botmux 3.16.1 → 3.17.0

package/dist/worker.js

@@ -15,15 +15,16 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { accessSync, chmodSync, mkdirSync, writeFileSync, unlinkSync, rmdirSync, existsSync, statSync, lstatSync, readdirSync, readlinkSync, readFileSync, realpathSync, copyFileSync, watch as fsWatch, createWriteStream, constants as fsConstants } from 'node:fs';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
-import { join, basename, dirname, delimiter } from 'node:path';
+import { join, basename, dirname, delimiter, relative } from 'node:path';
 import { resolveBotmuxWrapperBinDir, prependBotmuxBin } from './core/botmux-wrapper.js';
 import { homedir, tmpdir, userInfo } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { evaluateCredentialOnlyIsolationGate, credentialIsolationRequired, deviceCredentialIsolationMarkerPath, isCredentialIsolationReservedBasename, buildCredentialIsolationRules, buildSeatbeltProfile, isolatedPaneOriginChannel, isolatedPaneReattachSafe, evaluatePersistentPaneMigration, executePersistentPaneMigration, persistentTeardownKillKind, isolationPaneMarkerPath, policyOffTombstonePath, policyOffTombstoneContent, policyOffTombstoneValid, provenancePendingContent, provenancePendingNonce, sendCredFilePath, botHomePath, buildCliExecutableReadCarveOuts, isolationPaneMarkerContent, isolationPanePolicyDigest, } from './adapters/cli/read-isolation.js';
-import { buildFsPolicy, compileToSeatbelt, migrateLegacySandboxFields, resolveRedirectedAdapterAuthPaths, FsPolicyConfigError } from './adapters/cli/fs-policy.js';
+import { buildFsPolicy, compileToSeatbelt, migrateLegacySandboxFields, resolveRedirectedAdapterAuthPaths, resolveLarkCliLinuxStoreDir, larkCliChildDataRoot, FsPolicyConfigError } from './adapters/cli/fs-policy.js';
 import { buildCloseResultMessage, normalizeDestroyResult, mayRestoreWriteAdmission, interpretAbortOutcome, classifyRestartTeardown } from './adapters/backend/destroy-result.js';
 import { isRemoteBackendType, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, probePersistentSession, shouldRejectPersistentPostKillProbe } from './core/persistent-backend.js';
 import { finalizeRawCommandDelivery, writeRawCommandLine } from './core/raw-command-writer.js';
+import { decodeTerminalWriteFrameSource, terminalWriteFrame, } from './core/terminal-write-frame.js';
 import { rawCommandWriteOptionsFor } from './core/raw-command-write-options.js';
 import { publishCliSessionIdToDaemon } from './core/cli-session-id-publisher.js';
 import { readProcessStartIdentity } from './core/session-marker.js';
@@ -46,6 +47,7 @@ import { remoteWorkerShutdownInputBlocker } from './core/remote-worker-shutdown-
 import { ReadyGate, shouldArmReadyGate } from './utils/ready-gate.js';
 import { shouldRunStartupCommandsOnSpawn, shouldDeferInitialPromptForStartup } from './core/startup-commands.js';
 import { sanitizePerBotEnv } from './core/per-bot-env.js';
+import { normalizeExistingAppServerEndpoint } from './core/existing-app-server.js';
 import { resolveChildBotsConfig } from './core/config-dir.js';
 import { evaluateVcMeetingManagedSend, } from './services/vc-meeting-send-policy.js';
 import { TurnTerminalDeduper } from './services/turn-terminal-deduper.js';
@@ -58,7 +60,7 @@ import { readSessionMcpRuntimeManifest, sessionMcpRuntimeHostOnlyPaths, } from '
 import { prepareCliPluginGeneration } from './core/plugins/cli-generation.js';
 import { loadBotConfigs, resolveBrandLabel, resolveUsageDisplay, } from './bot-registry.js';
 import { readGlobalConfig, isWorkflowFeatureEnabled } from './global-config.js';
-import { deriveTerminalWriteToken, resolveTerminalAccessForRequest, safeTerminalTokenEqual, } from './core/terminal-write-auth.js';
+import { deriveTerminalWriteToken, resolveTerminalAccessForRequest, safeTerminalTokenEqual, TERMINAL_PLATFORM_READONLY_HINT_HEADER, } from './core/terminal-write-auth.js';
 import { deriveWorkerViewGeneration, looksLikeTerminalControlGrant, TERMINAL_VIEW_FORWARD_HEADER, verifyTerminalControlGrant, verifyTerminalViewForward, } from './core/terminal-control-grant.js';
 import { appendControlAudit, controlAuditRecord } from './dashboard/control-audit.js';
 import { readPlatformBinding } from './platform/binding.js';
@@ -81,6 +83,7 @@ import { currentHermesStateOffset, drainHermesStateDb, resolveHermesStateDbPath
 import { filterHermesEventsForBotmuxSession } from './services/hermes-session-filter.js';
 import { currentMtrSessionOffset, drainMtrSession, findLatestMtrSessionByDirectory, findMtrSessionById } from './services/mtr-transcript.js';
 import { drainPiTranscript } from './services/pi-transcript.js';
+import { drainOmpTranscript } from './services/omp-transcript.js';
