botmux 3.15.0 → 3.16.0

package/README.en.md

@@ -60,9 +60,9 @@ More: [Roles & teams](https://deepcoldy.github.io/botmux/en/roles) · [File sand
 
 ## Supported CLIs & Agents
 
-Switch with `cliId` in `bots.json`. **20+ adapters**, spanning local CLIs (process-isolated, reachable via `tmux attach`) and API / cloud agents (e.g. Mira, riff — reached over API / remote, not a local process). Representative ones:
+Switch with `cliId` in `bots.json`. **20+ adapters**, spanning local CLIs (process-isolated, reachable via `tmux attach`) and API / cloud agents (e.g. Mira, riff — reached over API / remote, not a local process; mojo is API-driven but executes tools on the bot host by default, set cloud: true for the remote sandbox). Representative ones:
 
-`claude-code` · `codex` · `gemini` · `cursor` · `opencode` · `opencode2` · `antigravity` · `copilot` · `grok` · `kimi` · `kiro-cli` · `reasonix` · `dsh` · `aiden` · `coco` (TRAE) · `hermes` · `mira` · `riff` (cloud agent) …
+`claude-code` · `codex` · `gemini` · `cursor` · `opencode` · `opencode2` · `antigravity` · `copilot` · `grok` · `kimi` · `kiro-cli` · `reasonix` · `dsh` · `aiden` · `coco` (TRAE) · `hermes` · `mira` · `riff` (cloud agent) … · `mojo` (API-driven, host execution by default) …
 
 The current full set of `cliId`s is authoritative in [`src/adapters/cli/registry.ts`](https://github.com/deepcoldy/botmux/blob/master/src/adapters/cli/registry.ts); per-CLI config and wrapper / gateway setups are in [CLI Adapters](https://deepcoldy.github.io/botmux/en/adapters).
 

package/README.md

@@ -60,9 +60,9 @@ botmux start                 # 启动 daemon（botmux autostart enable 设开机
 
 ## 支持的 CLI / Agent
 
-`bots.json` 里用 `cliId` 一键切换。**20+ 适配器**，覆盖本地 CLI（进程隔离，`tmux attach` 可直连）和 API / 云 Agent（如 Mira、riff——通过 API / 远端接入，非本地进程）。代表项：
+`bots.json` 里用 `cliId` 一键切换。**20+ 适配器**，覆盖本地 CLI（进程隔离，`tmux attach` 可直连）和 API / 云 Agent（如 Mira、riff——通过 API / 远端接入，非本地进程；mojo 为 API 驱动、默认在宿主机执行工具，可配 cloud: true 走云沙箱）。代表项：
 
-`claude-code` · `codex` · `gemini` · `cursor` · `opencode` · `opencode2` · `antigravity` · `copilot` · `grok` · `kimi` · `kiro-cli` · `reasonix` · `dsh` · `aiden` · `coco`(TRAE) · `hermes` · `mira` · `riff`(云 Agent) …
+`claude-code` · `codex` · `gemini` · `cursor` · `opencode` · `opencode2` · `antigravity` · `copilot` · `grok` · `kimi` · `kiro-cli` · `reasonix` · `dsh` · `aiden` · `coco`(TRAE) · `hermes` · `mira` · `riff`(云 Agent) … · `mojo`(API 驱动,默认宿主机执行) …
 
 当前完整 `cliId` 以 [`src/adapters/cli/registry.ts`](https://github.com/deepcoldy/botmux/blob/master/src/adapters/cli/registry.ts) 为准；各 CLI 的配置与套 wrapper / 网关方法见 [多 CLI 适配器](https://deepcoldy.github.io/botmux/adapters)。
 

package/dist/.runtime-build-id

@@ -1 +1 @@
-2ced7d9eb87e3223123b40dad870a3dbd1ec172f85fd98f00a8e26e4dbcc85ad
+fcbef93f36253ac754d6cd75cc01921945ebd0576db7947c727971d258a0ed82

