVcMeetingImTurnOrigin(ds.session, turnId),
+            allowTerminalReceipt: true,
+        });
+        return !decision.ok;
+    };
     const bot = getBot(ds.larkAppId);
     const botCfg = bot.config;
     const loc = botLocale(botCfg);
-    const notifyStartupFailure = async (reason, turnId) => {
+    const notifyStartupFailure = async (reason, turnId, dispatchAttempt) => {
         if (startupState.failureNotified)
             return;
         startupState.failureNotified = true;
+        // A durable VC meeting delivery attempt must not surface its startup/relaunch
+        // failure out-of-band. The worker-generation exit is fenced to the receipt
+        // (marked ambiguous and retried under the side-effect boundary); a direct
+        // sessionReply here would bypass that and could post on a silent delivery.
+        // Ordinary IM turns and non-receiver sessions still notify exactly once.
+        if (managedAuxUiSuppressed(turnId, dispatchAttempt)) {
+            logger.info(`[${t}] VC receiver startup failure kept out of auxiliary Lark UI `
+                + `turn=${turnId?.slice(0, 12) ?? '-'} attempt=${dispatchAttempt}: ${reason}`);
+            return;
+        }
         const cliName = getCliDisplayName(sessionCliId(ds, botCfg));
         const message = tr('worker.start_failed', { cliName, reason }, loc);
         emitSessionLifecycleHook(ds, 'session.requires_attention', {
@@ -1875,12 +1989,13 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 startupState.ready = true;
                 ds.workerPort = msg.port;
                 ds.workerToken = msg.token;
+                ds.workerViewToken = msg.viewToken ?? null;
                 // Persist port so it can be reused after daemon restart
                 ds.session.webPort = msg.port;
                 sessionStore.updateSession(ds.session);
                 const readOnlyUrl = buildTerminalUrl(ds);
                 const writeUrl = buildTerminalUrl(ds, { write: true });
-                logger.info(`[${t}] Worker ready, terminal at ${readOnlyUrl}`);
+                logger.info(`[${t}] Worker ready, terminal at ${readOnlyUrl.replace(/\?.*$/, '?viewToken=[redacted]')}`);
                 if (ds.usageLimit) {
                     ds.lastScreenStatus = 'limited';
                     armUsageLimitRetryTimer(ds);
@@ -1893,6 +2008,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         patch: { webPort: msg.port },
                     },
                 });
+                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
+                    logger.info(`[${t}] Managed VC receiver — suppressing ready/streaming card output`);
+                    break;
+                }
                 // Bot opted out of the streaming card: the terminal is up and the
                 // final answer will still arrive via `botmux send`; just don't post the
                 // live status card. (workerPort/token above are still set so the web
@@ -2096,7 +2215,9 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // is known, so consumers exclude this session from native parsers
                 // before its first positive-delta record exists.
                 recordOwnershipForDaemonSession(ds);
-                if (!wasLocalCliOpenReady && isLocalCliOpenReady(ds, { cliId: effectiveCliId })) {
+                if (!managedAuxUiSuppressed()
+                    && !wasLocalCliOpenReady
+                    && isLocalCliOpenReady(ds, { cliId: effectiveCliId })) {
                     scheduleLocalCliOpenReadinessPatch(ds);
                 }
                 break;
@@ -2151,6 +2272,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         queueMicrotask(cb.enforceLiveSessionCap);
                     }
                 }
+                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt))
+                    break;
                 // Bot opted out of the streaming card — dashboard SSE above already got
                 // the status patch; just don't touch any Lark card.
                 if (streamingCardDisabled(ds))
@@ -2232,6 +2355,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     content: ds.lastScreenContent ?? '',
                 });
                 persistStreamCardState(ds);
+                if (managedAuxUiSuppressed())
+                    break;
                 if ((ds.displayMode ?? 'hidden') !== 'screenshot')
                     break;
                 if (!ds.streamCardId || ds.streamCardId === CARD_POSTING_SENTINEL || !ds.workerPort)
@@ -2269,6 +2394,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // session.title; publishing this prompt description as `patch.title`
                 // would temporarily overwrite a user-issued /rename until refresh.
