botmux 3.14.0 → 3.16.0

package/dist/core/dashboard-ipc-server.js

@@ -4,7 +4,8 @@ import { execFileSync } from 'node:child_process';
 import { readFileSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { logger } from '../utils/logger.js';
-import { cliAuthBind, verifyHmac } from '../dashboard/auth.js';
+import { cliAuthBind, loadDashboardSecret, verifyHmac } from '../dashboard/auth.js';
+import { UnsafeHostAuthorityFileError } from '../platform/secure-host-file.js';
 import { WORKFLOW_DAEMON_IPC_ROUTE_PREFIX } from '../workflows/v3/daemon-ipc-auth.js';
 import { V3_SESSION_RUN_MUTATION_ROUTE_PREFIX } from '../workflows/v3/session-relay.js';
 import { REPORT_SESSION_RELAY_ROUTE } from './report-session-relay.js';
@@ -14,7 +15,7 @@ import { dashboardSecretPath } from './dashboard-secret.js';
 import { MANAGED_ORIGIN_ATTEST_ROUTE, MANAGED_ORIGIN_PROOF_DOMAIN, MANAGED_ORIGIN_PROOF_TTL_MS, writeManagedOriginAttestationProof, } from './managed-origin-attestation.js';
 import * as sessionStore from '../services/session-store.js';
 import { cliSupportsNativeUsage } from '../services/transcript-resolver.js';
-import { codexModelSupportsReasoningEffort, isCodexReasoningCliId, isCodexReasoningEffort, } from '../services/codex-reasoning-effort.js';
+import { cliModelSupportsReasoningEffort, isConfigurableReasoningCliId, isCodexReasoningEffort, } from '../services/codex-reasoning-effort.js';
 import * as asyncTriggerStore from '../services/async-trigger-store.js';
 import { resolveAsyncTriggerState, decideAsyncOwnership } from '../services/async-trigger-state.js';
 import * as scheduleStore from '../services/schedule-store.js';
@@ -78,10 +79,10 @@ import { readGlobalConfig } from '../global-config.js';
 import { normalizeChatReplyMode, setChatReplyMode } from '../services/chat-reply-mode-store.js';
 import * as chatFirstSeenStore from '../services/chat-first-seen-store.js';
 import * as scheduler from './scheduler.js';
-import { listActiveSessions, findActiveBySessionId, closeSession, getActiveSessionsRegistry, transferSession, deliverWriteLinkCardToOwners, forkWorker, suspendWorker, killWorker, latestPerBotEnvForRestart, getDaemonReplyCardUsageSnapshot, sessionSupportsWebTerminal, sendWorkerSessionInput, isSessionTransferring } from './worker-pool.js';
+import { listActiveSessions, findActiveBySessionId, closeSession, getActiveSessionsRegistry, transferSession, deliverWriteLinkCardToOwners, forkWorker, suspendWorker, killWorker, latestPerBotEnvForRestart, latestModelForRespawn, getDaemonReplyCardUsageSnapshot, sessionSupportsWebTerminal, sendWorkerSessionInput, isSessionTransferring, mojoCloseResidualForRow } from './worker-pool.js';
 import { listOnlineDaemons } from '../utils/daemon-discovery.js';
 import { isSessionStopped } from './session-liveness.js';
-import { isSuspendableBackendType } from './persistent-backend.js';
+import { isRemoteBackendType, isRemoteCliId, isSuspendableBackendType } from './persistent-backend.js';
 import { getChatMode, replyMessage, sendMessage, resolveUnionIdFromOpenId, listThreadMessages, listChatMessages, listChatMessagesUntil, listChatBotMembers, getUserProfile, getUserProfileStrict, resolveAllowedUsersWithMap } from '../im/lark/client.js';
 import { parseApiMessage, cardContentHasUpgradeFallback, resolveMergedCardContent, messageMentionsBot } from '../im/lark/message-parser.js';
 import { resumeSession, spawnDashboardSession, activateQueuedSession, closeCliMismatchedSessionsForBot } from './session-manager.js';
@@ -90,6 +91,9 @@ import { cleanupMaterializedDashboardImages, materializeDashboardImages } from '
 import { getCliDisplayName } from '../im/lark/card-builder.js';
 import { sessionConfiguredRuntimeDisplayName } from './cli-runtime-display.js';
 import { locateLimiter } from './dashboard-locate.js';
+import { DEFAULT_SESSION_OWNER_REMINDER } from './session-owner-reminder.js';
+import { updateSessionOwnerReminderConfig } from '../services/session-owner-reminder-config-store.js';
+import { sendSessionOwnerThreadNotification } from '../services/session-owner-notification.js';
 import { buildTerminalUrl } from './terminal-url.js';
 import { dashboardEventBus } from './dashboard-events.js';
 import { validateWorkingDir } from './working-dir.js';
@@ -101,7 +105,8 @@ import { resolveCliSelection, selectionKeyForBot } from '../setup/cli-selection.