package/dist/adapters/backend/destroy-result.d.ts

@@ -0,0 +1,159 @@
+/**
+ * How a worker must read a backend's destroySession() answer.
+ *
+ * Both decisions below used to be inline in worker.ts, where nothing could reach
+ * them from a test: the malformed-result branch had no coverage at all, and the
+ * rollback decision was a bare `if (!result.ok)`. They live here so the exact
+ * production logic is executable in isolation.
+ */
+import type { SessionDestroyResult } from './types.js';
+/**
+ * Normalize a raw destroySession() return value.
+ *
+ * Local multiplexers legitimately return void: their destroy is a synchronous,
+ * already-completed teardown, so "no result" really does mean success.
+ *
+ * Remote backends (mojo, riff) are the opposite. Their teardown is an
+ * asynchronous cancellation reportable only through SessionDestroyResult, so a
+ * missing or malformed result is an UNKNOWN outcome -- and treating unknown as
+ * success is what lets the daemon publish a closed row while a credentialed
+ * remote session (and its local child) keeps running.
+ */
+export declare function normalizeDestroyResult(raw: unknown, opts: {
+    remote: boolean;
+}): SessionDestroyResult;
+/**
+ * Is the close itself retryable — i.e. did nothing irreversible happen?
+ *
+ * This is the CLOSE-side question only. It must never be used to decide whether
+ * writes may be admitted again; see mayRestoreWriteAdmission for why the two
+ * answers legitimately differ.
+ */
+export declare function mayRetryClose(result: SessionDestroyResult): boolean;
+/**
+ * May a FAILED prepare restore write admission?
+ *
+ * Deliberately keyed on `admission`, NOT on `recovery`. Reading `recovery` here
+ * conflated two different questions and produced a real fencing hole: an
+ * unproven local child termination is `retryable` (the irreversible remote
+ * cancel has not run, so the close may be retried) yet a credentialed process
+ * may still be alive, so admitting a write would layer a fresh turn on top of a
+ * live orphan. Rolling back on every ok:false was worse still — it re-opened
+ * writes on a lineage already cancelled remotely.
+ *
+ * When `admission` is absent it is derived from `recovery`, which keeps the
+ * historical behaviour for results that predate the field.
+ */
+export declare function mayRestoreWriteAdmission(result: SessionDestroyResult): boolean;
+/**
+ * Did abortDestroySession() actually restore write admission?
+ *
+ * A rollback can be legitimately REFUSED (the backend is holding a latched fence
+ * because a credentialed local subtree could not be proven dead). The daemon used
+ * to infer success from "the worker answered without throwing", so a refused
+ * rollback was recorded durably as `admissionRestored: true` — the journal then
+ * claimed admission was back while write() kept returning false.
+ *
+ * Legacy backends return void from abortDestroySession, which genuinely means
+ * "restored"; that is the ONLY unknown shape treated as success. Anything else
+ * malformed fails closed, because a fence wrongly cleared is unrecoverable while
+ * a fence wrongly kept is merely retried.
+ */
+export declare function interpretAbortOutcome(raw: unknown): {
+    admissionRestored: boolean;
+    reason?: string;
+};
+/**
+ * How a restart's teardown ended.
+ *
+ * `absent` is the local-backend case: destroySession is synchronous (or missing),
+ * so there is no promise to race and nothing to be uncertain about.
+ */
+export type RestartTeardownOutcome = {
+    kind: 'absent';
+} | {
+    kind: 'settled';
+    raw: unknown;
+} | {
+    kind: 'rejected';
+    error: unknown;
+} | {
+    kind: 'timeout';
+};
+/**
+ * May restartCliProcess() respawn after this teardown?
+ *
+ * restartCliProcess used to compute the teardown and throw it away:
