botmux 3.13.0 → 3.14.0

package/dist/worker.js

@@ -23,18 +23,20 @@ import { evaluateCredentialOnlyIsolationGate, credentialIsolationRequired, devic
 import { buildFsPolicy, compileToSeatbelt, migrateLegacySandboxFields, resolveRedirectedAdapterAuthPaths, FsPolicyConfigError } from './adapters/cli/fs-policy.js';
 import { killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, probePersistentSession, shouldRejectPersistentPostKillProbe } from './core/persistent-backend.js';
 import { finalizeRawCommandDelivery, writeRawCommandLine } from './core/raw-command-writer.js';
+import { rawCommandWriteOptionsFor } from './core/raw-command-write-options.js';
 import { publishCliSessionIdToDaemon } from './core/cli-session-id-publisher.js';
 import { readProcessStartIdentity } from './core/session-marker.js';
 import { roleLibraryRoot, roleLibrarySubtree } from './core/role-library.js';
 import { drainTranscript, joinAssistantText, trailingAssistantText, findJsonlContainingFingerprint, findJsonlsContainingExactContent, findLatestJsonl, extractLastAssistantTurn, extractTurnStartText, splitTranscriptEventsByCutoff, isTranscriptRateLimitEvent, apiErrorMessageText } from './services/claude-transcript.js';
 import { BridgeTurnQueue, makeFingerprint, normaliseForFingerprint } from './services/bridge-turn-queue.js';
-import { bridgePostText, isBridgeNothingToSendFinal, shouldEmitEmptyCompletedBridgeFallback, shouldEmitFailedBridgeFallback, shouldSuppressBridgeEmit, stripTrailingBridgeSentinelLine } from './services/bridge-fallback-gate.js';
+import { bridgePostText, isBridgeNothingToSendFinal, shouldSuppressBridgeEmit, structuredFallbackKind, stripTrailingBridgeSentinelLine } from './services/bridge-fallback-gate.js';
 import { buildSubmitMessagePreview } from './services/submit-notification.js';
 import { decideHardTimeoutAction, decidePostHookPromptEvidence, decideSettleMarkReady, shouldArmPostHookPromptEvidenceFallback, shouldReleaseFirstPromptTimeout, shouldWaitForPostSessionStartPromptEvidence, shouldWriteNow, POST_HOOK_EVIDENCE_FALLBACK_MS, POST_HOOK_EVIDENCE_RETRY_MS, } from './utils/input-gate.js';
 import { decideCodexRunnerFreshness, CodexRunnerFreshnessInputQueue, shouldHoldCodexRunnerInput, } from './services/codex-runner-freshness.js';
 import { canStartInjectionFlush, shouldDeferUserFlush, shouldFlushInjectionsFirst } from './core/inject-queue-policy.js';
 import { decideRestartFollowup, settleDurableTurnForRestart } from './core/restart-followup-policy.js';
 import { stripAnsiForLog, tailChars } from './utils/crash-log.js';
+import { parseReadOnlyRemoteScrollPayload, READ_ONLY_REMOTE_SCROLL_SESSION_BUDGET, READ_ONLY_REMOTE_SCROLL_WINDOW_MS, ReadOnlyRemoteScrollLimiter, } from './utils/web-terminal-scroll.js';
 import { CodexUpdateDialogGuard } from './utils/codex-update-dialog.js';
 import { EffortConfirmDialogGuard } from './utils/effort-confirm-dialog.js';
 import { installStdioEpipeGuard, isIgnorableStreamError } from './utils/stdio-epipe-guard.js';
@@ -63,7 +65,7 @@ import { CodexBridgeQueue, pruneExpiredPreStartHeadsAndEmit } from './services/c
 import { detectCodexComposerState } from './services/codex-composer-state.js';
 import { generateCodexAppThreadTitle, readCodexAppThreadMetadata, setCodexAppThreadName, } from './services/codex-app-threads.js';
 import { buildBotmuxLarkNativeSessionTitle } from './core/session-title.js';
-import { CODEX_AUTH_ERROR_CODE, CODEX_CONNECTION_ERROR_CODE, CODEX_INVALID_REQUEST_ERROR_CODE, CODEX_RATE_LIMIT_ERROR_CODE, drainCodexRollout, findCodexRolloutBySessionId, findCodexRolloutByPid, findCodexRolloutSetByPid, codexHistorySidIsOwned, splitCodexEventsByCutoff, extractLastCodexTurn, codexSessionIdFromRolloutPath, isCodexRateLimitEvent, scanCodexThreadSettings, readLatestCodexRuntime } from './services/codex-transcript.js';
+import { CODEX_AUTH_ERROR_CODE, CODEX_CONNECTION_ERROR_CODE, CODEX_INVALID_REQUEST_ERROR_CODE, drainCodexRollout, findCodexRolloutBySessionId, findCodexRolloutByPid, findCodexRolloutSetByPid, codexHistorySidIsOwned, splitCodexEventsByCutoff, extractLastCodexTurn, codexSessionIdFromRolloutPath, isCodexRateLimitEvent, scanCodexThreadSettings, readLatestCodexRuntime } from './services/codex-transcript.js';
 import { CodexServiceTierTracker, resolveCodexServiceTierSnapshot } from './services/codex-service-tier.js';
 import { WORKER_IPC_HANDLER_READY_EVENT } from './worker-ipc-preload.js';
 import { drainTraexRollout, findTraexRolloutBySessionId, findTraexRolloutByPid, findTraexRolloutSetByPid, readLatestTraexRuntime, traexHistorySidIsOwned } from './services/traex-transcript.js';
@@ -91,9 +93,9 @@ import { t, setDefaultLocale } from './i18n/index.js';
 import { TerminalRenderer } from './utils/terminal-renderer.js';
 import { DEFAULT_RENDER_COLS, DEFAULT_RENDER_ROWS, MAX_RENDER_COLS, MAX_RENDER_ROWS, MIN_RENDER_COLS, MIN_RENDER_ROWS, clamp, resolveRenderDimensions, } from './utils/render-dimensions.js';
 import { createCliAdapterSync, locateOnPath } from './adapters/cli/registry.js';
-import { buildWrappedLaunch, parseWrapperCli, isTtadkWrapper } from './setup/cli-selection.js';
+import { buildWrappedLaunch, parseWrapperCli, isTtadkWrapper, wrapperLaunchEnv } from './setup/cli-selection.js';
 import { cliUnavailableMessage } from './setup/cli-availability.js';
-import { findLaunchedCliPid, scheduleWrapperRealCliPid, readComm, isBareShellComm, bareShellLaunchKind, settleLaunchComm, } from './core/session-discovery.js';
+import { findLaunchedCliPid, scheduleWrapperRealCliPid, readComm, isBareShellComm, bareShellLaunchKind, bareShellLaunchGuidance, settleLaunchComm, } from './core/session-discovery.js';
 import { CODEX_RPC_TERMINAL_HYDRATION_DELAYS_MS, RpcEngagementFence, codexRpcEligible, paneRunsRemoteTui, orchestrateCodexRpcInit, rolloutUserTurnMatches, decideStartupDialogAction, shouldQueueInitialPrompt, shouldPreMarkFirstTurn, killAndVerifyPersistentPane, rpcTranscriptIngestBlockedByAwaitingActivation } from './codex-rpc-lifecycle.js';