 import { checkCliAvailability } from '../setup/cli-availability.js';
 import { enrichHistorySenders } from '../dashboard/history-senders.js';
 import { validateCodexAppManagedSendOrigin, } from '../utils/codex-app-dispatch-ledger.js';
-import { withBotTurnAdmission, withBotTurnMutation } from './bot-turn-mutation-gate.js';
+import { tryWithBotTurnMutation, withBotTurnAdmission, withBotTurnMutation } from './bot-turn-mutation-gate.js';
+import { SESSION_WAKE_DEADLINE_HEADER, sessionWakeAcquireTimeoutMs, } from './session-wake-deadline.js';
 import { protectedSessionMutationReasons, } from './session-mutation-guard.js';
 import { listPendingAsks, submitAskFromDesktop } from './ask-broker.js';
 import { getMessageListenerConfig, sanitizeMessageListenerUpdate, updateMessageListenerConfig, validateMessageListenerUpdate } from '../services/message-listener-store.js';
@@ -128,7 +133,7 @@ export function setSupervisorShutdownHandler(registration) {
     supervisorShutdownRegistration = registration;
 }
 import { composeRowFromActive, composeRowFromClosed, composeRowFromPersistedActive, feishuChatLink, setBotName as setRowsBotName, getBotName, } from './dashboard-rows.js';
-import { getBotBrand, getBot, getBotOpenId, loadBotConfigs, readBotSkillPolicy, getBotTuiSlashAllow } from '../bot-registry.js';
+import { getBotBrand, getBot, getBotOpenId, loadBotConfigs, readBotSkillPolicy, getBotTuiSlashAllow, MAX_TURN_TIMEOUT_MS } from '../bot-registry.js';
 import { generateAuthUrl, tryHandleCallbackUrl, getFeedGroupAuthStatus, FEED_GROUP_OAUTH_SCOPES } from '../utils/user-token.js';
 import { normalizeBrand } from '../im/lark/lark-hosts.js';
 import { normalizeKanbanColumn, normalizeKanbanPosition, normalizeSessionTitle } from './session-board.js';
@@ -138,9 +143,11 @@ import { repinSessionWorkingDir } from './session-cwd.js';
 import { authorizeSessionScopedIpc } from './daemon-ipc-session-auth.js';
 import { normalizeSessionTitleSource, updateSessionTitle } from './session-title.js';
 import { requestAgentSessionRename } from './session-rename.js';
+import { isPreviewLoopbackHost, isPreviewPort, previewBackendSupported, probeSessionPreviewTarget, sessionPreviewDescriptor, } from './session-preview.js';
+import { clearSessionPreviewTarget } from './session-preview-registry.js';
 import { ChatRenameCooldown, ChatRenameSerialQueue, normalizeLarkChatName } from './chat-rename.js';
 import { sessionAnchorId, larkTransportEnabled } from './types.js';
-import { isRiffBackendSession } from './persistent-backend.js';
+import { isRemoteBackendSession } from './persistent-backend.js';
 import { attachSkillPolicy, detachSkillPolicy } from './skills/im-command.js';
 import { readSkillRegistry } from '../services/skill-registry-store.js';
 import { isSessionGroup } from '../services/session-groups-store.js';
@@ -459,13 +466,40 @@ function closeUntrustedRequestAfterResponse(req, res) {
 let injectedIpcSecret = null;
 /** Test seam: override the secret used to verify token-route HMAC. */
 export function setIpcAuthSecret(secret) { injectedIpcSecret = secret; }
+let loggedUnsafeIpcSecretAt = 0;
+/**
+ * Load the machine-local dashboard secret used to verify token-route HMAC.
+ *
+ * Goes through {@link loadDashboardSecret} — the same strict host-authority
+ * reader the dashboard and daemon startup use — instead of a bare
+ * `readFileSync`: the leaf must be a regular 0600 file owned by the current
+ * user and must NOT be a symlink, and `~/.botmux` must not be
+ * group/other-writable. This is a per-request verifier on ~96 daemon IPC routes,
+ * so an attacker who can plant a symlink or loose-perms `.dashboard-secret` after
+ * boot must not have that content trusted as the HMAC key here (the dashboard
+ * caches its secret once at startup; this path re-reads every request, so it is
+ * the more exposed reader).
+ *
+ * Fail-closed either way: an unsafe shape returns `null` (→ nobody can sign →
+ * 401) rather than being followed. We log it — throttled, since this runs per
+ * request — so a planted/misconfigured credential is diagnosable instead of
+ * looking identical to "no secret on disk".
+ */
 function ipcAuthSecret() {
     if (injectedIpcSecret)
         return injectedIpcSecret;
     try {
-        return readFileSync(dashboardSecretPath(), 'utf8').trim() || null;
+        return loadDashboardSecret(dashboardSecretPath());
     }
-    catch {
+    catch (err) {
+        if (err instanceof UnsafeHostAuthorityFileError) {
+            const now = Date.now();
+            if (now - loggedUnsafeIpcSecretAt > 60_000) {
+                loggedUnsafeIpcSecretAt = now;
+                logger.error(`[dashboard-ipc] 拒绝使用不安全的 .dashboard-secret：${err.message}（IPC 鉴权 fail-closed）`);
+            }
+            return null;
+        }
         return null;
     }
 }
@@ -536,7 +570,7 @@ function routeHasNarrowUntrustedAuth(method, pathname) {
     // 该会话的 rotating per-turn
     // capability 并绑定到 URL 里的 sessionId（同 /api/asks 姿势）——capability 只
     // 证明「我是这个会话当前这一轮的 CLI」，选不了别的会话。
-    if (method === 'POST' && /^\/api\/sessions\/[^/]+\/(?:slash|cd|close|chat-rename)$/.test(pathname))
+    if (method === 'POST' && /^\/api\/sessions\/[^/]+\/(?:slash|cd|close|preview|chat-rename)$/.test(pathname))
         return true;
     // UserPromptSubmit hook 的 envelope claim：沙箱内 hook 读不到 host secret，
     // 走 body 里的 per-turn capability；handler 内 sessionCliIpcAuth 绑定到 URL 的
@@ -903,7 +937,14 @@ ipcRoute('POST', '/api/sessions/:sessionId/close', async (req, res, params) => {
         // never clear a stale pre-drain snapshot while a turn is still preparing.
         const current = findSessionRecord(params.sessionId);
         if (current && current.status === 'closed') {
-            return jsonRes(res, 200, { ok: true, alreadyClosed: true });
+            // A closed row can still carry an UNCANCELLED remote session (a quarantined
+            // lineage is parked, not cancelled). Short-circuiting to a bare success here
+            // meant a retry — or any client that lost the first response — could never
+            // learn about it, so replay the same outcome the close itself would report.
