botmux 3.10.0 → 3.23.1

package/dist/utils/child-env.d.ts

@@ -1,147 +0,0 @@
-/**
- * Session-identity markers Claude Code exports into every Bash child it runs
- * (`CLAUDECODE` plus the `CLAUDE_CODE_*`/`CLAUDE_PID` family). Any process
- * started from inside a Claude session inherits them, and outside that session
- * they are always stale. The destructive one is CLAUDE_CODE_CHILD_SESSION: a
- * claude CLI that sees it treats itself as a nested subagent session and
- * silently turns OFF transcript persistence — which breaks `--resume`-based
- * continuity (respawn after a tmux session dies, role switch) for every bot.
- *
- * The poisoning path mirrors SESSION_CLI_HOME_ENV_KEYS: pm2 persists the env
- * of whichever process ran `botmux start/restart` (or raw `pm2 start`) into
- * every managed app, so one self-upgrade issued from a bot session bakes the
- * issuing session's markers into all daemons; the next time the shared tmux
- * server is (re)born it forks from the poisoned daemon, seeds its global env
- * with the markers, and every bot CLI on the machine stops saving transcripts.
- *
- * CLAUDE_EFFORT is deliberately absent: it is a behavior knob a user or
- * per-bot env may legitimately set, not a session-identity marker.
- */
-export declare const CLAUDE_SESSION_MARKER_ENV_KEYS: readonly ["CLAUDECODE", "CLAUDE_CODE_CHILD_SESSION", "CLAUDE_CODE_SESSION_ID", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CODE_EXECPATH", "CLAUDE_PID"];
-/** Delete inherited Claude session markers (CLAUDE_SESSION_MARKER_ENV_KEYS,
- *  plus BOUNDARY_ONLY_CLAUDE_ENV_KEYS) from `env` in place. Called at the same
- *  botmux-owned process boundaries as scrubSessionCliHomeEnv — pm2 invocation
- *  env (cli.ts pm2Env), daemon boot (index-daemon.ts), worker boot (worker.ts)
- *  — so a daemon (re)started from inside a Claude session never carries that
- *  session's identity into anything it forks (workers, the shared tmux
- *  server). */
-export declare function scrubClaudeSessionMarkerEnv(env: NodeJS.ProcessEnv): void;
-/**
- * Env vars that must never reach a spawned CLI child. The bot's IM-app creds
- * (a child CLI's own Lark OAuth reads `process.env.LARK_APP_ID` as the app to
- * authorize and gets hijacked by the botmux IM app → no docs scopes → 403
- * loop), daemon-side GitHub API tokens, and claude-code's session markers
- * (CLAUDE_SESSION_MARKER_ENV_KEYS). The
- * child resolves Lark via the namespaced `BOTMUX_LARK_APP_ID` or via bots.json
- * on disk (im/lark/client.ts); the worker keeps its own bare creds
- * (worker-pool.ts forkWorker) for lark-upload — only the *child* is redacted.
- *
- * Two leak vectors, two layers (both keyed off this list):
- *  - PTY / direct spawn: `redactChildEnv()` deletes them from the env object.
- *  - tmux: the new pane inherits the tmux *server's* global env, which the
- *    client env can't override, so the shell wrapper `unset`s them before exec
- *    (see SHELL_WRAPPER_SCRIPT in tmux-backend.ts).
- */
-export declare const REDACTED_CHILD_ENV_KEYS: readonly ["LARK_APP_ID", "LARK_APP_SECRET", "GITHUB_TOKEN", "GH_TOKEN", "CLAUDECODE", "CLAUDE_CODE_CHILD_SESSION", "CLAUDE_CODE_SESSION_ID", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CODE_EXECPATH", "CLAUDE_PID", "TMUX", "TMUX_PANE", "BOTMUX_PM2_GRACEFUL_EXIT_CODE"];
-/**
- * Session-level CLI data-root pointers: claude-family → CLAUDE_CONFIG_DIR,
- * codex → CODEX_HOME. Botmux computes these PER SESSION (read isolation pins
- * `<BOT_HOME>/claude|codex`; Seed/Relay pin their fork dirs via adapter
- * spawnEnv), so a value INHERITED from the surrounding environment is always
- * stale. The poisoning path: pm2 persists the env of whichever process ran
- * `botmux start/restart` into every managed app (and into dump.pm2 for
- * resurrect), so one self-upgrade issued from a bot session bakes that
- * session's injected CLAUDE_CONFIG_DIR into ALL daemons and workers — and
- * every non-isolated sibling bot then reads/writes that bot's home. Scrubbed
- * at each process boundary botmux owns: the pm2 invocation env (cli.ts
- * pm2Env), daemon boot (index-daemon.ts) and worker boot (worker.ts) — the
- * boot scrubs cover envs pm2 resurrects from a stale dump. Scrubbing
- * process.env (not just the spawned child's env) keeps worker-side resolvers
- * that consult it dynamically — codex submit confirmation / resume fallback /
- * transcript bridge (services/codex-paths.ts), slash-command discovery
- * (core/command-discovery.ts) — consistent with the CLI child.