 import { delay } from './utils/timing.js';
 import { claudeJsonlPathForSession, resolveJsonlFromPid, findOpenClaudeSessionIds, syncClaudeResumeTargetToCwd, DEFAULT_CLAUDE_DATA_DIR } from './adapters/cli/claude-code.js';
@@ -143,7 +145,7 @@ import { withCodexAppContext } from './utils/codex-app-context.js';
 import { resolveCodexAppFinalTurnIdentity } from './adapters/cli/codex-app-turn.js';
 import { RunnerControlDecoder } from './adapters/cli/runner-control-channel.js';
 import { normalizeCodexAppLifecycleEvent, normalizeFinalUsage, } from './services/codex-app-runner-protocol.js';
-import { hasMatchingManagedOriginCapability, ensureManagedOriginAttestationDirectory, ensureManagedOriginCapabilityLeafSafe, ensureManagedOriginDataRootProbe, ensureManagedOriginIsolationSentinel, ensureManagedOriginRootLocator, managedOriginLegacyIsolationProbeAccess, managedOriginDataRootProbeAccess, managedOriginIsolationSentinelAccess, managedOriginAttestationDirectory, managedOriginCapabilityPath, managedOriginRootLocatorPath, readManagedOriginAuthorityFile, RELAY_ORIGIN_CAPABILITY_BASENAME, replaceManagedOriginCapabilityFile, sweepManagedOriginAttestationProofs, } from './core/managed-origin-capability.js';
+import { hasMatchingManagedOriginCapability, ensureManagedOriginAttestationDirectory, ensureManagedOriginCapabilityLeafSafe, ensureManagedOriginDataRootProbe, ensureManagedOriginIsolationSentinel, ensureManagedOriginRootLocator, managedOriginLegacyIsolationProbeAccess, managedOriginDataRootProbeAccess, managedOriginIsolationSentinelAccess, managedOriginAttestationDirectory, managedOriginCapabilityDirectory, managedOriginCapabilityPath, managedOriginRootLocatorPath, readManagedOriginAuthorityFile, RELAY_ORIGIN_CAPABILITY_BASENAME, replaceManagedOriginCapabilityFile, sweepManagedOriginAttestationProofs, } from './core/managed-origin-capability.js';
 import { CodexRpcEngine, } from './codex-rpc-engine.js';
 import { beginRuntimeWriteCycle, isCliBackendGenerationCurrent, PtyOutputGeneration, projectRuntimeScreenStatus, } from './utils/runtime-screen-status.js';
 import { AsyncSerialQueue } from './utils/async-serial-queue.js';
@@ -422,14 +424,22 @@ function persistentPaneInfo(backendType, sessionId) {
                 : HerdrBackend.hasSession(name);
     return { name, live };
 }
-function persistentPaneLive(backendType, name) {
-    if (backendType === 'tmux')
-        return TmuxBackend.hasSession(name);
-    if (backendType === 'zellij')
-        return ZellijBackend.hasSession(name);
-    if (backendType === 'herdr')
-        return HerdrBackend.hasSession(name);
-    return ZmxBackend.hasSession(name);
+/** Tri-state pane liveness, for callers that must not read "no answer" as an
+ *  answer. The `hasSession()` helpers collapse an unanswered probe into
+ *  `false`, which is safe where a wrong guess just means "treat as fresh" but
+ *  NOT where the boolean is consumed as proof that a kill succeeded. Every
+ *  backend already classifies this correctly; only the boolean wrapper threw
+ *  the distinction away. */
+function persistentPaneProbe(backendType, name) {
+    const probe = backendType === 'tmux' ? TmuxBackend.probeSession(name)
+        : backendType === 'zellij' ? ZellijBackend.probeSession(name)
+            : backendType === 'herdr' ? HerdrBackend.probeSession(name)
+                : ZmxBackend.probeSession(name);
+    if (probe === 'exists')
+        return 'live';
+    if (probe === 'missing')
+        return 'gone';
+    return 'unknown';
 }
 function probeOwnedZmxSession(name, sessionId, expectedPid) {
     const managed = ZmxBackend.probeManagedSession(name, sessionId);
@@ -459,7 +469,7 @@ function probeOwnedZmxSession(name, sessionId, expectedPid) {
 async function killPersistentSessionVerified(backendType, name, sessionId) {
     return killAndVerifyPersistentPane(name, {
         kill: (resolvedName) => killPersistentSession(backendType, resolvedName, sessionId),
-        isLive: (resolvedName) => persistentPaneLive(backendType, resolvedName),
+        probeLive: (resolvedName) => persistentPaneProbe(backendType, resolvedName),
         wait: delay,
     });
 }
@@ -1439,6 +1449,10 @@ const authedClients = new WeakSet();
 const clientPtys = new Map();
 /** Managed-Herdr viewers survive an in-worker /restart while backend changes. */
 const herdrWebBindings = new Map();
+const readOnlyRemoteScrollLimiter = new ReadOnlyRemoteScrollLimiter({
+    budget: READ_ONLY_REMOTE_SCROLL_SESSION_BUDGET,
+    windowMs: READ_ONLY_REMOTE_SCROLL_WINDOW_MS,
+});
 // Standalone/test fallback. Production replaces this after init with a stable
 // per-session HMAC derived from the host-only dashboard secret, so an
 // already-issued 「操作链接」/write link survives a worker restart (a silent
@@ -1511,7 +1525,7 @@ let closeRequested = false;
 let capturedSpawnCommand = null;
 let deferredTopicOutputTail = '';
 const reportedDeferredTopicRoots = new Set();
-const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff', reasonix: 'Reasonix' };
+const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', opencode2: 'OpenCode 2', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff', reasonix: 'Reasonix', dsh: 'DeepSeek Harness' };
 function cliName() {
     return (lastInitConfig?.cliRuntime?.source === 'configured'
         ? (lastInitConfig.cliRuntime.displayName?.trim() || lastInitConfig.cliRuntime.id)
@@ -1677,17 +1691,14 @@ function releaseReadyGate(reason, opts) {
  *  the next command, capped so a slow/redrawing command can't stall the queue. */
 const STARTUP_CMD_QUIET_MS = 500;
 const STARTUP_CMD_CAP_MS = 4_000;
-/** Inter-keystroke spacing when typing a slash command into CoCo char-by-char.