+            const residual = mojoCloseResidualForRow(current);
+            return jsonRes(res, 200, residual
+                ? { ok: true, outcome: 'closed_with_residual', residual, alreadyClosed: true }
+                : { ok: true, outcome: 'closed', alreadyClosed: true });
         }
         const r = await closeSession(params.sessionId);
         jsonRes(res, r.ok ? 200 : 502, r);
@@ -1017,14 +1058,16 @@ ipcRoute('POST', '/api/sessions/:sessionId/restart', async (_req, res, params) =
         if (ds.adoptedFrom || ds.initConfig?.adoptMode) {
             return jsonRes(res, 409, { ok: false, error: 'adopt_restart_unsupported' });
         }
-        // Riff owns a remote task lineage. Its worker deliberately refuses restart
-        // because destroy + respawn would sever or replace that lineage. Reject at
-        // the daemon boundary so the dashboard never reports HTTP 200 for a no-op.
-        if (isRiffBackendSession(ds)) {
+        // Every REMOTE backend owns a remote lineage that destroy + respawn would
+        // sever or replace (for mojo the worker restart actively cancels the remote
+        // session and cold-boots a context-less replacement). Reject at the daemon
+        // boundary so the dashboard never reports HTTP 200 for a lineage-destroying
+        // restart.
+        if (isRemoteBackendSession(ds)) {
             return jsonRes(res, 409, {
                 ok: false,
-                error: 'riff_restart_unsupported',
-                message: t('cmd.restart.riff_unsupported', undefined, localeForBot(ds.larkAppId)),
+                error: 'remote_restart_unsupported',
+                message: t('cmd.restart.remote_unsupported', undefined, localeForBot(ds.larkAppId)),
             });
         }
         if (rejectProtectedSessionMutation(res, [ds]))
@@ -1035,7 +1078,7 @@ ipcRoute('POST', '/api/sessions/:sessionId/restart', async (_req, res, params) =
             // 捎带最新 per-bot env：dashboard 改完 env 后重启才真正生效（与 /restart 同逻辑）。
             try {
                 ds.workerReady = false;
-                ds.worker.send({ type: 'restart', reason: 'operator', env: latestPerBotEnvForRestart(ds) });
+                ds.worker.send({ type: 'restart', reason: 'operator', env: latestPerBotEnvForRestart(ds), model: latestModelForRespawn(ds) });
             }
             catch (err) {
                 return jsonRes(res, 502, { ok: false, error: String(err) });
@@ -1053,6 +1096,57 @@ ipcRoute('POST', '/api/sessions/:sessionId/restart', async (_req, res, params) =
         jsonRes(res, 200, { ok: true, sessionId: params.sessionId, cliId, revived: true });
     });
 });
+/** Materialize a dormant active session for a local `botmux list` attach.
+ * Unlike restart, this is idempotent when a live worker already exists: a Lark
+ * message may race the local picker, and that race must never restart an active
+ * turn. Empty input re-attaches/cold-resumes without creating a model turn. */
+ipcRoute('POST', '/api/sessions/:sessionId/wake', async (req, res, params) => {
+    const initial = findActiveBySessionId(params.sessionId);
+    if (!initial)
+        return jsonRes(res, 404, { ok: false, error: 'session_not_active' });
+    const acquireTimeoutMs = sessionWakeAcquireTimeoutMs(req.headers[SESSION_WAKE_DEADLINE_HEADER]);
+    const mutation = await tryWithBotTurnMutation(initial.larkAppId, acquireTimeoutMs, () => {
+        // A picker that exits aborts its fetch. If the request was queued behind an
+        // admitted turn, never materialize the session after that caller is gone.
+        if (req.aborted || res.destroyed)
+            return;
+        const ds = findActiveBySessionId(params.sessionId);
+        if (!ds)
+            return jsonRes(res, 404, { ok: false, error: 'session_not_active' });
+        if (isSessionTransferring(ds)) {
+            return jsonRes(res, 409, { ok: false, error: 'session_transferring' });
+        }
+        if (ds.adoptedFrom || ds.initConfig?.adoptMode) {
+            return jsonRes(res, 409, { ok: false, error: 'adopt_wake_unsupported' });
+        }
+        // Every REMOTE backend (riff / mojo) owns a remote lineage that a local
+        // forkWorker cold-boot would sever or replace — the same reason /restart
+        // rejects them. A dormant remote session cold-resumes from its own lineage
+        // on the next message, never from a picker-driven local wake.
+        if (isRemoteBackendSession(ds)) {
+            return jsonRes(res, 409, { ok: false, error: 'remote_wake_unsupported' });
+        }
+        if (rejectProtectedSessionMutation(res, [ds]))
+            return;
+        const cliId = ds.session.cliId ?? 'unknown';
+        if (ds.worker && !ds.worker.killed) {
+            return jsonRes(res, 200, {
+                ok: true,
+                sessionId: params.sessionId,
+                cliId,
+                woke: false,
+                reason: 'already_running',
+            });
+        }
+        if (!forkWorker(ds, '', ds.hasHistory)) {
+            return jsonRes(res, 409, { ok: false, error: 'wake_refused' });
+        }
+        jsonRes(res, 200, { ok: true, sessionId: params.sessionId, cliId, woke: true });
+    });
+    if (!mutation.acquired && !res.destroyed) {
+        jsonRes(res, 409, { ok: false, error: 'wake_mutation_timeout' });
+    }
+});
 /** Manually suspend one active session: kill the worker + CLI/pane, session
  *  stays active and cold-resumes from its transcript on the next message —
  *  the same semantics the idle-worker sweeper applies over the live cap.
