botmux 2.111.0 → 2.112.0

package/dist/worker.js

@@ -13,42 +13,46 @@
  *   7. On 'restart', kills CLI and re-spawns with --resume
  */
 import { randomBytes } from 'node:crypto';
-import { mkdirSync, writeFileSync, unlinkSync, existsSync, statSync, readdirSync, readlinkSync, readFileSync, realpathSync, copyFileSync, watch as fsWatch, createWriteStream } from 'node:fs';
+import { mkdirSync, writeFileSync, unlinkSync, existsSync, statSync, readdirSync, readlinkSync, readFileSync, realpathSync, copyFileSync, watch as fsWatch, createWriteStream, openSync, closeSync, fstatSync, constants as fsConstants } from 'node:fs';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
 import { join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
-import { evaluateReadIsolationGate, buildSeatbeltProfile, isolatedPaneReattachSafe, sendCredFilePath, botHomePath, buildV2DenyPaths, buildV2DenyRegexes, buildV2CarveOuts, buildCliExecutableReadCarveOuts, buildWriteSandboxRules, buildLinuxReadIsolationMasks, } from './adapters/cli/read-isolation.js';
+import { evaluateReadIsolationGate, buildSeatbeltProfile, isolatedPaneReattachSafe, sendCredFilePath, botHomePath, buildV2DenyPaths, buildV2DenyRegexes, buildV2CarveOuts, buildReadIsolationProtectedWriteRules, buildCliExecutableReadCarveOuts, buildWriteSandboxRules, buildLinuxReadIsolationMasks, isolationPaneMarkerContent, } from './adapters/cli/read-isolation.js';
 import { killPersistentSession } from './core/persistent-backend.js';
+import { readProcessStartIdentity } from './core/session-marker.js';
 import { drainTranscript, joinAssistantText, trailingAssistantText, findJsonlContainingFingerprint, findJsonlsContainingExactContent, findLatestJsonl, extractLastAssistantTurn, extractTurnStartText, splitTranscriptEventsByCutoff } from './services/claude-transcript.js';
 import { BridgeTurnQueue, makeFingerprint, normaliseForFingerprint } from './services/bridge-turn-queue.js';
 import { shouldSuppressBridgeEmit } from './services/bridge-fallback-gate.js';
 import { shouldReleaseFirstPromptTimeout, shouldWriteNow } from './utils/input-gate.js';
+import { canStartInjectionFlush, shouldDeferUserFlush, shouldFlushInjectionsFirst } from './core/inject-queue-policy.js';
 import { stripAnsiForLog, tailChars } from './utils/crash-log.js';
 import { CodexUpdateDialogGuard } from './utils/codex-update-dialog.js';
 import { installStdioEpipeGuard, isIgnorableStreamError } from './utils/stdio-epipe-guard.js';
-import { mergeQueuedCliInput } from './utils/pending-input-queue.js';
+import { mergeQueuedCliInput, pendingInputMayFlush, pendingInputAllowsTypeAhead, shouldDeferArgsBakedDurablePrompt, shouldStopPendingBatch, terminalReleasesDurableTurn, } from './utils/pending-input-queue.js';
 import { ReadyGate, shouldArmReadyGate } from './utils/ready-gate.js';
 import { shouldRunStartupCommandsOnSpawn, shouldDeferInitialPromptForStartup } from './core/startup-commands.js';
 import { sanitizePerBotEnv } from './core/per-bot-env.js';
+import { evaluateVcMeetingManagedSend, } from './services/vc-meeting-send-policy.js';
+import { TurnTerminalDeduper } from './services/turn-terminal-deduper.js';
 import { ensureGatewayEntry } from './core/plugins/mcp/gateway-installer.js';
 import { prepareCliPluginGeneration } from './core/plugins/cli-generation.js';
 import { loadBotConfigs } from './bot-registry.js';
 import { readGlobalConfig } from './global-config.js';
-import { resolveTerminalWriteForRequest } from './core/terminal-write-auth.js';
+import { deriveTerminalViewToken, resolveTerminalAccessForRequest, safeTerminalTokenEqual, } from './core/terminal-write-auth.js';
 import { readPlatformBinding } from './platform/binding.js';
-import { loadPersistedToken } from './dashboard/auth.js';
+import { loadDashboardSecret, loadPersistedToken } from './dashboard/auth.js';
 import { InflightInputTracker } from './core/inflight-input-tracker.js';
 import { shouldRunQuietRotation, evaluatePidResolverPullback, decideFingerprintSwitch, shouldHealAbsentBaseline, sessionIdFromJsonlPath, SESSION_ID_FILENAME_RE, } from './services/bridge-rotation-policy.js';
 import { CodexBridgeQueue } from './services/codex-bridge-queue.js';
-import { codexSessionIdFromRolloutPath, drainCodexRollout, findCodexRolloutBySessionId, findCodexRolloutByPid, splitCodexEventsByCutoff, extractLastCodexTurn } from './services/codex-transcript.js';
-import { findTraexRolloutBySessionId, findTraexRolloutByPid } from './services/traex-transcript.js';
+import { drainCodexRollout, findCodexRolloutBySessionId, findCodexRolloutByPid, splitCodexEventsByCutoff, extractLastCodexTurn, codexSessionIdFromRolloutPath } from './services/codex-transcript.js';
+import { drainTraexRollout, findTraexRolloutBySessionId, findTraexRolloutByPid } from './services/traex-transcript.js';
 import { cocoEventsPathForSession, drainCocoEvents, findCocoSessionByPid } from './services/coco-transcript.js';
 import { currentHermesStateOffset, drainHermesStateDb, resolveHermesStateDbPath } from './services/hermes-transcript.js';
 import { filterHermesEventsForBotmuxSession } from './services/hermes-session-filter.js';
 import { currentMtrSessionOffset, drainMtrSession, findLatestMtrSessionByDirectory, findMtrSessionById } from './services/mtr-transcript.js';
 import { drainPiTranscript } from './services/pi-transcript.js';
-import { drainGrokUpdates, grokSessionIdFromPath, } from './services/grok-transcript.js';
+import { drainGrokUpdates, findGrokSessionByPid, grokSessionIdFromPath, } from './services/grok-transcript.js';
 import { resolveFileBridgePath } from './services/file-bridge-path.js';
 import { isStructuredBridgeAdoptIdleCli, isStructuredBridgeAdoptInputCli, isStructuredBridgeFallbackActive, } from './services/structured-bridge-clis.js';
 import { drainCursorTranscript, findCursorChatIdByPid, findCursorTranscriptByChatId, findCursorTranscriptByPid } from './services/cursor-transcript.js';
@@ -59,6 +63,7 @@ import { dirname } from 'node:path';
 import { createServer as createHttpServer } from 'node:http';
 import { WebSocketServer, WebSocket } from 'ws';
 import { listenWebTerminalWithFallback } from './utils/web-terminal-listen.js';
+import { HerdrWebTerminalBinding } from './utils/herdr-web-terminal-binding.js';
 import { TERMINAL_FAVICON_DATA_URI } from './utils/terminal-favicon.js';
 import { t, setDefaultLocale } from './i18n/index.js';
 import { TerminalRenderer } from './utils/terminal-renderer.js';
@@ -87,6 +92,7 @@ import { ScreenAnalyzer } from './utils/screen-analyzer.js';
 import { captureToPng } from './utils/screenshot-renderer.js';
 import { snapshotToPng, snapshotToText, shouldCaptureScreen, isScreenSelfDriven } from './utils/transient-snapshot.js';
 import { chooseWebTerminalSeed } from './utils/web-terminal-seed.js';
+import { mergeHerdrWebSnapshot, renderHerdrWebHistory, } from './utils/herdr-web-history.js';
 import { parseWorkerRequestUrl } from './utils/worker-http.js';
 import { detectCliUsageLimit, usageLimitStateKey } from './utils/cli-usage-limit.js';
 import { uploadImageBuffer } from './utils/lark-upload.js';
@@ -99,13 +105,20 @@ import { createHash } from 'node:crypto';
 import { installHook } from './adapters/hook-installer.js';
 import { hookCommandFor } from './adapters/hook-command.js';
 import { withCodexAppContext } from './utils/codex-app-context.js';
+import { resolveCodexAppFinalTurnIdentity } from './adapters/cli/codex-app-turn.js';
+import { RunnerControlDecoder } from './adapters/cli/runner-control-channel.js';
+import { managedOriginCapabilityPath, RELAY_ORIGIN_CAPABILITY_BASENAME, replaceManagedOriginCapabilityFile, } from './core/managed-origin-capability.js';
 // ─── State ───────────────────────────────────────────────────────────────────
 let cliAdapter = null;
 let backend = null;
+let intentionalRestartBackend = null;
 let cliPidMarker = null; // path to .botmux-cli-pids/<pid>
 let seatbeltProfilePath = null; // per-session Seatbelt .sb profile to rm at exit (external-wrapper read isolation)
 let sandboxStopWatcher = null; // stop fn for the sandbox outbox watcher
 let sandboxCleanup = null; // unmount overlays + rm the per-session sandbox tree
+let sandboxRelayOutbox = null;
+let sandboxRelayCapability = null;
+let readIsolationOriginCapabilityFile = null;
 let sandboxTeardownDone = false; // guards the exit-time best-effort teardown from double-running / running on suspend-for-resume
 /** Counts consecutive in-worker restart cycles (see case 'restart'). Used by
  *  the SECONDARY guard so an adapter whose checkResumeTargetExists misses
@@ -349,12 +362,23 @@ const wsClients = new Set();
 const authedClients = new WeakSet();
 /** Per-WS-client tmux/zellij attach PTYs. */
 const clientPtys = new Map();
+/** Managed-Herdr viewers survive an in-worker /restart while backend changes. */
+const herdrWebBindings = new Map();
 const writeToken = randomBytes(16).toString('hex');
+// Standalone/test fallback. Production replaces this after init with a stable
+// per-session HMAC derived from the host-only dashboard secret.
+let viewToken = randomBytes(32).toString('base64url');
 // Active dashboard token, persisted by the dashboard process at this stable
 // path (mirrors dashboard.ts TOKEN_PATH). The platform proxy injects it as the
 // `botmux_dashboard_token` cookie on every request it fronts, so its presence
 // proves a request traversed the platform's authenticated front door.
 const DASHBOARD_TOKEN_PATH = join(homedir(), '.botmux', '.dashboard-token');
+const DASHBOARD_SECRET_PATH = join(homedir(), '.botmux', '.dashboard-secret');
+function refreshTerminalViewToken() {
+    const secret = loadDashboardSecret(DASHBOARD_SECRET_PATH);
+    if (secret && sessionId)
+        viewToken = deriveTerminalViewToken(secret, sessionId);
+}
 /**
  * Resolve terminal write permission for one request. The platform-injected
  * `X-Botmux-Role` header is trusted only when this machine is bound to a central
@@ -369,8 +393,8 @@ const DASHBOARD_TOKEN_PATH = join(homedir(), '.botmux', '.dashboard-token');
  * `botmux bind`/unbind and dashboard token rotation are hot-reloaded without
  * restarting this worker, so a cached value would go stale.
  */
-function resolveTerminalWriteForReq(req, tokenMatches) {
-    return resolveTerminalWriteForRequest(req.headers, tokenMatches, () => readPlatformBinding() !== null, () => loadPersistedToken(DASHBOARD_TOKEN_PATH));
+function resolveTerminalAccessForReq(req, url) {
+    return resolveTerminalAccessForRequest(req.headers, safeTerminalTokenEqual(url.searchParams.get('token'), writeToken), safeTerminalTokenEqual(url.searchParams.get('viewToken'), viewToken), () => readPlatformBinding() !== null, () => loadPersistedToken(DASHBOARD_TOKEN_PATH));
 }
 /** Lazily-written locked-mode zellij config for per-WS web-terminal attach
  *  clients: cleared keybinds + locked mode so every keystroke passes straight
@@ -396,6 +420,16 @@ function cliName() { return CLI_DISPLAY_NAMES[lastInitConfig?.cliId ?? ''] ?? 'C
 let isPromptReady = false;
 /** Mutex for async flushPending — prevents concurrent flush loops. */
 let isFlushing = false;
+/** True from the moment an owned CLI restart begins until the replacement
+ * backend has been synchronously installed. Async backends (notably Riff)
+ * keep the old backend object alive while destroySession() awaits remote
+ * cancellation; this gate prevents new input or an old idle callback from
+ * crossing that teardown fence. */
+let cliRestartInProgress = false;
+/** Raw slash commands require a real prompt and cannot use the ordinary
+ * type-ahead fallback. Keep them fenced across an owned restart until the
+ * replacement generation reaches its prompt. */
+let rawInputRestartGate = false;
 /** Per-spawn one-shot: have this spawn's bot.startupCommands been typed in yet?
  *  Reset in spawnCli so a restart/resume (which re-spawns the CLI) re-applies
  *  them — needed because session-only settings like `/effort ultracode` are lost
@@ -634,8 +668,9 @@ async function runStartupCommands() {
     idleDetector?.reset();
 }
 const pendingMessages = [];
-/** Literal commands that arrived while native /rename owned the TUI. Normal
- * raw_input commands are still delivered immediately (including while busy). */
+/** Literal commands that arrived while native /rename owned the TUI or while
+ * an owned CLI restart was fenced. Normal raw_input commands are still
+ * delivered immediately (including while busy). */
 const pendingRawInputs = [];
 /** Latest requested canonical session title. Unlike a normal prompt this is an
  * administrative TUI command: never type-ahead while the agent is busy, never
@@ -706,7 +741,9 @@ async function deliverRawInput(msg) {
     // Enter lands. sendToPty also observes commandLineWritesPending, so another
     // raw command's text -> Enter window cannot be interrupted by the follow-up.
     if (sent && msg.followUpContent) {
-        sendToPty(msg.followUpContent, undefined, msg.followUpCodexAppInput);
+        sendToPty(msg.followUpContent, undefined, {
+            codexAppInput: msg.followUpCodexAppInput,
+        });
         log(`Enqueued follow-up after raw input (${msg.followUpContent.length} chars)`);
     }
     // A pending /rename may have been held by the command-write mutex. It still
@@ -720,29 +757,192 @@ const inflightInputs = new InflightInputTracker();
  *  start work before their history/transcript submit marker is observable. */
 let lastPtyActivityAtMs = 0;
 let currentBotmuxTurnId;
-function readProcStarttime(pid) {
+let currentBotmuxDispatchAttempt;
+let currentVcMeetingImTurnOrigin;
+let durableTurnInFlight = false;
+function publishSandboxRelayCapability(opts = {}) {
+    const capability = {
+        token: randomBytes(32).toString('hex'),
+        ...(currentBotmuxTurnId ? { turnId: currentBotmuxTurnId } : {}),
+        ...(currentBotmuxDispatchAttempt !== undefined
+            ? { dispatchAttempt: currentBotmuxDispatchAttempt }
+            : {}),
+    };
+    const files = [
+        ...(sandboxRelayOutbox
+            ? [{
+                    path: join(sandboxRelayOutbox, RELAY_ORIGIN_CAPABILITY_BASENAME),
+                    body: JSON.stringify({ token: capability.token }),
+                }]
+            : []),
+        ...(readIsolationOriginCapabilityFile && sessionId
+            ? [{
+                    path: readIsolationOriginCapabilityFile,
+                    body: JSON.stringify({
+                        sessionId,
+                        capability: capability.token,
+                        ...(capability.turnId ? { turnId: capability.turnId } : {}),
+                        ...(capability.dispatchAttempt !== undefined
+                            ? { dispatchAttempt: capability.dispatchAttempt }
+                            : {}),
+                    }),
+                }]
+            : []),
+    ];
+    for (const file of files) {
+        try {
+            replaceManagedOriginCapabilityFile(file.path, file.body);
+        }
+        catch (err) {
+            log(`Failed to publish managed origin capability: ${err?.message ?? err}`);
+            if (opts.failClosed) {
+                unlinkManagedOriginCapabilityFiles();
+                throw err;
+            }
+        }
+    }
+    sandboxRelayCapability = capability;
+    if (sessionId) {
+        send({
+            type: 'managed_turn_origin',
+            sessionId,
+            capability: capability.token,
+            ...(capability.turnId ? { turnId: capability.turnId } : {}),
+            ...(capability.dispatchAttempt !== undefined
+                ? { dispatchAttempt: capability.dispatchAttempt }
+                : {}),
+        });
+    }
+}
+function unlinkManagedOriginCapabilityFiles() {
+    const files = [
+        sandboxRelayOutbox
+            ? join(sandboxRelayOutbox, RELAY_ORIGIN_CAPABILITY_BASENAME)
+            : undefined,
+        readIsolationOriginCapabilityFile ?? undefined,
+    ];
+    for (const file of new Set(files.filter((p) => !!p))) {
+        try {
+            unlinkSync(file);
+        }
+        catch { /* absent or teardown racing */ }
+    }
+}
+/** Read a host-owned isolation marker without following a child-planted
+ * symlink between lookup and open. */
+function readRegularHostFileNoFollow(filePath) {
+    let fd;
     try {
-        const raw = readFileSync(`/proc/${pid}/stat`, 'utf8');
-        const closeParen = raw.lastIndexOf(')');
-        if (closeParen < 0)
-            return undefined;
-        const fields = raw.slice(closeParen + 2).trim().split(/\s+/);
-        return fields[19] || undefined;
+        fd = openSync(filePath, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+        if (!fstatSync(fd).isFile())
+            return null;
+        return readFileSync(fd, 'utf8');
     }
     catch {
-        return undefined;
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best-effort */ }
+        }
     }
 }
+function completeManagedTurnOriginRevocation(revoked, turnId, dispatchAttempt) {
+    // Clear local authority before queuing daemon IPC. A forked/delayed process
+    // can otherwise win the small window between terminal publication and
+    // revocation by submitting through the still-live host relay.
+    sandboxRelayCapability = null;
+    currentVcMeetingImTurnOrigin = undefined;
+    if (sessionId) {
+        send({
+            type: 'managed_turn_origin_revoked',
+            sessionId,
+            ...(revoked ? { capability: revoked.token } : {}),
+            ...(turnId ? { turnId } : {}),
+            ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
+        });
+    }
+    unlinkManagedOriginCapabilityFiles();
+}
+/**
+ * Revoke this CLI generation's managed-send authority before an intentional
+ * in-worker restart starts tearing down its backend. The Node worker survives,
+ * so neither claude_exit nor worker-exit can perform the daemon-side cleanup.