 import { drainGrokUpdates, findGrokSessionByPid, grokSessionIdFromPath, } from './services/grok-transcript.js';
 import { resolveFileBridgePath } from './services/file-bridge-path.js';
 import { isStructuredBridgeAdoptIdleCli, isStructuredBridgeAdoptInputCli, isStructuredBridgeFallbackActive, isStructuredBridgeLifecycleBlockingCli, } from './services/structured-bridge-clis.js';
@@ -96,6 +99,7 @@ import { listenWebTerminalWithFallback } from './utils/web-terminal-listen.js';
 import { HerdrWebTerminalBinding } from './utils/herdr-web-terminal-binding.js';
 import { TERMINAL_FAVICON_DATA_URI } from './utils/terminal-favicon.js';
 import { t, setDefaultLocale } from './i18n/index.js';
+import { registerPromptOverrideResolver } from './skills/effective-builtins.js';
 import { TerminalRenderer } from './utils/terminal-renderer.js';
 import { DEFAULT_RENDER_COLS, DEFAULT_RENDER_ROWS, MAX_RENDER_COLS, MAX_RENDER_ROWS, MIN_RENDER_COLS, MIN_RENDER_ROWS, clamp, resolveRenderDimensions, } from './utils/render-dimensions.js';
 import { createCliAdapterSync, locateOnPath } from './adapters/cli/registry.js';
@@ -107,6 +111,7 @@ import { delay } from './utils/timing.js';
 import { claudeJsonlPathForSession, resolveJsonlFromPid, findOpenClaudeSessionIds, syncClaudeResumeTargetToCwd, DEFAULT_CLAUDE_DATA_DIR } from './adapters/cli/claude-code.js';
 import { sessionReadyHookCommand } from './adapters/hook-command.js';
 import { mtrSessionIdForBotmuxSession } from './adapters/cli/mtr.js';
+import { ompSessionDir } from './adapters/cli/oh-my-pi.js';
 import { strictInputHandle } from './adapters/cli/strict-input-handle.js';
 import { HerdrBackend } from './adapters/backend/herdr-backend.js';
 import { TmuxBackend } from './adapters/backend/tmux-backend.js';
@@ -130,7 +135,7 @@ import { tmuxEnv, probeTmuxFunctionalWithRetry } from './setup/ensure-tmux.js';
 import { probeZmxVersion } from './setup/ensure-zmx.js';
 import { tmuxRestartJitterMs } from './core/tmux-recovery.js';
 import { IdleDetector } from './utils/idle-detector.js';
-import { StuckDetector, matchHookReviewScreen } from './utils/stuck-detector.js';
+import { StuckDetector, matchHookReviewScreen, shouldHoldInputForHookReview, } from './utils/stuck-detector.js';
 import { processStuckWarningTuiKeys, shouldRearmStuckDetector } from './utils/stuck-key-guard.js';
 import { sendTuiKeySequence, submitTuiTextInput } from './utils/tui-input-delivery.js';
 import { captureToPng } from './utils/screenshot-renderer.js';
@@ -138,7 +143,8 @@ import { snapshotToPng, snapshotToText, shouldCaptureScreen, isScreenSelfDriven
 import { chooseWebTerminalSeed } from './utils/web-terminal-seed.js';
 import { mergeHerdrWebSnapshot, renderHerdrWebHistory, } from './utils/herdr-web-history.js';
 import { parseWorkerRequestUrl } from './utils/worker-http.js';
-import { detectCliUsageLimit, usageLimitStateKey, structuredRateLimitState, isStructuredRateLimitAuthoritative } from './utils/cli-usage-limit.js';
+import { structuredRateLimitState, isStructuredRateLimitAuthoritative } from './utils/cli-usage-limit.js';
+import { createUsageLimitTracker } from './utils/usage-limit-tracker.js';
 import { uploadImageBuffer } from './utils/lark-upload.js';
 import { applySessionOwnerEnv, redactChildEnv, scrubClaudeSessionMarkerEnv, scrubSessionCliHomeEnv } from './utils/child-env.js';
 import { decideSubmitConfirmationAction, settleDeferredSubmitConfirmation, settleStaleWriteContinuation, } from './services/submit-confirmation.js';
@@ -153,7 +159,7 @@ import { fetchDaemonIpc } from './core/daemon-ipc-auth.js';
 import { withCodexAppContext } from './utils/codex-app-context.js';
 import { resolveCodexAppFinalTurnIdentity } from './adapters/cli/codex-app-turn.js';
 import { RunnerControlDecoder } from './adapters/cli/runner-control-channel.js';
-import { normalizeCodexAppLifecycleEvent, normalizeFinalUsage, } from './services/codex-app-runner-protocol.js';
+import { CODEX_APP_ACTIVE_WRITER_EXIT_CODE, normalizeCodexAppLifecycleEvent, normalizeFinalUsage, } from './services/codex-app-runner-protocol.js';
 import { hasMatchingManagedOriginCapability, ensureManagedOriginAttestationDirectory, ensureManagedOriginCapabilityLeafSafe, ensureManagedOriginDataRootProbe, ensureManagedOriginIsolationSentinel, ensureManagedOriginRootLocator, managedOriginLegacyIsolationProbeAccess, managedOriginDataRootProbeAccess, managedOriginIsolationSentinelAccess, managedOriginAttestationDirectory, managedOriginCapabilityDirectory, managedOriginCapabilityPath, managedOriginRootLocatorPath, readManagedOriginAuthorityFile, RELAY_ORIGIN_CAPABILITY_BASENAME, replaceManagedOriginCapabilityFile, sweepManagedOriginAttestationProofs, } from './core/managed-origin-capability.js';