                 ds.currentTurnTitle = msg.description;
+                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
+                    logger.info(`[${t}] Managed VC receiver — TUI prompt kept in dashboard/audit only`);
+                    break;
+                }
                 try {
                     const cardJson = buildTuiPromptCard(sessionAnchorId(ds), ds.session.sessionId, msg.description, msg.options, msg.multiSelect, undefined, loc);
                     const cardMsgId = await scopedReply(cardJson, 'interactive', msg.turnId);
@@ -2283,6 +2412,11 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
             case 'tui_prompt_resolved': {
                 // TUI prompt is no longer showing — update card if it exists
                 logger.info(`[${t}] TUI prompt resolved${msg.selectedText ? `: ${msg.selectedText}` : ''}`);
+                if (managedAuxUiSuppressed()) {
+                    ds.tuiPromptCardId = undefined;
+                    ds.tuiPromptOptions = undefined;
+                    break;
+                }
                 if (ds.tuiPromptCardId) {
                     const resolvedCard = buildTuiPromptResolvedCard(msg.selectedText ?? tr('card.action.tui_done', undefined, loc), loc);
                     updateMessage(ds.larkAppId, ds.tuiPromptCardId, resolvedCard).catch(err => logger.debug(`[${t}] Failed to update TUI prompt card: ${err}`));
@@ -2293,13 +2427,33 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 break;
             }
             case 'claude_exit': {
+                // CLI-generation authority must not outlive the concrete worker/CLI
+                // pair that issued it. A delayed message from a replaced Node worker
+                // must neither clear nor restart the replacement generation.
+                if (ds.worker !== worker) {
+                    logger.warn(`[${t}] Ignored claude_exit from stale worker generation`);
+                    break;
+                }
+                ds.managedTurnOrigin = undefined;
                 logger.info(`[${t}] ${getCliDisplayName(effectiveCliId)} exited (code: ${msg.code}, signal: ${msg.signal})`);
                 ds.hasHistory = true;
+                try {
+                    await cb.onCliExit?.(ds, {
+                        sessionId: ds.session.sessionId,
+                        workerGeneration,
+                        code: msg.code,
+                        signal: msg.signal,
+                    });
+                }
+                catch (err) {
+                    logger.error(`[${t}] Failed to reconcile CLI exit generation ${workerGeneration}: ${err.message}`);
+                }
+                const suppressExitUi = managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt);
                 // Do NOT auto-restart in adopt mode — there's nothing to restart
                 if (ds.adoptedFrom) {
                     logger.info(`[${t}] Adopted session ended`);
                     // Freeze the streaming card
-                    if (ds.streamCardId && (ds.workerPort || ds.riffAccessUrl)) {
+                    if (!suppressExitUi && ds.streamCardId && (ds.workerPort || ds.riffAccessUrl)) {
                         const readUrl = buildTerminalUrl(ds);
                         const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
                         const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
@@ -2311,7 +2465,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // 不受影响" right before killing us, so another exit message here
                     // is just noise. Natural exits (user typed `exit`, CLI crashed)
                     // leave status='active' and still get the notice.
-                    if (ds.session.status !== 'closed') {
+                    if (!suppressExitUi && ds.session.status !== 'closed') {
                         try {
                             await scopedReply(tr('worker.adopted_session_exited', undefined, loc), 'text', undefined);
                         }
@@ -2334,7 +2488,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // Freeze the last streaming card so it doesn't stay at "working" forever.