+ *
+ *     try { await Promise.race([teardown, sleep(22_000)]); } catch {}
+ *     killCli(...);   // respawns regardless
+ *
+ * which laundered three distinct failures into "clean close": a resolved
+ * `ok: false` (never read), a won timeout (the timeout IS the signal that teardown
+ * is unfinished), and a rejection (swallowed by `catch {}`). All three then reached
+ * killCli() + respawn, so a fresh lineage — and a fresh env nonce — was layered on
+ * top of a subtree that may still hold the injected credential, while the old tree
+ * became unenumerable.
+ *
+ * This is the same fail-closed rule the close path uses, applied to restart: an
+ * unproven teardown must not silently start a second lineage. Note the deliberate
+ * asymmetry with the close path — the answer here is only "may we respawn?" and it
+ * NEVER authorises abortDestroySession(), because rollback is not the legitimate
+ * exit from an uncertain teardown.
+ */
+export declare function classifyRestartTeardown(outcome: RestartTeardownOutcome, opts: {
+    remote: boolean;
+}): {
+    mayRespawn: boolean;
+    reason?: string;
+    recovery?: 'retryable' | 'uncertain' | 'irreversible';
+};
+/**
+ * Why a local termination could not be proven, and therefore what the close may do.
+ *
+ * Two failures look identical at the call site and must NOT be punished the same:
+ *
+ *   - "the platform can never prove it"  — there is no instrument. On a host with
+ *     no /proc (Darwin), the scan answers `unsupported-platform` FOREVER, so a
+ *     latched write fence turns into a permanent wedge: every close fails, every
+ *     retry fails for the same unchangeable reason, and write() never returns true
+ *     again. Nothing about that state is evidence of a survivor; it is evidence
+ *     that we cannot look.
+ *   - "it should have been provable and was not" — `alive` is a positive sighting,
+ *     and `unscannable` is a transient or partial read failure on a host that CAN
+ *     normally enumerate. Both mean a credentialed process may be running right
+ *     now, and both may resolve on a retry, so both must keep the fence.
+ *
+ * The residual verdict is only safe because the credential-boundary question moves
+ * to the layer that can actually hold it: an unprovable containment handle is
+ * persisted and can NEVER be released, so the device-isolation blocker survives the
+ * closed row. Without that backstop this would be a fail-open hole, so do not reuse
+ * `residual-close` anywhere the blocker is not retained.
+ *
+ * Takes the kind as a plain string on purpose: this keeps the decision free of any
+ * import from the process-tree module, so the two files can be edited and merged
+ * independently. Unknown and absent kinds FAIL CLOSED.
+ */
+export declare function classifyUnprovenTermination(kind: string | undefined): {
+    outcome: 'residual-close' | 'fence';
+    reason: string;
+};
+/**
+ * The `close_result` payload a worker sends back for a close prepare.
+ *
+ * This is a function, not an inline object literal, because the daemon owns the
+ * rollback decision: dropping `recovery` here silently laundered every
+ * `uncertain` / `irreversible` verdict back into `retryable` at the IPC boundary,
+ * and an inline literal inside worker.ts was not reachable from any test.
+ */
+export declare function buildCloseResultMessage(requestId: string, result: SessionDestroyResult): {
+    type: 'close_result';
+    requestId: string;
+    ok: boolean;
+    taskId?: string;
+    error?: string;
+    recovery?: 'retryable' | 'uncertain' | 'irreversible';
+    admission?: 'restorable' | 'fenced';
+    residual?: 'local_subtree_unprovable_on_platform' | 'local_subtree_boundary_unproven';
+};
+//# sourceMappingURL=destroy-result.d.ts.map