 import { CodexRpcEngine, } from './codex-rpc-engine.js';
 import { beginRuntimeWriteCycle, isCliBackendGenerationCurrent, PtyOutputGeneration, projectRuntimeScreenStatus, } from './utils/runtime-screen-status.js';
@@ -1410,6 +1416,7 @@ const adoptWriteQueue = new AsyncSerialQueue();
  *  adapter's hermesBridgeAttach reads the correct mode. */
 let lastSpawnEffectiveResume = false;
 let lastSpawnEffectiveCliSessionId;
+let lastSpawnEffectiveAdapterSessionId;
 let lastSpawnDeferInitialPrompt = false;
 let lastSpawnQueuedInitialPrompt;
 let lastSpawnQueuedInitialPromptLogicalContent;
@@ -1678,7 +1685,7 @@ let closeRequested = false;
 let capturedSpawnCommand = null;
 let deferredTopicOutputTail = '';
 const reportedDeferredTopicRoots = new Set();
-const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', opencode2: 'OpenCode 2', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff', reasonix: 'Reasonix', dsh: 'DeepSeek Harness', mojo: 'Mojo' };
+const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', opencode2: 'OpenCode 2', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff', reasonix: 'Reasonix', dsh: 'DeepSeek Harness', 'dsh-tui': 'DeepSeek Harness TUI', mojo: 'Mojo' };
 function cliName() {
     return (lastInitConfig?.cliRuntime?.source === 'configured'
         ? (lastInitConfig.cliRuntime.displayName?.trim() || lastInitConfig.cliRuntime.id)
@@ -1793,6 +1800,38 @@ let readyPatternSeenDuringHold = false;
 let awaitingPostSessionStartPromptEvidence = false;
 /** Scoped marker set only by IdleDetector's screen-driven callback. */
 let postSessionStartPromptEvidenceInFlight = false;
+/** A visible Codex Hook-review screen owns Enter/arrow keys. Keep queued IM
+ * input out of that menu so an automated submit cannot accidentally select
+ * “Trust all” or get consumed as menu navigation. */
+let hookReviewInputHold = false;
+let hookReviewInputHoldNotified = false;
+function refreshHookReviewInputHold(snapshot) {
+    if (!snapshot.trim())
+        return;
+    const blocked = shouldHoldInputForHookReview(snapshot);
+    if (blocked === hookReviewInputHold)
+        return;
+    hookReviewInputHold = blocked;
+    if (blocked) {
+        log('Hook review menu visible — holding queued input until the menu is resolved');
+        return;
+    }
+    hookReviewInputHoldNotified = false;
+    log('Hook review menu cleared — releasing queued input');
+    if (hasPendingInputForFlush())
+        queueMicrotask(() => { void flushPending(); });
+}
+function notifyHookReviewInputHold() {
+    if (hookReviewInputHoldNotified)
+        return;
+    hookReviewInputHoldNotified = true;
+    send({
+        type: 'user_notify',
+        turnId: currentBotmuxTurnId,
+        message: '⚠️ Codex 正在显示 Hook 审核菜单。为避免消息误触“Trust all”或被菜单吞掉，'
+            + 'BotMux 已暂存后续消息；请先在终端完成 Hook 选择，恢复普通输入框后会自动投递。',
+    });
+}
 /** Wait until the PTY has been quiet for READY_FLUSH_SETTLE_MS (Ink render
  *  drained), capped at READY_FLUSH_SETTLE_CAP_MS, then flush the held prompt.
  *  An authoritative direct ready command (Hermes) can mark prompt readiness;
@@ -2028,6 +2067,15 @@ let pendingSessionRename = null;
 let nativeSessionTitleSyncInFlight;
 let nativeSessionTitleAppliedThreadId;
 let nativeSessionTitleRevision = 0;
+/** Every user-controlled input class that flushPending can deliver. Keep this
+ * shared with review-menu release handling so a queued raw command, adopt
+ * message, or native rename is not stranded after the menu disappears. */
+function hasPendingInputForFlush() {
+    return pendingMessages.length > 0
+        || pendingAdoptMessages.length > 0
+        || pendingRawInputs.length > 0
+        || pendingSessionRename !== null;
+}
 let nativeSessionTitleResumeUpdatedAt;
 let nativeSessionTitleCurrentGenerationResume = false;
 const nativeSessionTitleSyncAbortControllers = new Set();
@@ -3416,59 +3464,27 @@ function codexAppLivenessStatus(base, nowMs = Date.now()) {
 function structuredRateLimitAuthoritative() {
     return isStructuredRateLimitAuthoritative(cliAdapter);
 }
-// Per-turn usage-limit state machine. Owns the turn counter plus the
-// "did this turn hit a limit" / "suppress a stale retry-ready banner" flags, so
-// classify()'s state writes are explicit method calls rather than hidden
-// mutations of module globals from a function that otherwise reads as a pure
-// mapper.
-function createUsageLimitTracker() {
-    let turnSeq = 0;
-    let detectedTurn;
-    let suppressedRetryReadyKey;
-    return {
-        currentTurn() {
-            return turnSeq;
-        },
-        // Open a new turn; remember any stale retry-ready banner still on screen so
-        // classify() doesn't re-flag it as a fresh limit this turn.