                     // 读链接严格要求 workerPort（riffAccessUrl 是写能力且 worker 退出后不清，
                     // 用它放行会构造 host:undefined 的坏读链接）。
-                    if (ds.streamCardId && ds.workerPort) {
+                    if (!suppressExitUi && ds.streamCardId && ds.workerPort) {
                         const readUrl = buildTerminalUrl(ds);
                         const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
                         const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
@@ -2370,13 +2524,15 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     if (msg.logTail?.trim()) {
                         parts.push(`${tr('worker.crash_recent_output', undefined, loc)}\n${msg.logTail.trim()}`);
                     }
-                    try {
-                        await scopedReply(parts.join('\n\n'), 'text', undefined);
-                    }
-                    catch (replyErr) {
-                        if (replyErr instanceof MessageWithdrawnError) {
-                            logger.warn(`[${t}] Root message withdrawn, closing stale session`);
-                            cb.closeSession(ds);
+                    if (!suppressExitUi) {
+                        try {
+                            await scopedReply(parts.join('\n\n'), 'text', undefined);
+                        }
+                        catch (replyErr) {
+                            if (replyErr instanceof MessageWithdrawnError) {
+                                logger.warn(`[${t}] Root message withdrawn, closing stale session`);
+                                cb.closeSession(ds);
+                            }
                         }
                     }
                     break;
@@ -2393,7 +2549,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // `error` is a fatal launch-generation signal. It normally arrives
                 // during init, but can also follow a previously-ready worker whose CLI
                 // recovery/restart fails; that later failure must remain user-visible.
-                await notifyStartupFailure(msg.message, msg.turnId);
+                await notifyStartupFailure(msg.message, msg.turnId, msg.dispatchAttempt);
                 break;
             }
             case 'riff_access_url': {
@@ -2412,7 +2568,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 });
                 // Refresh the live streaming card (writable/AIO link) — parks a pending
                 // flag when the card POST is still in-flight and flushes once it lands.
-                scheduleRiffAccessUrlPatch(ds);
+                if (!managedAuxUiSuppressed())
+                    scheduleRiffAccessUrlPatch(ds);
                 break;
             }
             case 'riff_task_id': {
@@ -2461,6 +2618,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     reason: 'user_notify',
                     message: msg.message,
                 });
+                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt))
+                    break;
                 try {
                     await scopedReply(msg.message, 'text', msg.turnId);
                 }
@@ -2469,6 +2628,104 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 }
                 break;
             }
+            case 'turn_terminal': {
+                if (ds.worker !== worker) {
+                    logger.warn(`[${t}] Ignored turn_terminal from stale worker generation`);
+                    break;
+                }
+                if (msg.sessionId !== ds.session.sessionId) {
+                    logger.warn(`[${t}] Dropped turn_terminal with mismatched sessionId ` +
+                        `(worker=${msg.sessionId}, daemon=${ds.session.sessionId}, turn=${msg.turnId.substring(0, 8)})`);
+                    break;
+                }
+                // Defense in depth: the worker sends a token-matched revoke before the
+                // terminal IPC, but an older/mixed worker must still lose authority at
+                // this exact terminal edge. Tuple-match prevents a late turn N event
+                // from clearing a capability already rotated for turn N+1.
+                if (ds.managedTurnOrigin?.turnId === msg.turnId
+                    && ds.managedTurnOrigin.dispatchAttempt === msg.dispatchAttempt) {
+                    ds.managedTurnOrigin = undefined;
+                }
+                try {
+                    await cb.onTurnTerminal?.(ds, msg, { workerGeneration });
+                }
+                catch (err) {
+                    // The durable receipt remains non-terminal and can be reconciled;
+                    // never let a projection/store failure crash the worker IPC loop.