+ *
+ * Keep currentBotmuxTurnId/currentBotmuxDispatchAttempt intact: the old
+ * backend's exit callback still needs that exact identity to emit its terminal
+ * edge. The relay token and explicit IM origin, however, become unusable
+ * synchronously; a later real turn publishes a fresh token in flushPending().
+ */
+function revokeManagedTurnOriginForRestart() {
+    const revoked = sandboxRelayCapability;
+    completeManagedTurnOriginRevocation(revoked, currentBotmuxTurnId, currentBotmuxDispatchAttempt);
+}
+/** Revoke only the capability generation bound to this exact terminal. A late
+ * terminal from turn N must not clear the token already rotated for turn N+1. */
+function revokeManagedTurnOriginForTerminal(turnId, dispatchAttempt) {
+    const revoked = sandboxRelayCapability;
+    if (!revoked
+        || revoked.turnId !== turnId
+        || revoked.dispatchAttempt !== dispatchAttempt)
+        return;
+    completeManagedTurnOriginRevocation(revoked, turnId, dispatchAttempt);
+}
+function authorizeManagedSend(claim) {
+    if (!sessionId)
+        return { ok: false, error: 'VC policy cannot resolve session id' };
+    const dataDir = process.env.SESSION_DATA_DIR;
+    if (!dataDir)
+        return { ok: false, error: 'VC policy cannot resolve session data' };
+    // The sandbox controls every byte in outbox/*.req.json. A rotating host-issued
+    // capability binds request creation to this exact live turn; the request may
+    // not name an older loud receipt, and a delayed request crossing a turn
+    // boundary is rejected after capability rotation.
+    const capability = sandboxRelayCapability;
+    if (!capability || !claim.capability || claim.capability !== capability.token) {
+        return { ok: false, error: 'origin_mismatch: relay capability is stale or missing' };
+    }
+    const session = sessionStore.getSession(sessionId);
+    const currentImOrigin = currentVcMeetingImTurnOrigin;
+    const imOrigin = currentImOrigin?.larkMessageId === capability.turnId
+        && currentImOrigin?.receiverSessionId === sessionId
+        ? currentImOrigin
+        : undefined;
+    const decision = evaluateVcMeetingManagedSend(dataDir, {
+        receiverSessionId: sessionId,
+        receiverSession: !!session?.vcMeetingReceiver,
+        turnId: capability.turnId,
+        dispatchAttempt: capability.dispatchAttempt,
+        currentImTurnOrigin: imOrigin,
+    });
+    return decision.ok
+        ? {
+            ok: true,
+            origin: {
+                ...(capability.turnId ? { turnId: capability.turnId } : {}),
+                ...(capability.dispatchAttempt !== undefined
+                    ? { dispatchAttempt: capability.dispatchAttempt }
+                    : {}),
+            },
+        }
+        : { ok: false, error: `${decision.errorCode}: ${decision.error}` };
+}
 function writeCliPidMarker() {
     if (!cliPidMarker || !sessionId)
         return;
     try {
         // 原子写：daemon 侧（killStalePids 等）随时读这个 marker JSON。
         const markerPid = Number(basename(cliPidMarker));
-        const procStart = Number.isInteger(markerPid) && markerPid > 0 ? readProcStarttime(markerPid) : undefined;
+        const procStart = Number.isInteger(markerPid) && markerPid > 0
+            ? readProcessStartIdentity(markerPid)
+            : undefined;
         atomicWriteFileSync(cliPidMarker, JSON.stringify({
             sessionId,
             turnId: currentBotmuxTurnId ?? null,
+            dispatchAttempt: currentBotmuxDispatchAttempt ?? null,
             ...(procStart ? { procStart } : {}),
         }));
     }
@@ -910,6 +1110,12 @@ let codexAdoptPendingPid;
  *  but BEFORE the rollout was located still reach the Lark thread. 5s
  *  skew tolerance is applied on top, mirroring the Lark/Claude bridges. */
 let codexAdoptStartMs;
+/** Open-fd discovery is cheap via /proc on Linux but shells out to lsof on
+ * macOS/BSD. Lark-driven Grok rotation is immediate through writeInput; this
+ * throttled poll exists for direct terminal/adopt rotation and cold collision
+ * recovery, where a few seconds of latency is acceptable. */
+let grokBridgePidProbeLastMs = 0;
+const GROK_BRIDGE_PID_PROBE_INTERVAL_MS = 5_000;
 /** Adopt-only: 一次性发送的 "/adopt 前最后一轮" preamble 是否已经触发过。
  *  codexBridgeAttach 在 split-live 分支会查 history 取最后一对 user/assistant
  *  发给 daemon —— late-attach poller 也会反复走这条分支（每秒一次），所以
@@ -1785,6 +1991,10 @@ function bridgeIngest() {
     if (result.events.length > 0)
         lastStructuredBridgeActivityAtMs = Date.now();
     bridgeQueue.ingest(result.events, bridgeJsonlPath);
+    // Transcript terminal markers are authoritative and may settle a durable
+    // turn immediately. Do not wait for the screen prompt: permission/AskUser
+    // surfaces can resemble idle, while an explicit JSONL boundary cannot.
+    emitReadyTurns({ explicitTerminalOnly: true });
 }
 function performBridgeIngestAndScheduleQuietEmit() {
     const beforePath = bridgeJsonlPath;
@@ -1922,6 +2132,10 @@ function stopBridgeWatcher() {
     bridgeStalePidStateSessionId = undefined;
     bridgeSecondaryPaths.clear();
     bridgeFingerprintScanLastMs.clear();
+    // Attribution belongs to the CLI generation whose transcript we watched.
+    // A fresh backend must not inherit a terminal/fingerprint from the exited
+    // process; durable replay is owned by the receiver with a new attempt.
+    bridgeQueue.clearPending();
     bridgePreambleSent = false;
 }
 /**
@@ -1940,12 +2154,13 @@ function stopBridgeWatcher() {
  * Lark turn.
  *
  * The turnId is returned so the writeInput failure path can call
- * `bridgeQueue.dropPendingTurn(turnId)` after deferred recheck conclusively
- * fails — otherwise an Enter-eaten-by-TUI submit leaves a fingerprint that
- * no jsonl line will ever match, and `maybeSwitchBridgeJsonl` burns 99%
- * CPU scanning all sibling jsonls for it on every poll tick.
+ * `bridgeQueue.dropPendingTurn(turnId, dispatchAttempt)` after deferred
+ * recheck conclusively fails — otherwise an Enter-eaten-by-TUI submit leaves
+ * a fingerprint that no jsonl line will ever match, and
+ * `maybeSwitchBridgeJsonl` burns 99% CPU scanning all sibling jsonls for it
+ * on every poll tick.
  */
-function bridgeMarkPendingTurn(messageText, preferredTurnId) {
+function bridgeMarkPendingTurn(messageText, preferredTurnId, dispatchAttempt) {
     if (!bridgeJsonlPath)
         return undefined;
     if (!bridgeBaselineDone) {
@@ -1982,7 +2197,7 @@ function bridgeMarkPendingTurn(messageText, preferredTurnId) {
     const normalised = normaliseForFingerprint(messageText);
     const contentNormalized = normalised.length > 0 ? normalised : undefined;
     const turnId = preferredTurnId ?? randomBytes(8).toString('hex');
-    bridgeQueue.mark(turnId, fingerprint, Date.now(), contentNormalized);
+    bridgeQueue.mark(turnId, fingerprint, Date.now(), contentNormalized, dispatchAttempt);
     return turnId;
 }
 function bridgeDrainAndMaybeEmit() {
@@ -2003,8 +2218,13 @@ function bridgeDrainAndMaybeEmit() {
  *
  *  Caches per-path drains so a batch of turns from the same file only reads
  *  the transcript once (O(jsonl size) per distinct path). */
-function emitReadyTurns() {
-    const ready = bridgeQueue.drainEmittable();
+function emitReadyTurns(opts = {}) {
+    const ready = bridgeQueue.drainEmittable(opts.explicitTerminalOnly
+        ? { explicitTerminalOnly: true }
+        : {
+            terminalBoundary: true,
+            requireExplicitTerminalForDurable: true,
+        });
     if (ready.length === 0)
         return;
     const adoptMode = lastInitConfig?.adoptMode === true;
@@ -2068,6 +2288,7 @@ function emitReadyTurns() {
                     content: fields.content,
                     lastUuid,
                     turnId: turn.turnId,
+                    ...(turn.dispatchAttempt !== undefined ? { dispatchAttempt: turn.dispatchAttempt } : {}),
                     kind: 'local-turn',
                     userText: fields.userText,
                 });
@@ -2082,12 +2303,25 @@ function emitReadyTurns() {
                 content: headlessContent,
                 lastUuid,
                 turnId: turn.turnId,
+                ...(turn.dispatchAttempt !== undefined ? { dispatchAttempt: turn.dispatchAttempt } : {}),
                 kind: 'local-turn-headless',
             });
             continue;
         }
-        send({ type: 'final_output', content: assistantText, lastUuid, turnId: turn.turnId });
+        send({
+            type: 'final_output',
+            content: assistantText,
+            lastUuid,
+            turnId: turn.turnId,
+            ...(turn.dispatchAttempt !== undefined ? { dispatchAttempt: turn.dispatchAttempt } : {}),
+        });
     }
+    // A visible fallback is optional: it may be empty or deliberately suppressed
+    // after the model used `botmux send`. Completion is not optional. Emit it
+    // only after all corresponding final_output IPC messages have been queued so
+    // the daemon observes a stable per-turn ordering.
+    for (const turn of ready)
+        emitTurnTerminal(turn.turnId, 'completed', undefined, turn.dispatchAttempt);
 }
 /** Drain `path` from `fromOffset` and feed the events to the bridge queue
  *  with that path as the source stamp. Pure side-effects on bridgeQueue +
@@ -2115,10 +2349,11 @@ function codexBridgeFallbackActive() {
     // services/structured-bridge-clis.ts (single source of the allowlist).
     return isStructuredBridgeFallbackActive(lastInitConfig?.cliId, lastInitConfig?.adoptMode === true);
 }
-// Both Codex and TRAE share the same rollout JSONL layout (response_item
-// messages), so drainCodexRollout works for both.
 function structuredBridgeIsCodex() {
-    return lastInitConfig?.cliId === 'codex' || lastInitConfig?.cliId === 'traex';
+    return lastInitConfig?.cliId === 'codex';
+}
+function structuredBridgeIsTraex() {
+    return lastInitConfig?.cliId === 'traex';
 }
 function structuredBridgeIsHermes() {
     return lastInitConfig?.cliId === 'hermes';
@@ -2141,6 +2376,8 @@ function currentHermesBridgeDbPath() {
 function structuredBridgeIngestPath(path, offset) {
     if (structuredBridgeIsCodex())
         return drainCodexRollout(path, offset);
+    if (structuredBridgeIsTraex())
+        return drainTraexRollout(path, offset);
     if (codexBridgeIsCursor())
         return drainCursorTranscript(path, offset);
     if (structuredBridgeIsPi())
@@ -2222,6 +2459,17 @@ function codexBridgeStartTimer() {
                     emitReadyCodexTurns();
                 return;
             }
+            // Grok keeps one process alive across `/new` / `/clear` / `/resume`, but
+            // moves its authoritative updates stream to a new session directory.
+            // A Lark-driven next prompt reports the new sid through writeInput;
+            // adopt/local terminal input has no such callback, so follow the pid's
+            // currently-open Grok session on every bridge tick as well.
+            maybeFollowGrokSessionRotationViaPid();
+            // TRAE has the same adopt/local-input blind spot: a direct `/new` in
+            // the observed pane produces no adapter writeInput result. Its rollout
+            // fd is process-scoped, so following that fd cannot select a sibling
+            // TRAE process merely because it shares the working directory.
+            maybeFollowTraexSessionRotationViaPid();
             if (!codexBridgeRolloutPath) {
                 // Late-attach: cliSessionId (writeInput / daemon probe) then adopt
                 // pid. Path lookup is centralized in resolveFileBridgePath so
@@ -2474,7 +2722,38 @@ function codexBridgeNotifyCliSessionId(cliSessionId) {
     if (!codexBridgeFallbackActive())
         return;
     if (codexBridgeRolloutPath) {
-        // Already attached — first-attach-wins for most CLIs. Exception: grok's
+        // Already attached — first-attach-wins for most CLIs. Exceptions: TRAE
+        // and Grok can rotate their native session in the same process.
+        if (structuredBridgeIsTraex()) {
+            const currentSid = codexSessionIdFromRolloutPath(codexBridgeRolloutPath);
+            if (currentSid && currentSid.toLowerCase() === cliSessionId.toLowerCase())
+                return;
+            const next = resolveFileBridgePath('traex', { sessionId: cliSessionId });
+            // Close any terminal already committed to the retired rollout before
+            // switching. A durable turn is a worker HOL barrier, so a legitimate
+            // session rotation cannot overtake an unfinished durable delivery.
+            try {
+                codexBridgeIngest();
+                emitReadyCodexTurns();
+            }
+            catch (err) {
+                log(`TRAE pre-rotation bridge drain failed: ${err.message}`);
+            }
+            if (next && next !== codexBridgeRolloutPath) {
+                log(`TRAE session rotated ${currentSid ?? '?'} → ${cliSessionId}; re-attaching bridge to ${next}`);
+                codexBridgeDetachFile();
+                codexBridgePendingSessionId = undefined;
+                codexBridgeAttach(next, 'fresh-empty');
+            }
+            else if (!next) {
+                log(`TRAE session rotated ${currentSid ?? '?'} → ${cliSessionId}; waiting for rollout`);
+                codexBridgeDetachFile();
+                codexBridgePendingSessionId = cliSessionId;
+                codexBridgeStartTimer();
+            }
+            return;
+        }
+        // Grok's
         // `/new` / `/clear` / `/resume` rotate to a NEW session directory at the
         // SAME pid, and writeInput's prompt_history verify reports the new
         // session id on the very next submit. Without a re-attach the bridge
@@ -2490,6 +2769,17 @@ function codexBridgeNotifyCliSessionId(cliSessionId) {
             });
             if (next && next !== codexBridgeRolloutPath) {
                 log(`Grok session rotated ${currentSid ?? '?'} → ${cliSessionId}; re-attaching bridge to ${next}`);
+                // Drain the retired stream synchronously before closing its watcher.
+                // A turn_completed may already be on disk while fs.watch / the 1s
+                // poller is still queued; letting the new path replace it first would
+                // strand the exact old turn until the durable lease expires.
+                try {
+                    codexBridgeIngest();
+                    emitReadyCodexTurns();
+                }
+                catch (err) {
+                    log(`Grok pre-rotation bridge drain failed: ${err.message}`);
+                }
                 codexBridgeDetachFile();
                 codexBridgePendingSessionId = undefined;
                 codexBridgeAttach(next, 'fresh-empty');
@@ -2498,6 +2788,13 @@ function codexBridgeNotifyCliSessionId(cliSessionId) {
                 // New session id reported but updates.jsonl not on disk yet —
                 // detach the retired session and arm the poller for late-attach.
                 log(`Grok session rotated ${currentSid ?? '?'} → ${cliSessionId}; waiting for updates.jsonl`);
+                try {
+                    codexBridgeIngest();
+                    emitReadyCodexTurns();
+                }
+                catch (err) {
+                    log(`Grok pre-rotation bridge drain failed: ${err.message}`);
+                }
                 codexBridgeDetachFile();
                 codexBridgePendingSessionId = cliSessionId;
                 codexBridgeStartTimer();
@@ -2544,7 +2841,52 @@ function codexBridgeNotifyCliSessionId(cliSessionId) {
         codexBridgeStartTimer();
     }
 }
-function codexBridgeIngest() {
+/** Follow a Grok in-process session rotation even when no botmux writeInput
+ * occurred (notably direct terminal input in adopt mode). Open-fd discovery is
+ * process-scoped, so sibling Grok sessions in the same cwd cannot steal this
+ * bridge. `codexBridgeNotifyCliSessionId` owns the drain-before-detach switch. */
+function maybeFollowGrokSessionRotationViaPid() {
+    if (!structuredBridgeIsGrok() || !codexBridgeRolloutPath || !backend)
+        return;
+    const now = Date.now();
+    if (now - grokBridgePidProbeLastMs < GROK_BRIDGE_PID_PROBE_INTERVAL_MS)
+        return;
+    grokBridgePidProbeLastMs = now;
+    const pid = backend.cliPid
+        ?? backend.getChildPid?.()
+        ?? codexAdoptPendingPid;
+    if (!pid)
+        return;
+    const observed = findGrokSessionByPid(pid);
+    if (!observed)
+        return;
+    const currentSid = grokSessionIdFromPath(codexBridgeRolloutPath);
+    if (currentSid?.toLowerCase() === observed.sessionId.toLowerCase())
+        return;
+    persistCliSessionId(observed.sessionId);
+    codexBridgeNotifyCliSessionId(observed.sessionId);
+}
+/** Follow a TRAE in-process session rotation for direct local input in an
+ * adopted pane. `codexBridgeNotifyCliSessionId` performs the drain-before-
+ * detach switch and persists the newly observed native session id. */
+function maybeFollowTraexSessionRotationViaPid() {
+    if (!structuredBridgeIsTraex() || !codexBridgeRolloutPath || !backend)
+        return;
+    const pid = backend.cliPid
+        ?? backend.getChildPid?.()
+        ?? codexAdoptPendingPid;
+    if (!pid)
+        return;
+    const observed = findTraexRolloutByPid(pid);
+    if (!observed)
+        return;
+    const currentSid = codexSessionIdFromRolloutPath(codexBridgeRolloutPath);
+    if (currentSid?.toLowerCase() === observed.cliSessionId.toLowerCase())
+        return;
+    persistCliSessionId(observed.cliSessionId);
+    codexBridgeNotifyCliSessionId(observed.cliSessionId);
+}
+function codexBridgeIngest(opts = {}) {
     if (structuredBridgeIsHermes()) {
         hermesBridgeIngest();
         return;
@@ -2567,26 +2909,26 @@ function codexBridgeIngest() {
     // its own moving targets). Pushing idle here lets the bridge emit
     // immediately instead of waiting for readyPattern + quiescence to
     // converge. Idempotent — IdleDetector.fireIdle no-ops while already idle.