@@ -1223,6 +1317,164 @@ function sessionCliIpcAuth(req, ds, sessionId, body, opts = {}) {
     });
     return decision.ok ? { ok: true } : { ok: false, error: decision.error };
 }
+/**
+ * P1-12：会话血缘的根 pid——「谁有资格持有预览端口」的起点。
+ *
+ * worker fork 出来的进程树覆盖 pty 后端；tmux / zellij / herdr 这类后端的 CLI 是复用
+ * 器服务端的子进程、不在 worker 树下，所以 worker 通过私有 IPC 上报的 cliPid（以及
+ * adopt 会话接管的那个 CLI pid）必须单独作根，否则这些后端会被误判成「来路不明」。
+ */
+function previewOwnerPids(ds) {
+    return [
+        ds.worker?.pid,
+        ds.localProcessAttestation?.cliPid,
+        ds.session.pid,
+        ds.adoptedFrom?.originalCliPid,
+    ];
+}
+/** 当前权威代次。CAS 与 target 落盘都以它为准。 */
+function previewWorkerGeneration(ds) {
+    return ds.workerGeneration ?? ds.session.workerGeneration ?? 0;
+}
+/** Register one reachable loopback Web service for the exact calling session.
+ * This is the only route that can create preview routing state. An isolated CLI
+ * enters through the narrow capability aperture; a trusted host call is still
+ * path/port-bound by the outer daemon HMAC. The requested host is never DNS —
+ * only literal IPv4/IPv6 loopback is accepted, and the daemon connects before
+ * persisting the target. */
+ipcRoute('POST', '/api/sessions/:sessionId/preview', async (req, res, params) => {
+    let body;
+    try {
+        body = await readJsonBody(req, 4_096);
+    }
+    catch (error) {
+        return jsonRes(res, error instanceof JsonBodyTooLargeError ? 413 : 400, { ok: false, error: error instanceof JsonBodyTooLargeError ? 'body_too_large' : 'bad_json' });
+    }
+    const ds = findActiveBySessionId(params.sessionId);
+    const auth = sessionCliIpcAuth(req, ds, params.sessionId, body);
+    if (!auth.ok)
+        return jsonRes(res, 403, { ok: false, error: auth.error });
+    if (!ds)
+        return jsonRes(res, 404, { ok: false, error: 'session_not_active' });
+    // Riff 矩阵：远端 sandbox 的 Web 服务跑在远程主机上，daemon 这侧的 loopback 上
+    // 永远不会有它的监听。明确回 `preview_unsupported`，不要让它落进
+    // `preview_unreachable` 冒充「偶发故障」让 agent 反复重试。
+    if (!previewBackendSupported(ds.initConfig?.backendType ?? ds.session.backendType)) {
+        return jsonRes(res, 501, { ok: false, error: 'preview_unsupported' });
+    }
+    if (!isPreviewPort(body.port)) {
+        return jsonRes(res, 400, { ok: false, error: 'invalid_port' });
+    }
+    if (body.host !== undefined && !isPreviewLoopbackHost(body.host)) {
+        return jsonRes(res, 403, { ok: false, error: 'remote_host_forbidden' });
+    }
+    // P1-13：probe 是一次 await。鉴权发生在 await **之前**，而 await 期间这个会话可能
+    // 已经被 close、被 refork、切了 CLI——那些路径都会推进代次并清掉 previewTarget。
+    // 捕获本次请求看到的对象与代次，回填前做 CAS 复核，不一致就整条丢弃：否则一个属于
+    // 上一代 CLI 的注册会被写进新一代（甚至已关闭）的会话里。
+    const generationAtEntry = previewWorkerGeneration(ds);
+    const workerAtEntry = ds.worker;
+    // P1-3：previewTarget 自己也得进 CAS 锚点。上面那四件只覆盖「跨代次/跨生命周期」，
+    // **同代次内的并发注册**不在它们的射程里：这条路由没有 per-session 串行化，agent
+    // 完全可以 `botmux preview 3000 & botmux preview 4000 &`，或者在 stale 清理在途时
+    // 重注册。而谁先落地由 probe 耗时决定，不是由请求先后决定——单 host 超时 750ms，
+    // 不带 host 时 127.0.0.1 与 ::1 串行试，「A 慢一秒、B 快一毫秒」是常规而非极端。
+    // 没有这一条，后 settle 的旧请求会无条件盖掉先落地的新值，两条 CLI 都打印
+    // 「✓ Web 预览已注册」，实际生效的却是哪一个不确定。
+    const previewAtEntry = ds.session.previewTarget;
+    const probe = await probeSessionPreviewTarget({
+        port: body.port,
+        ...(isPreviewLoopbackHost(body.host) ? { host: body.host } : {}),
+        ownerPids: previewOwnerPids(ds),
+        workerGeneration: generationAtEntry,
+    });
+    if (!probe.ok) {
+        if (probe.error === 'invalid_port') {
+            return jsonRes(res, 400, { ok: false, error: 'invalid_port' });
+        }
+        if (probe.error === 'preview_owner_unverified') {
+            // fail closed：有人在监听，但证明不了是本会话的进程（血缘外、procfs 不可读、
+            // 非 Linux 平台）。宁可没有预览，也不给出一条指向不明进程的代理路由。
+            return jsonRes(res, 422, {
+                ok: false,
+                error: 'preview_owner_unverified',
+                ...(probe.reason ? { reason: probe.reason } : {}),
+            });
+        }
+        return jsonRes(res, 422, { ok: false, error: 'preview_unreachable' });
+    }
+    const target = probe.target;
+    const current = findActiveBySessionId(params.sessionId);
+    const recheck = sessionCliIpcAuth(req, current, params.sessionId, body);
+    if (current !== ds
+        || ds.session.status === 'closed'
+        || previewWorkerGeneration(ds) !== generationAtEntry
+        || ds.worker !== workerAtEntry
+        || !recheck.ok) {
+        return jsonRes(res, 409, { ok: false, error: 'preview_generation_changed' });