-        beginTurn(snapshot) {
-            turnSeq++;
-            detectedTurn = undefined;
-            const current = detectCliUsageLimit(snapshot, undefined, { suppressRateKind: structuredRateLimitAuthoritative() });
-            suppressedRetryReadyKey = current.limited && current.retryReady
-                ? usageLimitStateKey(current)
-                : undefined;
-            return turnSeq;
-        },
-        // Map a runtime status to a usage-limit-aware status, recording whether this
-        // turn hit a limit (read back via detectedThisTurn).
-        classify(content, status) {
-            const detected = detectCliUsageLimit(content, undefined, { suppressRateKind: structuredRateLimitAuthoritative() });
-            if (!detected.limited)
-                return { status };
-            const key = usageLimitStateKey(detected);
-            if (detected.retryReady && key === suppressedRetryReadyKey) {
-                return { status };
-            }
-            suppressedRetryReadyKey = undefined;
-            detectedTurn = turnSeq;
-            return { status: 'limited', usageLimit: detected };
-        },
-        detectedThisTurn(seq) {
-            return detectedTurn === seq;
-        },
-        // Record a limit that came from a STRUCTURED signal (transcript error
-        // record) rather than screen text. Mirrors classify()'s state writes so
-        // the tracker stays coherent: mark this turn as having hit a limit (read
-        // by detectedThisTurn for the submit-confirmation recheck) and clear any
-        // stale retry-ready suppression. The actual emit is done by the caller.
-        noteStructuredLimit() {
-            suppressedRetryReadyKey = undefined;
-            detectedTurn = turnSeq;
-        },
-    };
-}
-const usageLimitTracker = createUsageLimitTracker();
+/**
+ * PTY-quiescence window for the usage-limit active-work gate. A `working`
+ * status alone does not prove output is progressing (it is the default
+ * projection whenever promptReady === false), so the screen-scan suppression
+ * only applies while PTY output is this fresh. A non-structured CLI blocked at
+ * a rate/quota error screen that never renders its ready prompt goes silent
+ * past this window and is correctly detected instead of being suppressed
+ * forever. Aligns with the StuckDetector's PTY-quiescence threshold.
+ */
+const USAGE_LIMIT_OUTPUT_ACTIVE_WINDOW_MS = 15_000;
+function isOutputActivelyProgressing() {
+    return Date.now() - lastPtyActivityAtMs < USAGE_LIMIT_OUTPUT_ACTIVE_WINDOW_MS;
+}
+// Per-turn usage-limit state machine (extracted to utils/usage-limit-tracker
+// for unit testing). The structured-limit stickiness it owns is load-bearing:
+// a one-shot transcript emit must survive the daemon's working-frame self-heal
+// while the CLI stays genuinely blocked.
+const usageLimitTracker = createUsageLimitTracker({
+    isRateKindSuppressed: structuredRateLimitAuthoritative,
+    isOutputActive: isOutputActivelyProgressing,
+});
 function currentUsageLimitSnapshot() {
     if (!backendScreenEvidenceIsAuthoritativeForMutation())
         return '';
@@ -3588,6 +3604,10 @@ let activeRuntimePublished = false;
 const codexBridgeQueue = new CodexBridgeQueue();
 let codexBridgeWatcher = null;
 let codexBridgeTimer = null;
+let ompBridgeState = {};
+let ompQuietCandidateKey;
+let ompQuietCandidateCompleteOffset;
+const ompRetiredTranscriptPaths = new Set();
 /** Settings are observed on the same append-only cursor as bridge output.
  *  The tracker owns rollout-generation clear/update semantics and publishes a
  *  dedicated IPC event, independent of PTY redraw frequency. */
@@ -4766,7 +4786,7 @@ function maybeEmitStructuredRateLimit(events) {
         // Prefer a clock parsed from the record's own text ("... resets 10:40pm");
         // fall back to the shared bucketed cooldown when it carries none.
         const usageLimit = structuredRateLimitState(apiErrorMessageText(ev));
-        usageLimitTracker.noteStructuredLimit();
+        usageLimitTracker.noteStructuredLimit(usageLimit);
         send({
             type: 'screen_update',
             content: currentUsageLimitSnapshot(),
@@ -5132,6 +5152,11 @@ function emitReadyTurns(opts = {}) {
                 const fields = formatLocalTurnFields(rawUserText, postText);
                 if (!fields)
                     continue;
+                // A harvested answer proves the CLI recovered from any structured
+                // limit that parked it — mirror the daemon's final_output self-heal
+                // (worker-pool clears ds.usageLimit there) by dropping the tracker's
+                // re-emit latch so the next classify() does not re-pin the card.
+                usageLimitTracker.noteTurnCompleted();
                 send({
                     type: 'final_output',
                     content: fields.content,
@@ -5147,6 +5172,7 @@ function emitReadyTurns(opts = {}) {
             const headlessContent = formatHeadlessLocalTurnContent(postText);
             if (!headlessContent)
                 continue;
+            usageLimitTracker.noteTurnCompleted();
             send({
                 type: 'final_output',
                 content: headlessContent,
@@ -5164,6 +5190,7 @@ function emitReadyTurns(opts = {}) {
         const deliveredText = turn.restoredFromJournal
             ? `${t('worker.bridge_restored_turn_notice')}\n\n${postText}`
             : postText;
+        usageLimitTracker.noteTurnCompleted();
         send({
             type: 'final_output',
             content: deliveredText,
@@ -5209,6 +5236,19 @@ function codexBridgeFallbackActive() {
     // services/structured-bridge-clis.ts (single source of the allowlist).