- *
- * Do NOT pin a "default" instead of deleting: CLAUDE_CONFIG_DIR=~/.claude is
- * not a no-op — once the var is set, Claude Code reads its state file from
- * $CLAUDE_CONFIG_DIR/.claude.json instead of ~/.claude.json, which lacks
- * hasCompletedOnboarding → every non-isolated session reruns first-run
- * onboarding (theme picker + login).
- *
- * GROK_HOME is deliberately ABSENT: botmux never injects it per session (grok
- * has no per-bot isolation, and per-bot env rejects the key — see
- * core/per-bot-env.ts), so it can never carry a sibling bot's home. Its
- * contract is the opposite of per-session: process-level only, where worker
- * and CLI child must resolve the SAME value (the worker installs ready-gate
- * hooks and drains transcripts under it — see services/grok-paths.ts), so
- * scrubbing it on any single side would split-brain that documented
- * configuration channel.
- */
-export declare const SESSION_CLI_HOME_ENV_KEYS: readonly ["CLAUDE_CONFIG_DIR", "CODEX_HOME"];
-/** Delete inherited session-level CLI data-root pointers from `env` in place
- *  (see SESSION_CLI_HOME_ENV_KEYS). Values a session actually needs are
- *  computed and re-set AFTER this scrub (worker isolation pins / adapter
- *  spawnEnv). */
-export declare function scrubSessionCliHomeEnv(env: NodeJS.ProcessEnv): void;
-/**
- * Botmux-managed, session/bot-scoped env keys that reach the CLI pane via the
- * `/usr/bin/env KEY=VAL` wrapper injection (buildBotmuxEnvAssignments), NOT via
- * the tmux client env. They MUST be stripped from the env handed to the `tmux`
- * binary (see tmuxEnv), because the first `tmux new-session` that boots a server
- * copies its client env into the server's *global* environment — which then
- * leaks into every co-tenant session sharing that socket, including the user's
- * own interactive tmux. A leaked `BOTMUX_SESSION_ID` / `BOTMUX_CHAT_ID` makes a
- * plain Claude Code run in the user's terminal believe it is a botmux session
- * and misroute its AskUserQuestion hook to a Lark thread. Stripping is invisible
- * to botmux's own sessions: the pane still gets the correct per-session values
- * from the env(1) injection, which lands after rcfile load.
- *
- * The `BOTMUX` prefix is swept wholesale by {@link isBotmuxManagedTmuxEnvKey}
- * (covers daemon-internal BOTMUX_BOT_INDEX / BOTMUX_QUIET_RESTART / … that were
- * never meant to reach a pane). These non-prefixed keys come from
- * BOTMUX_INJECTED_ENV_KEYS; the bare IM-app creds are folded in from
- * REDACTED_CHILD_ENV_KEYS so a server botmux bootstraps can never seed them
- * into its global env either.
- */
-export declare const BOTMUX_INJECTED_ENV_KEYS: readonly ["__OWNER_OPEN_ID", "BOTMUX", "SESSION_DATA_DIR", "IS_SANDBOX", "BOTMUX_SESSION_ID", "BOTMUX_CHAT_ID", "BOTMUX_MCP_GATEWAY_SOCKET", "BOTMUX_MCP_GATEWAY_REQUIRED", "BOTMUX_CHAT_TYPE", "BOTMUX_LARK_APP_ID", "BOTMUX_ROOT_MESSAGE_ID", "BOTMUX_OWNER_OPEN_ID", "BOTMUX_TURN_ID", "BOTMUX_DISPATCH_ATTEMPT", "BOTMUX_BRAND_LABEL", "BOTMUX_READ_ISOLATION", "BOTMUX_API_ONLY", "BOTMUX_USAGE_DISPLAY", "BOTMUX_PI_INITIAL_PROMPT_FILE", "BOTMUX_DAEMON_IPC_PORT", "BOTMUX_LARK_LIST_BOTS_API_ENABLED", "BOTMUX_LARK_LIST_BOTS_API_TIMEOUT_MS", "BOTMUX_READY_COMMAND", "HERMES_HOME", "HERMES_BOTMUX_SOURCE_HOME", "HERMES_BOTMUX_PROFILES_ROOT", "CLAUDE_CONFIG_DIR", "CODEX_HOME", "CLAUDE_CODE_RESUME_TOKEN_THRESHOLD", "CJADK_INTERACTIVE"];
-/** Proxy env vars that must reach the CLI child process so it can dial the
- *  upstream API on hosts without direct internet access. Forwarded explicitly
- *  by buildBotmuxEnvAssignments (tmux/tmux-pipe/zellij backends) and
- *  prepareDirectSandbox (bwrap --setenv); the pty backend inherits them via the
- *  full child env.