package/dist/adapters/backend/destroy-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destroy-result.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/destroy-result.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACxB,oBAAoB,CAuBtB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAGnE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAI9E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAUnG;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACxB;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,CAAA;CAAE,CA4BjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB;IAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAkBzD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,oBAAoB,GAC3B;IACD,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;IACtD,SAAS,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;IACpC,QAAQ,CAAC,EAAE,sCAAsC,GAAG,iCAAiC,CAAC;CACvF,CAqBA"}

package/dist/adapters/backend/destroy-result.js

@@ -0,0 +1,223 @@
+/**
+ * Normalize a raw destroySession() return value.
+ *
+ * Local multiplexers legitimately return void: their destroy is a synchronous,
+ * already-completed teardown, so "no result" really does mean success.
+ *
+ * Remote backends (mojo, riff) are the opposite. Their teardown is an
+ * asynchronous cancellation reportable only through SessionDestroyResult, so a
+ * missing or malformed result is an UNKNOWN outcome -- and treating unknown as
+ * success is what lets the daemon publish a closed row while a credentialed
+ * remote session (and its local child) keeps running.
+ */
+export function normalizeDestroyResult(raw, opts) {
+    // typeof, NOT `'ok' in raw`: a truthy non-boolean such as { ok: 'yes' }
+    // satisfies the `in` test and then passes a plain `result.ok` check, so a
+    // malformed payload was read as a successful teardown.
+    const structured = !!raw
+        && typeof raw === 'object'
+        && typeof raw.ok === 'boolean';
+    if (structured)
+        return raw;
+    // `uncertain`, NOT `retryable`: the comment above already called this outcome
+    // UNKNOWN, but returning retryable told the caller to roll back and re-open
+    // write admission — on a session whose remote teardown may well have completed.
+    // An unknown outcome must fence, not roll back.
+    // `admission: 'fenced'` is stated EXPLICITLY rather than left to the
+    // recovery-derived default: this is the one outcome where we know nothing at
+    // all, so the fence must not depend on a second field keeping its value.
+    return opts.remote
+        ? {
+            ok: false,
+            error: 'remote_close_result_missing',
+            recovery: 'uncertain',
+            admission: 'fenced',
+        }
+        : { ok: true };
+}
+/**
+ * Is the close itself retryable — i.e. did nothing irreversible happen?
+ *
+ * This is the CLOSE-side question only. It must never be used to decide whether
+ * writes may be admitted again; see mayRestoreWriteAdmission for why the two
+ * answers legitimately differ.
+ */
+export function mayRetryClose(result) {
+    if (result.ok)
+        return false;
+    return (result.recovery ?? 'retryable') !== 'irreversible';
+}
+/**
+ * May a FAILED prepare restore write admission?
+ *
+ * Deliberately keyed on `admission`, NOT on `recovery`. Reading `recovery` here
+ * conflated two different questions and produced a real fencing hole: an
+ * unproven local child termination is `retryable` (the irreversible remote
+ * cancel has not run, so the close may be retried) yet a credentialed process
+ * may still be alive, so admitting a write would layer a fresh turn on top of a
+ * live orphan. Rolling back on every ok:false was worse still — it re-opened
+ * writes on a lineage already cancelled remotely.
+ *
+ * When `admission` is absent it is derived from `recovery`, which keeps the
+ * historical behaviour for results that predate the field.
+ */
+export function mayRestoreWriteAdmission(result) {
+    if (result.ok)
+        return false;
+    if (result.admission)
+        return result.admission === 'restorable';
+    return (result.recovery ?? 'retryable') === 'retryable';
+}
+/**
+ * Did abortDestroySession() actually restore write admission?
+ *
+ * A rollback can be legitimately REFUSED (the backend is holding a latched fence
+ * because a credentialed local subtree could not be proven dead). The daemon used
+ * to infer success from "the worker answered without throwing", so a refused
+ * rollback was recorded durably as `admissionRestored: true` — the journal then
+ * claimed admission was back while write() kept returning false.
+ *
+ * Legacy backends return void from abortDestroySession, which genuinely means
+ * "restored"; that is the ONLY unknown shape treated as success. Anything else
+ * malformed fails closed, because a fence wrongly cleared is unrecoverable while
+ * a fence wrongly kept is merely retried.
+ */
+export function interpretAbortOutcome(raw) {
+    if (raw === undefined || raw === null)
+        return { admissionRestored: true };
+    if (typeof raw === 'object' && typeof raw.admissionRestored === 'boolean') {
+        const { admissionRestored, reason } = raw;
+        return {
+            admissionRestored,
+            ...(typeof reason === 'string' && reason ? { reason } : {}),
+        };
+    }
+    return { admissionRestored: false, reason: 'abort_result_malformed' };
+}
+/**
+ * May restartCliProcess() respawn after this teardown?
+ *
+ * restartCliProcess used to compute the teardown and throw it away:
+ *
+ *     try { await Promise.race([teardown, sleep(22_000)]); } catch {}
+ *     killCli(...);   // respawns regardless
+ *
+ * which laundered three distinct failures into "clean close": a resolved
+ * `ok: false` (never read), a won timeout (the timeout IS the signal that teardown
+ * is unfinished), and a rejection (swallowed by `catch {}`). All three then reached
+ * killCli() + respawn, so a fresh lineage — and a fresh env nonce — was layered on