     return isStructuredBridgeFallbackActive(lastInitConfig?.cliId, lastInitConfig?.adoptMode === true);
 }
+/** A Codex App shared-adopt starts a SECOND official `codex --remote` client
+ * against an external App Server/thread. It has the same transcript shape as
+ * terminal `/adopt`, but is deliberately NOT `adoptMode`: BotMux still owns
+ * the remote TUI and its normal Lark-input reliability rules. */
+function isExistingAppServerSharedBridge() {
+    return !!lastInitConfig?.existingAppServerEndpoint;
+}
+/** `/adopt`'s split-live attach is also required for the App Server share:
+ * existing history is absorbed while new, App-side turns after the attach
+ * boundary can be synthesised back into the Lark conversation. */
+function codexBridgeUsesSplitLiveAttach() {
+    return lastInitConfig?.adoptMode === true || isExistingAppServerSharedBridge();
+}
 /** Only drivers with a complete normal-final + interrupted-terminal contract
  *  may let a transcript-started turn override the screen-ready heuristic. */
 function hasStructuredLifecycleBlock() {
@@ -5241,6 +5281,9 @@ function structuredBridgeIsMtr() {
 function structuredBridgeIsPi() {
     return lastInitConfig?.cliId === 'pi';
 }
+function structuredBridgeIsOmp() {
+    return lastInitConfig?.cliId === 'oh-my-pi';
+}
 function structuredBridgeIsGrok() {
     return lastInitConfig?.cliId === 'grok';
 }
@@ -5250,7 +5293,7 @@ function codexBridgeIsCursor() {
 function currentHermesBridgeDbPath() {
     return hermesBridgeDbPath ?? resolveHermesStateDbPath();
 }
-function structuredBridgeIngestPath(path, offset) {
+function structuredBridgeIngestPath(path, offset, opts = {}) {
     if (structuredBridgeIsCodex())
         return drainCodexRollout(path, offset);
     // adoptMode gates the drainer's bare-sentinel synthesis: adopt posts
@@ -5262,6 +5305,13 @@ function structuredBridgeIngestPath(path, offset) {
         return drainCursorTranscript(path, offset);
     if (structuredBridgeIsPi())
         return drainPiTranscript(path, offset);
+    if (structuredBridgeIsOmp()) {
+        const result = drainOmpTranscript(path, offset, ompBridgeState, {
+            flushTrailingFinal: opts.flushOmpTrailingFinal,
+        });
+        ompBridgeState = result.state;
+        return result;
+    }
     if (structuredBridgeIsGrok())
         return drainGrokUpdates(path, offset);
     if (structuredBridgeIsHermes()) {
@@ -5353,12 +5403,14 @@ function codexBridgeStartTimer() {
             // fd is process-scoped, so following that fd cannot select a sibling
             // TRAE process merely because it shares the working directory.
             maybeFollowTraexSessionRotationViaPid();
+            maybeFollowOmpTranscriptRotation();
             if (!codexBridgeRolloutPath) {
                 // Late-attach: cliSessionId (writeInput / daemon probe) then adopt
                 // pid. Path lookup is centralized in resolveFileBridgePath so
                 // adding a file-backed CLI does not grow this if-tree.
-                // Adopt → split-live; non-adopt → fresh-empty (queue markTimeMs
-                // lower bound handles history without a split).
+                // Terminal `/adopt` and an existing-App-Server share both need
+                // split-live: absorb history before the attach boundary while keeping
+                // new local/App-side turns after it available for forwarding.
                 const path = resolveFileBridgePath(lastInitConfig?.cliId, {
                     sessionId: codexBridgePendingSessionId,
                     cwd: lastInitConfig?.workingDir,
@@ -5387,11 +5439,12 @@ function codexBridgeStartTimer() {
                     }
                     codexBridgePendingSessionId = undefined;
                     codexAdoptPendingPid = undefined;
-                    const mode = lastInitConfig?.adoptMode ? 'split-live' : 'fresh-empty';
+                    const mode = codexBridgeUsesSplitLiveAttach() ? 'split-live' : 'fresh-empty';
                     codexBridgeAttach(path, mode);
                 }
             }
             codexBridgeIngest();
+            maybeFlushOmpTrailingFinalOnQuietTick();
             if (isPromptReady)
                 emitReadyCodexTurns();
         }
@@ -5493,6 +5546,9 @@ function mtrBridgeIngest() {
     }
 }
 function codexBridgeAttach(rolloutPath, mode) {
+    ompBridgeState = {};
+    ompQuietCandidateKey = undefined;
+    ompQuietCandidateCompleteOffset = undefined;
     codexBridgeRolloutPath = rolloutPath;
     if (structuredBridgeIsCodex())
         codexServiceTierTracker.bind(rolloutPath);
@@ -5676,6 +5732,9 @@ function codexBridgeDetachFile() {
     codexBridgeOffset = 0;
     codexBridgePendingTail = '';
     codexBridgeBaselineDone = false;
+    ompBridgeState = {};
+    ompQuietCandidateKey = undefined;
+    ompQuietCandidateCompleteOffset = undefined;
 }
 /** Resolve the pid of the Codex process this worker observes (spawned child or
  *  adopted pane), mirroring the grok/traex pid-follow resolution order. */
@@ -5796,7 +5855,7 @@ function codexBridgeNotifyCliSessionId(cliSessionId) {
             const pid = currentCodexObservedPid();
             const next = resolveFileBridgePath('codex', { sessionId: cliSessionId });
             if (next && next !== codexBridgeRolloutPath) {
-                const attachMode = lastInitConfig?.adoptMode ? 'split-live' : 'fresh-empty';