- *  CoCo (Trae CLI, Ink TUI) treats "several bytes delivered in one PTY read" as a
- *  paste, which skips command mode + the slash picker — so each char must land as
- *  its own keystroke. 40ms is comfortably above CoCo's coalescing window (verified
- *  against Trae CLI 0.120.45) while keeping a short command sub-second. */
-const COCO_SLASH_TYPE_THROTTLE_MS = 40;
 /** Type one literal input LINE into the CLI exactly like a passthrough slash
- *  command: raw text → a 200ms beat (so the TUI's slash-command picker registers
- *  the match before submit) → a separate Enter. Non-TUI backends fall back to a
- *  single write + CR. Shared by the `raw_input` IPC handler and runStartupCommands
- *  so both stay in lockstep. */
+ *  command. Delivery is adapter-derived: adapters that declare a paste-line
+ *  input mode (e.g. OpenCode) paste the line up front, then wait out the
+ *  adapter's settle window before pressing Enter; generic backends keep the
+ *  classic raw text → a 200ms beat (so the TUI's slash-command picker
+ *  registers the match before submit) → a separate Enter, or fall back to a
+ *  single write + CR. Shared by the `raw_input` IPC handler and
+ *  runStartupCommands so both stay in lockstep. */
 async function sendRawCommandLine(be, content) {
     // PR #597 extracted the CoCo/pty keystroke choreography into the shared
     // writeRawCommandLine helper (unit-tested in raw-command-writer.ts). It
@@ -1695,11 +1706,7 @@ async function sendRawCommandLine(be, content) {
     // recovery-fence transaction detects a failed submission by a thrown error, so
     // bridge the two: turn an explicit `false` into the same throw the inline
     // implementation used, letting runAmbiguousSubmissionTransaction cancel the WAL.
-    const accepted = await writeRawCommandLine(be, content, {
-        coco: lastInitConfig?.cliId === 'coco',
-        cocoThrottleMs: COCO_SLASH_TYPE_THROTTLE_MS,
-        submitBeatMs: 200,
-    });
+    const accepted = await writeRawCommandLine(be, content, rawCommandWriteOptionsFor(cliAdapter ?? undefined, lastInitConfig?.cliId));
     if (accepted === false) {
         throw new Error('backend rejected command text or submit key input');
     }
@@ -2090,6 +2097,7 @@ let currentBotmuxDispatchAttempt;
 let currentVcMeetingImTurnOrigin;
 let durableTurnInFlight = false;
 function publishSandboxRelayCapability(opts = {}) {
+    const daemonIpcPort = parseDaemonIpcPort(process.env.BOTMUX_DAEMON_IPC_PORT);
     const capability = {
         token: randomBytes(32).toString('hex'),
         ...(currentBotmuxTurnId ? { turnId: currentBotmuxTurnId } : {}),
@@ -2104,6 +2112,21 @@ function publishSandboxRelayCapability(opts = {}) {
                     body: JSON.stringify({ token: capability.token }),
                 }]
             : []),
+        ...(readIsolationOriginChannelId
+            ? [{
+                    path: managedOriginCapabilityPath(process.env.SESSION_DATA_DIR ?? config.session.dataDir, sessionId, readIsolationOriginChannelId),
+                    body: JSON.stringify({
+                        sessionId,
+                        channelId: readIsolationOriginChannelId,
+                        capability: capability.token,
+                        ...(capability.turnId ? { turnId: capability.turnId } : {}),
+                        ...(capability.dispatchAttempt !== undefined
+                            ? { dispatchAttempt: capability.dispatchAttempt }
+                            : {}),
+                        ...(daemonIpcPort !== undefined ? { ipcPort: daemonIpcPort } : {}),
+                    }),
+                }]
+            : []),
     ];
     let publishError;
     for (const file of files) {
@@ -4800,8 +4823,11 @@ function currentHermesBridgeDbPath() {
 function structuredBridgeIngestPath(path, offset) {
     if (structuredBridgeIsCodex())
         return drainCodexRollout(path, offset);
-    if (structuredBridgeIsTraex())
-        return drainTraexRollout(path, offset);
+    // adoptMode gates the drainer's bare-sentinel synthesis: adopt posts
+    // transcript text verbatim, so a synthesised token would leak into Lark.
+    if (structuredBridgeIsTraex()) {
+        return drainTraexRollout(path, offset, { adoptMode: lastInitConfig?.adoptMode === true });
+    }
     if (codexBridgeIsCursor())
         return drainCursorTranscript(path, offset);
     if (structuredBridgeIsPi())
@@ -6020,13 +6046,17 @@ function emitReadyCodexTurns() {
             isLocal: turn.isLocal,
             finalText: turn.finalText,
             terminalStatus: turn.terminalStatus,
+            terminalErrorCode: turn.terminalErrorCode,
         };
-        const content = turn.terminalErrorCode !== CODEX_RATE_LIMIT_ERROR_CODE
-            && shouldEmitFailedBridgeFallback(gateInput, nextBoundaryMs, markers, adoptMode)
+        // The rate-limit skip is narrowed to CLIs with a dedicated structured
+        // rate-limit chain (Codex): TRAE 429 has no such chain, so skipping the
+        // generic failed fallback would post nothing at all.