- *  Deliberately NOT in BOTMUX_INJECTED_ENV_KEYS: that list drives tmuxEnv()
- *  stripping and scrubTmuxServerGlobalEnv() cleanup — adding proxy keys there
- *  would delete the user's own tmux server proxy config. */
-export declare const PROXY_ENV_KEYS: readonly ["http_proxy", "https_proxy", "HTTP_PROXY", "HTTPS_PROXY", "no_proxy", "NO_PROXY", "all_proxy", "ALL_PROXY"];
-/**
- * True for any env key botmux must keep out of the tmux CLIENT env it hands to
- * the `tmux` binary. This is stricter than server-global scrub: besides
- * botmux-owned routing/profile vars, we also strip daemon-side GitHub tokens so
- * a botmux-started tmux server never seeds them into its shared global env.
- */
-export declare function isBotmuxManagedTmuxEnvKey(key: string): boolean;
-/**
- * True for env keys botmux is allowed to repair out of an already-running tmux
- * SERVER global environment. This intentionally excludes user-wide GitHub
- * tokens: botmux panes must `unset` them locally, but daemon startup must not
- * rewrite a shared tmux server's general-purpose env table.
- */
-export declare function isBotmuxManagedTmuxServerGlobalEnvKey(key: string): boolean;
-/**
- * Build the base environment for a spawned CLI child: copy the worker's env
- * and REMOVE the keys in REDACTED_CHILD_ENV_KEYS.
- *
- * Why `delete` and not `{ ...env, KEY: undefined }`: node-pty stringifies an
- * `undefined` env value to the literal string "undefined" rather than omitting
- * the key (verified against the bundled node-pty). So `{ ...env, LARK_APP_ID:
- * undefined }` hands the child `LARK_APP_ID="undefined"` — still truthy, so any
- * SDK probing `process.env.LARK_APP_ID` takes the Lark path with appId
- * "undefined". Only deleting the key truly unsets it.
- *
- * NOTE: this covers the PTY path and the tmux *client* env. The tmux *server*
- * global-env vector is closed separately by the wrapper's `unset` — see the
- * comment on REDACTED_CHILD_ENV_KEYS.
- *
- * Returns a fresh object; the input env is not mutated.
- */
-export declare function redactChildEnv(base: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-//# sourceMappingURL=child-env.d.ts.map

package/dist/utils/child-env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../src/utils/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,8BAA8B,gJAOjC,CAAC;AAeX;;;;;;eAMe;AACf,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAGxE;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,oQA8B1B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,yBAAyB,8CAA+C,CAAC;AAEtF;;;iBAGiB;AACjB,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAEnE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,ytBA4D3B,CAAC;AAEX;;;;;;;4DAO4D;AAC5D,eAAO,MAAM,cAAc,uHAGjB,CAAC;AA2BX;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAIzE"}

package/dist/utils/child-env.js

@@ -1,299 +0,0 @@
-/**
- * Session-identity markers Claude Code exports into every Bash child it runs
- * (`CLAUDECODE` plus the `CLAUDE_CODE_*`/`CLAUDE_PID` family). Any process
- * started from inside a Claude session inherits them, and outside that session
- * they are always stale. The destructive one is CLAUDE_CODE_CHILD_SESSION: a
- * claude CLI that sees it treats itself as a nested subagent session and
- * silently turns OFF transcript persistence — which breaks `--resume`-based
- * continuity (respawn after a tmux session dies, role switch) for every bot.
- *
- * The poisoning path mirrors SESSION_CLI_HOME_ENV_KEYS: pm2 persists the env
- * of whichever process ran `botmux start/restart` (or raw `pm2 start`) into
- * every managed app, so one self-upgrade issued from a bot session bakes the
- * issuing session's markers into all daemons; the next time the shared tmux
- * server is (re)born it forks from the poisoned daemon, seeds its global env
- * with the markers, and every bot CLI on the machine stops saving transcripts.
- *
- * CLAUDE_EFFORT is deliberately absent: it is a behavior knob a user or
- * per-bot env may legitimately set, not a session-identity marker.