+                    logger.error(`[${t}] Failed to persist turn_terminal for ${msg.turnId.substring(0, 8)}: ${err.message}`);
+                }
+                break;
+            }
+            case 'receiver_reset_ready': {
+                if (msg.sessionId !== ds.session.sessionId) {
+                    logger.warn(`[${t}] Dropped receiver_reset_ready with mismatched sessionId`);
+                    break;
+                }
+                cb.onReceiverResetReady?.(ds, {
+                    sessionId: msg.sessionId,
+                    turnId: msg.turnId,
+                    dispatchAttempt: msg.dispatchAttempt,
+                });
+                break;
+            }
+            case 'durable_expiry_ready': {
+                if (msg.sessionId !== ds.session.sessionId) {
+                    logger.warn(`[${t}] Dropped durable_expiry_ready with mismatched sessionId`);
+                    break;
+                }
+                cb.onDurableExpiryReady?.(ds, {
+                    sessionId: msg.sessionId,
+                    turnId: msg.turnId,
+                    dispatchAttempt: msg.dispatchAttempt,
+                    workerGeneration,
+                    disposition: msg.disposition,
+                });
+                break;
+            }
+            case 'managed_turn_origin': {
+                if (ds.worker !== worker) {
+                    logger.warn(`[${t}] Ignored managed_turn_origin from stale worker generation`);
+                    break;
+                }
+                if (msg.sessionId !== ds.session.sessionId) {
+                    logger.warn(`[${t}] Dropped managed_turn_origin with mismatched sessionId`);
+                    break;
+                }
+                ds.managedTurnOrigin = {
+                    capability: msg.capability,
+                    ...(msg.turnId ? { turnId: msg.turnId } : {}),
+                    ...(msg.dispatchAttempt !== undefined
+                        ? { dispatchAttempt: msg.dispatchAttempt }
+                        : {}),
+                };
+                break;
+            }
+            case 'managed_turn_origin_revoked': {
+                if (ds.worker !== worker) {
+                    logger.warn(`[${t}] Ignored managed_turn_origin_revoked from stale worker generation`);
+                    break;
+                }
+                if (msg.sessionId !== ds.session.sessionId) {
+                    logger.warn(`[${t}] Dropped managed_turn_origin_revoked with mismatched sessionId`);
+                    break;
+                }
+                // Same-worker IPC is ordered, but token-match as well so a delayed
+                // revoke can never clear authority already rotated by the next turn.
+                if (msg.capability
+                    && ds.managedTurnOrigin?.capability
+                    && ds.managedTurnOrigin.capability !== msg.capability) {
+                    logger.warn(`[${t}] Ignored stale managed turn origin revoke after capability rotation`);
+                    break;
+                }
+                if (!msg.capability && ds.managedTurnOrigin
+                    && (ds.managedTurnOrigin.turnId !== msg.turnId
+                        || ds.managedTurnOrigin.dispatchAttempt !== msg.dispatchAttempt)) {
+                    logger.warn(`[${t}] Ignored unbound stale managed turn origin revoke`);
+                    break;
+                }
+                ds.managedTurnOrigin = undefined;
+                break;
+            }
             case 'final_output': {
                 // Adopt-bridge: worker harvested the assistant turn from Claude Code's
                 // transcript JSONL and forwarded it to us. Dedup with a session-scoped
@@ -2480,6 +2737,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     break;
                 if (shouldDropMismatchedHermesFinalOutput(ds, msg, t))
                     break;
+                if (managedFinalOutputSuppressed(msg.turnId, msg.dispatchAttempt)) {
+                    logger.debug(`[${t}] final_output captured/discarded for silent turn ${msg.turnId.substring(0, 8)}`);
+                    break;
+                }
                 if (!msg.sessionId) {
                     logger.warn(`[${t}] final_output missing sessionId; accepting for compatibility (session=${ds.session.sessionId}, turn=${msg.turnId.substring(0, 8)})`);
                 }
@@ -2506,6 +2767,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     logger.warn(`[${t}] Ignored adopt_preamble from non-adopt worker`);
                     break;
                 }
+                if (managedAuxUiSuppressed(msg.turnId))
+                    break;
                 if (!msg.userText.trim() && !msg.assistantText.trim())
                     break;
                 const recipientOpenId = daemonCardFooterRecipientOpenId(ds, effectiveCliId);
@@ -2515,7 +2778,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     assistantText: msg.assistantText,
                     assistantLabel: getCliDisplayName(effectiveCliId),
                     recipientOpenId,
-                    brand: resolveBrandLabel(ds.larkAppId),
+                    brand: renderBrandTemplate(resolveBrandLabel(ds.larkAppId), ds.workingDir),
                     locale: localeForBot(ds.larkAppId),
                     workingDir: ds.workingDir,
                     localHomeLinkMode: daemonCardLocalHomeLinkMode(ds),
@@ -2527,7 +2790,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
             }
         }
     });
-    worker.on('exit', (code) => {
+    worker.on('exit', (code, signal) => {
         logger.info(`[${t}] Worker process exited (code: ${code})`);
         // Last-resort startup guard: syntax/import crashes and abrupt exits can
         // happen before the worker sends either ready or a structured error.  Do
@@ -2535,13 +2798,33 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
         // replacement kills are excluded to avoid noisy false alarms.