-    if (result.events.some(e => e.kind === 'assistant_final')) {
+    if (opts.signalIdle !== false && result.events.some(e => e.kind === 'assistant_final')) {
         idleDetector?.fireIdle();
     }
 }
 /** Mark a pending Lark turn for Codex. Crucially this works even before a
  *  rollout path is known — the queue is path-agnostic, and ingest after
  *  late-attach picks up the user_message and matches the fingerprint. */
-function codexBridgeMarkPendingTurn(messageText, preferredTurnId) {
+function codexBridgeMarkPendingTurn(messageText, preferredTurnId, dispatchAttempt) {
     if (!codexBridgeFallbackActive())
         return false;
     const turnId = preferredTurnId ?? `codex-${randomBytes(8).toString('hex')}`;
-    codexBridgeQueue.mark(turnId, messageText);
+    codexBridgeQueue.mark(turnId, messageText, Date.now(), dispatchAttempt);
     return true;
 }
-function codexBridgeDrainAndMaybeEmit() {
+function codexBridgeDrainAndMaybeEmit(opts = {}) {
     if (!codexBridgeFallbackActive())
         return;
     if (structuredBridgeIsHermes() || structuredBridgeIsMtr() || (codexBridgeRolloutPath && codexBridgeBaselineDone)) {
         try {
-            codexBridgeIngest();
+            codexBridgeIngest(opts);
         }
         catch (err) {
             log(`Codex bridge ingest error: ${err.message}`);
@@ -2639,6 +2981,7 @@ function emitReadyCodexTurns() {
                 content: fields.content,
                 lastUuid: turn.turnId,
                 turnId: turn.turnId,
+                ...(turn.dispatchAttempt !== undefined ? { dispatchAttempt: turn.dispatchAttempt } : {}),
                 kind: 'local-turn',
                 userText: fields.userText,
             });
@@ -2650,8 +2993,12 @@ function emitReadyCodexTurns() {
             content: turn.finalText,
             lastUuid: turn.turnId,
             turnId: turn.turnId,
+            ...(turn.dispatchAttempt !== undefined ? { dispatchAttempt: turn.dispatchAttempt } : {}),
         });
     }
+    for (const turn of ready) {
+        emitTurnTerminal(turn.turnId, turn.terminalStatus ?? 'completed', turn.terminalErrorCode, turn.dispatchAttempt);
+    }
 }
 function stopCodexBridge() {
     if (codexBridgeWatcher) {
@@ -2680,6 +3027,7 @@ function stopCodexBridge() {
     codexBridgePendingSessionId = undefined;
     codexAdoptPendingPid = undefined;
     codexAdoptStartMs = undefined;
+    grokBridgePidProbeLastMs = 0;
 }
 /** When a rotation moves bridgeJsonlPath away from `oldPath`, queue turns
  *  whose sourceJsonlPath equals oldPath may still be waiting on assistant
@@ -2772,6 +3120,9 @@ const SCREEN_UPDATE_INTERVAL_MS = 2_000;
 // ─── Scrollback Buffer (replay to late-connecting WS clients) ───────────────
 const MAX_SCROLLBACK = 1_000_000; // chars (~1MB)
 let scrollback = '';
+let herdrWebHistory = null;
+let herdrWebScrollDirection = null;
+let herdrWebCursor = null;
 const WORKFLOW_TRANSCRIPT_MAX = 2_000_000; // chars (~2MB)
 const WORKFLOW_OUTPUT_END_MARKER = '</WORKFLOW_OUTPUT>';
 const CRASH_DIAGNOSTIC_RAW_MAX = 200_000; // enough scrollback for the web terminal without huge temp files
@@ -2787,6 +3138,68 @@ let workflowFinalOutputSent = false;
 let altBufferActive = false;
 const ALT_ENTER_RE = /\x1b\[\?(1049|1047|47)h/g;
 const ALT_EXIT_RE = /\x1b\[\?(1049|1047|47)l/g;
+function usesHerdrSnapshotWebHistory() {
+    return backend instanceof HerdrBackend;
+}
+function herdrWebCursorSequence(cursor = herdrWebCursor) {
+    return cursor ? `\x1b[${cursor.row + 1};${cursor.col + 1}H` : '';
+}
+function relayHerdrWebCursor(cursor) {
+    herdrWebCursor = cursor;
+    const sequence = herdrWebCursorSequence(cursor);
+    for (const ws of wsClients) {
+        if (ws.readyState === WebSocket.OPEN)
+            ws.send(sequence);
+    }
+}
+function relayHerdrWebSnapshot(snapshot) {
+    const merged = mergeHerdrWebSnapshot(herdrWebHistory, snapshot, herdrWebScrollDirection, MAX_SCROLLBACK);
+    herdrWebHistory = merged.state;
+    herdrWebScrollDirection = null;
+    scrollback = renderHerdrWebHistory(merged.state);
+    const payload = `\x1b]1989;history;${merged.addedLines}\x07${scrollback}${herdrWebCursorSequence()}`;
+    for (const ws of wsClients) {
+        if (ws.readyState === WebSocket.OPEN)
+            ws.send(payload);
+    }
+}
+function applyHerdrWebBindingResult(ws, result) {
+    if (ws.readyState !== WebSocket.OPEN)
+        return;
+    const { backend: herdrWebBackend, initialSize, size } = result;
+    if (initialSize) {
+        ws.send(`\x1b]1989;follower;${initialSize.cols};${initialSize.rows}\x07`);
+    }
+    if (!herdrWebBackend || !size)
+        return;
+    for (const client of wsClients) {
+        if (client.readyState === WebSocket.OPEN &&
+            !herdrWebBackend.isWebTerminalOwner(client)) {
+            client.send(`\x1b]1989;follower;${size.cols};${size.rows}\x07`);
+        }
+    }
+}
+/**
+ * /restart replaces a managed Herdr backend without closing browser sockets.
+ * Restore every viewer in connection order so the previous oldest surviving
+ * owner remains authoritative, then re-apply its last browser grid.
+ */
+function restoreHerdrWebBindings() {
+    if (!(backend instanceof HerdrBackend) || lastInitConfig?.adoptMode)
+        return;
+    for (const [ws, binding] of herdrWebBindings) {
+        if (ws.readyState !== WebSocket.OPEN) {
+            binding.release();
+            herdrWebBindings.delete(ws);
+            continue;
+        }
+        applyHerdrWebBindingResult(ws, binding.restore());
+    }
+}
+function wireHerdrWebTerminalRelays(be) {
+    be.onSnapshot(relayHerdrWebSnapshot);
+    be.onWebTerminalCursor(relayHerdrWebCursor);
+}
 function recentTerminalLogTail() {
     const plain = stripAnsiForLog(tailChars(scrollback, CRASH_DIAGNOSTIC_RAW_MAX));
     if (!plain)
@@ -2968,7 +3381,7 @@ function startScreenAnalyzer() {
         onAnalyzing: () => { },
         onTuiPrompt: (description, options, multiSelect) => {
             tuiPromptBlocking = true;
-            send({ type: 'tui_prompt', description, options, multiSelect, turnId: currentBotmuxTurnId });
+            send({ type: 'tui_prompt', description, options, multiSelect, turnId: currentBotmuxTurnId, dispatchAttempt: currentBotmuxDispatchAttempt });
         },
         onTuiPromptResolved: (selectedText) => {
             tuiPromptBlocking = false;
@@ -3254,6 +3667,78 @@ async function handleTuiKeys(keys, isFinal) {
     }
     log(`TUI keys: ${keys.join(' ')}${isFinal ? ' (final)' : ''}`);
 }
+// 待注入的 TUI 命令队列。生命周期绑定当前 CLI 进程：killCli() 会清空它，
+// 防止 restart 后残留命令重放进新 CLI——新增清理状态时记得同步那里。
+// barrier=true 标记该注入携带 updateWorkingDir（cwd-move，如 /cd）：markPromptReady
+// 里 barrier 注入必须先于本次 pending 用户消息落地，防止用户消息在「记录已是新
+// cwd、进程仍在旧 cwd」的窗口里被写进旧目录的 CLI。排队策略判定收敛到
+// core/inject-queue-policy.ts（shouldDeferUserFlush / shouldFlushInjectionsFirst）
+// 以获得可单测的纯函数单元——本文件只持有队列状态。
+const pendingInjections = [];
+let injectionFlushing = false;
+/** 排队注入一行 TUI 命令：idle（isPromptReady）时经 sendRawCommandLineSerially 敲入。 */
+async function flushPendingInjections() {
+    // 不跨 restart 边界写入（与 flushPending 同款守卫）：destroySession 异步期间
+    // backend 可能仍指向旧 CLI。
+    if (cliRestartInProgress)
+        return;
+    // 与其它 PTY 写入方的互斥判定收敛在 canStartInjectionFlush（纯函数，可单测）：
+    // - 用户消息 flush 持锁中（isFlushing）：markPromptReady 没有 isFlushing 守卫，
+    //   可能在 flush 中途被误 idle 触发（startup-command 的 quiescence 等待、慢
+    //   submit-verify 的 text→Enter 间隙都是多秒级窗口）——此时开始注入会把命令
+    //   拼进已敲了半条用户消息的 composer。flushPending 反向检查 injectionFlushing，
+    //   互斥必须对称才成立。
+    // - /rename 原生同步在飞（sessionRenameInFlight）与字面命令行写入窗口
+    //   （commandLineWritesPending）：raw-write 围栏，注入同为 raw 命令行写入方。
+    // 被挡下的注入不丢：队列留存，竞争写入方结束后的下一次 markPromptReady 再踢。
+    if (!canStartInjectionFlush({
+        injectionFlushing,
+        userFlushing: isFlushing,
+        sessionRenameInFlight,
+        commandLineWritesPending,
+        bareShellLaunchBlocked,
+    }))
+        return;
+    injectionFlushing = true;
+    try {
+        while (pendingInjections.length > 0 && backend && isPromptReady && !bareShellLaunchBlocked
+            && !sessionRenameInFlight) {
+            // Mirror flushPending's one-shot launch-failure guard: when an injection is
+            // the FIRST writer after a (re)spawn, flushPending may never have run
+            // (pendingMessages empty ⇒ early return) so the bare-shell check must also
+            // fire here before typing. Shares the same one-shot flag — whichever flush
+            // path sends first runs the detection.
+            if (!bareShellChecked) {
+                bareShellChecked = true;
+                if (detectBareShellLaunch())
+                    return; // finally{} releases the mutex; queue stays
+            }
+            const item = pendingInjections.shift();
+            const cmd = item.command;
+            isPromptReady = false;
+            idleDetector?.reset();
+            try {
+                // Serially：与 startupCommands / raw_input / native-rename 共用同一条
+                // 字面命令行写入互斥链（text → beat → Enter 窗口不被拼接）。
+                await sendRawCommandLineSerially(backend, cmd);
+                await awaitPtyQuiescence(STARTUP_CMD_QUIET_MS, STARTUP_CMD_CAP_MS);
+                log(`Injected command: ${cmd}`);
+            }
+            catch (e) {
+                log(`Inject command failed (${cmd}): ${e?.message ?? e}`);
+            }
+        }
+    }
+    finally {
+        injectionFlushing = false;
+        // 若注入期间有用户输入（消息 / raw input / rename）被 flushPending 的
+        // injectionFlushing 守卫挡下、且此刻已重新 idle，补踢一次（flushPending
+        // 自带全部守卫，最坏 no-op）。
+        if (isPromptReady && (pendingMessages.length > 0 || pendingRawInputs.length > 0 || pendingSessionRename !== null)) {
+            void flushPending();
+        }
+    }
+}
 /**
  * Handle atomic text-input: navigate to "Type something" (WITHOUT pressing Enter),
  * then write text via cliAdapter (which adds its own Enter to submit).
@@ -3422,9 +3907,8 @@ function dismissAidenCodexUpdateDialog(data) {
 // Codex App runner sends botmux control messages as OSC sequences so they do
 // not pollute the visible terminal. Strip them before xterm rendering and
 // translate them back into worker IPC.
-const CODEX_APP_OSC_PREFIX = '\x1b]777;botmux:';
 const APP_RUNNER_OSC_CLI_IDS = new Set(['codex-app', 'mira', 'mir']);
-let codexAppOscPending = '';
+const appRunnerControlDecoder = new RunnerControlDecoder();
 let kiroSessionIdCaptureArmed = false;
 let kiroSessionIdCaptureBuffer = '';
 function decodeCodexAppPayload(payload) {
@@ -3450,20 +3934,45 @@ function handleCodexAppMarker(body) {
     if (kind === 'final' && typeof payload.content === 'string') {
         const startedAtMs = typeof payload.startedAtMs === 'number' ? payload.startedAtMs : undefined;
         const completedAtMs = typeof payload.completedAtMs === 'number' ? payload.completedAtMs : Date.now();
+        // Codex App keeps the app-server-generated id separately for diagnostics.
+        // Routing must use its stable clientUserMessageId marker; legacy envelopes
+        // intentionally omit it and fall back to the worker's frozen botmux turn.
+        const identity = resolveCodexAppFinalTurnIdentity(payload, currentBotmuxTurnId, `${lastInitConfig?.cliId ?? 'app'}-${Date.now()}`);
+        if (!identity.ok) {
+            log(`${cliName()} rejected final marker with mismatched turn `
+                + `(marker=${identity.markerTurnId.substring(0, 12)}, `
+                + `current=${identity.currentBotmuxTurnId?.substring(0, 12) ?? '-'})`);
+            return;
+        }
+        const { turnId, nativeTurnId } = identity;
+        if (nativeTurnId && nativeTurnId !== turnId) {
+            log(`${cliName()} native turn ${nativeTurnId.substring(0, 12)} mapped to botmux turn ${turnId.substring(0, 12)}`);
+        }
+        if (payload.dispatchAttempt !== undefined
+            && payload.dispatchAttempt !== currentBotmuxDispatchAttempt) {
+            log(`${cliName()} rejected final marker with mismatched dispatch attempt `
+                + `(marker=${String(payload.dispatchAttempt)}, current=${currentBotmuxDispatchAttempt ?? '-'})`);
+            return;
+        }
+        // Attempt authority is worker-owned. A runner marker may redundantly assert
+        // equality for compatibility, but can never select another attempt.
+        const dispatchAttempt = currentBotmuxDispatchAttempt;
         if (startedAtMs !== undefined) {
             const sentByModel = shouldSuppressBridgeEmit({ markTimeMs: startedAtMs, isLocal: false, finalText: payload.content }, completedAtMs + 5_001, readSendMarkers(), false);
             if (sentByModel) {
                 log(`${cliName()} final_output suppressed (model already called botmux send)`);
+                emitTurnTerminal(turnId, 'completed', undefined, dispatchAttempt);
                 return;
             }
         }
-        const turnId = typeof payload.turnId === 'string' ? payload.turnId : (currentBotmuxTurnId ?? `${lastInitConfig?.cliId ?? 'app'}-${Date.now()}`);
         send({
             type: 'final_output',
             content: payload.content,
             lastUuid: turnId,
             turnId,
+            ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
         });
+        emitTurnTerminal(turnId, 'completed', undefined, dispatchAttempt);
     }
 }
 function maybeCaptureKiroSessionId(data) {
@@ -3478,36 +3987,7 @@ function maybeCaptureKiroSessionId(data) {
     kiroSessionIdCaptureBuffer = '';
 }
 function splitCodexAppControl(data) {
-    if (!APP_RUNNER_OSC_CLI_IDS.has(lastInitConfig?.cliId ?? '') && codexAppOscPending.length === 0)
-        return data;
-    const input = codexAppOscPending + data;
-    codexAppOscPending = '';
-    let out = '';
-    let cursor = 0;
-    for (;;) {
-        const start = input.indexOf(CODEX_APP_OSC_PREFIX, cursor);
-        if (start < 0) {
-            let tailStart = input.length;
-            const tail = input.slice(cursor);
-            for (let n = Math.min(CODEX_APP_OSC_PREFIX.length - 1, tail.length); n > 0; n--) {
-                if (CODEX_APP_OSC_PREFIX.startsWith(tail.slice(tail.length - n))) {
-                    tailStart = input.length - n;
-                    break;
-                }
-            }
-            out += input.slice(cursor, tailStart);
-            codexAppOscPending = input.slice(tailStart);
-            return out;
-        }
-        out += input.slice(cursor, start);
-        const end = input.indexOf('\x07', start + CODEX_APP_OSC_PREFIX.length);
-        if (end < 0) {
-            codexAppOscPending = input.slice(start);
-            return out;
-        }
-        handleCodexAppMarker(input.slice(start + CODEX_APP_OSC_PREFIX.length, end));
-        cursor = end + 1;
-    }
+    return appRunnerControlDecoder.push(data, APP_RUNNER_OSC_CLI_IDS.has(lastInitConfig?.cliId ?? ''), handleCodexAppMarker);
 }
 // ─── Prompt Detection ────────────────────────────────────────────────────────
 function onPtyData(data) {
@@ -3522,7 +4002,7 @@ function onPtyData(data) {
     // no relay needed. In non-tmux mode AND in pipe mode (adopt-bridge),
     // broadcast through the shared scrollback so all connected web clients
     // render the same byte stream.
-    if (!isTmuxMode || isPipeMode) {
+    if ((!isTmuxMode || isPipeMode) && !usesHerdrSnapshotWebHistory()) {
         // Track alt-buffer state so we can restore it in the scrollback prefix.
         // Scan for the *last* toggle in this chunk — that's the current state.
         let lastToggleIdx = -1;
@@ -3583,6 +4063,12 @@ function onPtyData(data) {
     lastPtyOutputAtMs = Date.now();
     idleDetector?.feed(data);
 }
+function releaseRawInputRestartGate() {
+    if (!rawInputRestartGate)
+        return;
+    rawInputRestartGate = false;
+    log('Replacement CLI prompt ready — releasing deferred passthrough commands');
+}
 function markPromptReady() {
     if (isPromptReady)
         return; // guard against duplicate calls
@@ -3604,6 +4090,11 @@ function markPromptReady() {
     }
     isPromptReady = true;
     clearSessionRenameInFlight();
+    // An old backend can still report idle while its async teardown is running.
+    // Only a prompt observed after the general restart fence drops may release
+    // slash commands to the replacement generation.
+    if (!cliRestartInProgress)
+        releaseRawInputRestartGate();
     // CLI 实际启动成功（回到 prompt）：复位连续重启计数。
     // 任何能到这一步的 spawn 都算"成功"——后续即便再崩溃（不是 resume 目标不存在
     // 的问题），下一轮也该有新的 2 次重试预算，而不是被历史重启计数卡住。
@@ -3614,7 +4105,12 @@ function markPromptReady() {
     // CLI is back at its prompt — every previously written input has been
     // consumed, so nothing is in flight anymore. A later crash must not
     // replay these.