- */
-export const CLAUDE_SESSION_MARKER_ENV_KEYS = [
-    'CLAUDECODE',
-    'CLAUDE_CODE_CHILD_SESSION',
-    'CLAUDE_CODE_SESSION_ID',
-    'CLAUDE_CODE_ENTRYPOINT',
-    'CLAUDE_CODE_EXECPATH',
-    'CLAUDE_PID',
-];
-/** Boundary-only companion to the markers. A CLAUDE_EFFORT inherited THROUGH
- *  pm2 → daemon → worker is indistinguishable from the issuing Claude
- *  session's own override and would silently pin that session's
- *  behavior/cost/latency onto every bot, so the boundary scrub drops it. It
- *  stays OUT of REDACTED_CHILD_ENV_KEYS / the pane unset / the server-global
- *  scrub, which keeps the supported config channels working: per-bot `env`
- *  (injected after redact on every backend, PTY included) and — on the
- *  shell-wrapped backends (tmux/zellij) — the pane shell's own profile. The
- *  ambient "export it in the shell that runs `botmux start`" channel is
- *  deliberately sacrificed: at that boundary it cannot be told apart from
- *  contamination. */
-const BOUNDARY_ONLY_CLAUDE_ENV_KEYS = ['CLAUDE_EFFORT'];
-/** Delete inherited Claude session markers (CLAUDE_SESSION_MARKER_ENV_KEYS,
- *  plus BOUNDARY_ONLY_CLAUDE_ENV_KEYS) from `env` in place. Called at the same
- *  botmux-owned process boundaries as scrubSessionCliHomeEnv — pm2 invocation
- *  env (cli.ts pm2Env), daemon boot (index-daemon.ts), worker boot (worker.ts)
- *  — so a daemon (re)started from inside a Claude session never carries that
- *  session's identity into anything it forks (workers, the shared tmux
- *  server). */
-export function scrubClaudeSessionMarkerEnv(env) {
-    for (const key of CLAUDE_SESSION_MARKER_ENV_KEYS)
-        delete env[key];
-    for (const key of BOUNDARY_ONLY_CLAUDE_ENV_KEYS)
-        delete env[key];
-}
-/**
- * Env vars that must never reach a spawned CLI child. The bot's IM-app creds
- * (a child CLI's own Lark OAuth reads `process.env.LARK_APP_ID` as the app to
- * authorize and gets hijacked by the botmux IM app → no docs scopes → 403
- * loop), daemon-side GitHub API tokens, and claude-code's session markers
- * (CLAUDE_SESSION_MARKER_ENV_KEYS). The
- * child resolves Lark via the namespaced `BOTMUX_LARK_APP_ID` or via bots.json
- * on disk (im/lark/client.ts); the worker keeps its own bare creds
- * (worker-pool.ts forkWorker) for lark-upload — only the *child* is redacted.
- *
- * Two leak vectors, two layers (both keyed off this list):
- *  - PTY / direct spawn: `redactChildEnv()` deletes them from the env object.
- *  - tmux: the new pane inherits the tmux *server's* global env, which the
- *    client env can't override, so the shell wrapper `unset`s them before exec
- *    (see SHELL_WRAPPER_SCRIPT in tmux-backend.ts).
- */
-export const REDACTED_CHILD_ENV_KEYS = [
-    'LARK_APP_ID',
-    'LARK_APP_SECRET',
-    'GITHUB_TOKEN',
-    'GH_TOKEN',
-    ...CLAUDE_SESSION_MARKER_ENV_KEYS,
-    // Parent-tmux client vars: when the daemon itself was started inside a tmux
-    // session, process.env carries TMUX (server socket path) + TMUX_PANE. Leaking
-    // these into a spawned CLI makes tmux-aware tools (codex integrates with tmux)
-    // try to talk to the daemon's PARENT tmux server — which does not exist inside
-    // the file sandbox (fresh /tmp tmpfs), so the connect() ENOENTs and the CLI
-    // aborts with "No such file or directory (os error 2)". The tmux/tmux-pipe
-    // backends already strip these for their OWN pane launch via tmuxEnv(), but the
-    // sandbox path injects childEnv straight into the pane's env(1), so strip at
-    // the source. Non-tmux CLIs are unaffected (they don't read TMUX).
-    'TMUX',
-    'TMUX_PANE',
-    // PM2 graceful-exit sentinel (BOTMUX_PM2_GRACEFUL_EXIT_CODE, defined as
-    // PM2_GRACEFUL_EXIT_CODE_ENV in pm2-graceful-exit.ts). pm2 bakes it into the
-    // daemon/dashboard env so ONLY those two managed cores exit with the sentinel
-    // code (90) on graceful stop instead of 0 — otherwise a signal-killed daemon's
-    // null→0 code would match stop_exit_codes and suppress crash-autorestart. But
-    // it must never reach a session's CLI child: a foreground `botmux serve
-    // --api-only` / `daemon` / `dashboard` launched from inside a bot session would
-    // inherit the marker and, per gracefulProcessExitCode(), exit 90 on a clean
-    // Ctrl+C — a supervisor/launcher then misreads that non-zero code as a crash.
-    // Only daemon.ts + dashboard.ts read this key, so stripping it at the child
-    // boundary is safe. Kept as a string literal (like the keys above) with a
-    // drift-guard test pinning it to PM2_GRACEFUL_EXIT_CODE_ENV.