         if (!startupState.ready && !startupState.failureNotified && !worker.killed && ds.session.status !== 'closed') {
             const reason = tr('worker.start_exited_early', { code: code ?? 'null' }, loc);
-            void notifyStartupFailure(reason);
+            // Carry the frozen init attribution so an abrupt pre-ready exit of a
+            // durable VC delivery is fenced to the receipt/lease chain, not replied
+            // out-of-band (which could post on a silent delivery).
+            void notifyStartupFailure(reason, startupState.initTurnId, startupState.initDispatchAttempt);
         }
-        // Only clear ds.worker if it's still THIS worker — during takeover,
-        // the old worker's exit fires AFTER the new worker has been assigned.
+        // Clear the current child before notifying durable consumers. A callback
+        // may schedule a retry; it must not observe/send to this dead IPC channel.
+        // A stale takeover worker never clears the replacement — during takeover the
+        // old worker's exit fires AFTER the new worker has been assigned.
         if (ds.worker === worker) {
             ds.worker = null;
             ds.workerPort = null;
+            ds.managedTurnOrigin = undefined;
+        }
+        try {
+            const notified = cb.onWorkerExit?.(ds, {
+                sessionId: ds.session.sessionId,
+                workerGeneration,
+                code,
+                signal,
+            });
+            void Promise.resolve(notified).catch((err) => {
+                logger.error(`[${t}] Failed to reconcile worker exit generation ${workerGeneration}: ${err.message}`);
+            });
+        }
+        catch (err) {
+            logger.error(`[${t}] Failed to reconcile worker exit generation ${workerGeneration}: ${err.message}`);
         }
         // Notify dashboard, but only once per session lifecycle. The
         // dashboard-driven `closeSession()` path also publishes; whichever
@@ -2612,6 +2895,10 @@ async function finishTurnReactions(ds) {
         return;
     // Detach the batch first so a second idle edge can't double-flip it.
     ds.pendingAckReactions = [];
+    // A dedicated receiver has no progress-reaction channel. Clear any stale
+    // in-memory entries restored from an older build without touching Lark.
+    if (ds.session.vcMeetingReceiver)
+        return;
     const silent = silentTurnReactions(ds);
     const doneEmoji = doneReactionEmojiFor(ds);
     for (const ack of list) {
@@ -2639,17 +2926,20 @@ async function finishTurnReactions(ds) {
  *  and give up — the user's answer is lost; better than leaking memory
  *  via an unbounded retry loop. */
 function deliverFinalOutput(ds, msg, t, attempt) {
+    const managedReceiver = !!ds.session.vcMeetingReceiver;
     // Wait Mode / HTTP Sync Override:
     // If this turn is being waited for by an HTTP webhook request, intercept the
     // output, resolve the Promise immediately, and DO NOT send it to Lark.
-    const waitPromise = ds.pendingWaitPromises?.get(msg.turnId);
+    // Dedicated receivers are structurally pinned to their audited listener
+    // action and may never be diverted into these generic host-side sinks.