+ * top of a subtree that may still hold the injected credential, while the old tree
+ * became unenumerable.
+ *
+ * This is the same fail-closed rule the close path uses, applied to restart: an
+ * unproven teardown must not silently start a second lineage. Note the deliberate
+ * asymmetry with the close path — the answer here is only "may we respawn?" and it
+ * NEVER authorises abortDestroySession(), because rollback is not the legitimate
+ * exit from an uncertain teardown.
+ */
+export function classifyRestartTeardown(outcome, opts) {
+    switch (outcome.kind) {
+        case 'absent':
+            return { mayRespawn: true };
+        case 'timeout':
+            // Bounded wait expired: teardown is still in flight, so its side effects are
+            // unknown. Respawning here is what produced a second credentialed lineage.
+            return { mayRespawn: false, reason: 'restart_teardown_timeout', recovery: 'uncertain' };
+        case 'rejected':
+            return {
+                mayRespawn: false,
+                reason: outcome.error instanceof Error
+                    ? `restart_teardown_threw: ${outcome.error.message}`
+                    : `restart_teardown_threw: ${String(outcome.error)}`,
+                recovery: 'uncertain',
+            };
+        case 'settled': {
+            // Reuses the close path's normalizer so a malformed remote answer is UNKNOWN
+            // here too, rather than a truthy object passing for success.
+            const result = normalizeDestroyResult(outcome.raw, { remote: opts.remote });
+            if (result.ok)
+                return { mayRespawn: true };
+            return {
+                mayRespawn: false,
+                reason: result.error ?? 'restart_teardown_failed',
+                recovery: result.recovery ?? 'retryable',
+            };
+        }
+    }
+}
+/**
+ * Why a local termination could not be proven, and therefore what the close may do.
+ *
+ * Two failures look identical at the call site and must NOT be punished the same:
+ *
+ *   - "the platform can never prove it"  — there is no instrument. On a host with
+ *     no /proc (Darwin), the scan answers `unsupported-platform` FOREVER, so a
+ *     latched write fence turns into a permanent wedge: every close fails, every
+ *     retry fails for the same unchangeable reason, and write() never returns true
+ *     again. Nothing about that state is evidence of a survivor; it is evidence
+ *     that we cannot look.
+ *   - "it should have been provable and was not" — `alive` is a positive sighting,
+ *     and `unscannable` is a transient or partial read failure on a host that CAN
+ *     normally enumerate. Both mean a credentialed process may be running right
+ *     now, and both may resolve on a retry, so both must keep the fence.
+ *
+ * The residual verdict is only safe because the credential-boundary question moves
+ * to the layer that can actually hold it: an unprovable containment handle is
+ * persisted and can NEVER be released, so the device-isolation blocker survives the
+ * closed row. Without that backstop this would be a fail-open hole, so do not reuse
+ * `residual-close` anywhere the blocker is not retained.
+ *
+ * Takes the kind as a plain string on purpose: this keeps the decision free of any
+ * import from the process-tree module, so the two files can be edited and merged
+ * independently. Unknown and absent kinds FAIL CLOSED.
+ */
+export function classifyUnprovenTermination(kind) {
+    if (kind === 'unsupported-platform') {
+        return {
+            outcome: 'residual-close',
+            reason: 'mojo_local_termination_unprovable_on_platform',
+        };
+    }
+    // Everything else, including an unrecognised kind, keeps the fence. A fence
+    // wrongly kept costs a retry; a fence wrongly released strands a credentialed
+    // process behind a row that claims to be closed.
+    return {
+        outcome: 'fence',
+        reason: kind === 'alive'
+            ? 'mojo_local_child_termination_unproven'
+            : kind === 'unscannable'
+                ? 'mojo_local_termination_unscannable'
+                : 'mojo_local_child_termination_unproven',
+    };
+}
+/**
+ * The `close_result` payload a worker sends back for a close prepare.
+ *
+ * This is a function, not an inline object literal, because the daemon owns the
+ * rollback decision: dropping `recovery` here silently laundered every
+ * `uncertain` / `irreversible` verdict back into `retryable` at the IPC boundary,
+ * and an inline literal inside worker.ts was not reachable from any test.
+ */
+export function buildCloseResultMessage(requestId, result) {
+    return {
+        type: 'close_result',
+        requestId,
+        ok: result.ok,
+        ...(result.taskId ? { taskId: result.taskId } : {}),
+        ...(result.error ? { error: result.error } : {}),
+        ...(result.recovery ? { recovery: result.recovery } : {}),
+        // `admission` must cross the IPC boundary for the same reason `recovery`
+        // does: dropping it here would let the daemon re-derive "retryable ⇒ writes
+        // are fine" and undo a fence the backend deliberately kept.
+        ...(result.admission ? { admission: result.admission } : {}),
+        // `residual` must cross too, and dropping it was NOT symmetric with dropping
+        // `recovery`: an ok:true close whose local subtree was never proven gone would
+        // arrive as a bare success, so the daemon published an ORDINARY closed row.
+        // That is the fail-open this round exists to remove -- the backend kept the
+        // containment handle, the row said the session was fully gone, and the two
+        // disagreed about a still-credentialed process. The daemon cannot re-derive
+        // this: only the backend saw the evidence grade.
+        ...(result.residual ? { residual: result.residual } : {}),
+    };
+}
+//# sourceMappingURL=destroy-result.js.map