-    'BOTMUX_PM2_GRACEFUL_EXIT_CODE',
-];
-/**
- * Session-level CLI data-root pointers: claude-family → CLAUDE_CONFIG_DIR,
- * codex → CODEX_HOME. Botmux computes these PER SESSION (read isolation pins
- * `<BOT_HOME>/claude|codex`; Seed/Relay pin their fork dirs via adapter
- * spawnEnv), so a value INHERITED from the surrounding environment is always
- * stale. The poisoning path: pm2 persists the env of whichever process ran
- * `botmux start/restart` into every managed app (and into dump.pm2 for
- * resurrect), so one self-upgrade issued from a bot session bakes that
- * session's injected CLAUDE_CONFIG_DIR into ALL daemons and workers — and
- * every non-isolated sibling bot then reads/writes that bot's home. Scrubbed
- * at each process boundary botmux owns: the pm2 invocation env (cli.ts
- * pm2Env), daemon boot (index-daemon.ts) and worker boot (worker.ts) — the
- * boot scrubs cover envs pm2 resurrects from a stale dump. Scrubbing
- * process.env (not just the spawned child's env) keeps worker-side resolvers
- * that consult it dynamically — codex submit confirmation / resume fallback /
- * transcript bridge (services/codex-paths.ts), slash-command discovery
- * (core/command-discovery.ts) — consistent with the CLI child.
- *
- * Do NOT pin a "default" instead of deleting: CLAUDE_CONFIG_DIR=~/.claude is
- * not a no-op — once the var is set, Claude Code reads its state file from
- * $CLAUDE_CONFIG_DIR/.claude.json instead of ~/.claude.json, which lacks
- * hasCompletedOnboarding → every non-isolated session reruns first-run
- * onboarding (theme picker + login).
- *
- * GROK_HOME is deliberately ABSENT: botmux never injects it per session (grok
- * has no per-bot isolation, and per-bot env rejects the key — see
- * core/per-bot-env.ts), so it can never carry a sibling bot's home. Its
- * contract is the opposite of per-session: process-level only, where worker
- * and CLI child must resolve the SAME value (the worker installs ready-gate
- * hooks and drains transcripts under it — see services/grok-paths.ts), so
- * scrubbing it on any single side would split-brain that documented
- * configuration channel.
- */
-export const SESSION_CLI_HOME_ENV_KEYS = ['CLAUDE_CONFIG_DIR', 'CODEX_HOME'];
-/** Delete inherited session-level CLI data-root pointers from `env` in place
- *  (see SESSION_CLI_HOME_ENV_KEYS). Values a session actually needs are
- *  computed and re-set AFTER this scrub (worker isolation pins / adapter
- *  spawnEnv). */
-export function scrubSessionCliHomeEnv(env) {
-    for (const key of SESSION_CLI_HOME_ENV_KEYS)
-        delete env[key];
-}
-/**
- * Botmux-managed, session/bot-scoped env keys that reach the CLI pane via the
- * `/usr/bin/env KEY=VAL` wrapper injection (buildBotmuxEnvAssignments), NOT via
- * the tmux client env. They MUST be stripped from the env handed to the `tmux`
- * binary (see tmuxEnv), because the first `tmux new-session` that boots a server
- * copies its client env into the server's *global* environment — which then
- * leaks into every co-tenant session sharing that socket, including the user's
- * own interactive tmux. A leaked `BOTMUX_SESSION_ID` / `BOTMUX_CHAT_ID` makes a
- * plain Claude Code run in the user's terminal believe it is a botmux session
- * and misroute its AskUserQuestion hook to a Lark thread. Stripping is invisible
- * to botmux's own sessions: the pane still gets the correct per-session values
- * from the env(1) injection, which lands after rcfile load.
- *
- * The `BOTMUX` prefix is swept wholesale by {@link isBotmuxManagedTmuxEnvKey}
- * (covers daemon-internal BOTMUX_BOT_INDEX / BOTMUX_QUIET_RESTART / … that were
- * never meant to reach a pane). These non-prefixed keys come from
- * BOTMUX_INJECTED_ENV_KEYS; the bare IM-app creds are folded in from
- * REDACTED_CHILD_ENV_KEYS so a server botmux bootstraps can never seed them
- * into its global env either.
- */
-export const BOTMUX_INJECTED_ENV_KEYS = [
-    '__OWNER_OPEN_ID',
-    'BOTMUX',
-    'SESSION_DATA_DIR',
-    'IS_SANDBOX',
-    // botmux ask/hooks use these to locate the daemon and route back to the
-    // current session/thread. The worker refreshes them per pane/turn.
-    'BOTMUX_SESSION_ID',
-    'BOTMUX_CHAT_ID',
-    // Session-scoped plugin MCP relay. The worker owns the credential-bearing
-    // Gateway; the CLI and its native MCP launcher receive only this socket
-    // capability plus a fail-closed marker.
-    'BOTMUX_MCP_GATEWAY_SOCKET',
-    'BOTMUX_MCP_GATEWAY_REQUIRED',
-    // v3 host effects / schedule delivery need chatType inside the pane.