+    const waitPromise = managedReceiver ? undefined : ds.pendingWaitPromises?.get(msg.turnId);
     if (waitPromise) {
         waitPromise.resolve(msg.content);
         ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
         logger.info(`[${t}] Intercepted final_output for Wait Mode HTTP request (turn ${msg.turnId.substring(0, 8)})`);
         return;
     }
-    const asyncResult = ds.asyncTriggerResults?.get(msg.turnId);
+    const asyncResult = managedReceiver ? undefined : ds.asyncTriggerResults?.get(msg.turnId);
     if (asyncResult) {
         asyncResult.status = 'completed';
         asyncResult.content = msg.content;
@@ -2660,7 +2950,9 @@ function deliverFinalOutput(ds, msg, t, attempt) {
     }
     const cb = requireCallbacks();
     const effectiveCliId = ds.session.cliId ?? getBot(ds.larkAppId).config.cliId;
-    const scopedReply = (content, msgType, turnId) => cb.sessionReply(sessionAnchorId(ds), content, msgType, ds.larkAppId, fallbackTurnId(ds, turnId));
+    const scopedReply = (content, msgType, turnId, opts) => cb.sessionReply(sessionAnchorId(ds), content, msgType, ds.larkAppId, fallbackTurnId(ds, turnId), ds.session.vcMeetingReceiver
+        ? { ...opts, sourceSessionId: ds.session.sessionId }
+        : opts);
     setTimeout(async () => {
         // Guard: if the user closed the session (or it was torn down for any
         // other reason) between attempts, don't post a stale final answer to
@@ -2672,7 +2964,7 @@ function deliverFinalOutput(ds, msg, t, attempt) {
         try {
             // 文档评论入口分流：本轮若来自飞书文档评论（/watch-comment / /subscribe-lark-doc），把正文
             // 发表为文档评论（而非飞书卡片），状态卡/占位卡仍留在飞书会话起点。
-            const docTurn = ds.docCommentTurns?.get(msg.turnId);
+            const docTurn = managedReceiver ? undefined : ds.docCommentTurns?.get(msg.turnId);
             if (docTurn) {
                 // 嵌套回复到用户那条评论 thread（已挂在其下，无需再 ↪ 前缀）。这是兜底路径
                 // （模型没显式 botmux send），默认 @ 回原评论人，仅首块加。
@@ -2708,27 +3000,152 @@ function deliverFinalOutput(ds, msg, t, attempt) {
             // they use the contextual card so the user prompt sits in a
             // blockquote and only the assistant body goes through full markdown
             // rendering.
-            const recipientOpenId = daemonCardFooterRecipientOpenId(ds, effectiveCliId);
+            const imOrigin = msg.dispatchAttempt === undefined
+                ? resolveVcMeetingImTurnOrigin(ds.session, msg.turnId)
+                : undefined;
+            const managedDecision = ds.session.vcMeetingReceiver
+                ? evaluateVcMeetingManagedSend(config.session.dataDir, {
+                    receiverSessionId: ds.session.sessionId,
+                    receiverSession: true,
+                    turnId: msg.turnId,
+                    dispatchAttempt: msg.dispatchAttempt,
+                    currentImTurnOrigin: imOrigin,
+                    allowTerminalReceipt: true,
+                })
+                : undefined;
+            if (managedDecision && !managedDecision.ok) {
+                ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
+                logger.warn(`[${t}] VC final_output lost current membership authority `
+                    + `(${managedDecision.errorCode}) turn=${msg.turnId.substring(0, 8)}`);
+                return;
+            }
+            const revalidateManagedSend = () => {
+                if (!ds.session.vcMeetingReceiver)
+                    return;
+                const current = evaluateVcMeetingManagedSend(config.session.dataDir, {
+                    receiverSessionId: ds.session.sessionId,
+                    receiverSession: true,
+                    turnId: msg.turnId,
+                    dispatchAttempt: msg.dispatchAttempt,
+                    currentImTurnOrigin: imOrigin,
+                    allowTerminalReceipt: true,
+                });
+                if (!current.ok) {
+                    throw new Error(`VC final_output authority expired (${current.errorCode}): ${current.error}`);
+                }
+                if (current.kind !== 'listener_thread') {
+                    throw new Error('VC final_output authority no longer targets the listener thread');
+                }
+            };
+            const listenerOutputOwner = managedDecision?.ok
+                && managedDecision.kind === 'listener_thread'
+                ? managedDecision.meetingOwner
+                : undefined;
+            // Meeting-derived text is untrusted card markdown. A model-authored
+            // native <at> tag and the ordinary owner footer would both create a
+            // second addressing side effect outside the action ledger.