-    inflightInputs.onTurnComplete();
+    // Screen-idle is sufficient for ordinary IM batching, but durable input is
+    // cleared only by its exact turn_terminal. If this is a false idle and the
+    // CLI exits, onCliExit still reports ambiguous while deliberately declining
+    // worker-local replay of the durable attempt.
+    if (!durableTurnInFlight)
+        inflightInputs.onTurnComplete();
     maybeEmitWorkflowTranscriptOutput();
     if (awaitingFirstPrompt) {
         awaitingFirstPrompt = false;
@@ -3628,9 +4124,23 @@ function markPromptReady() {
     // (where the initial prompt is queued before the CLI becomes idle).
     if (renderer && pendingMessages.length === 0 && pendingRawInputs.length === 0 && pendingSessionRename === null && !isFlushing) {
         const { content } = renderer.snapshot();
-        send({ type: 'screen_update', content, ...usageLimitTracker.classify(content, 'idle'), turnId: currentBotmuxTurnId });
+        send({ type: 'screen_update', content, ...usageLimitTracker.classify(content, 'idle'), turnId: currentBotmuxTurnId, dispatchAttempt: currentBotmuxDispatchAttempt });
+    }
+    // cwd-move 注入（barrier=true，如 /cd）必须先于本次 pending 用户消息落地：
+    // 用户在 bot 发完「已切换角色」确认后立刻发下一条消息是最常见路径——若
+    // flushPending 先跑，该消息会在 barrier 注入之前被写进旧 cwd 的 CLI（daemon
+    // 记录已是新目录，实际执行仍在旧目录）。跳过本次 flushPending 不会饿死用户
+    // 消息：flushPending 自身的 injectionFlushing 守卫会挡住并发写入，
+    // flushPendingInjections 的 finally 会在注入完成、CLI 重新 idle 后补踢一次
+    // flushPending 排空 pendingMessages。
+    if (shouldFlushInjectionsFirst(pendingInjections)) {
+        void flushPendingInjections();
+    }
+    else {
+        flushPending();
+        if (pendingInjections.length > 0)
+            void flushPendingInjections();
     }
-    flushPending();
 }
 function persistCliSessionId(cliSessionId) {
     if (!cliSessionId || !sessionId)
@@ -3709,20 +4219,25 @@ const SUBMIT_DEFERRED_RECHECK_MS = 20_000;
  *
  *  `bridgeTurnId` is the BridgeTurnQueue mark created right before the
  *  failing writeInput. When the deferred recheck conclusively fails (= no
- *  jsonl line will ever match this fingerprint), we drop the mark — leaving
- *  it would keep `maybeSwitchBridgeJsonl` doing full-directory scans every
- *  poll tick for a fingerprint that's permanently dead, the 99% CPU bug
- *  this whole patch series is fixing. */
-function scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId, failureReason, turnSeq = usageLimitTracker.currentTurn()) {
+ *  jsonl line will ever match this fingerprint), we drop that exact dispatch
+ *  attempt's mark — leaving it would keep `maybeSwitchBridgeJsonl` doing
+ *  full-directory scans every poll tick for a fingerprint that's permanently
+ *  dead, the 99% CPU bug this whole patch series is fixing. */
+function scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId, failureReason, turnSeq = usageLimitTracker.currentTurn(), turnIdentity) {
     const preview = msg.length > 60 ? msg.slice(0, 60) + '…' : msg;
+    const emitDurableFailure = (errorCode) => {
+        if (turnIdentity?.turnId && turnIdentity.dispatchAttempt !== undefined) {
+            emitTurnTerminal(turnIdentity.turnId, 'failed', errorCode, turnIdentity.dispatchAttempt);
+        }
+    };
     const dropBridgeMark = () => {
         if (!bridgeTurnId)
             return;
-        const dropped = bridgeQueue.dropPendingTurn(bridgeTurnId);
+        const dropped = bridgeQueue.dropPendingTurn(bridgeTurnId, turnIdentity?.dispatchAttempt);
         if (dropped) {
             if (dropped.contentFingerprint)
                 bridgeFingerprintScanLastMs.delete(dropped.contentFingerprint);
-            log(`Bridge mark dropped after submit failure (turnId=${bridgeTurnId}) — rotation-fallback scan will stop spinning on this fingerprint.`);
+            log(`Bridge mark dropped after submit failure (turnId=${bridgeTurnId}, attempt=${turnIdentity?.dispatchAttempt ?? '-'}) — rotation-fallback scan will stop spinning on this fingerprint.`);
         }
     };
     if (failureReason) {
@@ -3734,11 +4249,14 @@ function scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId
         dropBridgeMark();
         const reason = action.kind === 'notify-hard-failure' ? action.reason : failureReason;
         log(`writeInput: submit impossible — notifying user immediately. reason="${reason}" preview="${preview}"`);
-        send({
-            type: 'user_notify',
-            turnId: currentBotmuxTurnId,
-            message: t('worker.submit_impossible', { cliName: cliName(), reason, preview }),
-        });
+        emitDurableFailure(`submit_impossible:${reason}`);
+        if (turnIdentity?.dispatchAttempt === undefined) {
+            send({
+                type: 'user_notify',
+                turnId: turnIdentity?.turnId ?? currentBotmuxTurnId,
+                message: t('worker.submit_impossible', { cliName: cliName(), reason, preview }),
+            });
+        }
         return;
     }
     const activityBaselineMs = Date.now();
@@ -3777,9 +4295,16 @@ function scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId
             case 'suppress-usage-limit':
                 dropBridgeMark();
                 log(`Deferred recheck missing but usage limit was detected for this turn — suppressing submit warning. preview="${preview}"`);
+                emitDurableFailure('submit_usage_limit');
                 return;
             case 'suppress-active':
                 log(`Deferred recheck missing but later ${action.evidence} shows ${cliName()} is active — suppressing submit warning. preview="${preview}"`);
+                // For a durable turn, activity is evidence of possible submission, not
+                // a terminal result. Keep the arbiter closed and re-check until either
+                // the transcript confirms it or a quiet interval proves it stuck.
+                if (turnIdentity?.dispatchAttempt !== undefined) {
+                    scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId, undefined, turnSeq, turnIdentity);
+                }
                 return;
             case 'notify-hard-failure':
                 // failureReason is handled synchronously above.
@@ -3789,11 +4314,14 @@ function scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId
         }
         dropBridgeMark();
         log(`Deferred recheck still missing — notifying user. preview="${preview}"`);
-        send({
-            type: 'user_notify',
-            turnId: currentBotmuxTurnId,
-            message: t('worker.submit_unconfirmed', { cliName: cliName(), secs: Math.round(SUBMIT_DEFERRED_RECHECK_MS / 1000), transcriptLabel, preview }),
-        });
+        emitDurableFailure('submit_unconfirmed');
+        if (turnIdentity?.dispatchAttempt === undefined) {
+            send({
+                type: 'user_notify',
+                turnId: turnIdentity?.turnId ?? currentBotmuxTurnId,
+                message: t('worker.submit_unconfirmed', { cliName: cliName(), secs: Math.round(SUBMIT_DEFERRED_RECHECK_MS / 1000), transcriptLabel, preview }),
+            });
+        }
     }, SUBMIT_DEFERRED_RECHECK_MS);
 }
 /**
@@ -3856,7 +4384,7 @@ function detectBareShellLaunch() {
                 `可能原因：rc 文件启动过慢/报错，或 \`${cli}\` 的可执行文件不在 PATH 上（CLI 没找到）。\n` +
                 `建议：在 web 终端里手动敲一下启动命令看报什么错；确认 CLI 二进制能在 PATH 上找到；或精简 rc 启动逻辑后重启 daemon 再试。`;
     }
-    send({ type: 'user_notify', turnId: currentBotmuxTurnId, message });
+    send({ type: 'user_notify', turnId: currentBotmuxTurnId, dispatchAttempt: currentBotmuxDispatchAttempt, message });
     return true;
 }
 /**
@@ -3866,6 +4394,11 @@ function detectBareShellLaunch() {
  * Messages pushed during a flush are picked up by the while loop.
  */
 async function flushPending() {
+    // destroySession() may be asynchronous while `backend` still references the
+    // old CLI. Never let a new flush (including one triggered by the old
+    // backend's idle/task-done callback) write across that restart boundary.
+    if (cliRestartInProgress)
+        return;
     if (isFlushing)
         return; // while loop in active flush will pick up new messages
     if (!backend || !cliAdapter)
@@ -3876,8 +4409,25 @@ async function flushPending() {
         return; // wait for /rename to finish before any user input
     if (commandLineWritesPending > 0)
         return; // do not splice into text -> Enter
+    // 注入进行中不得并发写 PTY（用户消息留在 pendingMessages，注入完成后的下一次
+    // markPromptReady 自然排空）——防止 type-ahead 插进注入的 text→Enter 窗口。
+    if (injectionFlushing)
+        return;
+    // cwd 切换是 barrier：在它执行前，任何用户消息都不得写入（type-ahead 路径也会
+    // 走到这里，因为 supportsTypeAhead 的 CLI 从 sendToPty 直接调 flushPending，
+    // 完全绕过 markPromptReady 的 barrier-first 分支）——否则消息（含 raw input 与
+    // rename）会落进旧 cwd 的 CLI。消息留在 pendingMessages，待 markPromptReady →
+    // flushPendingInjections 消费完 barrier 后由其 finally 的 re-kick 排空。
+    if (shouldDeferUserFlush(pendingInjections))
+        return;
     if (bareShellLaunchBlocked)
         return; // launch failed into a bare shell — don't type prompts into it
+    // Screen-idle is not a durable receipt. A permission/AskUser prompt can look
+    // idle while the logical delivery is unresolved, so no following IM or
+    // meeting turn may cross this boundary until an explicit terminal releases
+    // the active attempt.
+    if (!pendingInputMayFlush(durableTurnInFlight))
+        return;
     // Ready-gate: hold the FIRST prompt until the SessionStart hook fires a true-
     // ready signal. A cjadk-style startup selector's ❯ falsely matches readyPattern
     // and would otherwise eat this message. releaseReadyGate() re-invokes us once
@@ -3918,7 +4468,7 @@ async function flushPending() {
     // Codex on codex-cli 0.134.0.
     const claudeBridgeActive = !!bridgeJsonlPath && !lastInitConfig?.adoptMode;
     const codexBridgeActive = codexBridgeFallbackActive();
-    const typeAheadAllowed = cliAdapter.supportsTypeAhead;
+    const typeAheadAllowed = pendingInputAllowsTypeAhead(cliAdapter.supportsTypeAhead === true, durableTurnInFlight, pendingMessages[0]);
     // Native /rename is an administrative command, not a steer/queued model
     // message. It must wait for a real prompt even on type-ahead CLIs. Normal
     // pending messages can still drain while busy; the rename stays queued.
@@ -4001,12 +4551,18 @@ async function flushPending() {
         }
         while (pendingMessages.length > 0 && backend && cliAdapter) {
             const item = pendingMessages.shift();
+            const durableWrite = item.dispatchAttempt !== undefined;
+            if (durableWrite)
+                durableTurnInFlight = true;
             // Track as in-flight until the CLI returns to idle (markPromptReady).
             // If the CLI exits first, onExit stashes these for re-queue on respawn.
             inflightInputs.onWrite(item);
             const msg = item.content;
             currentBotmuxTurnId = item.turnId;
+            currentBotmuxDispatchAttempt = item.dispatchAttempt;
+            currentVcMeetingImTurnOrigin = item.vcMeetingImTurnOrigin;
             writeCliPidMarker();
+            publishSandboxRelayCapability();
             const turnSeq = usageLimitTracker.beginTurn(currentUsageLimitSnapshot());
             // Bridge fallback: mark immediately before writeInput. Doing it here
             // (instead of at enqueue time) means markTimeMs anchors to the
@@ -4021,14 +4577,27 @@ async function flushPending() {
                     bridgeIngest();
                 }
                 catch { /* best-effort */ }
-                bridgeTurnId = bridgeMarkPendingTurn(msg, item.turnId);
+                bridgeTurnId = bridgeMarkPendingTurn(msg, item.turnId, item.dispatchAttempt);
             }
             else if (codexBridgeActive) {
                 // Codex mark works even before the rollout path is known: the
                 // queue is path-agnostic, and the late-attach below will start
                 // ingest from offset 0 so the user_message that lands shortly
                 // after still fingerprint-matches this turn.
-                codexBridgeMarkPendingTurn(msg, item.turnId);
+                codexBridgeMarkPendingTurn(msg, item.turnId, item.dispatchAttempt);
+            }
+            if (durableWrite
+                && cliAdapter.reliableTurnTerminal === true
+                && lastInitConfig?.cliId === 'claude-code'
+                && (!item.turnId || !bridgeTurnId)) {
+                // The advertised Claude contract is transcript-backed. If we cannot
+                // establish the mark before touching the PTY, fail without submitting;
+                // otherwise this real delivery would have no attributable final edge.
+                if (item.turnId) {
+                    emitTurnTerminal(item.turnId, 'failed', 'terminal_bridge_unavailable', item.dispatchAttempt);
+                }
+                log('Refused durable Claude submit: transcript terminal bridge is unavailable');
+                break;
             }
             log(`Writing to PTY (flush): "${msg.substring(0, 80)}"`);
             // Defense in depth: TmuxPipeBackend's send methods no longer throw on a
@@ -4046,12 +4615,18 @@ async function flushPending() {
             }
             catch (err) {
                 log(`writeInput threw: ${err?.message ?? err}`);
+                if (durableWrite && item.turnId) {
+                    // A throwing backend cannot prove whether bytes reached the CLI.
+                    // Reconcile as ambiguous (not a definitive failure) so the receiver
+                    // can replay the same frozen delivery behind the action gate.
+                    emitTurnTerminal(item.turnId, 'ambiguous', 'write_input_threw', item.dispatchAttempt);
+                }
                 // If the CLI exited mid-write the backend already fired onExit (which
                 // nulled `backend` and told the user the CLI exited) — nothing more to
                 // do. Otherwise surface it as a submit failure so the message isn't
                 // silently lost.
                 if (backend)
-                    scheduleSubmitFailureNotify(msg, undefined, '会话 JSONL', bridgeTurnId, undefined, turnSeq);
+                    scheduleSubmitFailureNotify(msg, undefined, '会话 JSONL', bridgeTurnId, undefined, turnSeq, item);
                 break;
             }
             // Persist any sessionId the adapter observed via authoritative sources
@@ -4070,7 +4645,7 @@ async function flushPending() {
             // nulled backend) the user already got a "CLI exited" notice; don't also
             // nag that the submit wasn't confirmed.
             if (result && result.submitted === false && backend) {
-                scheduleSubmitFailureNotify(msg, result.recheck, '会话 JSONL', bridgeTurnId, result.failureReason, turnSeq);
+                scheduleSubmitFailureNotify(msg, result.recheck, '会话 JSONL', bridgeTurnId, result.failureReason, turnSeq, item);
             }
             // All structured bridges now drain every pending message in one flush:
             // Claude's BridgeTurnQueue handles `attachment(queued_command)` events
@@ -4078,22 +4653,44 @@ async function flushPending() {
             // and writes the user event at dequeue time (transcript stays interleaved);
             // Codex parks them too but steers them into the active turn (which can
             // merge into one final), and CodexBridgeQueue's HOL-block-drop attributes
-            // that correctly. We WANT them to drain all pending here so the extras
-            // land in the TUI queue rather than waiting for the next idle.
+            // that correctly. Durable receiver attempts are the exception: they and
+            // adjacent IM turns wait for separate idle edges so neither can be
+            // HOL-dropped or steered into the other.
+            if (shouldStopPendingBatch(item, pendingMessages[0]))
+                break;
         }
     }
     finally {
         isFlushing = false;
     }
 }
-function sendToPty(content, turnId, codexAppInput) {
-    if (!backend || !cliAdapter)
+function sendToPty(content, turnId, opts = {}) {
+    if (!cliAdapter)
+        return;
+    const next = {
+        content,
+        turnId,
+        ...(opts.codexAppInput ? { codexAppInput: opts.codexAppInput } : {}),
+        ...(opts.dispatchAttempt !== undefined ? { dispatchAttempt: opts.dispatchAttempt } : {}),
+        ...(opts.vcMeetingImTurnOrigin
+            ? { vcMeetingImTurnOrigin: opts.vcMeetingImTurnOrigin }
+            : {}),
+    };
+    // During an exact lease-fenced CLI restart the worker stays alive while the
+    // backend is rebuilt. Preserve incoming attempt N+1 in the worker queue; the
+    // old early-return silently dropped it after receiver had already persisted
+    // DISPATCHED.
+    if (cliRestartInProgress || !backend) {
+        pendingMessages.push(next);
+        log(`Queued message while CLI backend is restarting (${pendingMessages.length} pending)`);
         return;
-    const next = { content, turnId, codexAppInput };
-    const shouldMergeQueued = !isFlushing && !shouldWriteNow({
+    }
+    const supportsTypeAhead = pendingInputAllowsTypeAhead(cliAdapter.supportsTypeAhead === true, durableTurnInFlight, next);
+    const shouldMergeQueued = opts.dispatchAttempt === undefined && !durableTurnInFlight
+        && !isFlushing && !shouldWriteNow({
         isPromptReady,
         isFlushing,
-        supportsTypeAhead: cliAdapter.supportsTypeAhead === true,
+        supportsTypeAhead,
         awaitingFirstPrompt,
     }) && cliAdapter.mergeQueuedInput === true;
     const mergedQueued = shouldMergeQueued && mergeQueuedCliInput(pendingMessages, next);
@@ -4126,7 +4723,9 @@ function sendToPty(content, turnId, codexAppInput) {
     // type-ahead write is dropped (no input box yet) — markPromptReady()'s flush
     // delivers queued messages instead. See input-gate.ts; this fixes dispatch's
     // brief reaching Codex before its first idle and never landing.