-    'BOTMUX_CHAT_TYPE',
-    'BOTMUX_LARK_APP_ID',
-    'BOTMUX_ROOT_MESSAGE_ID',
-    // Session owner (standard name; `__OWNER_OPEN_ID` above is the legacy
-    // channel). Custom CLI wrappers read it for per-user permission isolation.
-    'BOTMUX_OWNER_OPEN_ID',
-    'BOTMUX_TURN_ID',
-    'BOTMUX_DISPATCH_ATTEMPT',
-    // Resolved display footer for sandboxed `botmux send`; avoids reading the
-    // credential-bearing bots.json from inside the child.
-    'BOTMUX_BRAND_LABEL',
-    // Read-isolation marker + host-owned apiOnly verdict. Both are decided by the
-    // worker (gated on sandboxRequested / cfg.apiOnly) and MUST reach the child:
-    // inside the sandbox bots.json is denied, so the CLI has no other way to tell
-    // "denied because I'm sandboxed (expected)" from "unreadable (real fault)", nor
-    // to know its own apiOnly (a no-transport bot's send-cred.json is denied too).
-    // Being on this list also means tmuxEnv()/scrubTmuxServerGlobalEnv() strip them
-    // when unset — so a stale value cannot leak into a NON-sandboxed pane.
-    'BOTMUX_READ_ISOLATION',
-    'BOTMUX_API_ONLY',
-    // Per-bot display preference for Context / Token usage
-    // ('streaming' | 'footer' | 'off'). Injected explicitly so sandboxed offline
-    // fallback cannot drift to the default when bots.json is unreadable.
-    'BOTMUX_USAGE_DISPLAY',
-    // Pi deferred long-first-prompt extension reads one exact per-session file.
-    'BOTMUX_PI_INITIAL_PROMPT_FILE',
-    // Loopback port of the owning daemon's agent-facing IPC. Read-isolated CLIs
-    // (whose daemon discovery dir is Seatbelt-denied) need it to reach the
-    // session-scoped, capability-gated routes (v3 workflow relay, vc-agent).
-    // A port marker, not a credential — every route authenticates independently.
-    'BOTMUX_DAEMON_IPC_PORT',
-    // Keep `botmux bots list` and ready-gated CLIs aligned with daemon config.
-    'BOTMUX_LARK_LIST_BOTS_API_ENABLED',
-    'BOTMUX_LARK_LIST_BOTS_API_TIMEOUT_MS',
-    'BOTMUX_READY_COMMAND',
-    // Hermes profile roots must match the worker-side transcript reader.
-    'HERMES_HOME',
-    'HERMES_BOTMUX_SOURCE_HOME',
-    'HERMES_BOTMUX_PROFILES_ROOT',
-    // Per-bot isolated data roots for Claude/Codex.
-    'CLAUDE_CONFIG_DIR',
-    'CODEX_HOME',
-    // CLI-specific non-interactive/resume startup controls.
-    'CLAUDE_CODE_RESUME_TOKEN_THRESHOLD',
-    'CJADK_INTERACTIVE',
-];
-/** Proxy env vars that must reach the CLI child process so it can dial the
- *  upstream API on hosts without direct internet access. Forwarded explicitly
- *  by buildBotmuxEnvAssignments (tmux/tmux-pipe/zellij backends) and
- *  prepareDirectSandbox (bwrap --setenv); the pty backend inherits them via the
- *  full child env.
- *  Deliberately NOT in BOTMUX_INJECTED_ENV_KEYS: that list drives tmuxEnv()
- *  stripping and scrubTmuxServerGlobalEnv() cleanup — adding proxy keys there
- *  would delete the user's own tmux server proxy config. */
-export const PROXY_ENV_KEYS = [
-    'http_proxy', 'https_proxy', 'HTTP_PROXY', 'HTTPS_PROXY',
-    'no_proxy', 'NO_PROXY', 'all_proxy', 'ALL_PROXY',
-];
-const TMUX_CLIENT_STRIP_KEYS = new Set([
-    ...BOTMUX_INJECTED_ENV_KEYS,
-    ...REDACTED_CHILD_ENV_KEYS,
-    // Strip proxy vars from the tmux CLIENT env so botmux doesn't seed the
-    // shared server's global env with daemon-side proxy (which may contain
-    // embedded credentials) and leak it to the user's own interactive panes.
-    // Deliberately NOT in TMUX_SERVER_GLOBAL_SCRUB_KEYS: we must not delete
-    // proxy config the user set on their own tmux server. Per-pane injection
-    // via buildBotmuxEnvAssignments reads opts.env directly, so it's unaffected
-    // by this client-side strip.