+            const safeAssistantText = managedReceiver
+                ? neutralizeLarkAtTags(msg.content)
+                : msg.content;
+            const safeUserText = managedReceiver && msg.userText !== undefined
+                ? neutralizeLarkAtTags(msg.userText)
+                : msg.userText;
+            const recipientOpenId = managedReceiver
+                ? undefined
+                : imOrigin?.replyTargetSenderOpenId
+                    ?? daemonCardFooterRecipientOpenId(ds, effectiveCliId);
             const localHomeLinkMode = daemonCardLocalHomeLinkMode(ds);
             const cardJson = msg.kind === 'local-turn' || msg.kind === 'local-turn-headless'
                 ? buildContextualReplyCard({
                     title: msg.kind === 'local-turn-headless'
                         ? tr('card.local_turn_resumed', undefined, localeForBot(ds.larkAppId))
                         : tr('card.local_turn', undefined, localeForBot(ds.larkAppId)),
-                    userText: msg.kind === 'local-turn' ? msg.userText ?? '' : undefined,
-                    assistantText: msg.content,
+                    userText: msg.kind === 'local-turn' ? safeUserText ?? '' : undefined,
+                    assistantText: safeAssistantText,
                     assistantLabel: getCliDisplayName(effectiveCliId),
                     recipientOpenId,
-                    brand: resolveBrandLabel(ds.larkAppId),
+                    brand: renderBrandTemplate(resolveBrandLabel(ds.larkAppId), ds.workingDir),
                     locale: localeForBot(ds.larkAppId),
                     workingDir: ds.workingDir,
                     localHomeLinkMode,
                 })
-                : buildMarkdownCard(msg.content, recipientOpenId, resolveBrandLabel(ds.larkAppId), localeForBot(ds.larkAppId), ds.workingDir, localHomeLinkMode);
+                : buildMarkdownCard(safeAssistantText, recipientOpenId, renderBrandTemplate(resolveBrandLabel(ds.larkAppId), ds.workingDir), localeForBot(ds.larkAppId), ds.workingDir, localHomeLinkMode);
+            const proposedOutput = {
+                targetChatId: ds.chatId,
+                ...(imOrigin ? { quoteTargetId: imOrigin.larkMessageId } : {}),
+                msgType: 'interactive',
+                content: cardJson,
+            };
+            const preparedImReply = imOrigin
+                ? prepareVcMeetingImReply(config.session.dataDir, imOrigin, proposedOutput)
+                : undefined;
+            const preparedDeliveryReply = !imOrigin
+                && listenerOutputOwner
+                && msg.dispatchAttempt !== undefined
+                ? prepareVcMeetingDeliveryReply(config.session.dataDir, {
+                    receiverSessionId: ds.session.sessionId,
+                    stableTurnId: msg.turnId,
+                    dispatchAttempt: msg.dispatchAttempt,
+                }, proposedOutput)
+                : undefined;
+            const preparedListenerReply = preparedImReply ?? preparedDeliveryReply;
+            if (preparedListenerReply?.kind === 'conflict') {
+                ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
+                logger.error(`[${t}] VC listener fallback suppressed (${preparedListenerReply.reason}) `
+                    + `turn=${msg.turnId.substring(0, 8)}: ${preparedListenerReply.detail}`);
+                return;
+            }
+            const canonicalOutput = preparedListenerReply?.canonicalOutput ?? proposedOutput;
+            if (preparedListenerReply?.outputMismatch) {
+                logger.warn(`[${t}] VC listener reply output_mismatch action=${preparedListenerReply.ref.actionId} `
+                    + `turn=${msg.turnId}; reusing first canonical output`);
+            }