+        const fallbackKind = structuredFallbackKind(gateInput, nextBoundaryMs, markers, adoptMode, structuredBridgeIsCodex());
+        const content = fallbackKind === 'failed'
             ? failedBridgeFallbackContent(turn.terminalErrorCode, turn.terminalErrorSummary, turn.finalText)
-            : turn.finalText && turn.finalText.trim()
-                ? turn.finalText
-                : shouldEmitEmptyCompletedBridgeFallback(gateInput, nextBoundaryMs, markers, adoptMode)
+            : fallbackKind === 'final'
+                ? turn.finalText ?? ''
+                : fallbackKind === 'empty_completed'
                     ? emptyCompletedBridgeFallbackContent()
                     : '';
         if (!content)
@@ -6295,6 +6325,10 @@ function restoreHerdrWebBindings() {
         applyHerdrWebBindingResult(ws, binding.restore());
     }
 }
+function canHandleReadOnlyRemoteScroll() {
+    return cliAdapter?.readOnlyRemoteScroll === true
+        && !(lastInitConfig?.adoptMode && lastInitConfig.adoptZellijPaneId);
+}
 function wireHerdrWebTerminalRelays(be) {
     be.onSnapshot(relayHerdrWebSnapshot);
     be.onWebTerminalCursor(relayHerdrWebCursor);
@@ -7548,11 +7582,11 @@ function handleVisibleStartupInteraction(data) {
     }
     return true;
 }
-// Mira/Mir still send terminal OSC control messages. Codex App deliberately
+// Mira/Mir/dsh send terminal OSC control messages. Codex App deliberately
 // does not (PR #597): its signed Unix-socket channel is independent of the
 // terminal/backend rendering (including Herdr and Zellij), so it is no longer
 // in the terminal-OSC decode set.
-const APP_RUNNER_OSC_CLI_IDS = new Set(['mira', 'mir']);
+const APP_RUNNER_OSC_CLI_IDS = new Set(['mira', 'mir', 'dsh']);
 const appRunnerControlDecoder = new RunnerControlDecoder();
 let kiroSessionIdCaptureArmed = false;
 let kiroSessionIdCaptureBuffer = '';
@@ -8706,7 +8740,17 @@ function markPromptReady() {
     // make the CLI busy, so the idle state is transient and shouldn't appear
     // in the card.  This avoids a false "就绪" flash on daemon restart
     // (where the initial prompt is queued before the CLI becomes idle).
-    if (renderer && pendingMessages.length === 0 && pendingAdoptMessages.length === 0 && pendingRawInputs.length === 0 && pendingSessionRename === null && !isFlushing) {
+    //
+    // ALSO skip when the Grok-class busy arm is pending (spawnArgvInitialPromptBusy):
+    // for these adapters the FIRST ready is a pre-execution SessionStart edge, not a
+    // turn boundary — the argv-baked first prompt is still running. isPromptReady was
+    // just set true above, so this generic snapshot would project 'idle' and reach the
+    // daemon BEFORE the busy arm below re-publishes 'working'. Combined with the
+    // first-turn working already sent by startScreenUpdates, the daemon would then see
+    // working→idle and fire finishTurnReactions() — a premature ✅ DONE mid-turn (and a
+    // 「工作中→等待输入→工作中」 flicker on the open card). The busy arm below owns the
+    // correct 'working' publish for this path, so this idle must not escape first.
+    if (renderer && !spawnArgvInitialPromptBusy && pendingMessages.length === 0 && pendingAdoptMessages.length === 0 && pendingRawInputs.length === 0 && pendingSessionRename === null && !isFlushing) {
         const { content } = renderer.snapshot();
         send({
             type: 'screen_update',
@@ -9079,7 +9123,10 @@ async function detectBareShellLaunch() {
     // rcfile may still finish and exec the CLI after this bounded check.
     const launchShell = (lastInitConfig?.launchShell || process.env.SHELL || '').trim();
     const expectedShell = launchShell ? basename(launchShell) : '';
-    const trampolined = bareShellLaunchKind(comm, expectedShell) === 'trampoline';
+    if (!comm)
+        return false;
+    const shellComm = comm;
+    const trampolined = bareShellLaunchKind(shellComm, expectedShell) === 'trampoline';
     bareShellLaunchBlocked = true;
     // Injection-first flushes can enter while isPromptReady is still true. Make
     // this a real busy/blocked transition so a later PTY-ready event re-enters
@@ -9094,17 +9141,18 @@ async function detectBareShellLaunch() {
     const cli = cliName();
     let message;
     if (trampolined) {
+        const guidance = bareShellLaunchGuidance(shellComm, expectedShell);
         message =
-            `⚠️ 会话没能启动：pane 里现在是裸 \`${comm}\`，${cli} 没真正跑起来——所以我没把你的消息打进去（否则会被当 shell 命令执行，报 \`parse error\`）。\n\n` +
-                `最可能原因：botmux 用 \`${expectedShell}\` 启动 CLI，但 pane 落到了 \`${comm}\`。通常是 rc 文件（如 \`~/.${expectedShell}rc\`）里有 \`exec ${comm}\` 这类跳转——\`${expectedShell} -i\` 会 source rc，于是 shell 被顶替，CLI 的启动命令没机会跑。\n\n` +
+            `⚠️ 会话没能启动：pane 里现在是裸 \`${shellComm}\`，${cli} 没真正跑起来——所以我没把你的消息打进去（否则会被当 shell 命令执行，报 \`parse error\`）。\n\n` +
+                `最可能原因：botmux 用 \`${expectedShell}\` 启动 CLI，但 pane 落到了 \`${shellComm}\`。通常是 rc 文件（如 \`${guidance.rcFileHint}\`）里有 \`exec ${shellComm}\` 这类跳转——\`${expectedShell} -i\` 会 source rc，于是 shell 被顶替，CLI 的启动命令没机会跑。\n\n` +
                 `两种修法（任选其一，改完重启 daemon 再发一条消息）：\n` +
-                `① 给那行加守卫，只在手动开终端时切：\`[ -z "$BASH_EXECUTION_STRING" ] && [ -t 1 ] && exec ${comm}\`（注意 PATH/nvm 等导出放在它之前）\n` +
-                `② 给这个 bot 配 \`launchShell: ${comm}\`（dashboard 机器人配置，或 \`/config launchShell ${comm}\`），直接用 \`${comm}\` 启动绕开 \`${expectedShell}\` 的 rc——但要确保 PATH/nvm 在 \`${comm}\` 的 rc 里。`;
+                `① 给那行加守卫，只在手动开终端时切：\`${guidance.manualTerminalGuard}\`（注意 PATH/nvm 等导出放在它之前）\n` +
+                `② 给这个 bot 配 \`launchShell: ${shellComm}\`（dashboard 机器人配置，或 \`/config launchShell ${shellComm}\`），直接用 \`${shellComm}\` 启动绕开 \`${expectedShell}\` 的 rc——但要确保 PATH/nvm 在 \`${shellComm}\` 的 rc 里。`;
     }
     else {
         message =
-            `⚠️ ${cli} 启动时间较长：pane 里暂时仍是 \`${comm}\`。我没有把消息写进 shell，消息还在队列里；检测到真实输入框后会自动继续投递，无需重发。\n\n` +
-                `仅凭进程仍是 \`${comm}\` 无法判断具体原因，可能只是 rc 文件或机器负载让启动变慢。若长时间没有恢复，请打开 Web 终端查看当前提示，处理后等待自动继续，或使用 \`/restart\` 重启会话。`;
+            `⚠️ ${cli} 启动时间较长：pane 里暂时仍是 \`${shellComm}\`。我没有把消息写进 shell，消息还在队列里；检测到真实输入框后会自动继续投递，无需重发。\n\n` +
+                `仅凭进程仍是 \`${shellComm}\` 无法判断具体原因，可能只是 rc 文件或机器负载让启动变慢。若长时间没有恢复，请打开 Web 终端查看当前提示，处理后等待自动继续，或使用 \`/restart\` 重启会话。`;
     }
     const pendingTurn = pendingMessages[0];
     send({
@@ -9985,8 +10033,48 @@ function startScreenUpdates() {
     // watermark — there we must capture every tick (see shouldCaptureScreen).