-    ...PROXY_ENV_KEYS,
-]);
-const TMUX_SERVER_GLOBAL_SCRUB_KEYS = new Set([
-    ...BOTMUX_INJECTED_ENV_KEYS,
-    'LARK_APP_ID',
-    'LARK_APP_SECRET',
-    // Claude session markers are stale by definition in a server's GLOBAL env
-    // table (they can only have been seeded by whatever process booted the
-    // server), so unlike user-wide GitHub tokens they are safe to repair out of
-    // an already-running server — this is what heals a fleet whose tmux server
-    // was born from a poisoned daemon without waiting for the server to die.
-    ...CLAUDE_SESSION_MARKER_ENV_KEYS,
-]);
-/**
- * True for any env key botmux must keep out of the tmux CLIENT env it hands to
- * the `tmux` binary. This is stricter than server-global scrub: besides
- * botmux-owned routing/profile vars, we also strip daemon-side GitHub tokens so
- * a botmux-started tmux server never seeds them into its shared global env.
- */
-export function isBotmuxManagedTmuxEnvKey(key) {
-    return key.startsWith('BOTMUX') || TMUX_CLIENT_STRIP_KEYS.has(key);
-}
-/**
- * True for env keys botmux is allowed to repair out of an already-running tmux
- * SERVER global environment. This intentionally excludes user-wide GitHub
- * tokens: botmux panes must `unset` them locally, but daemon startup must not
- * rewrite a shared tmux server's general-purpose env table.
- */
-export function isBotmuxManagedTmuxServerGlobalEnvKey(key) {
-    return key.startsWith('BOTMUX') || TMUX_SERVER_GLOBAL_SCRUB_KEYS.has(key);
-}
-/**
- * Build the base environment for a spawned CLI child: copy the worker's env
- * and REMOVE the keys in REDACTED_CHILD_ENV_KEYS.
- *
- * Why `delete` and not `{ ...env, KEY: undefined }`: node-pty stringifies an
- * `undefined` env value to the literal string "undefined" rather than omitting
- * the key (verified against the bundled node-pty). So `{ ...env, LARK_APP_ID:
- * undefined }` hands the child `LARK_APP_ID="undefined"` — still truthy, so any
- * SDK probing `process.env.LARK_APP_ID` takes the Lark path with appId
- * "undefined". Only deleting the key truly unsets it.
- *
- * NOTE: this covers the PTY path and the tmux *client* env. The tmux *server*
- * global-env vector is closed separately by the wrapper's `unset` — see the
- * comment on REDACTED_CHILD_ENV_KEYS.
- *
- * Returns a fresh object; the input env is not mutated.
- */
-export function redactChildEnv(base) {
-    const env = { ...base };
-    for (const key of REDACTED_CHILD_ENV_KEYS)
-        delete env[key];
-    return env;
-}
-//# sourceMappingURL=child-env.js.map

package/dist/utils/child-env.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../src/utils/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,YAAY;IACZ,2BAA2B;IAC3B,wBAAwB;IACxB,wBAAwB;IACxB,sBAAsB;IACtB,YAAY;CACJ,CAAC;AAEX;;;;;;;;;;qBAUqB;AACrB,MAAM,6BAA6B,GAAG,CAAC,eAAe,CAAU,CAAC;AAEjE;;;;;;eAMe;AACf,MAAM,UAAU,2BAA2B,CAAC,GAAsB;IAChE,KAAK,MAAM,GAAG,IAAI,8BAA8B;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,6BAA6B;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,aAAa;IACb,iBAAiB;IACjB,cAAc;IACd,UAAU;IACV,GAAG,8BAA8B;IACjC,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,gFAAgF;IAChF,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM;IACN,WAAW;IACX,wEAAwE;IACxE,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,6DAA6D;IAC7D,+BAA+B;CACvB,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,mBAAmB,EAAE,YAAY,CAAU,CAAC;AAEtF;;;iBAGiB;AACjB,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,KAAK,MAAM,GAAG,IAAI,yBAAyB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,iBAAiB;IACjB,QAAQ;IACR,kBAAkB;IAClB,YAAY;IACZ,wEAAwE;IACxE,mEAAmE;IACnE,mBAAmB;IACnB,gBAAgB;IAChB,0EAA0E;IAC1E,wEAAwE;IACxE,wCAAwC;IACxC,2BAA2B;IAC3B,6BAA6B;IAC7B,qEAAqE;IACrE,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,sEAAsE;IACtE,2EAA2E;IAC3E,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,0EAA0E;IAC1E,sDAAsD;IACtD,oBAAoB;IACpB,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,uEAAuE;IACvE,uBAAuB;IACvB,iBAAiB;IACjB,uDAAuD;IACvD,6EAA6E;IAC7E,qEAAqE;IACrE,sBAAsB;IACtB,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,6EAA6E;IAC7E,wBAAwB;IACxB,2EAA2E;IAC3E,mCAAmC;IACnC,sCAAsC;IACtC,sBAAsB;IACtB,qEAAqE;IACrE,aAAa;IACb,2BAA2B;IAC3B,6BAA6B;IAC7B,gDAAgD;IAChD,mBAAmB;IACnB,YAAY;IACZ,wDAAwD;IACxD,oCAAoC;IACpC,mBAAmB;CACX,CAAC;AAEX;;;;;;;4DAO4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa;IACxD,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW;CACxC,CAAC;AAEX,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,GAAG,wBAAwB;IAC3B,GAAG,uBAAuB;IAC1B,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,6BAA6B;IAC7B,GAAG,cAAc;CAClB,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACjE,GAAG,wBAAwB;IAC3B,aAAa;IACb,iBAAiB;IACjB,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,GAAG,8BAA8B;CAClC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,GAAW;IAC/D,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,uBAAuB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/cli-usage-limit.d.ts