+            const recordPrimaryOutput = (messageId) => {
+                if (!listenerOutputOwner)
+                    return;
+                try {
+                    const recorded = recordVcMeetingListenerMessage(config.session.dataDir, {
+                        ...listenerOutputOwner,
+                        targetChatId: canonicalOutput.targetChatId,
+                        messageId,
+                    });
+                    if (!recorded.ok) {
+                        logger.warn(`[${t}] VC listener-message index rejected message=${messageId} reason=${recorded.reason}`);
+                    }
+                }
+                catch (error) {
+                    // Lark already accepted the primary message. Never enter the delivery
+                    // retry loop solely because the auxiliary quote index failed.
+                    logger.error(`[${t}] VC listener-message index write failed after send: `
+                        + `${error instanceof Error ? error.message : String(error)}`);
+                }
+            };
+            if (preparedListenerReply?.kind === 'succeeded' && preparedListenerReply.messageId) {
+                recordPrimaryOutput(preparedListenerReply.messageId);
+                ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
+                logger.info(`[${t}] VC listener fallback replayed existing provider result `
+                    + `(turn ${msg.turnId.substring(0, 8)})`);
+                return;
+            }
             // Always deliver the answer as a fresh message — never PATCH a card in
             // place. message.patch is silent (no Feishu notification / unread), which
             // used to swallow the answer; a brand-new message always pings.
-            await scopedReply(cardJson, 'interactive', msg.turnId);
+            revalidateManagedSend();
+            const messageId = await scopedReply(canonicalOutput.content, canonicalOutput.msgType, msg.turnId, preparedListenerReply
+                ? {
+                    uuid: preparedListenerReply.providerKey,
+                    quoteMessageId: canonicalOutput.quoteTargetId,
+                    beforeQuoteFallback: revalidateManagedSend,
+                    // Managed output has one audited external effect (the Lark
+                    // provider call). Never fan meeting content out to user hooks,
+                    // including the first attempt and crash reconciliation replay.
+                    suppressHook: true,
+                }
+                : undefined);
+            recordPrimaryOutput(messageId);
+            if (preparedListenerReply?.kind === 'send' || preparedListenerReply?.kind === 'succeeded') {
+                finishVcMeetingImReply(config.session.dataDir, preparedListenerReply.ref, messageId);
+            }
             ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
             logger.info(`[${t}] Bridge final_output forwarded (turn ${msg.turnId.substring(0, 8)}, ${msg.content.length} chars, kind=${msg.kind ?? 'bridge'}, attempt ${attempt + 1})`);
         }
@@ -2791,6 +3208,8 @@ export function forkAdoptWorker(ds, opts) {
         ds.worker = null;
         ds.workerPort = null;
         ds.workerToken = null;
+        ds.workerViewToken = null;
+        ds.managedTurnOrigin = undefined;
     }
     // No ensureCliSkills — adopt mode attaches to an existing CLI session
     // Fall back to home if the adopted cwd is gone — a missing fork cwd emits an
@@ -2891,6 +3310,7 @@ export function forkAdoptWorker(ds, opts) {
         type: 'init',
         sessionId: ds.session.sessionId,
         chatId: ds.chatId,
+        chatType: ds.chatType,
         rootMessageId: sessionAnchorId(ds),
         workingDir: adopted.cwd,
         cliId: adoptedCliId,