+    }
+    // 引用比较即「我 await 期间有没有别人写过这个字段」：注册整体替换对象，清理写
+    // undefined，两者都会改变引用。
+    if (ds.session.previewTarget !== previewAtEntry) {
+        return jsonRes(res, 409, { ok: false, error: 'preview_target_changed' });
+    }
+    const previous = ds.session.previewTarget;
+    ds.session.previewTarget = target;
+    try {
+        sessionStore.updateSession(ds.session);
+    }
+    catch {
+        ds.session.previewTarget = previous;
+        return jsonRes(res, 500, { ok: false, error: 'preview_persist_failed' });
+    }
+    dashboardEventBus.publish({
+        type: 'session.update',
+        body: { sessionId: params.sessionId, patch: { previewTarget: target } },
+    });
+    return jsonRes(res, 200, {
+        ok: true,
+        preview: sessionPreviewDescriptor(params.sessionId, target),
+    });
+});
+/**
+ * P1-12/P1-13：作废一个会话的预览目标。
+ *
+ * 由中央 Dashboard 在**代理落地前**发现归属已变（端口换了进程持有）时调用：代理侧
+ * 只有本机 procfs 的只读视角，改不了会话行，必须由持有会话的 daemon 来清字段 + 落盘
+ * + 广播 `preview: null`。仅 trusted host / HMAC 可用；幂等——本来就没有目标时回 200。
+ *
+ * P1-3：`?expectedRegisteredAt=` 指名要作废的是哪一次注册。判定失效发生在代理进程，
+ * 这条 DELETE 落地在 daemon 进程，中间隔着一次跨进程往返；那段窗口里会话完全可以合法
+ * 地重注册一个新目标，无条件清空会把它一起抹掉（fail-closed 方向没错，但 agent 刚拿到
+ * 的「✓ 已注册」会莫名其妙失效）。revision 不匹配时整条 no-op，回 `cleared: false`，
+ * 幂等语义不变。不带参数时保持原来的无条件语义。
+ */
+ipcRoute('DELETE', '/api/sessions/:sessionId/preview', (req, res, params) => {
+    if (!isTrustedHostIpcRequest(req) && !ipcHmacAuthorized(req)) {
+        return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
+    }
+    const ds = findActiveBySessionId(params.sessionId);
+    if (!ds)
+        return jsonRes(res, 404, { ok: false, error: 'session_not_active' });
+    const expectedRegisteredAt = new URL(req.url ?? '/', 'http://localhost')
+        .searchParams.get('expectedRegisteredAt') ?? undefined;
+    const cleared = clearSessionPreviewTarget(ds.session, 'listener ownership changed', expectedRegisteredAt);
+    return jsonRes(res, 200, { ok: true, cleared });
+});
+/** Host-only daemon read API. It intentionally returns the browser-safe
+ * descriptor, not the literal loopback host/port used inside daemon SSE. */
+ipcRoute('GET', '/api/sessions/:sessionId/preview', (req, res, params) => {
+    if (!isTrustedHostIpcRequest(req) && !ipcHmacAuthorized(req)) {
+        return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
+    }
+    const ds = findActiveBySessionId(params.sessionId);
+    if (!ds)
+        return jsonRes(res, 404, { ok: false, error: 'session_not_active' });
+    const preview = sessionPreviewDescriptor(params.sessionId, ds.session.previewTarget);
+    if (!preview)
+        return jsonRes(res, 404, { ok: false, error: 'preview_not_registered' });
+    return jsonRes(res, 200, { ok: true, preview });
+});
 /** 向本会话 CLI 注入一条 allowlist 内的原生斜杠命令（idle 后生效）。
  *  鉴权双路径（见 sessionCliIpcAuth）：trusted-host 签名或本会话 rotating
  *  capability；命令面由 allowlist（默认空=全拒）承担。 */
@@ -1240,6 +1492,17 @@ ipcRoute('POST', '/api/sessions/:sessionId/slash', async (req, res, params) => {
     if (ds.adoptedFrom || ds.initConfig?.adoptMode) {
         return jsonRes(res, 409, { ok: false, error: 'adopt_inject_unsupported' });
     }
+    // Remote backends (riff / mojo) have no TUI to inject a slash line into. For mojo
+    // the injection does not no-op either: MojoBackend.write() starts a REAL remote
+    // turn, and this IPC carries no credential snapshot (unlike message / raw_input),
+    // so an allowlisted slash sent after a JWT rotation or clear would run the turn
+    // on the worker's stale token. Refused rather than wired up: this is a TUI-only
+    // channel, and the same reasoning already hides the PTY quick-action keys for
+    // these backends.
+    const injectFrozenType = ds.initConfig?.backendType ?? ds.session.backendType;
+    if (injectFrozenType && isRemoteBackendType(injectFrozenType)) {
+        return jsonRes(res, 409, { ok: false, error: 'remote_backend_inject_unsupported' });
+    }
     if ((!ds.worker || ds.worker.killed) && !isSessionTransferring(ds)) {
         return jsonRes(res, 409, { ok: false, error: 'no_live_worker' });
     }
@@ -1363,14 +1626,17 @@ ipcRoute('POST', '/api/sessions/:sessionId/cd', async (req, res, params) => {
     if (ds.adoptedFrom || ds.initConfig?.adoptMode) {
         return jsonRes(res, 409, { ok: false, error: 'adopt_cd_unsupported' });
     }
-    // Riff restart/kill is intentionally refused to preserve remote task
-    // lineage. Reject before validation/repin so the persisted cwd cannot drift
-    // from the still-running sandbox.