     let lastSnapshotPtyActivity = -1;
     screenUpdateTimer = setInterval(() => {
-        if (awaitingFirstPrompt)
+        if (awaitingFirstPrompt) {
+            // First-turn 「工作中」 publisher. The async sampler below is fully gated
+            // until the first turn ends (markPromptReady flips awaitingFirstPrompt) or
+            // the 15s soft timeout, so an argv-baked first prompt (Pi/Grok/…, delivered
+            // via the launch command — it never goes through flushPending) would emit
+            // NO screen_update for the whole turn: the daemon card sits at 'starting'
+            // and jumps straight to 「等待输入」 on the first idle, skipping 「工作中」.
+            //
+            // The status projection already reads 'working' during turn one (isPromptReady
+            // is still false — same rule that makes every post-submit turn working), so we
+            // simply PUBLISH that projection once instead of scraping the screen for a busy
+            // marker. This is the general "sent to the CLI ⇒ working" model: it fires for
+            // every argv-baked first prompt (spawnArgvNeedsWorkingSeed), not just CLIs that
+            // happen to render a detectable busyPattern.
+            //
+            // Gate on spawnArgvNeedsWorkingSeed so it stays a no-op for a NON-argv first
+            // turn (Claude/Codex/type-ahead): there the prompt is still queued and the CLI
+            // is genuinely booting — not working — until flushPending() submits it after
+            // the ready edge. Empty-prompt adopt sessions also don't arm the flag, so an
+            // attach never falsely claims working.
+            //
+            // Pure publisher: it only send()s a status and updates the local lastSentStatus
+            // dedup — it never touches isPromptReady, the idle detector, or the argv seed
+            // flags (spawnArgvInitialPromptBusy / -NeedsWorkingSeed), so the first-prompt
+            // evidence machinery and the end-of-turn seed are unchanged.
+            if (spawnArgvNeedsWorkingSeed && lastSentStatus !== 'working' && renderer) {
+                const projected = projectedRuntimeScreenStatus();
+                if (projected === 'working') {
+                    const { content } = renderer.snapshot();
+                    lastSentStatus = 'working';
+                    send({
+                        type: 'screen_update',
+                        content,
+                        status: 'working',
+                        turnId: currentBotmuxTurnId,
+                        dispatchAttempt: currentBotmuxDispatchAttempt,
+                    });
+                    log('Argv-baked first prompt in flight — publishing projected working before first prompt');
+                }
+            }
             return;
+        }
         void (async () => {
             const { snapshot, status } = await snapshotWithLatestRuntimeStatus(async () => {
                 let content = lastContent;
@@ -10708,6 +10796,8 @@ async function spawnCli(cfg, opts = {}) {
         // Feishu. Thread the flag so the reconstructed config keeps the boundary.
         if (cfg.apiOnly)
             sessionEnv.BOTMUX_API_ONLY = '1';
+        if (cfg.feedback)
+            sessionEnv.BOTMUX_FEEDBACK_POLICY = JSON.stringify(cfg.feedback);
         // Session scope for `botmux send` inside the sandbox. Thread sessions
         // anchor on a real om_ message (reply_in_thread); chat-scope sessions use
         // the chat id as anchor (sessionAnchorId), which is NOT a message id —
@@ -10744,6 +10834,12 @@ async function spawnCli(cfg, opts = {}) {
         // Per-bot env (bots.json `env`) takes precedence over session context;
         // explicit riff config.env takes precedence over both.
         const mergedEnv = { ...sessionEnv, ...sanitizePerBotEnv(cfg.env), ...cfg.backendConfig.env };
+        // The effective policy is a host-resolved snapshot, not a user-overridable
+        // backend env knob. Re-freeze it after config.env/per-bot env merge.