-    if (!sessionRenameInFlight && commandLineWritesPending === 0 && shouldWriteNow({ isPromptReady, isFlushing, supportsTypeAhead: cliAdapter.supportsTypeAhead === true, awaitingFirstPrompt })) {
+    if (!sessionRenameInFlight && commandLineWritesPending === 0 && shouldWriteNow({
+        isPromptReady, isFlushing, supportsTypeAhead, awaitingFirstPrompt,
+    })) {
         if (!mergedQueued)
             log(`Writing to PTY: "${content.substring(0, 80)}"`);
         flushPending(); // fire-and-forget async; no-op if already flushing
@@ -4209,7 +4808,7 @@ function startScreenUpdates() {
             const usageAware = usageLimitTracker.classify(content, status);
             if (changed || usageAware.status !== lastSentStatus) {
                 lastSentStatus = usageAware.status;
-                send({ type: 'screen_update', content, ...usageAware, turnId: currentBotmuxTurnId });
+                send({ type: 'screen_update', content, ...usageAware, turnId: currentBotmuxTurnId, dispatchAttempt: currentBotmuxDispatchAttempt });
             }
         })();
     }, SCREEN_UPDATE_INTERVAL_MS);
@@ -4424,8 +5023,12 @@ function setupAdoptIdleDetection(cfg, label) {
 function seedBackendScreen(source, be) {
     try {
         const initial = be.captureCurrentScreen?.() ?? '';
-        if (initial.length > 0)
+        if (initial.length > 0) {
             onPtyData(initial);
+            if (be instanceof HerdrBackend) {
+                relayHerdrWebSnapshot(initial);
+            }
+        }
     }
     catch (err) {
         log(`${source} captureCurrentScreen failed: ${err.message}`);
@@ -4549,6 +5152,7 @@ function spawnCli(cfg) {
             rows,
             env: process.env,
         });
+        wireHerdrWebTerminalRelays(herdrBe);
         seedBackendScreen('herdr adopt', herdrBe);
         setupAdoptTranscriptBridges(cfg);
         setupAdoptInputAdapter(cfg);
@@ -4562,7 +5166,7 @@ function spawnCli(cfg) {
             backend = null;
             isPromptReady = false;
             stopBridgeWatcher();
-            send({ type: 'claude_exit', code, signal });
+            send({ type: 'claude_exit', code, signal, turnId: currentBotmuxTurnId, dispatchAttempt: currentBotmuxDispatchAttempt });
         });
         awaitingFirstPrompt = false;
         renderer?.markNewTurn();
@@ -4615,7 +5219,7 @@ function spawnCli(cfg) {
             backend = null;
             isPromptReady = false;
             stopBridgeWatcher();
-            send({ type: 'claude_exit', code, signal });
+            send({ type: 'claude_exit', code, signal, turnId: currentBotmuxTurnId, dispatchAttempt: currentBotmuxDispatchAttempt });
         });
         awaitingFirstPrompt = false;
         renderer?.markNewTurn();
@@ -4852,6 +5456,7 @@ function spawnCli(cfg) {
         }
     }
     let isolationBotHome;
+    let isolatedCodexHome;
     if (willReadIsolate) {
         isolationBotHome = ownBotHome;
         const isClaudeFam = !!claudeDataDir;
@@ -4871,6 +5476,17 @@ function spawnCli(cfg) {
             if (report.warning)
                 log(`[mcp-gateway] WARN ${report.warning}`);
         }
+        if (!isClaudeFam) {
+            isolatedCodexHome = join(isolationBotHome, 'codex');
+            // The CLI child and its dedicated worker must resolve the same Codex data
+            // root. Adapter submit confirmation, resume fallback, and transcript bridge
+            // discovery all run in the worker and consult process.env.CODEX_HOME
+            // dynamically. Setting only childEnv made successful submissions look
+            // unconfirmed because the worker kept watching the global ~/.codex history.
+            // A worker owns one session, so this process-local redirect cannot leak
+            // between bots or sessions.
+            process.env.CODEX_HOME = isolatedCodexHome;
+        }
     }
     // Predict reattach vs fresh BEFORE the resume pre-flight. On a persistent
     // backend (tmux/herdr/zellij) a daemon restart finds the CLI process still
@@ -4893,11 +5509,11 @@ function spawnCli(cfg) {
     // survive a daemon restart still running a CLI that may NOT be isolated (e.g.
     // spawned before isolation was enabled, or by an old build). Isolation is only
     // injectable at spawn time, so reattaching such a pane would silently run
-    // unisolated. We stamp a boot-id marker when we spawn an isolated pane; if this
-    // isolated bot's existing pane is NOT stamped by THIS daemon lifetime, kill it
-    // so the probe below sees no pane and we cold-spawn fresh isolated. A pane from
-    // this lifetime (suspend→resume) keeps its marker → reattaches normally (it is
-    // still the isolated process). This lets isolated bots use tmux/zellij/herdr.
+    // unisolated. We stamp a versioned policy marker when we spawn an isolated
+    // pane; if an existing pane was not spawned under the current policy, kill it
+    // so the probe below sees no pane and we cold-spawn fresh isolated. A current-
+    // policy pane survives daemon restarts and suspend→resume safely because the
+    // confinement remains attached to the live process.
     if ((willReadIsolate || willWriteSandbox) && persistentSessionName && effectiveBackendType !== 'pty') {
         const paneLive = effectiveBackendType === 'tmux'
             ? TmuxBackend.hasSession(persistentSessionName)
@@ -4906,20 +5522,17 @@ function spawnCli(cfg) {
                 : HerdrBackend.hasSession(persistentSessionName);
         if (paneLive) {
             let marker = null;
-            try {
-                marker = readFileSync(join(process.env.SESSION_DATA_DIR ?? '', 'read-isolation', `${cfg.sessionId}.boot`), 'utf-8');
-            }
-            catch { /* no marker → pane was spawned WITHOUT isolation */ }
+            marker = readRegularHostFileNoFollow(join(process.env.SESSION_DATA_DIR ?? '', 'read-isolation', `${cfg.sessionId}.boot`));
             if (isolatedPaneReattachSafe(marker)) {
-                // Pane was spawned isolated (marker present) → still confined on the running
-                // process even across daemon restarts → warm reattach is safe and preserves
+                // Pane was spawned under the current isolation policy → still confined
+                // on the running process across daemon restarts; warm reattach preserves
                 // resume/context + tmux idle-suspend.
                 log(`[read-isolation] reattaching isolated persistent pane (${cfg.sessionId})`);
             }
             else {
-                // No marker → pane predates isolation (or an old build) → could be running
-                // UNISOLATED → kill it so the probe below cold-spawns fresh isolated.
-                log(`[read-isolation] unmarked persistent pane for ${cfg.sessionId} (not spawned isolated) — killing + cold-spawning isolated`);
+                // Missing/legacy marker → pane predates the current policy and may retain
+                // obsolete permissions. Kill it before publishing any new capability.
+                log(`[read-isolation] legacy/unmarked persistent pane for ${cfg.sessionId} — killing + cold-spawning with current policy`);
                 try {
                     killPersistentSession(effectiveBackendType, persistentSessionName);
                 }
@@ -5048,6 +5661,10 @@ function spawnCli(cfg) {
         hasStartupCommands: !!cfg.startupCommands?.length,
         adoptMode: cfg.adoptMode === true,
         passesInitialPromptViaArgs: cliAdapter.passesInitialPromptViaArgs === true,
+    }) || shouldDeferArgsBakedDurablePrompt({
+        passesInitialPromptViaArgs: cliAdapter.passesInitialPromptViaArgs === true,
+        adoptMode: cfg.adoptMode === true,
+        dispatchAttempt: cfg.dispatchAttempt,
     }) || (effectiveResume && cliAdapter.initialPromptArgsIgnoredOnResume === true);
     kiroSessionIdCaptureArmed = cfg.cliId === 'kiro-cli' && !effectiveCliSessionId && !willReattachPersistent;
     kiroSessionIdCaptureBuffer = '';
@@ -5064,10 +5681,22 @@ function spawnCli(cfg) {
         readIsolationCtx = {
             homeDir: homedir(),
             botmuxHome: dirname(sessionDataDir),
+            defaultBotmuxHome: join(homedir(), '.botmux'),
             sessionDataDir,
             currentAppId: cfg.larkAppId,
+            currentSessionId: cfg.sessionId,
             extraDenyPaths: cfg.readDenyExtraPaths,
         };
+        readIsolationOriginCapabilityFile = process.platform === 'darwin'
+            ? managedOriginCapabilityPath(sessionDataDir, cfg.sessionId)
+            : null;
+        // Replace any legacy child-planted symlink before Seatbelt canonicalizes
+        // carve-outs. A failure is fatal: spawning with a missing/ambiguous
+        // capability transport would either break all IPC or reopen an attacker-
+        // selected realpath in the generated profile.
+        if (readIsolationOriginCapabilityFile) {
+            publishSandboxRelayCapability({ failClosed: true });
+        }
         // Write this bot's OWN send-credential into its BOT_HOME (the same per-bot
         // private storage as its CLI data; siblings' BOT_HOMEs are whole-denied).
         // `botmux send` reads the secret from here instead of bots.json — so the
@@ -5198,6 +5827,10 @@ function spawnCli(cfg) {
     // approver allowlist against session.owner. Missing env → exit 2.
     childEnv.BOTMUX_SESSION_ID = cfg.sessionId;
     childEnv.BOTMUX_CHAT_ID = cfg.chatId;
+    if (cfg.chatType)
+        childEnv.BOTMUX_CHAT_TYPE = cfg.chatType;
+    else
+        delete childEnv.BOTMUX_CHAT_TYPE;
     childEnv.BOTMUX_LARK_APP_ID = cfg.larkAppId;
     childEnv.BOTMUX_ROOT_MESSAGE_ID = cfg.rootMessageId;
     // NOTE: under read isolation `botmux send` gets this bot's secret from the worker-
@@ -5216,6 +5849,9 @@ function spawnCli(cfg) {
     // Initial value only; long-lived panes get the latest turn via the JSON pid marker.
     if (cfg.turnId)
         childEnv.BOTMUX_TURN_ID = cfg.turnId;
+    if (cfg.dispatchAttempt !== undefined) {
+        childEnv.BOTMUX_DISPATCH_ATTEMPT = String(cfg.dispatchAttempt);
+    }
     if (injectClaudeSandbox)
         childEnv.IS_SANDBOX = '1';
     if (claudeResumeTokenThreshold)
@@ -5235,7 +5871,7 @@ function spawnCli(cfg) {
         if (claudeDataDir)
             childEnv.CLAUDE_CONFIG_DIR = claudeDataDir; // = <BOT_HOME>/claude
         else
-            childEnv.CODEX_HOME = join(isolationBotHome, 'codex');
+            childEnv.CODEX_HOME = isolatedCodexHome;
     }
     // Per-bot env (bots.json `env`): extra vars for THIS bot's CLI only — e.g.
     // ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN to run a bot on GLM/a 3rd-party
@@ -5283,18 +5919,25 @@ function spawnCli(cfg) {
         // readable ~/.botmux + system creds; the own slice is re-opened via carve-outs.
         // For a WRITE-sandbox-only session these stay empty → reads wide open (Linux parity).
         let denyPaths = [], denyRegexes = [], allowPaths = [], finalDenyPaths = [], traverseDirs = [];
+        let protectedWrites;
         if (readIsolationCtx) {
             const profileCtx = {
                 ...readIsolationCtx,
                 homeDir: canonical(readIsolationCtx.homeDir),
                 botmuxHome: canonical(readIsolationCtx.botmuxHome),
+                defaultBotmuxHome: canonical(readIsolationCtx.defaultBotmuxHome ?? join(readIsolationCtx.homeDir, '.botmux')),
                 sessionDataDir: canonical(readIsolationCtx.sessionDataDir),
             };
             denyPaths = buildV2DenyPaths(profileCtx).map(canonical);
             denyRegexes = buildV2DenyRegexes(profileCtx);
             const carve = buildV2CarveOuts(profileCtx);
+            const capabilityCarvePath = managedOriginCapabilityPath(profileCtx.sessionDataDir, profileCtx.currentSessionId);
             allowPaths = [
-                ...carve.allowPaths.map(canonical),
+                // Never realpath the capability leaf: another legacy sandbox can race
+                // a symlink into that shared host directory while multiple persistent
+                // sessions recover. Keeping the exact path may fail closed on a raced
+                // symlink, but can never turn its target into a Seatbelt allow rule.
+                ...carve.allowPaths.map(path => path === capabilityCarvePath ? path : canonical(path)),
                 ...buildCliExecutableReadCarveOuts({
                     homeDir: profileCtx.homeDir,
                     cliId: cliAdapter.id,
@@ -5303,6 +5946,16 @@ function spawnCli(cfg) {
             ];
             finalDenyPaths = carve.finalDenyPaths.map(canonical);
             traverseDirs = carve.traverseDirs.map(canonical);
+            protectedWrites = buildReadIsolationProtectedWriteRules(profileCtx, {
+                // Keep lexical roots as well as their canonical targets. Canonical
+                // rules protect contents reached through a symlink; lexical literals
+                // prevent replacing the symlink/root directory entry itself.
+                dashboardRoots: [
+                    readIsolationCtx.defaultBotmuxHome ?? join(readIsolationCtx.homeDir, '.botmux'),
+                    readIsolationCtx.botmuxHome,
+                ],
+                sessionDataDirs: [readIsolationCtx.sessionDataDir],
+            });
         }
         // WRITE rules — the macOS file-sandbox (Linux-bwrap twin). Realpath the writable
         // zones + crown-jewel re-denies for the same symlink-safety reason as reads.
@@ -5319,21 +5972,21 @@ function spawnCli(cfg) {
         const profileDir = join(process.env.SESSION_DATA_DIR, 'read-isolation');
         mkdirSync(profileDir, { recursive: true });
         const profilePath = join(profileDir, `${cfg.sessionId}.sb`);
-        writeFileSync(profilePath, buildSeatbeltProfile(denyPaths, allowPaths, finalDenyPaths, traverseDirs, denyRegexes, writeRules), { mode: 0o600 });
+        replaceManagedOriginCapabilityFile(profilePath, buildSeatbeltProfile(denyPaths, allowPaths, finalDenyPaths, traverseDirs, denyRegexes, writeRules, protectedWrites));
         seatbeltProfilePath = profilePath;
         spawnArgs = ['-f', profilePath, spawnBin, ...spawnArgs];
         spawnBin = 'sandbox-exec';
         log(`[file-sandbox] wrapping ${cliAdapter.id} in Seatbelt (read-isolation=${!!readIsolationCtx}, write-sandbox=${!!writeRules}): sandbox-exec -f ${profilePath}`);
     }
     // Fresh sandboxed spawn on a persistent backend: stamp the pane with this daemon's
-    // boot id so a later suspend→resume reattach can be trusted (see the stale-pane
+    // policy version + boot id so a later suspend→resume reattach can be trusted (see the stale-pane
     // guard above). Applies to read-isolation AND write-sandbox panes (both carry the
     // Seatbelt confinement on the live process). pty needs no marker (never reattached).
     if ((readIsolationCtx || writeSandboxRules) && persistentSessionName && !willReattachPersistent) {
         try {
             const markerDir = join(process.env.SESSION_DATA_DIR, 'read-isolation');
             mkdirSync(markerDir, { recursive: true });
-            writeFileSync(join(markerDir, `${cfg.sessionId}.boot`), cfg.daemonBootId ?? '', { mode: 0o600 });
+            replaceManagedOriginCapabilityFile(join(markerDir, `${cfg.sessionId}.boot`), isolationPaneMarkerContent(cfg.daemonBootId ?? ''));
         }
         catch { /* non-fatal: worst case a same-lifetime reattach cold-spawns instead */ }
     }
@@ -5373,6 +6026,7 @@ function spawnCli(cfg) {
             ...readIsolationCtx,
             homeDir: canon(readIsolationCtx.homeDir),
             botmuxHome: canon(readIsolationCtx.botmuxHome),
+            defaultBotmuxHome: canon(readIsolationCtx.defaultBotmuxHome ?? join(readIsolationCtx.homeDir, '.botmux')),
             sessionDataDir: canon(readIsolationCtx.sessionDataDir),
         };
         const ids = new Set();
@@ -5454,7 +6108,9 @@ function spawnCli(cfg) {
                         catch { /* */ }
                     }
                     sandboxCleanup = att.cleanup;
-                    sandboxStopWatcher = startOutboxWatcher(att.outbox, childEnv, cfg.sessionId);
+                    sandboxRelayOutbox = att.outbox;
+                    sandboxStopWatcher = startOutboxWatcher(att.outbox, childEnv, cfg.sessionId, { authorize: authorizeManagedSend });
+                    publishSandboxRelayCapability();
                     log(`Sandbox REATTACH (${cfg.cliId}): live pane CLI kept, re-wired outbox=${att.outbox} (no remount)`);
                 }
                 else {
@@ -5477,7 +6133,15 @@ function spawnCli(cfg) {
                     // sensitive set, keep the own BOT_HOME real+writable (authPaths), and re-
                     // expose the own attachments bucket read-only after the masks (readonlyRoots).
                     hidePaths: [...(cfg.sandboxHidePaths ?? []), ...(readIsoLinuxMasks?.hidePaths ?? [])],
-                    authPaths: [...(cliAdapter.authPaths ?? []), ...(readIsoLinuxMasks?.ownReadWritePaths ?? [])],
+                    authPaths: [...(cliAdapter.authPaths ?? [])],
+                    // BOTMUX_HOME is credential-masked wholesale. Re-open only this
+                    // bot's daemon-derived private CLI home after that parent mask, then
+                    // re-mask its send credential so an untrusted receiver cannot bypass
+                    // the host-authorized relay with a direct Lark API call.
+                    trustedWritablePaths: readIsoLinuxMasks?.ownReadWritePaths ?? [],
+                    finalHidePaths: readIsoLinuxMasks
+                        ? [sendCredFilePath(dataDir, cfg.larkAppId)]
+                        : [],
                     extraExecPaths: cliAdapter.sandboxExtraExecPaths?.(),
                     readonlyRoots: [...(cfg.skillReadonlyRoots ?? []), ...(readIsoLinuxMasks?.ownReadOnlyPaths ?? [])],
                     userReadonlyPaths: cfg.sandboxReadonlyPaths ?? [],
@@ -5503,8 +6167,10 @@ function spawnCli(cfg) {
                         catch { /* */ }
                     }
                     sandboxCleanup = sbx.cleanup;
+                    sandboxRelayOutbox = sbx.outbox;
                     // session-id is FORCED here so a relayed send can't target another session.