-    if (isRiffBackendSession(ds)) {
+    // Remote retirement (Riff AND Mojo) is intentionally refused without
+    // prepare/commit, so a cold restart cannot follow a repin here. Reject
+    // before validation/repin so the persisted cwd cannot drift from the
+    // still-running remote lineage — mojo used to slip past the riff-only
+    // guard, repin, and then killWorker's refusal left the live worker on the
+    // old cwd while the route reported cold-restart (P1-a split brain).
+    if (isRemoteBackendSession(ds)) {
         return jsonRes(res, 409, {
             ok: false,
-            error: 'riff_cd_unsupported',
-            message: t('cmd.cd.riff_unsupported', undefined, localeForBot(ds.larkAppId)),
+            error: 'remote_cd_unsupported',
+            message: t('cmd.cd.remote_unsupported', undefined, localeForBot(ds.larkAppId)),
         });
     }
     // ownAppId 收窄到本 bot 自己的角色库子树：不收窄就能切进别的 bot 的角色目录，
@@ -1404,7 +1670,7 @@ ipcRoute('POST', '/api/sessions/:sessionId/cd', async (req, res, params) => {
         // 陈旧的 lastInitConfig.workingDir（daemon 侧 initConfig 已在上面同步）。
         try {
             ds.workerReady = false;
-            ds.worker.send({ type: 'restart', updateWorkingDir: v.resolvedPath, env: latestPerBotEnvForRestart(ds) });
+            ds.worker.send({ type: 'restart', updateWorkingDir: v.resolvedPath, env: latestPerBotEnvForRestart(ds), model: latestModelForRespawn(ds) });
         }
         catch {
             // send() 抛异常：worker 进程实际上已经不可达（管道已断），但 above 的
@@ -1549,7 +1815,15 @@ function buildAsyncTriggerLookupResponse(sessionId, triggerId) {
         sessionId,
         liveActive: !!ds,
         chatId: ds?.chatId ?? stored?.chatId,
-        memResult: memResult ? { status: memResult.status, content: memResult.content, completedAt: memResult.completedAt, usage: memResult.usage } : undefined,
+        memResult: memResult ? {
+            status: memResult.status,
+            content: memResult.content,
+            completedAt: memResult.completedAt,
+            failedAt: memResult.failedAt,
+            errorCode: memResult.errorCode,
+            terminalErrorCode: memResult.terminalErrorCode,
+            usage: memResult.usage,
+        } : undefined,
         memTriggerId: memResult ? memTriggerId : undefined,
         persisted,
         storedStatus: stored ? (stored.status === 'closed' ? 'closed' : 'open') : undefined,
@@ -2061,6 +2335,33 @@ ipcRoute('GET', '/api/sessions/:sessionId/write-link', (req, res, params) => {
         return jsonRes(res, 409, { ok: false, error: 'terminal_unavailable' });
     jsonRes(res, 200, { ok: true, url: buildTerminalUrl(ds, { write: true }) });
 });
+/**
+ * Read-only twin of write-link: the base capability URL the Feishu card's
+ * 「打开 Web 终端」button also hands out (viewToken, never the write token).
+ * The viewToken here is the worker's PER-BOOT card token — it dies with the
+ * worker generation and is deliberately not bound to any dashboard auth
+ * session. The central dashboard therefore REPLACES it with a short-lived
+ * signed read grant bound to the requesting identity before answering its own
+ * /api/sessions/:id/view-link (P1-5); this loopback-HMAC route never reaches a
+ * browser directly. That grant is also PINNED to the boot generation derived
+ * from this very token, so the value must be present and current — a live port
+ * left over from a previous boot (persisted `session.webPort` outliving the
+ * worker) is not enough. Same guard shape as write-link.
+ *
+ * Knowing any view capability never grants terminal input, so the link stays
+ * read-only by construction rather than by UI convention.
+ */
+ipcRoute('GET', '/api/sessions/:sessionId/view-link', (req, res, params) => {
+    if (!ipcHmacAuthorized(req))
+        return jsonRes(res, 401, { ok: false, error: 'unauthorized' });
+    const ds = findActiveBySessionId(params.sessionId);
+    if (!ds)
+        return jsonRes(res, 404, { ok: false, error: 'session_not_active' });
+    const port = ds.workerPort ?? ds.session.webPort;
+    if (!port || !ds.workerViewToken)
+        return jsonRes(res, 409, { ok: false, error: 'terminal_unavailable' });
+    jsonRes(res, 200, { ok: true, url: buildTerminalUrl(ds) });
+});
 /**
  * Dashboard「复现命令」：返回该 active session 本次冷启的**近似**可复现 CLI 调用
  * （bin + argv + cwd + 权威注入 env），供用户粘到调试终端改参数复现。命令原样保留
@@ -2352,7 +2653,11 @@ ipcRoute('POST', '/api/sessions/:sessionId/locate', async (_req, res, params) =>
         return jsonRes(res, 200, { ok: false, error: 'no_feishu_transport' });
     }
     try {
-        const messageId = await replyMessage(ctx.larkAppId, ctx.rootMessageId, `<at user_id="${ctx.ownerOpenId}"></at>`, 'text', true);
+        const messageId = await sendSessionOwnerThreadNotification({
+            larkAppId: ctx.larkAppId,
+            rootMessageId: ctx.rootMessageId,
+            ownerOpenId: ctx.ownerOpenId,
+        });
         jsonRes(res, 200, { ok: true, messageId });
     }
     catch (err) {
@@ -3489,6 +3794,9 @@ ipcRoute('GET', '/api/bot-default-oncall', async (_req, res) => {
     let wrapperCli = null;
     let model = null;
     let reasoningEffort = null;
+    // dsh runner turn timeout (ms). Only meaningful for the dsh adapter; exposed
+    // so the dashboard can render the dsh-only field with its current value.