+        if (cfg.feedback)
+            mergedEnv.BOTMUX_FEEDBACK_POLICY = JSON.stringify(cfg.feedback);
+        else
+            delete mergedEnv.BOTMUX_FEEDBACK_POLICY;
         // Re-freeze the no-transport capability keys AFTER the merge: a stale or
         // attacker-shaped backendConfig.env / per-bot env merges LAST and would
         // otherwise override the frozen values, restoring send capability for a
@@ -10896,6 +10992,19 @@ async function spawnCli(cfg, opts = {}) {
             resolvedBin: canonicalPolicyPath(cliAdapter.resolvedBin),
         })
         : undefined;
+    const managedOriginChannelRequired = willReadIsolate
+        || credentialOnlySeatbelt
+        || credentialOnlyBwrap;
+    const managedOriginChannelPolicyDigest = (willReadIsolate || willWriteSandbox)
+        ? darwinIsolationPolicyDigest
+        : managedOriginChannelRequired
+            ? createHash('sha256').update(JSON.stringify({
+                domain: 'botmux.credential-origin-channel.v1',
+                platform: process.platform,
+                configuredBotmuxHome: canonicalPolicyPath(configuredBotmuxHome),
+                defaultBotmuxHome: canonicalPolicyPath(defaultBotmuxHome),
+            })).digest('hex')
+            : undefined;
     let mcpRuntimeManifest = readSessionMcpRuntimeManifest(cfg.sessionId, config.session.dataDir);
     const hasMcpRuntimeEntries = !!cliAdapter.mcpGateway && !!mcpRuntimeManifest?.entries.length;
     const reuseRecordedHerdrTarget = !sandboxRequested && !hasMcpRuntimeEntries;
@@ -11052,8 +11161,7 @@ async function spawnCli(cfg, opts = {}) {
         if (paneLive) {
             const markerPath = join(isolationRuntimeDataDir, 'read-isolation', `${cfg.sessionId}.boot`);
             const marker = readManagedOriginAuthorityFile(markerPath);
-            const darwinPolicyExpected = process.platform === 'darwin'
-                && (willReadIsolate || willWriteSandbox);
+            const originChannelPolicyExpected = !!managedOriginChannelPolicyDigest;
             // A stamped pane must match even when the new policy is OFF. Otherwise a
             // disable followed by restart could reattach the still-confined process
             // without rebuilding its authority/profile. An unsafe planted marker
@@ -11062,16 +11170,16 @@ async function spawnCli(cfg, opts = {}) {
                 ? isolatedPaneReattachSafe(marker, {
                     requiredCapabilities: appliedIsolationCapabilities,
                     exactCapabilities: true,
-                    ...(darwinPolicyExpected ? {
+                    ...(originChannelPolicyExpected ? {
                         readIsolation: willReadIsolate,
                         writeSandbox: willWriteSandbox,
                         requireOriginChannel: true,
-                        policyDigest: darwinIsolationPolicyDigest,
+                        policyDigest: managedOriginChannelPolicyDigest,
                     } : {}),
                 })
                 : marker === null && !hostEntryExistsNoFollow(markerPath);
             if (policyMatches) {
-                if (darwinPolicyExpected) {
+                if (originChannelPolicyExpected) {
                     persistentPaneOriginChannelId = isolatedPaneOriginChannel(marker);
                 }
                 // Pane was spawned under the current isolation policy → still confined
@@ -11132,7 +11240,7 @@ async function spawnCli(cfg, opts = {}) {
             }
         }
     }
-    readIsolationOriginChannelId = willReadIsolate
+    readIsolationOriginChannelId = managedOriginChannelRequired
         ? (persistentPaneOriginChannelId ?? randomBytes(32).toString('hex'))
         : null;
     if (readIsolationOriginChannelId) {
@@ -11479,7 +11587,7 @@ async function spawnCli(cfg, opts = {}) {
         try {
             const credPath = sendCredFilePath(process.env.SESSION_DATA_DIR, cfg.larkAppId);
             mkdirSync(dirname(credPath), { recursive: true });
-            writeFileSync(credPath, JSON.stringify({ larkAppId: cfg.larkAppId, larkAppSecret: cfg.larkAppSecret, brand: cfg.brand, apiOnly: cfg.apiOnly }), { mode: 0o600 });
+            writeFileSync(credPath, JSON.stringify({ larkAppId: cfg.larkAppId, larkAppSecret: cfg.larkAppSecret, brand: cfg.brand, apiOnly: cfg.apiOnly, feedback: cfg.feedback }), { mode: 0o600 });
         }
         catch (e) {
             log(`[sandbox] WARN could not write send-cred file: ${e.message}`);
@@ -11772,8 +11880,19 @@ async function spawnCli(cfg, opts = {}) {
             throw new Error('[read-isolation] origin channel is unavailable');
         }
         childEnv.BOTMUX_READ_ISOLATED = '1';
+    }
+    if (readIsolationOriginChannelId) {
         childEnv.BOTMUX_ORIGIN_CHANNEL_ID = readIsolationOriginChannelId;
     }
+    // Credential-only children have no writable relay outbox. Publish the same
+    // rotating managed-origin claim through a host-owned per-channel directory
+    // before the Seatbelt/bwrap wrapper is compiled, then expose only that
+    // directory read-only below.
+    if (readIsolationOriginChannelId && !sandboxRequested) {
+        readIsolationOriginCapabilityFile = managedOriginCapabilityPath(isolationRuntimeDataDir, cfg.sessionId, readIsolationOriginChannelId);
+        ensureManagedOriginCapabilityLeafSafe(readIsolationOriginCapabilityFile);
+        publishSandboxRelayCapability({ failClosed: true });
+    }
     // Per-bot env (bots.json `env`): extra vars for THIS bot's CLI only — e.g.
     // ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN to run a bot on GLM/a 3rd-party
     // provider, an HTTPS_PROXY, or a CLI feature flag. Passed as injectEnv (NOT
@@ -11948,6 +12067,11 @@ async function spawnCli(cfg, opts = {}) {
                 writeFileSync(tsFile, '');
         }
         catch { /* */ }
+        // UserPromptSubmit sidecar 目录（#794）：daemon 逐 turn 写入，沙盒内 hook 只读。
+        try {
+            mkdirSync(join(dataDir, 'prompt-ctx', cfg.sessionId), { recursive: true, mode: 0o700 });
+        }
+        catch { /* */ }
         try {
             mkdirSync(join(dataDir, 'attachments', cfg.larkAppId), { recursive: true });
         }
@@ -12002,7 +12126,7 @@ async function spawnCli(cfg, opts = {}) {
         if (readIsolationOriginCapabilityFile) {
             ensureManagedOriginCapabilityLeafSafe(readIsolationOriginCapabilityFile);
             publishSandboxRelayCapability({ failClosed: true });
-            mandatoryReadOnlyPaths.push(readIsolationOriginCapabilityFile);
+            mandatoryReadOnlyPaths.push(managedOriginCapabilityDirectory(dataDir, cfg.sessionId, readIsolationOriginChannelId));
             mandatoryReadOnlyPaths.push(managedOriginAttestationDirectory(dataDir, cfg.sessionId, readIsolationOriginChannelId));
             mandatoryReadOnlyPaths.push(managedOriginRootLocatorPath(userInfo().homedir, cfg.sessionId));
         }
@@ -12288,12 +12412,12 @@ async function spawnCli(cfg, opts = {}) {
         try {
             const markerDir = join(isolationRuntimeDataDir, 'read-isolation');
             mkdirSync(markerDir, { recursive: true });
-            replaceManagedOriginCapabilityFile(join(markerDir, `${cfg.sessionId}.boot`), isolationPaneMarkerContent(cfg.daemonBootId ?? '', appliedIsolationCapabilities, willReadIsolate || willWriteSandbox
+            replaceManagedOriginCapabilityFile(join(markerDir, `${cfg.sessionId}.boot`), isolationPaneMarkerContent(cfg.daemonBootId ?? '', appliedIsolationCapabilities, managedOriginChannelPolicyDigest
                 ? {
                     originChannelId: persistentPaneOriginChannelId,
                     readIsolation: willReadIsolate,
                     writeSandbox: willWriteSandbox,
-                    policyDigest: darwinIsolationPolicyDigest,
+                    policyDigest: managedOriginChannelPolicyDigest,
                 }
                 : undefined));
         }
@@ -12337,11 +12461,13 @@ async function spawnCli(cfg, opts = {}) {
                 // the input box). cjadk's own botmux integration (`cjadk feishu`, see its
                 // botmux-wrapper-writer) sets CJADK_INTERACTIVE=0 to disable all of that.