-                    sandboxStopWatcher = startOutboxWatcher(sbx.outbox, childEnv, cfg.sessionId);
+                    sandboxStopWatcher = startOutboxWatcher(sbx.outbox, childEnv, cfg.sessionId, { authorize: authorizeManagedSend });
+                    publishSandboxRelayCapability();
                     log(`Sandbox ON (${cfg.cliId}): upper=${sbx.workDir} outbox=${sbx.outbox}`);
                 }
                 else {
@@ -5862,6 +6528,7 @@ function spawnCli(cfg) {
         });
     }
     backend.onData(onPtyData);
+    const observedBackend = backend;
     backend.onAccessUrl?.((url) => {
         send({ type: 'riff_access_url', accessUrl: url });
     });
@@ -5877,8 +6544,57 @@ function spawnCli(cfg) {
     backend.onTaskId?.((taskId) => {
         send({ type: 'riff_task_id', taskId });
     });
+    if (backend instanceof HerdrBackend) {
+        wireHerdrWebTerminalRelays(backend);
+        restoreHerdrWebBindings();
+    }
     backend.onExit((code, signal) => {
+        const intentionalRestart = intentionalRestartBackend === observedBackend;
+        if (intentionalRestart)
+            intentionalRestartBackend = null;
+        // destroySession()/kill() may report exit after the 500ms replacement spawn
+        // has already installed a fresh backend. That callback belongs to the old
+        // generation: apart from consuming its intentional-restart marker, it must
+        // not clear the replacement backend/durable HOL state or emit claude_exit.
+        if (backend !== observedBackend) {
+            log(`Ignored stale backend exit (code: ${code}, signal: ${signal})`);
+            return;
+        }
+        const exitedTurnId = currentBotmuxTurnId;
+        const exitedDispatchAttempt = currentBotmuxDispatchAttempt;
+        // Fail closed as soon as this CLI generation ends. The Node worker may
+        // stay alive for auto-restart/crash diagnostics, but an old sandbox relay
+        // token or explicit IM origin must not remain usable in that interval.
+        completeManagedTurnOriginRevocation(sandboxRelayCapability, exitedTurnId, exitedDispatchAttempt);
         log(`${cliName()} exited (code: ${code}, signal: ${signal})`);
+        if (cliAdapter?.reliableTurnTerminal === true
+            && exitedTurnId
+            && exitedDispatchAttempt !== undefined) {
+            // The CLI may have durably appended its terminal record immediately
+            // before exiting while fs.watch/the 1s poller is still queued. Drain it
+            // synchronously before claiming `cli_exit`; otherwise ambiguous wins the
+            // deduper and needlessly replays a turn that actually completed.
+            if (bridgeJsonlPath) {
+                try {
+                    bridgeDrainAndMaybeEmit();
+                }
+                catch (err) {
+                    log(`Bridge exit drain failed: ${err.message}`);
+                }
+            }
+            if (codexBridgeFallbackActive()) {
+                try {
+                    codexBridgeDrainAndMaybeEmit({ signalIdle: false });
+                }
+                catch (err) {
+                    log(`Codex bridge exit drain failed: ${err.message}`);
+                }
+            }
+            // Race-safe with transcript final / submit-failure: the worker-local
+            // terminal deduper lets exactly one status win for this attempt.
+            emitTurnTerminal(exitedTurnId, 'ambiguous', 'cli_exit', exitedDispatchAttempt);
+        }
+        durableTurnInFlight = false;
         const logTail = recentTerminalLogTail();
         // Don't park a diagnostic shell here: most exits are immediately
         // auto-restarted by the daemon, so an inline park would just be torn down
@@ -5893,13 +6609,24 @@ function spawnCli(cfg) {
         // the CLI — codex crashing mid-submit never records them, and the fresh
         // respawn comes up empty. Stash them so the next spawnCli re-queues and
         // re-delivers.
-        const stashed = inflightInputs.onCliExit();
+        // Durable meeting replay has exactly one owner: the receiver receipt loop.
+        // onCliExit tells the daemon to mark that receipt ambiguous; replaying the
+        // same attempt locally as ordinary carry-over would race hub attempt N+1
+        // and execute the prompt twice.
+        const stashed = inflightInputs.onCliExit(item => item.dispatchAttempt === undefined);
         if (stashed > 0) {
             log(`CLI exited with ${stashed} in-flight message(s); will re-queue after restart`);
         }
         backend = null;
         isPromptReady = false;
-        send({ type: 'claude_exit', code, signal, logTail, canParkDiagnostic });
+        currentBotmuxTurnId = undefined;
+        currentBotmuxDispatchAttempt = undefined;
+        if (intentionalRestart) {
+            log('Suppressed claude_exit for intentional in-worker restart');
+        }
+        else {
+            send({ type: 'claude_exit', code, signal, logTail, canParkDiagnostic, turnId: exitedTurnId, dispatchAttempt: exitedDispatchAttempt });
+        }
     });
     if (isPipeMode && backend && 'isReattach' in backend && backend.isReattach) {
         log(`Re-attached to existing ${effectiveBackendType} session via pipe backend: ${persistentSessionName}`);
@@ -5955,7 +6682,7 @@ function spawnCli(cfg) {
         markPromptReady();
     }
 }
-function killCli() {
+function killCli(opts = {}) {
     destroyCrashDiagnosticTerminal('killCli');
     idleDetector?.dispose();
     idleDetector = null;
@@ -5989,6 +6716,7 @@ function killCli() {
         catch { /* already gone */ }
         cliPidMarker = null;
     }
+    completeManagedTurnOriginRevocation(sandboxRelayCapability, currentBotmuxTurnId, currentBotmuxDispatchAttempt);
     // Stop the sandbox outbox watcher, then unmount the overlays + remove the
     // per-session sandbox tree. In the overlay model the upper layer (the
     // changeset) must be landed BEFORE close — `/land` runs while the session is
@@ -6000,6 +6728,11 @@ function killCli() {
         catch { /* */ }
         sandboxStopWatcher = null;
     }
+    sandboxRelayOutbox = null;
+    readIsolationOriginCapabilityFile = null;
+    currentBotmuxTurnId = undefined;
+    currentBotmuxDispatchAttempt = undefined;
+    currentVcMeetingImTurnOrigin = undefined;
     if (sandboxCleanup) {
         try {
             sandboxCleanup();
@@ -6009,15 +6742,112 @@ function killCli() {
     }
     isPromptReady = false;
     clearSessionRenameInFlight();
-    pendingMessages.length = 0;
+    if (!opts.preservePending)
+        pendingMessages.length = 0;
     // pendingRawInputs contains only commands that were accepted but never typed
-    // because /rename owned the TUI. Preserve them across restart; unlike an
-    // in-flight raw command, replaying these cannot duplicate a side effect.
+    // because /rename owned the TUI or an owned CLI restart was already fenced.
+    // Preserve them across restart; unlike an in-flight raw command, replaying
+    // these cannot duplicate a side effect.
+    // pendingInjections 则无条件清空（不随 preservePending 保留）：barrier /cd 的
+    // 目录变更已固化进 lastInitConfig.workingDir 与 daemon 记录，respawn 本身就落在
+    // 新目录，重放 /cd 反而多余；非 barrier 注入（如 /compact）是 best-effort，
+    // 不跨进程重放。
+    pendingInjections.length = 0;
     scrollback = '';
+    herdrWebHistory = null;
+    herdrWebScrollDirection = null;
+    herdrWebCursor = null;
     altBufferActive = false;
     trustHandled = false;
     codexUpdateDialogGuard.reset();
-    codexAppOscPending = '';
+    appRunnerControlDecoder.reset();
+}
+async function restartCliProcess(reason, opts = {}) {
+    if (lastInitConfig?.adoptMode) {
+        log(`Restart ignored in adopt mode (${reason})`);
+        return;
+    }
+    // Set before touching destroySession(): remote teardown can await for many
+    // seconds while the old backend object is still non-null and still capable
+    // of firing idle/task-done callbacks. Inputs accepted in that interval must
+    // remain queued until a replacement backend has been installed.
+    cliRestartInProgress = true;
+    rawInputRestartGate = true;
+    // The Node worker stays alive through this restart, so the daemon will see
+    // neither claude_exit nor worker-exit. Explicitly revoke the old turn's
+    // authority now, before jitter/async teardown leaves a stale-send window.
+    // This deliberately preserves currentBotmuxTurnId/dispatchAttempt for the
+    // old backend's terminal attribution.
+    revokeManagedTurnOriginForRestart();
+    log(`Restart requested (${reason})`);
+    // Tier-2 guard: 2nd consecutive in-worker restart forces FRESH. Tier-1
+    // adapter probing is still re-run on every spawn.
+    consecutiveInWorkerRestarts++;
+    log(`Restart count: ${consecutiveInWorkerRestarts} (>=2 forces FRESH)`);
+    const restart = async () => {
+        try {
+            tmuxRestartTimer = null;
+            const restartingBackend = backend;
+            if (restartingBackend)
+                intentionalRestartBackend = restartingBackend;
+            // Riff teardown cancels a remote task asynchronously. Wait for the cancel
+            // (bounded) before respawning, otherwise the old and replacement tasks can
+            // overlap and both emit into the same Lark thread. Local backends normally
+            // return void here and continue synchronously. A synchronous throw is
+            // handled by the same fatal restart path below, so it cannot leave the
+            // input gate permanently armed.
+            const teardown = restartingBackend?.destroySession?.();
+            if (teardown && typeof teardown.then === 'function') {
+                try {
+                    await Promise.race([
+                        teardown,
+                        new Promise(resolve => setTimeout(resolve, 22_000)),
+                    ]);
+                }
+                catch { /* destroySession logs its own failure details */ }
+            }
+            killCli({ preservePending: opts.preservePending });
+            awaitingFirstPrompt = true;
+            setTimeout(async () => {
+                if (lastInitConfig) {
+                    startScreenUpdates();
+                    startScreenAnalyzer();
+                    try {
+                        spawnCli({ ...lastInitConfig, resume: true, prompt: '' });
+                    }
+                    catch (err) {
+                        cliRestartInProgress = false;
+                        await sendFatalWorkerErrorAndExit(err);
+                        return;
+                    }
+                }
+                cliRestartInProgress = false;
+                // Riff marks itself prompt-ready inside spawnCli(); that early flush is
+                // intentionally held by the restart gate above. Release its raw-input
+                // fence now; other backends keep it until their later markPromptReady().
+                if (effectiveBackendType === 'riff' && isPromptReady)
+                    releaseRawInputRestartGate();
+                void flushPending();
+            }, 500);
+        }
+        catch (err) {
+            cliRestartInProgress = false;
+            try {
+                await sendFatalWorkerErrorAndExit(err);
+            }
+            catch { /* sendFatalWorkerErrorAndExit is already best-effort */ }
+        }
+    };
+    if (effectiveBackendType === 'tmux' && !opts.immediate) {
+        const delayMs = tmuxRestartJitterMs(lastInitConfig?.sessionId ?? '', consecutiveInWorkerRestarts);
+        log(`Staggering tmux teardown/restart by ${delayMs}ms to avoid shared-server probe storms`);
+        if (tmuxRestartTimer)
+            clearTimeout(tmuxRestartTimer);
+        tmuxRestartTimer = setTimeout(() => { void restart(); }, delayMs);
+    }
+    else {
+        await restart();
+    }
 }
 // ─── HTTP + WebSocket Server ─────────────────────────────────────────────────
 function startWebServer(host, preferredPort) {
@@ -6030,17 +6860,47 @@ function startWebServer(host, preferredPort) {
                 res.end('Bad Request');
                 return;
             }
-            const tokenMatches = url.searchParams.get('token') === writeToken;
-            const { hasWrite, platformReadonly } = resolveTerminalWriteForReq(req, tokenMatches);
+            const { hasRead, hasWrite, platformReadonly } = resolveTerminalAccessForReq(req, url);
+            if (!hasRead) {
+                res.writeHead(403, {
+                    'Content-Type': 'text/plain; charset=utf-8',
+                    'Cache-Control': 'no-store',
+                });
+                res.end('Forbidden');
+                return;
+            }
             const loginHdr = req.headers['x-botmux-login-url'];
             const loginUrl = typeof loginHdr === 'string' && /^https?:\/\/[^"'<>\s]+$/.test(loginHdr) ? loginHdr : '';
+            // Herdr snapshots contain screen cells but not terminal mode state. On a
+            // refreshed page an alt-screen CLI would otherwise look like an empty
+            // normal buffer until resize causes a redraw. Preserve that mode so
+            // scroll gestures continue to target the CLI's own transcript.
+            const forceRemoteScroll = effectiveBackendType === 'herdr' && cliAdapter?.altScreen === true;
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(getTerminalHtml(hasWrite, platformReadonly, loginUrl));
+            res.end(getTerminalHtml(hasWrite, platformReadonly, loginUrl, forceRemoteScroll));
+        });
+        wss = new WebSocketServer({
+            server: httpServer,
+            // Reject before the WebSocket handshake completes.  Closing from the
+            // `connection` callback is too late: an unauthenticated localhost scanner
+            // briefly becomes a client and races the terminal history seed.
+            verifyClient: ({ req }, done) => {
+                const url = parseWorkerRequestUrl(req);
+                if (!url) {
+                    done(false, 400, 'Bad Request');
+                    return;
+                }
+                if (!resolveTerminalAccessForReq(req, url).hasRead) {
+                    done(false, 403, 'Forbidden');
+                    return;
+                }
+                done(true);
+            },
         });
-        wss = new WebSocketServer({ server: httpServer });
         wss.on('connection', (ws, req) => {
             wsClients.add(ws);
-            // Check token from query string for write access
+            // Read access was already checked before the WebSocket handshake. Resolve
+            // again here only to decide whether this client may write.
             const url = parseWorkerRequestUrl(req);
             if (!url) {
                 log(`Bad worker WS URL rejected: ${JSON.stringify(req.url ?? '')}`);
@@ -6048,8 +6908,7 @@ function startWebServer(host, preferredPort) {
                 ws.close(1008, 'Bad Request');
                 return;
             }
-            const tokenMatches = url.searchParams.get('token') === writeToken;
-            const { hasWrite } = resolveTerminalWriteForReq(req, tokenMatches);
+            const { hasWrite } = resolveTerminalAccessForReq(req, url);
             if (hasWrite)
                 authedClients.add(ws);
             log(`WS client connected (total: ${wsClients.size}, write: ${hasWrite})`);
@@ -6078,7 +6937,13 @@ function startWebServer(host, preferredPort) {
                 const startAttach = (cols, rows) => {
                     if (cp)
                         return;
-                    cp = pty.spawn('tmux', ['attach-session', '-t', tmuxTarget], {
+                    // Defense in depth: view-capability clients attach through tmux's
+                    // own read-only mode as well as the WebSocket input gate below.
+                    cp = pty.spawn('tmux', [
+                        'attach-session',
+                        ...(!hasWrite ? ['-r'] : []),
+                        '-t', tmuxTarget,
+                    ], {
                         name: 'xterm-256color',
                         cols,
                         rows,
@@ -6115,13 +6980,11 @@ function startWebServer(host, preferredPort) {
                             }
                         }
                         else if (msg.type === 'input' && typeof msg.data === 'string') {
-                            if (!authedClients.has(ws)) {
-                                // Read-only: allow mouse events through (scroll/click are
-                                // non-destructive in tmux — just views history / selects text).
-                                // SGR mouse: \x1b[<...  X10 mouse: \x1b[M...
-                                if (!/^\x1b\[([<M])/.test(msg.data))
-                                    return;
-                            }
+                            // Mouse protocols carry clicks, releases, drags and wheel input;
+                            // a mouse-aware TUI may bind any of them to approvals/actions.
+                            // A view capability therefore forwards no input bytes at all.
+                            if (!authedClients.has(ws))
+                                return;
                             if (cp)
                                 cp.write(msg.data);
                             else
@@ -6203,11 +7066,8 @@ function startWebServer(host, preferredPort) {
                                 cp.resize(msg.cols, msg.rows);
                         }
                         else if (msg.type === 'input' && typeof msg.data === 'string') {
-                            if (!authedClients.has(ws)) {
-                                // Read-only: only let mouse events (scroll/select) through.
-                                if (!/^\x1b\[([<M])/.test(msg.data))
-                                    return;
-                            }
+                            if (!authedClients.has(ws))
+                                return;
                             if (cp)
                                 cp.write(msg.data);
                             else
@@ -6235,6 +7095,12 @@ function startWebServer(host, preferredPort) {
             }
             else {
                 // ── Shared relay (PtyBackend OR tmux pipe mode) ──
+                const herdrWebBinding = new HerdrWebTerminalBinding(ws, () => (backend instanceof HerdrBackend && !lastInitConfig?.adoptMode ? backend : null));
+                herdrWebBindings.set(ws, herdrWebBinding);
+                const initialHerdrSize = herdrWebBinding.sync().initialSize;
+                if (initialHerdrSize) {
+                    ws.send(`\x1b]1989;follower;${initialHerdrSize.cols};${initialHerdrSize.rows}\x07`);
+                }
                 // History seed: prefer tmux's authoritative capture-pane in pipe mode
                 // (clean grid + scrollback) over replaying the raw cumulative byte
                 // stream, which scrolls stale Ink redraw/spinner frames into scrollback
@@ -6252,29 +7118,37 @@ function startWebServer(host, preferredPort) {
                     if (sz && sz.cols > 0 && sz.rows > 0)
                         ws.send(`\x1b]1989;${sz.cols};${sz.rows}\x07`);
                 }
-                const seed = chooseWebTerminalSeed({
-                    canCapture: isPipeMode && isObserveBackend(backend),
-                    capture: () => backend.captureCurrentScreen(),
-                    scrollback,
-                    onError: log,
-                });
+                const seed = usesHerdrSnapshotWebHistory() && scrollback.length > 0
+                    ? scrollback
+                    : chooseWebTerminalSeed({
+                        canCapture: isPipeMode && isObserveBackend(backend),
+                        capture: () => backend.captureCurrentScreen(),
+                        scrollback,
+                        onError: log,
+                    });
                 if (seed.length > 0) {
-                    ws.send(seed);
+                    ws.send(seed + herdrWebCursorSequence());
                 }
                 ws.on('message', (raw) => {
                     try {
                         const msg = JSON.parse(String(raw));
                         if (msg.type === 'resize' && msg.cols > 0 && msg.rows > 0) {
-                            backend?.resize(msg.cols, msg.rows);
+                            const result = herdrWebBinding.resize(msg.cols, msg.rows);
+                            applyHerdrWebBindingResult(ws, result);
+                            if (!result.backend) {
+                                backend?.resize(msg.cols, msg.rows);
+                            }
                         }
                         else if (msg.type === 'input' && typeof msg.data === 'string') {
-                            if (!authedClients.has(ws)) {
-                                // Read-only: allow ONLY wheel scroll sequences (SGR buttons 64-67).