+    let turnTimeoutMs = null;
     let agentSelectionKey = '';
     try {
         const cfg = getBot(cachedLarkAppId).config;
@@ -3504,14 +3812,21 @@ ipcRoute('GET', '/api/bot-default-oncall', async (_req, res) => {
         wrapperCli = typeof cfg.wrapperCli === 'string' && cfg.wrapperCli.trim() ? cfg.wrapperCli : null;
         model = typeof cfg.model === 'string' && cfg.model.trim() ? cfg.model : null;
         reasoningEffort = cfg.reasoningEffort ?? null;
+        turnTimeoutMs = typeof cfg.turnTimeoutMs === 'number'
+            && Number.isInteger(cfg.turnTimeoutMs) && cfg.turnTimeoutMs > 0
+            ? cfg.turnTimeoutMs
+            : null;
         agentSelectionKey = selectionKeyForBot(cliId, wrapperCli ?? undefined);
     }
     catch { /* no registered bot */ }
     let maxLiveWorkers = null;
+    let sessionOwnerReminder = DEFAULT_SESSION_OWNER_REMINDER;
     try {
-        const m = getBot(cachedLarkAppId).config.maxLiveWorkers;
+        const botConfig = getBot(cachedLarkAppId).config;
+        const m = botConfig.maxLiveWorkers;
         if (typeof m === 'number' && Number.isInteger(m) && m > 0)
             maxLiveWorkers = m;
+        sessionOwnerReminder = botConfig.sessionOwnerReminder ?? DEFAULT_SESSION_OWNER_REMINDER;
     }
     catch { /* default unlimited */ }
     let logicalSessionCount = 0;
@@ -3592,6 +3907,7 @@ ipcRoute('GET', '/api/bot-default-oncall', async (_req, res) => {
         wrapperCli,
         model,
         reasoningEffort,
+        turnTimeoutMs,
         agentSelectionKey,
         defaultOncall: defaultOncall ?? { enabled: false, workingDir: '', since: 0 },
         defaultWorkingDir,
@@ -3643,6 +3959,7 @@ ipcRoute('GET', '/api/bot-default-oncall', async (_req, res) => {
         // value when this bot has no explicit override (prompt/global/off).
         skillInjectionDefault: globalBuiltinSkillInjectionDefault(),
         maxLiveWorkers,
+        sessionOwnerReminder,
         logicalSessionCount,
         residentSessionCount,
         dormantSessionCount,
@@ -3992,7 +4309,23 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
         return jsonRes(res, 400, { ok: false, error: 'invalid_reasoning_effort' });
     }
     const currentBotConfig = getBot(larkAppId).config;
-    const supportsReasoningEffort = isCodexReasoningCliId(selected.cliId);
+    const supportsReasoningEffort = isConfigurableReasoningCliId(selected.cliId);
+    // Per-bot dsh runner turn timeout. Only the dsh adapter forwards it
+    // (`--turn-timeout-ms`); the dashboard exposes the field for dsh only. The
+    // field is optional in the body, so distinguish absent (preserve) from
+    // present-but-empty (clear → runner default) like reasoningEffort does.
+    const supportsTurnTimeout = selected.cliId === 'dsh';
+    const turnTimeoutFieldPresent = Object.prototype.hasOwnProperty.call(body, 'turnTimeoutMs');
+    let nextTurnTimeoutMs;
+    if (turnTimeoutFieldPresent && body.turnTimeoutMs !== null && body.turnTimeoutMs !== '') {
+        const n = Number(body.turnTimeoutMs);
+        // Positive integer within the arm-able bound; reject anything else so an
+        // over-bound value can't wrap to ~1ms in the runner's setTimeout.
+        if (!Number.isInteger(n) || n <= 0 || n > MAX_TURN_TIMEOUT_MS) {
+            return jsonRes(res, 400, { ok: false, error: 'invalid_turn_timeout_ms' });
+        }
+        nextTurnTimeoutMs = n;
+    }
     const runtimeFieldPresent = Object.prototype.hasOwnProperty.call(body, 'cliRuntime');
     const currentSelectionKey = selectionKeyForBot(currentBotConfig.cliId, currentBotConfig.wrapperCli);
     const selectionChanged = key !== currentSelectionKey;
@@ -4090,7 +4423,7 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
             const nextReasoningEffort = supportsReasoningEffort
                 ? (reasoningEffortFieldPresent ? reasoningEffort ?? undefined : entry.reasoningEffort)
                 : undefined;
-            if (nextReasoningEffort && !codexModelSupportsReasoningEffort(model || undefined, nextReasoningEffort)) {
+            if (nextReasoningEffort && !cliModelSupportsReasoningEffort(selected.cliId, model || undefined, nextReasoningEffort)) {
                 return { write: false, result: { error: 'reasoning_effort_not_supported_by_model' } };
             }
             entry.cliId = selected.cliId;
@@ -4124,19 +4457,31 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
                 else
                     delete entry.reasoningEffort;
             }
+            // dsh-only turn timeout: non-dsh always drops it; on dsh, an explicit
+            // field value writes/clears it, absence preserves the current value.