                 // We mirror it here so a `cjadk <agent>` wrapperCli is driven the way
-                // cjadk intends — no selector, clean soft-newline input. Keyed on the
-                // wrapper's leading token so only cjadk launches are affected.
-                if (parseWrapperCli(cfg.wrapperCli)[0] === 'cjadk') {
-                    childEnv.CJADK_INTERACTIVE = '0';
-                    log('cjadk launcher: set CJADK_INTERACTIVE=0 (non-interactive, mirrors cjadk feishu wrapper)');
+                // cjadk intends — no selector, clean soft-newline input. The env set
+                // comes from wrapperLaunchEnv — the shared single source of truth also
+                // used by one-shot children (session-group AI titling).
+                const wrapperEnv = wrapperLaunchEnv(cfg.wrapperCli);
+                if (wrapperEnv) {
+                    Object.assign(childEnv, wrapperEnv);
+                    log(`wrapper launcher env applied: ${Object.keys(wrapperEnv).join(', ')} (mirrors the wrapper's own non-interactive integration)`);
                 }
             }
         }
@@ -12379,8 +12505,9 @@ async function spawnCli(cfg, opts = {}) {
         });
         const profileDir = join(isolationRuntimeDataDir, 'read-isolation');
         mkdirSync(profileDir, { recursive: true });
+        const originDirectory = managedOriginCapabilityDirectory(isolationRuntimeDataDir, cfg.sessionId, readIsolationOriginChannelId);
         const profilePath = join(profileDir, `${cfg.sessionId}.sb`);
-        replaceManagedOriginCapabilityFile(profilePath, buildSeatbeltProfile(rules.denyPaths.map(canonical), [], [], [], rules.denyRegexes, undefined, {
+        replaceManagedOriginCapabilityFile(profilePath, buildSeatbeltProfile([...rules.denyPaths.map(canonical), canonical(profileDir)], [canonical(originDirectory)], [], [canonical(profileDir)], rules.denyRegexes, undefined, {
             denyWritePaths: [...new Set([
                     ...rules.denyWritePaths.map(canonical),
                     canonical(profileDir),
@@ -12482,7 +12609,10 @@ async function spawnCli(cfg, opts = {}) {
         const credentialSandbox = prepareCredentialOnlySandbox({
             hideDirectories: [...hideDirectories],
             hideFiles: [...hideFiles],
-            readonlyPaths: [realpathSync(panePolicyDir)],
+            privateReadonlyDirectories: [{
+                    parent: realpathSync(panePolicyDir),
+                    directory: realpathSync(managedOriginCapabilityDirectory(isolationRuntimeDataDir, cfg.sessionId, readIsolationOriginChannelId)),
+                }],
             workingDir: spawnCwd,
             cliBin: credentialCliBin,
             cliArgs: spawnArgs,
@@ -13590,6 +13720,7 @@ function startWebServer(host, preferredPort) {
             // normal buffer until resize causes a redraw. Preserve that mode so
             // scroll gestures continue to target the CLI's own transcript.
             const forceRemoteScroll = effectiveBackendType === 'herdr' && cliAdapter?.altScreen === true;
+            const allowReadOnlyRemoteScroll = canHandleReadOnlyRemoteScroll();
             // The wheel burst cap throttles backends where a forwarded wheel is
             // EXPENSIVE or has no local terminal to drive:
             //   • Herdr — each forwarded wheel → pane send-text + snapshot re-render.
@@ -13607,7 +13738,7 @@ function startWebServer(host, preferredPort) {
                 || effectiveBackendType === 'tmux'
                 || effectiveBackendType === 'zellij';
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(getTerminalHtml(hasWrite, platformReadonly, loginUrl, forceRemoteScroll, localTerminalBackend));
+            res.end(getTerminalHtml(hasWrite, platformReadonly, loginUrl, forceRemoteScroll, localTerminalBackend, allowReadOnlyRemoteScroll));
         });
         wss = new WebSocketServer({
             server: httpServer,
@@ -13639,6 +13770,7 @@ function startWebServer(host, preferredPort) {
                 return;
             }
             const { hasWrite } = resolveTerminalAccessForReq(req, url);
+            const allowReadOnlyRemoteScroll = canHandleReadOnlyRemoteScroll();
             if (hasWrite)
                 authedClients.add(ws);
             log(`WS client connected (total: ${wsClients.size}, write: ${hasWrite})`);
@@ -13890,6 +14022,18 @@ function startWebServer(host, preferredPort) {
                             }
                             backend?.write(msg.data);
                         }
+                        else if (msg.type === 'scroll' && typeof msg.data === 'string') {
+                            if (!allowReadOnlyRemoteScroll || authedClients.has(ws))
+                                return;
+                            const parsed = parseReadOnlyRemoteScrollPayload(msg.data);
+                            if (!parsed)
+                                return;
+                            if (!readOnlyRemoteScrollLimiter.tryConsume(parsed.eventCount))
+                                return;
+                            if (usesHerdrSnapshotWebHistory())
+                                herdrWebScrollDirection = parsed.direction;
+                            backend?.write(msg.data);
+                        }
                     }
                     catch { /* ignore non-JSON or bad messages */ }
                 });
@@ -13912,7 +14056,7 @@ function startWebServer(host, preferredPort) {
             .then(resolve, reject);
     });
 }
-function getTerminalHtml(hasWrite, platformReadonly = false, loginUrl = '', forceRemoteScroll = false, localTerminalBackend = false) {
+function getTerminalHtml(hasWrite, platformReadonly = false, loginUrl = '', forceRemoteScroll = false, localTerminalBackend = false, allowReadOnlyRemoteScroll = false) {
     const label = sessionId.substring(0, 8);
     return `<!DOCTYPE html>
 <html>
@@ -14050,6 +14194,7 @@ var hasToken=${hasWrite};
 var platformReadonly=${platformReadonly};
 var remoteScroll=${forceRemoteScroll};
 var localTerminalBackend=${localTerminalBackend};
+var readOnlyRemoteScroll=${allowReadOnlyRemoteScroll};
 if(!hasToken){
   if(platformReadonly){var _lb=document.getElementById('login-banner');_lb.classList.add('show');}
   else{var _rb=document.getElementById('readonly-banner');_rb.classList.add('show');_rb.addEventListener('click',function(){_rb.classList.remove('show')});}
@@ -14346,8 +14491,9 @@ window.addEventListener('resize',onViewportResize);
 // Alt-screen + mouse-mode CLIs (e.g. Claude Code) keep NO scrollback in xterm OR
 // tmux — their whole transcript is redrawn by the app inside the fixed alt-screen
 // grid, so term.scrollLines() reveals nothing. In the alternate buffer we forward
-// scrolling as SGR mouse-wheel events so the CLI scrolls its own transcript and
-// repaints. This is write-capability only; view links stay locally scrollable.