package/dist/adapters/backend/destroy-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"destroy-result.js","sourceRoot":"","sources":["../../../src/adapters/backend/destroy-result.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAY,EACZ,IAAyB;IAEzB,wEAAwE;IACxE,0EAA0E;IAC1E,uDAAuD;IACvD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG;WACnB,OAAO,GAAG,KAAK,QAAQ;WACvB,OAAQ,GAAwB,CAAC,EAAE,KAAK,SAAS,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,GAA2B,CAAC;IACnD,8EAA8E;IAC9E,4EAA4E;IAC5E,gFAAgF;IAChF,gDAAgD;IAChD,qEAAqE;IACrE,6EAA6E;IAC7E,yEAAyE;IACzE,OAAO,IAAI,CAAC,MAAM;QAChB,CAAC,CAAC;YACA,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,6BAA6B;YACpC,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,QAAQ;SACpB;QACD,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAA4B;IACxD,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,WAAW,CAAC,KAAK,cAAc,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,KAAK,YAAY,CAAC;IAC/D,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,WAAW,CAAC,KAAK,WAAW,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAAuC,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC/G,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,GAAuD,CAAC;QAC9F,OAAO;YACL,iBAAiB;YACjB,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;AACxE,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA+B,EAC/B,IAAyB;IAEzB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9B,KAAK,SAAS;YACZ,6EAA6E;YAC7E,2EAA2E;YAC3E,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAC1F,KAAK,UAAU;YACb,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,OAAO,CAAC,KAAK,YAAY,KAAK;oBACpC,CAAC,CAAC,2BAA2B,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE;oBACpD,CAAC,CAAC,2BAA2B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBACtD,QAAQ,EAAE,WAAW;aACtB,CAAC;QACJ,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,6EAA6E;YAC7E,6DAA6D;YAC7D,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC3C,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,yBAAyB;gBACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,WAAW;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAwB;IAExB,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,iDAAiD;IACjD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,IAAI,KAAK,OAAO;YACtB,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,IAAI,KAAK,aAAa;gBACtB,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,uCAAuC;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,MAA4B;IAW5B,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,SAAS;QACT,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,yEAAyE;QACzE,4EAA4E;QAC5E,4DAA4D;QAC5D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,6EAA6E;QAC7E,+EAA+E;QAC/E,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,iDAAiD;QACjD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/adapters/backend/herdr-backend.d.ts