+            if (!supportsTurnTimeout)
+                delete entry.turnTimeoutMs;
+            else if (turnTimeoutFieldPresent) {
+                if (nextTurnTimeoutMs !== undefined)
+                    entry.turnTimeoutMs = nextTurnTimeoutMs;
+                else
+                    delete entry.turnTimeoutMs;
+            }
             if (entry.readIsolation === true &&
                 !readIsolationEnforceableFor({ cliId: selected.cliId, cliPathOverride: effectivePath, wrapperCli: selected.wrapperCli })) {
                 delete entry.readIsolation;
                 readIsolationCleared = true;
             }
-            // cliId=riff → backendType 自动设为 riff（否则 spawn 走 pty 后端找不到本地二进制）。
-            if (selected.cliId === 'riff') {
-                entry.backendType = 'riff';
+            // 远端 CLI（riff / mojo）→ backendType 自动设为同名后端（否则 spawn 走 pty 后端，
+            // 而它们的 resolvedBin 是空串）。mojo 加入后这里必须按「是否远端」判断，不能再
+            // 硬编码 riff。
+            if (isRemoteCliId(selected.cliId)) {
+                entry.backendType = selected.cliId;
             }
-            else if (entry.backendType === 'riff') {
-                // 从 riff 切回其它 CLI：清掉这个自动配对的 backend override，回落 daemon
-                // 默认后端——否则新 CLI 会跑在 RiffBackend 上（PTY 分块输入被当成一串 riff
-                // 任务）。手动的 pty/tmux/herdr/zellij override 不受影响（它们不会是 riff）。
+            else if (entry.backendType && isRemoteBackendType(entry.backendType)) {
+                // 从远端 CLI 切回其它 CLI：清掉这个自动配对的 backend override，回落 daemon
+                // 默认后端——否则新 CLI 会跑在远端 Backend 上（PTY 分块输入被当成一串远端
+                // turn）。手动的 pty/tmux/herdr/zellij override 不受影响（它们不是远端后端）。
                 delete entry.backendType;
             }
             return { write: true, result: { nextReasoningEffort } };
@@ -4147,7 +4492,7 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
             return jsonRes(res, 400, {
                 ok: false,
                 error: r.result.error,
-                message: `模型 ${model || '（Codex 默认模型）'} 不支持当前思考强度`,
+                message: `模型 ${model || '（Agent 默认模型）'} 不支持当前思考强度`,
             });
         }
         const bot = getBot(larkAppId);
@@ -4163,12 +4508,18 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
             bot.config.reasoningEffort = undefined;
         else
             bot.config.reasoningEffort = r.result.nextReasoningEffort ?? undefined;
+        // Mirror the entry write: non-dsh clears it, dsh with an explicit field
+        // takes the parsed value, dsh without the field preserves the existing one.
+        if (!supportsTurnTimeout)
+            bot.config.turnTimeoutMs = undefined;
+        else if (turnTimeoutFieldPresent)
+            bot.config.turnTimeoutMs = nextTurnTimeoutMs;
         if (readIsolationCleared)
             bot.config.readIsolation = false;
-        if (selected.cliId === 'riff') {
-            bot.config.backendType = 'riff';
+        if (isRemoteCliId(selected.cliId)) {
+            bot.config.backendType = selected.cliId;
         }
-        else if (bot.config.backendType === 'riff') {
+        else if (bot.config.backendType && isRemoteBackendType(bot.config.backendType)) {
             bot.config.backendType = undefined;
         }
         // 热切后立刻清掉本 bot 名下失配的存量会话——否则它们冻结的旧 CLI 会被下一条
@@ -4183,8 +4534,15 @@ ipcRoute('PUT', '/api/bot-agent', async (req, res) => {
             wrapperCli: selected.wrapperCli ?? null,
             model: model || null,
             reasoningEffort: supportsReasoningEffort ? bot.config.reasoningEffort ?? null : null,
+            turnTimeoutMs: supportsTurnTimeout ? bot.config.turnTimeoutMs ?? null : null,
             selectionKey,
-            closedMismatchedSessions,
+            // Number kept for compatibility with an older dashboard bundle; the residual
+            // count rides alongside so a hot CLI switch cannot silently strand a remote
+            // session behind a plain "closed N". (mojo/riff sessions live off-box, so a
+            // local row can close while the remote one survives.)
+            closedMismatchedSessions: closedMismatchedSessions.closed,
+            closedMismatchedResidual: closedMismatchedSessions.residual,
+            closedMismatchedFailed: closedMismatchedSessions.failed,
             // Report the (possibly auto-cleared) read-isolation state + whether the new
             // agent can still enforce it, so the dashboard updates its toggle immediately
             // instead of showing a stale enabled/supported state until a full refetch.
@@ -4675,6 +5033,21 @@ ipcRoute('PUT', '/api/bot-max-live-workers', async (req, res) => {
         return jsonRes(res, 400, { ok: false, error: r.reason });
     jsonRes(res, 200, { ok: true, maxLiveWorkers: value });
 });
+ipcRoute('PUT', '/api/bot-session-owner-reminder', async (req, res) => {
+    if (!cachedLarkAppId)
+        return jsonRes(res, 503, { error: 'larkAppId_not_set' });
+    let raw;
+    try {
+        raw = await readJsonBody(req);
+    }
+    catch {
+        return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+    }
+    const result = await updateSessionOwnerReminderConfig(cachedLarkAppId, raw);
+    if (!result.ok)
+        return jsonRes(res, 400, { ok: false, error: result.reason });
+    return jsonRes(res, 200, { ok: true, sessionOwnerReminder: result.config });
+});
 // Per-bot skill policy. Dashboard uses this for attach/detach; JSON policy
 // still shares the same applyConfigField path as /botconfig.
 ipcRoute('PUT', '/api/bot-skills', async (req, res) => {