-                                // Scrolling the CLI's own view is non-destructive and lets read-only
-                                // viewers page back through an alt-screen TUI's history (Claude etc.,
-                                // which has no local scrollback). Everything else is dropped.
-                                if (!/^(\x1b\[<6[4-7];\d+;\d+M)+$/.test(msg.data))
-                                    return;
+                            // Mouse protocols can encode approvals/actions as well as wheel input.
+                            // A read-only view capability must never forward bytes to the backend.
+                            if (!authedClients.has(ws))
+                                return;
+                            if (usesHerdrSnapshotWebHistory()) {
+                                if (msg.data.includes('\x1b[<64;'))
+                                    herdrWebScrollDirection = 'up';
+                                else if (msg.data.includes('\x1b[<65;'))
+                                    herdrWebScrollDirection = 'down';
                             }
                             backend?.write(msg.data);
                         }
@@ -6283,6 +7157,11 @@ function startWebServer(host, preferredPort) {
                 });
                 ws.on('close', () => {
                     wsClients.delete(ws);
+                    herdrWebBindings.delete(ws);
+                    const promoted = herdrWebBinding.release();
+                    if (promoted?.readyState === WebSocket.OPEN) {
+                        promoted.send('\x1b]1989;owner\x07');
+                    }
                 });
             }
         });
@@ -6295,7 +7174,7 @@ function startWebServer(host, preferredPort) {
             .then(resolve, reject);
     });
 }
-function getTerminalHtml(hasWrite, platformReadonly = false, loginUrl = '') {
+function getTerminalHtml(hasWrite, platformReadonly = false, loginUrl = '', forceRemoteScroll = false) {
     const label = sessionId.substring(0, 8);
     return `<!DOCTYPE html>
 <html>
@@ -6307,8 +7186,8 @@ function getTerminalHtml(hasWrite, platformReadonly = false, loginUrl = '') {
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@xterm/xterm@5/css/xterm.min.css">
 <style>
 *{margin:0;padding:0;box-sizing:border-box}
-html,body{height:100%;background:#1a1b26;overflow:hidden;overscroll-behavior:none}
-body{display:flex;flex-direction:column}
+html,body{width:100%;height:100%;background:#1a1b26;overflow:hidden;overscroll-behavior:none}
+body{display:flex;flex-direction:column;height:100vh;height:100dvh}
 #safe-area-probe{position:fixed;visibility:hidden;pointer-events:none;
   padding:env(safe-area-inset-top,0px) env(safe-area-inset-right,0px) env(safe-area-inset-bottom,0px) env(safe-area-inset-left,0px)}
 #toolbar-shell{--toolbar-scale:1;display:none;position:fixed;z-index:100;
@@ -6363,7 +7242,7 @@ body{display:flex;flex-direction:column}
   background:rgba(36,40,59,0.74)!important;touch-action:none}
 #toolbar.idle{opacity:.82}
 @media(prefers-reduced-motion:reduce){#toolbar,#toolbar.collapsed{transition:opacity .12s linear}}
-#terminal{flex:1;min-height:0}
+#terminal{flex:1;min-width:0;min-height:0;width:100%;height:100%}
 #terminal .xterm{height:100%}
 /* Real scroll container is xterm's own viewport — kill iOS rubber-band bounce
    and momentum here (not just on body), and reserve gestures for pinch-zoom so
@@ -6428,9 +7307,10 @@ ${loginUrl ? `<a id="login-banner" href="${loginUrl}" target="_top" rel="noopene
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-canvas@0/lib/addon-canvas.min.js"></script>
 <script>
 var isTouch='ontouchstart'in window||navigator.maxTouchPoints>0;
-if(isTouch){document.getElementById('vp').content='width=1100,viewport-fit=cover';document.body.classList.add('touch');}
+if(isTouch){document.body.classList.add('touch');}
 var hasToken=${hasWrite};
 var platformReadonly=${platformReadonly};
+var remoteScroll=${forceRemoteScroll};
 if(!hasToken){
   if(platformReadonly){var _lb=document.getElementById('login-banner');_lb.classList.add('show');}
   else{var _rb=document.getElementById('readonly-banner');_rb.classList.add('show');_rb.addEventListener('click',function(){_rb.classList.remove('show')});}
@@ -6536,9 +7416,9 @@ document.getElementById('terminal').addEventListener('contextmenu',function(e){e
 var ws_=null,el=document.getElementById('status');
 term.onData(function(d){
   if(!hasToken){
-    // Allow mouse events through (scroll/click) — server accepts these in read-only.
-    // Keyboard input triggers the toast instead.
-    if(!/^\\x1b\\[[<M]/.test(d)){_showReadonlyToast();return;}
+    // Mouse escape sequences are input too: a TUI can bind clicks or wheel
+    // events to actions. View links never forward terminal bytes.
+    _showReadonlyToast();return;
   }
   if(ws_&&ws_.readyState===1)ws_.send(JSON.stringify({type:'input',data:d}));
 });
@@ -6561,13 +7441,14 @@ function onViewportResize(){
 }
 window.addEventListener('resize',onViewportResize);
 (function connect(){
-  var t=new URLSearchParams(location.search).get('token')||'';
   // Derive base from the current path so the WS connects to the same prefix the
   // page was served under — works both directly (path '/') and behind the
-  // per-daemon reverse proxy ('/s/{sessionId}'). See terminal-proxy.ts.
+  // per-daemon reverse proxy ('/s/{sessionId}'). Preserve the complete query:
+  // write links carry token, while read-only links carry the distinct
+  // viewToken capability. See terminal-proxy.ts.
   var base=location.pathname.replace(/\\/+$/,'');
   var proto=location.protocol==='https:'?'wss':'ws';
-  var ws=new WebSocket(proto+'://'+location.host+base+'/?token='+t);
+  var ws=new WebSocket(proto+'://'+location.host+base+'/'+location.search);
   ws_=ws;ws.binaryType='arraybuffer';
   // Force a resize on every (re)connect: clear the dedup memory first. On
   // reconnect the browser grid is usually unchanged, so without this the
@@ -6579,6 +7460,36 @@ window.addEventListener('resize',onViewportResize);
   ws.onopen=function(){el.textContent='connected';el.className='ok';_lastC=_lastR=0;sendResize()};
   ws.onmessage=function(e){
     var data=typeof e.data==='string'?e.data:new TextDecoder().decode(e.data);
+    // Snapshot-aware Herdr history replaces the buffer instead of appending a
+    // mostly-overlapping full screen. Preserve the reader's anchor when older
+    // rows were prepended; otherwise preserve their current position/follow.
+    var _hh=data.match(/^\x1b\]1989;history;([0-9]+)\x07/);
+    if(_hh){
+      var _ha=+_hh[1],_hb=term.buffer.active,_hy=_hb.viewportY,_hBottom=_hy===_hb.baseY;
+      data=data.slice(_hh[0].length);_cancelInitialFollow();term.reset();term.clear();
+      data='\\x1b[2J\\x1b[H'+data;
+      term.write(data,function(){
+        if(_ha>0)term.scrollToLine(_hy+_ha);
+        else if(_hBottom)term.scrollToBottom();
+        else term.scrollToLine(_hy);
+      });
+      return;
+    }
+    // Managed Herdr has one authoritative pane grid shared by every viewer.
+    // Followers render at the owner's grid; a promoted owner re-fits to its
+    // own viewport and reports the new size back to the worker.
+    var _hf=data.match(/\\x1b\\]1989;follower;(\\d+);(\\d+)\\x07/);
+    if(_hf){
+      fixedSize=true;var _hc=+_hf[1],_hr=+_hf[2];
+      if(_hc>0&&_hr>0){try{term.resize(_hc,_hr)}catch(ex){}_lastC=_hc;_lastR=_hr}
+      data=data.replace(_hf[0],'');
+    }
+    var _ho=data.match(/\\x1b\\]1989;owner\\x07/);
+    if(_ho){
+      fixedSize=false;data=data.replace(_ho[0],'');
+      try{fit.fit()}catch(ex){}
+      _lastC=_lastR=0;sendResize();
+    }
     // botmux OSC 1989: pin the xterm to the adopted pane's fixed size (the pane
     // can't be resized, so FitAddon-to-browser would wrap the snapshot lines).
     var _fs=data.match(/\\x1b\\]1989;(\\d+);(\\d+)\\x07/);
@@ -6597,17 +7508,30 @@ window.addEventListener('resize',onViewportResize);
 // tmux — their whole transcript is redrawn by the app inside the fixed alt-screen
 // grid, so term.scrollLines() reveals nothing. In the alternate buffer we forward
 // scrolling as SGR mouse-wheel events so the CLI scrolls its own transcript and
-// repaints (works in read-only too: the server only lets wheel sequences through).
+// repaints. This is write-capability only; view links stay locally scrollable.
 // Normal-buffer CLIs keep xterm's native scrollback scroll. Capture-phase +
 // stopPropagation pre-empts xterm's own handler. Skipped for pure tmux/zellij
 // ATTACH (gate), where the attach client owns scrolling via copy-mode.
 //
-// Accumulate intended scroll DISTANCE (px) and emit one wheel tick per STEP px —
-// decoupled from how many wheel/touch events the browser fires per gesture
-// (high-res trackpads fire dozens), so a small gesture stays a small scroll and
-// doesn't compound into a whole screen. px<0 = scroll up (toward history). The
-// per-call cap stops a single huge delta (page tick / fling) from over-firing.
-var _scrollAccum=0;var _SCROLL_STEP=33;
+// Accumulate intended scroll DISTANCE (px) and emit one wheel tick per STEP px.
+// A high-resolution trackpad emits dozens of wheel events for one gesture, so
+// cap the whole continuous burst — not each browser event — then require an idle
+// gap (or direction reversal) before loading the next history chunk.
+var _scrollAccum=0,_scrollBurstTicks=0,_scrollBurstDir=0,_scrollBurstT=0;
+var _SCROLL_STEP=33;var _SCROLL_BURST_MAX=6;var _SCROLL_BURST_IDLE_MS=250;
+function _endScrollBurst(){
+  clearTimeout(_scrollBurstT);_scrollBurstT=0;
+  _scrollAccum=0;_scrollBurstTicks=0;_scrollBurstDir=0;
+}
+// Snapshot-backed remote TUIs can still accumulate useful local xterm history.
+// Consume it first; request another remote chunk only when the user pushes past
+// the local top/bottom boundary in that direction.
+function _canScrollLocal(px){
+  var b=term.buffer.active;
+  if(b.type==='alternate'||!px)return false;
+  if(!remoteScroll)return true;
+  return px>0||b.viewportY>0;
+}
 // Map a viewport pixel (clientX/Y) to a 1-based terminal cell "col;row", clamped to
 // the grid. The forwarded SGR wheel event MUST carry the cell UNDER THE POINTER, the
 // way a physical terminal reports it: zone-routed alt-screen TUIs — OpenCode (Bubble
@@ -6631,27 +7555,36 @@ function _cellAt(clientX,clientY){
   return col+';'+row;
 }
 function _fwdScroll(px,coord){
-  if(!ws_||ws_.readyState!==1)return;
+  if(!hasToken||!ws_||ws_.readyState!==1||!px)return;
   coord=coord||(((term.cols>>1)+1)+';'+((term.rows>>1)+1)); // never (1,1)
+  var dir=px<0?-1:1;
+  if(_scrollBurstDir&&dir!==_scrollBurstDir){_scrollAccum=0;_scrollBurstTicks=0;}
+  _scrollBurstDir=dir;
+  clearTimeout(_scrollBurstT);_scrollBurstT=setTimeout(_endScrollBurst,_SCROLL_BURST_IDLE_MS);
+  if(_scrollBurstTicks>=_SCROLL_BURST_MAX)return;
   _scrollAccum+=px;var data='',n=0;
-  while(Math.abs(_scrollAccum)>=_SCROLL_STEP&&n<6){
+  while(Math.abs(_scrollAccum)>=_SCROLL_STEP&&n<6&&_scrollBurstTicks<_SCROLL_BURST_MAX){
     var up=_scrollAccum<0; // px<0 → wheel-up (history)
     data+='\\x1b[<'+(up?64:65)+';'+coord+'M';
-    _scrollAccum+=up?_SCROLL_STEP:-_SCROLL_STEP;n++;
+    _scrollAccum+=up?_SCROLL_STEP:-_SCROLL_STEP;n++;_scrollBurstTicks++;
   }
+  if(_scrollBurstTicks>=_SCROLL_BURST_MAX)_scrollAccum=0;
   if(data)ws_.send(JSON.stringify({type:'input',data:data}));
 }
 if(!${isTmuxMode && !isPipeMode}){
   document.getElementById('terminal').addEventListener('wheel',function(e){
-    if(term.buffer.active.type!=='alternate'){
+    // Normalise deltaMode to px: line→~16px, page→~one screen.
+    var px=e.deltaMode===1?e.deltaY*16:e.deltaMode===2?e.deltaY*term.rows*16:e.deltaY;
+    if(_canScrollLocal(px)){
       // Normal buffer: xterm scrolls its own scrollback natively. In read-only a
       // mouse-mode CLI could swallow the wheel, so drive scrollback directly.
-      if(!hasToken){e.preventDefault();e.stopPropagation();term.scrollLines(e.deltaY>0?3:-3);}
+      if(!hasToken){e.preventDefault();e.stopPropagation();term.scrollLines(px>0?3:-3);}
       return;
     }
+    if(!hasToken){
+      e.preventDefault();e.stopPropagation();term.scrollLines(e.deltaY>0?3:-3);return;
+    }
     e.preventDefault();e.stopPropagation();
-    // Normalise deltaMode to px: line→~16px, page→~one screen.
-    var px=e.deltaMode===1?e.deltaY*16:e.deltaMode===2?e.deltaY*term.rows*16:e.deltaY;
     _fwdScroll(px,_cellAt(e.clientX,e.clientY)); // report the cell under the pointer
   },{capture:true,passive:false});
 }
@@ -6956,35 +7889,79 @@ if(isTouch&&hasToken){
   _scheduleToolbarLayout();_wakeToolbar();
 }
 
-// Single-finger touch scrolling: normal-buffer CLIs use xterm's own Viewport
-// (handleTouchMove → scrollTop) natively. Alt-screen CLIs (Claude) have no xterm
-// scrollback, so native touch scroll does nothing — mirror the wheel fix and
-// forward the drag to the CLI as SGR wheel events so it scrolls its own
-// transcript. Only the alternate buffer is intercepted (capture + stopPropagation);
-// the normal buffer falls through to xterm untouched, so no double-drive of
-// scrollTop. overscroll-behavior:none (see <style>) kills the iOS rubber-band.
+// Single-finger touch scrolling: drive normal-buffer scrollback explicitly.
+// Some embedded WebViews do not perform xterm/browser native touch scrolling
+// when touch-action is restricted for pinch zoom. Handling in capture phase and
+// stopping propagation also prevents xterm from double-driving the viewport.
+// Alt-screen CLIs have no xterm scrollback, so forward the drag as SGR wheel
+// events and let the CLI scroll its own transcript.
 if(!${isTmuxMode && !isPipeMode}){
   var _tTerm=document.getElementById('terminal');
+  var _tViewport=document.querySelector('#terminal .xterm-viewport');
   var _tLastY=null;
   _tTerm.addEventListener('touchstart',function(e){
     if(e.touches.length===1)_tLastY=e.touches[0].clientY;
   },{capture:true,passive:true});
   _tTerm.addEventListener('touchmove',function(e){
-    // Normal buffer / multi-touch / no start → let xterm (or the browser) handle it.
-    if(term.buffer.active.type!=='alternate'||_tLastY===null||e.touches.length!==1)return;
+    // View links never forward input; let xterm/browser handle local scrolling.
+    if(!hasToken||_tLastY===null||e.touches.length!==1)return;
     e.preventDefault();e.stopPropagation();
     var y=e.touches[0].clientY;
+    var px=_tLastY-y;
+    if(_canScrollLocal(px)){
+      if(_tViewport)_tViewport.scrollTop-=y-_tLastY;
+      else term.scrollLines(y>_tLastY?-1:1);
+      _tLastY=y;return;
+    }
     // finger drags down (y grows) → px<0 → scroll up (history); report the touched cell
-    _fwdScroll(_tLastY-y,_cellAt(e.touches[0].clientX,y));
+    _fwdScroll(px,_cellAt(e.touches[0].clientX,y));
     _tLastY=y;
   },{capture:true,passive:false});
-  _tTerm.addEventListener('touchend',function(){_tLastY=null;},{capture:true,passive:true});
+  _tTerm.addEventListener('touchend',function(){_tLastY=null;_endScrollBurst()},{capture:true,passive:true});
+  _tTerm.addEventListener('touchcancel',function(){_tLastY=null;_endScrollBurst()},{capture:true,passive:true});
 }
 </script>
 </body>
 </html>`;
 }
-// ─── IPC Communication ───────────────────────────────────────────────────────
+const emittedTurnTerminals = new TurnTerminalDeduper();
+/** Report CLI processing completion independently from user-visible output.
+ *  Keep a bounded worker-local dedup set because transcript watchers and app
+ *  runners may surface the same final boundary more than once. */
+function emitTurnTerminal(turnId, status, errorCode, dispatchAttempt) {
+    if (!sessionId || !turnId)
+        return;
+    if (!emittedTurnTerminals.claim(sessionId, turnId, dispatchAttempt))
+        return;
+    if (status !== 'completed') {
+        const dropped = codexBridgeQueue.dropPendingTurn(turnId, dispatchAttempt);
+        if (dropped) {
+            log(`Structured bridge retired terminal attempt turn=${turnId.slice(0, 12)} attempt=${dispatchAttempt ?? '-'} status=${status}`);
+        }
+    }
+    // Revoke before publishing terminal. The daemon receives same-worker IPC in
+    // order, and the worker-side relay becomes unusable synchronously.
+    revokeManagedTurnOriginForTerminal(turnId, dispatchAttempt);
+    send({
+        type: 'turn_terminal',
+        sessionId,
+        turnId,
+        status,
+        ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
+        ...(errorCode ? { errorCode } : {}),
+    });
+    if (terminalReleasesDurableTurn({ turnId: currentBotmuxTurnId, dispatchAttempt: currentBotmuxDispatchAttempt }, { turnId, dispatchAttempt })) {
+        // Durable replay ownership moves back to the receiver/hub at terminal.