@@ -57,6 +57,10 @@ export declare class HerdrBackend implements SessionBackend {
     claudeJsonlPath?: string;
     cliPid?: number;
     cliCwd?: string;
+    /** Default managed agent name for a Botmux-launched CLI (the single source of
+     *  truth shared by the constructor default and the selector's agent-precise
+     *  reattach probe). */
+    static defaultAgentName(): string;
     constructor(sessionName: string, opts?: HerdrBackendOptions);
     static isAvailable(): boolean;
     static sessionName(sessionId: string): string;

package/dist/adapters/backend/herdr-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"herdr-backend.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/herdr-backend.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAKvF,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,mBAAmB;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAqCD,QAAA,MAAM,gBAAgB,iDAAkD,CAAC;AACzE,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAsB/D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAqPD,qBAAa,YAAa,YAAW,cAAc;IAiC/C,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAjCvB,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,SAAS,CAA+B;IAChD,OAAO,CAAC,mBAAmB,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyC;IACrE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuD;IACpF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmE;IAC3F,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiD;IAChF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,IAAI,CAAO;IACnB,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,SAAS,CAAyB;IAC1C,OAAO,CAAC,iBAAiB,CAA8C;IACvE,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAE7E,OAAO,CAAC,QAAQ,CAAqC;IAErD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;gBAGL,WAAW,EAAE,MAAM,EACX,IAAI,GAAE,mBAAwB;IAMjD,MAAM,CAAC,WAAW,IAAI,OAAO;IAS7B,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI7C,qEAAqE;IACrE,MAAM,CAAC,kBAAkB,IAAI,MAAM;IAInC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIxC;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY;IAQ/C,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAatC,MAAM,CAAC,kBAAkB,IAAI,MAAM,EAAE;IAOrC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAIhE,0EAA0E;IAC1E,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY;IAevE;;;;;;;OAOG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI;IAsB1E,6EAA6E;IAC7E,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAI9D,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IA6EzD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAS5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI/B,eAAe,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO;IAS3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAKxC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAM/D,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAmB1F,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAejD,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI3C,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAIxC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAIhD,wEAAwE;IACxE,mBAAmB,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,GAAG,IAAI;IAIvE,oBAAoB,IAAI,sBAAsB,GAAG,IAAI;IAIrD,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAItE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI;IAU3D,IAAI,IAAI,IAAI;IASZ,cAAc,IAAI,IAAI;IAetB,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,aAAa;IAIb,oBAAoB,IAAI,MAAM;IAI9B,eAAe,IAAI,MAAM;IAIzB,WAAW,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIpD,OAAO,CAAC,YAAY;IA2BpB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAkFtB,OAAO,CAAC,cAAc;IA8DtB,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,IAAI;IA4BZ,0EAA0E;IAC1E,OAAO,CAAC,gBAAgB;IAwBxB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2F1B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,UAAU;CAUnB"}
+{"version":3,"file":"herdr-backend.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/herdr-backend.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAKvF,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,mBAAmB;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAqCD,QAAA,MAAM,gBAAgB,iDAAkD,CAAC;AACzE,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAsB/D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAqPD,qBAAa,YAAa,YAAW,cAAc;IAwC/C,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAxCvB,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,SAAS,CAA+B;IAChD,OAAO,CAAC,mBAAmB,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyC;IACrE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuD;IACpF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmE;IAC3F,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiD;IAChF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,IAAI,CAAO;IACnB,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,SAAS,CAAyB;IAC1C,OAAO,CAAC,iBAAiB,CAA8C;IACvE,OAAO,CAAC,SAAS,CAAuC;IACxD,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAE7E,OAAO,CAAC,QAAQ,CAAqC;IAErD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;2BAEuB;IACvB,MAAM,CAAC,gBAAgB,IAAI,MAAM;gBAKtB,WAAW,EAAE,MAAM,EACX,IAAI,GAAE,mBAAwB;IAMjD,MAAM,CAAC,WAAW,IAAI,OAAO;IAS7B,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI7C,qEAAqE;IACrE,MAAM,CAAC,kBAAkB,IAAI,MAAM;IAInC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIxC;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY;IAQ/C,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAatC,MAAM,CAAC,kBAAkB,IAAI,MAAM,EAAE;IAOrC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAIhE,0EAA0E;IAC1E,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY;IAevE;;;;;;;OAOG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI;IAsB1E,6EAA6E;IAC7E,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAI9D,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IA8FzD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAS5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI/B,eAAe,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO;IAS3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAKxC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAM/D,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAmB1F,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAejD,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI3C,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAIxC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAIhD,wEAAwE;IACxE,mBAAmB,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,GAAG,IAAI;IAIvE,oBAAoB,IAAI,sBAAsB,GAAG,IAAI;IAIrD,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAItE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI;IAU3D,IAAI,IAAI,IAAI;IASZ,cAAc,IAAI,IAAI;IAetB,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,aAAa;IAIb,oBAAoB,IAAI,MAAM;IAI9B,eAAe,IAAI,MAAM;IAIzB,WAAW,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIpD,OAAO,CAAC,YAAY;IA2BpB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAkFtB,OAAO,CAAC,cAAc;IA8DtB,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,IAAI;IA4BZ,0EAA0E;IAC1E,OAAO,CAAC,gBAAgB;IAwBxB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2F1B,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,UAAU;CAUnB"}