@@ -1,62 +0,0 @@
-export type CliUsageLimitKind = 'usage' | 'rate';
-export interface CliUsageLimitState {
-    limited: true;
-    kind: CliUsageLimitKind;
-    retryAtMs: number;
-    retryLabel: string;
-    retryReady: boolean;
-}
-export interface CliUsageLimitNotDetected {
-    limited: false;
-}
-export type CliUsageLimitDetection = CliUsageLimitState | CliUsageLimitNotDetected;
-export declare const HARD_RATE_LIMIT_COOLDOWN_MS: number;
-export interface DetectUsageLimitOptions {
-    /**
-     * Suppress the screen-scan `rate` verdict entirely. Set for CLIs that have an
-     * authoritative structured rate-limit signal (Claude family via transcript
-     * `error:"rate_limit"`): there, scraping the screen for "429" / "rate limit"
-     * only produces false positives (the model's own output, or a dev editing
-     * rate-limit code, puts those phrases on screen). `usage` quota detection is
-     * unaffected — it has no structured equivalent yet.
-     */
-    suppressRateKind?: boolean;
-}
-/**
- * Whether a CLI adapter is authoritative for structured rate limits — i.e. it
- * actually PUBLISHES a `limited` screen_update from its transcript. Only the
- * Claude family does (via the worker's `maybeEmitStructuredRateLimit` on the
- * `bridgeJsonlPath` path), and it is exactly the adapters that carry
- * `claudeDataDir`. When true, the worker passes `suppressRateKind` so the
- * screen-scan `rate` verdict is suppressed in favor of the structured signal.
- *
- * Gate on `claudeDataDir`, NOT `reliableTurnTerminal`: the codexBridgeQueue
- * CLIs emit NO structured `limited` state, so suppressing their screen `rate`
- * would drop the Dashboard「需要你」signal + backoff on a real 429. Most of
- * them (codex / grok / traex) DO set `reliableTurnTerminal`, so gating on that
- * flag would wrongly suppress them; pi is also codexBridgeQueue-backed but does
- * not set it — either way, none carry `claudeDataDir`, so all correctly stay
- * screen-scanning. Extracted as a pure predicate so the split has a direct
- * unit-test surface (see cli-usage-limit.test.ts) — a future adapter can't
- * silently re-broaden it.
- */
-export declare function isStructuredRateLimitAuthoritative(adapter: {
-    readonly claudeDataDir?: string;
-} | null | undefined): boolean;
-export declare function detectCliUsageLimit(text: string, now?: Date, opts?: DetectUsageLimitOptions): CliUsageLimitDetection;
-export declare function usageLimitStateKey(state: CliUsageLimitState): string;
-/**
- * Build a rate-limit state from a STRUCTURED signal (e.g. Claude Code's
- * transcript `error: "rate_limit"` record) instead of screen text.
- *
- * The caller has already decided this IS a rate limit via a machine field, so
- * unlike detectCliUsageLimit() there is no pattern gate here — we only need to
- * fix the retry time. Claude's rate-limit records usually carry a human clock
- * in their text ("You've hit your session limit · resets 10:40pm"); when
- * `text` yields a parseable time we honor it (accurate retry_ready flip),
- * otherwise we reuse the same wall-clock-bucketed fallback the screen-text
- * hard-429 path uses so the usageLimitStateKey stays stable across repeated
- * ticks within a bucket (no persist/timer churn on the daemon side).
- */
-export declare function structuredRateLimitState(text?: string, now?: Date): CliUsageLimitState;
-//# sourceMappingURL=cli-usage-limit.d.ts.map

package/dist/utils/cli-usage-limit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-usage-limit.d.ts","sourceRoot":"","sources":["../../src/utils/cli-usage-limit.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,KAAK,CAAC;CAChB;AAED,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;AAoCnF,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AA0DzD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC9D,OAAO,CAET;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,GAAG,OAAa,EAChB,IAAI,GAAE,uBAA4B,GACjC,sBAAsB,CAsCxB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,SAAK,EAAE,GAAG,OAAa,GAAG,kBAAkB,CAUxF"}