+                const attachMode = codexBridgeUsesSplitLiveAttach() ? 'split-live' : 'fresh-empty';
                 log(`Codex session binding corrected ${currentSid ?? '?'} → ${cliSessionId} (pid ${pid} owns it); re-attaching bridge to ${next}`);
                 codexBridgeDetachFile();
                 codexBridgePendingSessionId = undefined;
@@ -5925,7 +5984,7 @@ function codexBridgeNotifyCliSessionId(cliSessionId) {
         }
         return;
     }
-    // Codex INITIAL attach (no prior rollout bound). The multi-fd adopt case
+    // Codex INITIAL attach (no prior rollout bound). The multi-fd terminal-adopt case
     // reaches here with codexBridgeRolloutPath still unset: findCodexRolloutByPid
     // returned undefined (ambiguous parent+sibling), so the adopt block armed the
     // poller instead of attaching. The cliSessionId is normally already
@@ -5963,7 +6022,7 @@ function codexBridgeNotifyCliSessionId(cliSessionId) {
     });
     if (path) {
         codexBridgePendingSessionId = undefined;
-        codexBridgeAttach(path, 'fresh-empty');
+        codexBridgeAttach(path, codexBridgeUsesSplitLiveAttach() ? 'split-live' : 'fresh-empty');
     }
     else {
         codexBridgePendingSessionId = cliSessionId;
@@ -6015,6 +6074,30 @@ function maybeFollowTraexSessionRotationViaPid() {
     persistCliSessionId(observed.cliSessionId);
     codexBridgeNotifyCliSessionId(observed.cliSessionId);
 }
+/** OMP may create a new JSONL in the same isolated Botmux session directory.
+ * Follow only that exact directory; no pid/global-session discovery is used. */
+function maybeFollowOmpTranscriptRotation() {
+    if (!structuredBridgeIsOmp() || !codexBridgeRolloutPath
+        || !lastSpawnEffectiveAdapterSessionId)
+        return;
+    const next = resolveFileBridgePath('oh-my-pi', {
+        sessionId: lastSpawnEffectiveAdapterSessionId,
+    });
+    if (!next || next === codexBridgeRolloutPath || ompRetiredTranscriptPaths.has(next))
+        return;
+    const retired = codexBridgeRolloutPath;
+    try {
+        codexBridgeIngest();
+        emitReadyCodexTurns();
+    }
+    catch (err) {
+        log(`OMP pre-rotation bridge drain failed: ${err.message}`);
+    }
+    log(`OMP transcript rotated: ${codexBridgeRolloutPath} → ${next}`);
+    ompRetiredTranscriptPaths.add(retired);
+    codexBridgeDetachFile();
+    codexBridgeAttach(next, 'fresh-empty');
+}
 function codexBridgeIngest(opts = {}) {
     // Follow-up RPC turns install their exact bridge mark only after the
     // turn/start ACK passes the generation fence. Ordinary ingest must not
@@ -6033,7 +6116,9 @@ function codexBridgeIngest(opts = {}) {
     }
     if (!codexBridgeRolloutPath || !codexBridgeBaselineDone)
         return;
-    const result = structuredBridgeIngestPath(codexBridgeRolloutPath, codexBridgeOffset);
+    const result = structuredBridgeIngestPath(codexBridgeRolloutPath, codexBridgeOffset, {
+        flushOmpTrailingFinal: opts.flushOmpTrailingFinal,
+    });
     codexBridgeOffset = result.newOffset;
     codexBridgePendingTail = result.pendingTail;
     if (structuredBridgeIsTraex()) {
@@ -6069,6 +6154,42 @@ function codexBridgeIngest(opts = {}) {
         idleDetector?.fireIdle();
     }
 }
+/** Confirm an OMP file-tail terminal only after one complete quiet bridge tick
+ * and an authoritative current viewport with no busy marker. This deliberately
+ * runs while lifecycle blocking is asserted; ingesting the final releases it. */
+function maybeFlushOmpTrailingFinalOnQuietTick() {
+    if (!structuredBridgeIsOmp())
+        return;
+    const candidate = ompBridgeState.provisionalFinal;
+    if (!candidate) {
+        ompQuietCandidateKey = undefined;
+        ompQuietCandidateCompleteOffset = undefined;
+        return;
+    }
+    const key = candidate.event.uuid;
+    if (ompQuietCandidateKey !== key
+        || ompQuietCandidateCompleteOffset !== codexBridgeOffset) {
+        ompQuietCandidateKey = key;
+        ompQuietCandidateCompleteOffset = codexBridgeOffset;
+        return;
+    }
+    if (codexBridgePendingTail || !hasStructuredLifecycleBlock() || !backend
+        || !backendScreenEvidenceIsAuthoritativeForMutation()
+        || !cliAdapter?.busyPattern)
+        return;
+    try {
+        const screen = captureBackendScreen(backend);
+        if (!screen || cliAdapter.busyPattern.test(busyProbeRegion(screen)))
+            return;
+    }
+    catch (err) {
+        log(`OMP quiet-final viewport capture failed: ${err.message}`);
+        return;
+    }
+    ompQuietCandidateKey = undefined;
+    ompQuietCandidateCompleteOffset = undefined;
+    codexBridgeIngest({ flushOmpTrailingFinal: true });
+}
 /** 将 Codex 的结构化 429 终态同步为既有的限流状态。 */
 function maybeEmitCodexStructuredRateLimit(events) {
     for (const ev of events) {
@@ -6076,7 +6197,7 @@ function maybeEmitCodexStructuredRateLimit(events) {
             continue;
         emittedRateLimitUuids.add(ev.uuid);
         const usageLimit = structuredRateLimitState(ev.terminalErrorSummary ?? '429 Too Many Requests');
-        usageLimitTracker.noteStructuredLimit();
+        usageLimitTracker.noteStructuredLimit(usageLimit);
         send({
             type: 'screen_update',
             content: currentUsageLimitSnapshot(),
@@ -6453,11 +6574,12 @@ function emitReadyCodexTurns() {
     // that flag to settle completed-with-empty; a bare `completed` terminal (e.g.