package/dist/adapters/backend/herdr-backend.js

@@ -315,10 +315,16 @@ export class HerdrBackend {
     claudeJsonlPath;
     cliPid;
     cliCwd;
+    /** Default managed agent name for a Botmux-launched CLI (the single source of
+     *  truth shared by the constructor default and the selector's agent-precise
+     *  reattach probe). */
+    static defaultAgentName() {
+        return 'botmux';
+    }
     constructor(sessionName, opts = {}) {
         this.sessionName = sessionName;
         this.opts = opts;
-        this.agentName = opts.agentName ?? 'botmux';
+        this.agentName = opts.agentName ?? HerdrBackend.defaultAgentName();
         if (opts.externalTarget?.paneId)
             this.paneId = opts.externalTarget.paneId;
     }
@@ -461,6 +467,22 @@ export class HerdrBackend {
                 this.actuallyReattached = true;
                 this.paneId = existing.pane_id;
             }
+            else if (this.opts.isReattach) {
+                // FREEZE the reattach decision (mirrors ZmxBackend: "never turn a stale
+                // reattach into a new CLI after the backing session disappeared"). The
+                // worker predicted reattach from an earlier probe and therefore SKIPPED
+                // the cold-path setup that only runs on !willReattachPersistent — the
+                // PENDING generation proof AND the credential-only Seatbelt/bwrap wrapper.
+                // If the `botmux` agent vanished between that probe and here, silently
+                // `agent start`ing a fresh CLI would launch it WITHOUT the credential
+                // boundary (unsafe on an enrolled host) and leave the old committed marker
+                // in place to later reattach it as "isolated". Post-spawn teardown can't
+                // undo an already-executed unwrapped CLI, so we must refuse HERE: throw so
+                // the worker's next launch takes the cold path (write PENDING + assemble
+                // the wrapper BEFORE creating the agent).
+                throw new Error(`herdr agent ${this.agentName} in ${this.sessionName} disappeared before reattach; `
+                    + `refusing to silently start a fresh (unwrapped) generation`);
+            }
             else if (herdrUsesPaneAgentStart()) {
                 this.paneId = this.startPaneAgent(bin, args, opts);
             }