+// scrolling as SGR mouse-wheel events so the CLI scrolls its own transcript.
+// Read-only viewers get this remote path only for adapters that explicitly opt
+// in; the server then accepts only validated wheel events, never general input.
 // Normal-buffer CLIs keep xterm's native scrollback scroll. Capture-phase +
 // stopPropagation pre-empts xterm's own handler. Skipped for pure tmux/zellij
 // ATTACH (gate), where the attach client owns scrolling via copy-mode.
@@ -14407,7 +14553,7 @@ function _cellAt(clientX,clientY){
   return col+';'+row;
 }
 function _fwdScroll(px,coord){
-  if(!hasToken||!ws_||ws_.readyState!==1||!px)return;
+  if((!hasToken&&!readOnlyRemoteScroll)||!ws_||ws_.readyState!==1||!px)return;
   coord=coord||(((term.cols>>1)+1)+';'+((term.rows>>1)+1)); // never (1,1)
   var dir=px<0?-1:1;
   if(_scrollBurstDir&&dir!==_scrollBurstDir){_scrollAccum=0;_scrollBurstTicks=0;}
@@ -14421,7 +14567,7 @@ function _fwdScroll(px,coord){
     _scrollAccum+=up?_SCROLL_STEP:-_SCROLL_STEP;n++;_scrollBurstTicks++;
   }
   if(_scrollBurstTicks>=_SCROLL_BURST_MAX)_scrollAccum=0;
-  if(data)ws_.send(JSON.stringify({type:'input',data:data}));
+  if(data)ws_.send(JSON.stringify({type:hasToken?'input':'scroll',data:data}));
 }
 if(!${isTmuxMode && !isPipeMode}){
   document.getElementById('terminal').addEventListener('wheel',function(e){
@@ -14434,7 +14580,9 @@ if(!${isTmuxMode && !isPipeMode}){
       return;
     }
     if(!hasToken){
-      e.preventDefault();e.stopPropagation();term.scrollLines(e.deltaY>0?3:-3);return;
+      e.preventDefault();e.stopPropagation();
+      if(readOnlyRemoteScroll)_fwdScroll(px,_cellAt(e.clientX,e.clientY));
+      else term.scrollLines(e.deltaY>0?3:-3);return;
     }
     e.preventDefault();e.stopPropagation();
     _fwdScroll(px,_cellAt(e.clientX,e.clientY)); // report the cell under the pointer
@@ -14755,8 +14903,7 @@ if(!${isTmuxMode && !isPipeMode}){
     if(e.touches.length===1)_tLastY=e.touches[0].clientY;
   },{capture:true,passive:true});
   _tTerm.addEventListener('touchmove',function(e){
-    // View links never forward input; let xterm/browser handle local scrolling.
-    if(!hasToken||_tLastY===null||e.touches.length!==1)return;
+    if((!hasToken&&!readOnlyRemoteScroll)||_tLastY===null||e.touches.length!==1)return;
     e.preventDefault();e.stopPropagation();
     var y=e.touches[0].clientY;
     var px=_tLastY-y;
@@ -15934,7 +16081,17 @@ process.on('message', async (raw) => {
                 break;
             }
             closeRequested = true;
-            send({ type: 'session_close_ready', sessionId });
+            // This ACK is what resolves the daemon's close fence (worker-pool
+            // resolveCloseFence) so `/close` can return. It MUST be flushed: a plain
+            // send() only queues on process.send's async IPC buffer, and the fully
+            // synchronous teardown + process.exit(0) below never yield the event loop
+            // to drain it. Worse, process.exit(0) can wedge in node-pty's native
+            // reader-thread join whenever a web-terminal client PTY was attached — so
+            // the queued ACK would be lost entirely and the fence would only resolve
+            // on the daemon's 7s SIGKILL backstop (the ~7s dashboard/card close stall).
+            // closeRequested already fences bridge-marker reads, so ACKing before
+            // teardown stays safe; sendAndFlush yields so the ACK truly departs.
+            await sendAndFlush({ type: 'session_close_ready', sessionId });
             stopScreenshotLoop();
             stopBridgeWatcher();
             stopCodexBridge();
@@ -16115,7 +16272,11 @@ process.on('message', async (raw) => {
             lastAbortedCloseRequestId = null;
             backend?.commitDestroySession?.();
             closeRequested = true;
-            send({ type: 'session_close_ready', sessionId });
+            // Flush the fence-resolving ACK before the synchronous teardown +
+            // process.exit(0); see the local-close case for the node-pty exit-wedge
+            // rationale (a queued send() would be dropped and strand `/close` behind
+            // the daemon's 7s SIGKILL backstop).
+            await sendAndFlush({ type: 'session_close_ready', sessionId });
             stopScreenshotLoop();
             stopBridgeWatcher();
             stopCodexBridge();