     // the RPC-hydration timeout path) must never be read as silence.
     const nothingToSendTurns = new Set();
-    const adoptMode = lastInitConfig?.adoptMode === true;
+    const terminalAdoptMode = lastInitConfig?.adoptMode === true;
+    const sharedAppServerBridge = isExistingAppServerSharedBridge();
     // Adopt mode: model is the user's external Codex, no botmux send to
     // gate against — every assistant turn (Lark-driven OR locally typed)
     // should reach the thread. Skip marker IO entirely.
-    const markers = adoptMode ? [] : readSendMarkers();
+    const markers = terminalAdoptMode ? [] : readSendMarkers();
     const remaining = codexBridgeQueue.peek();
     // Only a STARTED pending turn can bound the last ready turn's send window.
     // An unstarted turn hasn't been dequeued yet (its user event hasn't landed),
@@ -6472,6 +6594,13 @@ function emitReadyCodexTurns() {
         : undefined;
     for (let i = 0; i < ready.length; i++) {
         const turn = ready[i];
+        // A shared App Server session still owns the BotMux remote TUI, so its
+        // Lark-originated turns retain normal send-marker deduplication. Only a
+        // turn synthesized from Codex App input is external/local: that side has
+        // no pending Lark fingerprint and must be forwarded like terminal
+        // `/adopt`, including both the App prompt and its final reply.
+        const adoptMode = terminalAdoptMode
+            || (sharedAppServerBridge && turn.isLocal === true);
         const sourceHermesSessionId = structuredBridgeIsHermes() ? turn.sourceSessionId : undefined;
         const nextBoundaryMs = (i + 1 < ready.length ? ready[i + 1].markTimeMs : nextPendingMarkTimeMs);
         const gateInput = {
@@ -6527,6 +6656,9 @@ function emitReadyCodexTurns() {
             const fields = formatLocalTurnFields(turn.userText ?? '', postContent);
             if (!fields)
                 continue;
+            // Harvested answer → drop the structured-limit re-emit latch (mirrors
+            // the daemon's final_output self-heal; see emitReadyTurns).
+            usageLimitTracker.noteTurnCompleted();
             send({
                 type: 'final_output',
                 ...(sourceHermesSessionId ? { sourceHermesSessionId } : {}),
@@ -6539,6 +6671,7 @@ function emitReadyCodexTurns() {
             });
             continue;
         }
+        usageLimitTracker.noteTurnCompleted();
         send({
             type: 'final_output',
             ...(sourceHermesSessionId ? { sourceHermesSessionId } : {}),
@@ -6577,6 +6710,10 @@ function stopCodexBridge() {
     codexBridgeOffset = 0;
     codexBridgePendingTail = '';
     codexBridgeBaselineDone = false;
+    ompBridgeState = {};
+    ompQuietCandidateKey = undefined;
+    ompQuietCandidateCompleteOffset = undefined;
+    ompRetiredTranscriptPaths.clear();
     hermesBridgeOffset = 0;
     hermesBridgeBaselineDone = false;
     hermesBridgeSourceSessionId = undefined;
@@ -8011,6 +8148,13 @@ function handleVisibleStartupInteraction(data) {
     // row; never let its selection marker reach the first-prompt idle detector.
     if (dismissAidenCodexUpdateDialog(data))
         return true;
+    // An existing App Server viewer shares the user's Codex App trust context.
+    // Never auto-accept an interactive trust prompt here: it can include
+    // project/plugin hooks owned outside BotMux. The operator can safely choose
+    // "Continue without trusting" through the Web Terminal when Codex presents
+    // its Hooks review menu.