+        // Do not let a later CLI exit carry this already-settled attempt into the
+        // fresh process behind the receiver's newer dispatch attempt.
+        inflightInputs.onTurnComplete();
+        durableTurnInFlight = false;
+        // The terminal may be emitted from inside an active flush continuation
+        // (for example a synchronous hard-submit failure). Wake after that
+        // continuation releases the mutex so queued work cannot remain stranded.
+        queueMicrotask(() => { void flushPending(); });
+    }
+}
 function workerIpcPayload(msg) {
     return msg.type === 'final_output' && sessionId
         ? { ...msg, sessionId }
@@ -7021,7 +7998,7 @@ let fatalWorkerErrorPending = false;
  * used both during init and after a previously-ready worker tries to recover
  * from a stopped/crashed CLI, so those later paths cannot regress to a silent
  * unhandled rejection/exception. */
-async function sendFatalWorkerErrorAndExit(err, turnId = currentBotmuxTurnId) {
+async function sendFatalWorkerErrorAndExit(err, turnId = currentBotmuxTurnId, dispatchAttempt = currentBotmuxDispatchAttempt) {
     if (fatalWorkerErrorPending)
         return;
     fatalWorkerErrorPending = true;
@@ -7029,6 +8006,9 @@ async function sendFatalWorkerErrorAndExit(err, turnId = currentBotmuxTurnId) {
         type: 'error',
         message: err instanceof Error ? err.message : String(err),
         turnId,
+        // Carry the durable attempt so the daemon can leave a meeting delivery
+        // failure to the receipt/lease recovery path instead of replying out-of-band.
+        ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
     });
     process.exit(1);
 }
@@ -7045,6 +8025,7 @@ process.on('message', async (raw) => {
                 return; // already initialized
             lastInitConfig = msg;
             sessionId = msg.sessionId;
+            refreshTerminalViewToken();
             if (msg.ownerOpenId)
                 process.env.__OWNER_OPEN_ID = msg.ownerOpenId;
             // Pin this worker's i18n locale early so every t() call below resolves
@@ -7078,7 +8059,10 @@ process.on('message', async (raw) => {
             try {
                 if (msg.turnId) {
                     currentBotmuxTurnId = msg.turnId;
+                    currentBotmuxDispatchAttempt = msg.dispatchAttempt;
+                    currentVcMeetingImTurnOrigin = msg.vcMeetingImTurnOrigin;
                     writeCliPidMarker();
+                    publishSandboxRelayCapability();
                 }
                 let port = 0;
                 if (!isWorkflowWorker()) {
@@ -7111,6 +8095,10 @@ process.on('message', async (raw) => {
                     hasStartupCommands: !!msg.startupCommands?.length,
                     adoptMode: msg.adoptMode === true,
                     passesInitialPromptViaArgs: cliAdapter?.passesInitialPromptViaArgs === true,
+                }) || shouldDeferArgsBakedDurablePrompt({
+                    passesInitialPromptViaArgs: cliAdapter?.passesInitialPromptViaArgs === true,
+                    adoptMode: msg.adoptMode === true,
+                    dispatchAttempt: msg.dispatchAttempt,
                 }) || (msg.adoptMode !== true && lastSpawnEffectiveResume && cliAdapter?.initialPromptArgsIgnoredOnResume === true);
                 if (msg.prompt && cliAdapter?.passesInitialPromptViaArgs && !deferInitialPrompt && codexBridgeFallbackActive()) {
                     // Args-baked first prompts (notably Pi) never pass through the normal
@@ -7119,12 +8107,14 @@ process.on('message', async (raw) => {
                     // Mark it here before the CLI starts processing; late-attach is fine
                     // because CodexBridgeQueue is path-agnostic until ingest discovers the
                     // transcript file.
-                    codexBridgeMarkPendingTurn(msg.prompt, msg.turnId);
+                    codexBridgeMarkPendingTurn(msg.prompt, msg.turnId, msg.dispatchAttempt);
                 }
                 if (msg.prompt && (!cliAdapter?.passesInitialPromptViaArgs || deferInitialPrompt)) {
                     pendingMessages.push({
                         content: msg.prompt,
                         turnId: msg.turnId,
+                        dispatchAttempt: msg.dispatchAttempt,
+                        vcMeetingImTurnOrigin: msg.vcMeetingImTurnOrigin,
                         codexAppInput: msg.promptCodexAppInput,
                     });
                 }
@@ -7136,7 +8126,14 @@ process.on('message', async (raw) => {
                 if (effectiveBackendType === 'riff' && pendingMessages.length > 0) {
                     flushPending();
                 }
-                send({ type: 'ready', port, token: writeToken, turnId: currentBotmuxTurnId });
+                send({
+                    type: 'ready',
+                    port,
+                    token: writeToken,
+                    viewToken,
+                    turnId: currentBotmuxTurnId,
+                    dispatchAttempt: currentBotmuxDispatchAttempt,
+                });
             }
             catch (err) {
                 await sendFatalWorkerErrorAndExit(err);
@@ -7161,8 +8158,6 @@ process.on('message', async (raw) => {
                 deferredPluginSkillCatalog = null;
                 log('Attached refreshed plugin Skill catalog to the first turn of this CLI generation');
             }
-            currentBotmuxTurnId = msg.turnId;
-            writeCliPidMarker();
             if (!backend && crashDiagnosticStopped && lastInitConfig && !lastInitConfig.adoptMode) {
                 log('Message received after crash-loop stop; retrying CLI start');
                 destroyCrashDiagnosticTerminal('retry after message');
@@ -7175,11 +8170,23 @@ process.on('message', async (raw) => {
                     spawnCli({ ...lastInitConfig, resume: true, prompt: '' });
                 }
                 catch (err) {
-                    await sendFatalWorkerErrorAndExit(err, msg.turnId);
+                    // Pass the message's own attempt (not the stale currentBotmux* from a
+                    // prior IM turn) so a durable delivery relaunch failure carries the
+                    // right attribution for the daemon's receipt/lease gate.
+                    await sendFatalWorkerErrorAndExit(err, msg.turnId, msg.dispatchAttempt);
                     return;
                 }
             }
             if (lastInitConfig?.adoptMode) {
+                // Adopt writes immediately below, so this turn really becomes current
+                // now. Non-adopt messages update the marker only when flushPending
+                // dequeues/writes them; doing it at IPC arrival lets a queued IM turn
+                // steal the identity of a still-running durable delivery.
+                currentBotmuxTurnId = msg.turnId;
+                currentBotmuxDispatchAttempt = msg.dispatchAttempt;
+                currentVcMeetingImTurnOrigin = msg.vcMeetingImTurnOrigin;
+                writeCliPidMarker();
+                publishSandboxRelayCapability();
                 // Bridge mode: capture transcript baseline BEFORE writing to the pane,
                 // so any assistant uuids appended after this point are attributed to
                 // *this* Lark turn (not local user activity in the pane). Mark may
@@ -7190,7 +8197,7 @@ process.on('message', async (raw) => {
                         bridgeIngest();
                     }
                     catch { /* best effort */ }
-                    bridgeMarkPendingTurn(content, msg.turnId);
+                    bridgeMarkPendingTurn(content, msg.turnId, msg.dispatchAttempt);
                 }
                 else if (codexBridgeFallbackActive()) {
                     // Codex adopt: same idea, different bridge. ingest first so any
@@ -7202,7 +8209,7 @@ process.on('message', async (raw) => {
                         // before this IPC message is handled. Mark first so that preexisting
                         // current-line can still fingerprint-match instead of being marked
                         // seen as an unmatched event.
-                        codexBridgeMarkPendingTurn(content, msg.turnId);
+                        codexBridgeMarkPendingTurn(content, msg.turnId, msg.dispatchAttempt);
                         try {
                             codexBridgeIngest();
                         }
@@ -7213,7 +8220,7 @@ process.on('message', async (raw) => {
                             codexBridgeIngest();
                         }
                         catch { /* best effort */ }
-                        codexBridgeMarkPendingTurn(content, msg.turnId);
+                        codexBridgeMarkPendingTurn(content, msg.turnId, msg.dispatchAttempt);
                     }
                 }
                 // Adopt mode write:
@@ -7273,17 +8280,28 @@ process.on('message', async (raw) => {
                 // arrival. Marking now would race with a still-running previous
                 // turn whose `botmux send` could sneak its sentAtMs past this
                 // turn's markTimeMs and falsely suppress its fallback.
-                sendToPty(content, msg.turnId, codexAppInput);
+                sendToPty(content, msg.turnId, {
+                    codexAppInput,
+                    dispatchAttempt: msg.dispatchAttempt,
+                    vcMeetingImTurnOrigin: msg.vcMeetingImTurnOrigin,
+                });
             }
             break;
         }
         case 'raw_input': {
             // Preserve legacy busy delivery (/btw and other steering commands). A
-            // native /rename already submitted to the TUI is the sole exception: its
-            // command UI must return to the prompt before another slash command lands.
-            if (sessionRenameInFlight) {
+            // native /rename and an owned CLI restart are the exceptions: never splice
+            // into the rename UI, write through an old backend during async teardown,
+            // or type into the replacement before its real prompt is ready.
+            // TUI 注入是第三个例外：注入进行中（injectionFlushing——Serially 只互斥
+            // text→Enter 短窗口，覆盖不了注入后的 quiescence 等待）或队列里有 cwd
+            // barrier（shouldDeferUserFlush——/cd 未落地前任何用户输入都不得写入，
+            // 否则 passthrough 会执行在旧 cwd 的 CLI 里）时入队。注入排空后由
+            // flushPendingInjections 的 finally 补踢 flushPending 送达。
+            if (cliRestartInProgress || rawInputRestartGate || sessionRenameInFlight
+                || injectionFlushing || shouldDeferUserFlush(pendingInjections)) {
                 pendingRawInputs.push(msg);
-                log(`Deferred passthrough slash command until native rename settles: ${msg.content}`);
+                log(`Deferred passthrough slash command until CLI input gate settles: ${msg.content}`);
             }
             else {
                 await deliverRawInput(msg);
@@ -7310,71 +8328,99 @@ process.on('message', async (raw) => {
             break;
         }
         case 'restart': {
-            if (lastInitConfig?.adoptMode) {
-                log('Restart ignored in adopt mode');
+            await restartCliProcess('daemon request', { preservePending: true });
+            break;
+        }
+        case 'expire_durable_turn': {
+            const acknowledge = (disposition) => send({
+                type: 'durable_expiry_ready',
+                sessionId,
+                turnId: msg.turnId,
+                dispatchAttempt: msg.dispatchAttempt,
+                disposition,
+            });
+            const currentExact = durableTurnInFlight
+                && currentBotmuxTurnId === msg.turnId
+                && currentBotmuxDispatchAttempt === msg.dispatchAttempt;
+            if (currentExact) {
+                if (lastInitConfig?.adoptMode) {
+                    log('Refused durable expiry ACK for adopt-mode session');
+                    break;
+                }
+                log(`Expiring active durable turn=${msg.turnId.slice(0, 12)} attempt=${msg.dispatchAttempt}; `
+                    + 'restarting CLI with queued follow-ups preserved');
+                durableTurnInFlight = false;
+                inflightInputs.onTurnComplete();
+                // immediate=true bypasses tmux jitter. Await teardown (including Riff's
+                // async remote cancellation) before ACKing so replay cannot overlap the
+                // old owned CLI; the replacement spawn itself remains delayed by 500ms.
+                await restartCliProcess('durable lease expiry', { immediate: true, preservePending: true });
+                acknowledge('cli_fenced');
                 break;
             }
-            log('Restart requested');
-            // Tier-2 guard: 2nd consecutive in-worker restart forces FRESH.
-            // Increment BEFORE spawnCli so the guard trips at count==2 (i.e. the
-            // third attempted spawn in a 1-success → 2-failure sequence):
-            //   initial spawn (count=0) → fail → claude_exit → daemon sends restart
-            //   1st restart (count=1) → resume still fails → restart
-            //   2nd restart (count=2) → tier-2 kicks in → FRESH
-            // Tier 1 probe (adapter.checkResumeTargetExists) is re-run on each
-            // spawn, so even count=1 often short-circuits; tier-2 only catches
-            // silent/race failures and adapters that don't implement the probe.
-            consecutiveInWorkerRestarts++;
-            log(`Restart count: ${consecutiveInWorkerRestarts} (>=2 forces FRESH)`);
-            // Must destroySession(), not kill(): for persistent backends (tmux/herdr)
-            // kill() only detaches — the backing session + CLI process keep running,
-            // so the resume:true spawnCli below would re-attach to the SAME live CLI
-            // (selectSessionBackend reattaches whenever hasSession() is true) and the
-            // process would never actually restart. destroySession() tears the session
-            // down so the respawn starts a fresh CLI. (PTY has no destroySession, so
-            // the ?. no-ops and killCli()'s kill() does the teardown.)
-            const restart = async () => {
-                tmuxRestartTimer = null;
-                // riff：teardown=远端 task-cancel（异步）。必须等它完成再 spawn，否则
-                // 旧任务与新任务并跑、双方都往话题里发消息。
-                const t = backend?.destroySession?.();
-                if (t && typeof t.then === 'function') {
-                    try {
-                        await Promise.race([t, new Promise((r) => setTimeout(r, 22_000))]);
-                    }
-                    catch { /* logged inside destroySession */ }
+            // A receipt's lease begins at daemon dispatch claim, before worker IPC
+            // necessarily reaches the PTY. It can therefore expire behind a long
+            // ordinary IM turn. Remove that exact queued generation and ACK without
+            // restarting the unrelated active turn; otherwise attempt N survives in
+            // the queue and executes after the hub has already replayed N+1.
+            let removedPending = 0;
+            for (let i = pendingMessages.length - 1; i >= 0; i--) {
+                const item = pendingMessages[i];
+                if (item.turnId === msg.turnId && item.dispatchAttempt === msg.dispatchAttempt) {
+                    pendingMessages.splice(i, 1);
+                    removedPending++;
                 }
-                killCli();
-                awaitingFirstPrompt = true;
-                setTimeout(async () => {
-                    if (lastInitConfig) {
-                        startScreenUpdates();
-                        startScreenAnalyzer();
-                        try {
-                            spawnCli({ ...lastInitConfig, resume: true, prompt: '' });
-                        }
-                        catch (err) {
-                            await sendFatalWorkerErrorAndExit(err);
-                        }
-                    }
-                }, 500);
-            };
-            if (effectiveBackendType === 'tmux') {
-                const delayMs = tmuxRestartJitterMs(lastInitConfig?.sessionId ?? '', consecutiveInWorkerRestarts);
-                log(`Staggering tmux teardown/restart by ${delayMs}ms to avoid shared-server probe storms`);
-                if (tmuxRestartTimer)
-                    clearTimeout(tmuxRestartTimer);
-                tmuxRestartTimer = setTimeout(restart, delayMs);
             }
-            else {
-                restart();
+            if (removedPending > 0) {
+                log(`Expired ${removedPending} queued durable input(s) turn=${msg.turnId.slice(0, 12)} `
+                    + `attempt=${msg.dispatchAttempt}`);
+                acknowledge('queued_removed');
+                break;
             }
+            // Neither active nor queued means this worker cannot prove where the
+            // attempt went. Deliberately withhold ACK so the daemon's short timeout
+            // escalates to an owned-pane teardown before replay is admitted.
+            log(`Cannot prove durable expiry turn=${msg.turnId.slice(0, 12)} `
+                + `attempt=${msg.dispatchAttempt}; withholding ACK for daemon fencing`);
+            break;
+        }
+        case 'reset_ambiguous_receiver': {
+            const receiver = sessionId ? sessionStore.getSession(sessionId)?.vcMeetingReceiver : undefined;
+            if (!receiver) {
+                log('Ignored boot recovery reset for a non-receiver session');
+                break;
+            }
+            if (lastInitConfig?.adoptMode) {
+                log('Refused boot recovery ACK for adopt-mode receiver identity');
+                break;
+            }
+            log(`Boot recovery fencing ambiguous receiver turn=${msg.turnId.slice(0, 12)} `
+                + `attempt=${msg.dispatchAttempt}`);
+            durableTurnInFlight = false;
+            inflightInputs.onTurnComplete();
+            await restartCliProcess('ambiguous receiver boot recovery', { immediate: true, preservePending: true });
+            send({
+                type: 'receiver_reset_ready',
+                sessionId: sessionId,
+                turnId: msg.turnId,
+                dispatchAttempt: msg.dispatchAttempt,
+            });
             break;
         }
         case 'tui_keys': {
             handleTuiKeys(msg.keys, msg.isFinal);
             break;
         }
+        case 'inject_command': {
+            // 会话内 /cd 移动后，worker 内部 respawn（claude_exit 自动重启 / IM /restart /
+            // dashboard restart）必须收敛到新目录，而不是陈旧的 lastInitConfig.workingDir。
+            if (msg.updateWorkingDir && lastInitConfig) {
+                lastInitConfig.workingDir = msg.updateWorkingDir;
+            }
+            pendingInjections.push({ command: msg.command, barrier: !!msg.updateWorkingDir });
+            void flushPendingInjections();
+            break;
+        }
         case 'tui_text_input': {
             handleTuiTextInput(msg.keys, msg.text);
             break;
@@ -7473,6 +8519,7 @@ process.on('message', async (raw) => {
             // forkWorker(resume=true) → a fresh `new-session --resume <cliSessionId>`
             // that rebuilds context from the on-disk transcript (same path the daemon
             // uses to recover sessions after a reboot kills the tmux server).
+            revokeManagedTurnOriginForRestart();
             try {
                 // riff：suspend 语义是「休眠待续」——绝不能 cancel 远端任务（血缘已持久化，
                 // 恢复时 follow-up 续上）；只断流 detach。
@@ -7521,6 +8568,7 @@ function cleanup() {
     for (const ws of wsClients)
         ws.close();
     wsClients.clear();
+    herdrWebBindings.clear();
     if (wss) {
         wss.close();
         wss = null;
@@ -7593,6 +8641,8 @@ function teardownSandboxBestEffort() {
     }
     catch { /* */ }
     sandboxCleanup = null;
+    unlinkManagedOriginCapabilityFiles();
+    sandboxRelayCapability = null;
     if (seatbeltProfilePath) {
         try {
             unlinkSync(seatbeltProfilePath);