+    if (lastInitConfig?.existingAppServerEndpoint)
+        return false;
     if (trustHandled)
         return false;
     const stripped = data.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, '');
@@ -8820,6 +8964,7 @@ function onPtyData(data) {
         }
     }
     renderer?.write(data);
+    refreshHookReviewInputHold(`${renderer?.rawSnapshot() ?? ''}\n${data}`);
     // In tmux-attach mode, each web client has its own tmux attach PTY —
     // no relay needed. In non-tmux mode AND in pipe mode (adopt-bridge),
     // broadcast through the shared scrollback so all connected web clients
@@ -8929,6 +9074,7 @@ async function onBackendScreenResync(snapshot) {
     // current viewport: a prior local attach may have changed the real geometry.
     const visibleSnapshot = nextRenderer?.rawSnapshot() ?? '';
     lastAnalyzerSnapshot = visibleSnapshot;
+    refreshHookReviewInputHold(visibleSnapshot);
     // ZMX history does not carry the authoritative current PTY dimensions. A
     // local `zmx attach` can resize the session below our default 120x24 and that
     // size persists after detach, so even the rendered tail may include rows just
@@ -9638,12 +9784,9 @@ function scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId
             case 'suppress-active':
                 redriveRejectedStructuredReady();
                 log(`Deferred recheck missing but later ${action.evidence} shows ${cliName()} is active — suppressing submit warning. preview="${preview}"`);
-                // For a durable turn, activity is evidence of possible submission, not
-                // a terminal result. Keep the arbiter closed and re-check until either
-                // the transcript confirms it or a quiet interval proves it stuck.
-                if (turnIdentity?.dispatchAttempt !== undefined) {
-                    scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId, undefined, turnSeq, turnIdentity, durableTerminalStatus);
-                }
+                // activity 证据只能说明 CLI 仍在动，不能证明本次输入已提交
+                // 普通 IM 和 durable turn 都继续重查，直到 transcript 命中或安静窗口落到 submit_unconfirmed
+                scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId, undefined, turnSeq, turnIdentity, durableTerminalStatus, structuredTarget);
                 return;
             case 'notify-hard-failure':
                 // failureReason is handled synchronously above.
@@ -9817,7 +9960,7 @@ async function flushPending() {
     }
     if (ambiguousSubmissionRecoveryHold?.backend === backend)
         return;
-    if (pendingMessages.length === 0 && pendingAdoptMessages.length === 0 && pendingRawInputs.length === 0 && pendingSessionRename === null)
+    if (!hasPendingInputForFlush())
         return; // nothing to flush — keep isPromptReady
     if (sessionRenameInFlight())
         return; // wait for /rename to finish before any user input
@@ -9836,6 +9979,14 @@ async function flushPending() {
         return;
     if (bareShellLaunchBlocked)
         return; // launch is held at a bare shell — don't type prompts into it
+    // A Hook-review page has an active selection and consumes Enter/arrow keys.
+    // Re-check the rendered viewport right before a literal write; PTY chunks
+    // can arrive between idle detection and this queue drain.
+    refreshHookReviewInputHold(lastAnalyzerSnapshot || renderer?.rawSnapshot() || '');
+    if (hookReviewInputHold) {
+        notifyHookReviewInputHold();
+        return;
+    }
     // Screen-idle is not a durable receipt. A permission/AskUser prompt can look
     // idle while the logical delivery is unresolved, so no following IM or
     // meeting turn may cross this boundary until an explicit terminal releases
@@ -11161,6 +11312,27 @@ function scheduleBusyPatternIdleProbe(source) {
 }
 async function spawnCli(cfg, opts = {}) {
     const spawnGeneration = ++cliSpawnGeneration;
+    // Experimental external App Server attachment: BotMux owns only this TUI
+    // client, never the server or its JSON-RPC input stream. Re-establish the
+    // remote argv state on EVERY spawn because killCli() deliberately clears the
+    // generic RPC remote variables before a restart.
+    if (cfg.existingAppServerEndpoint !== undefined) {
+        if (cfg.cliId !== 'codex') {
+            throw new Error('existing App Server attachment requires cliId "codex"');
+        }
+        if (!cfg.cliSessionId) {
+            throw new Error('existing App Server attachment requires an already-selected Codex thread id');
+        }
+        if (cfg.codexRpcInput === true) {
+            throw new Error('existing App Server attachment cannot enable BotMux codexRpcInput');
+        }
+        if (codexRpcEngine) {
+            throw new Error('existing App Server attachment cannot share a BotMux-owned Codex RPC engine');
+        }
+        remoteWsUrl = normalizeExistingAppServerEndpoint(cfg.existingAppServerEndpoint, `worker existingAppServerEndpoint for session ${cfg.sessionId}`);
+        remoteThreadId = cfg.cliSessionId;
+        log(`External Codex App Server attach prepared for thread ${cfg.cliSessionId.substring(0, 12)}`);
+    }
     // Prefer force-clear so a half-finished rename cannot block the new generation.
     forceClearSessionRenameInFlight();
     currentCliCredentialIsolated = false;
@@ -11330,7 +11502,16 @@ async function spawnCli(cfg, opts = {}) {
         log(`Adopt mode (${effectiveBackendType}): observing ${target} (${cols}x${rows})`);
         return;
     }
-    cliAdapter = createCliAdapterSync(cfg.cliId, cfg.cliPathOverride);
+    // dsh runtime variant: when the bot selected dsh-tui (dshRuntime='tui'),
+    // resolve the PTY-driven dsh-tui adapter instead of the headless JSON-RPC
+    // runner. The bot's cliId stays 'dsh' (the toggle is a per-bot config field),
+    // so every other dsh-specific branch (OSC decode, turn timeout, etc.) is
+    // unaffected — dsh-tui simply doesn't emit OSC frames, making the decoder a
+    // no-op for it.
+    const effectiveCliId = cfg.cliId === 'dsh' && cfg.dshRuntime === 'tui'
+        ? 'dsh-tui'
+        : cfg.cliId;
+    cliAdapter = createCliAdapterSync(effectiveCliId, cfg.cliPathOverride);
     // backendType trust-but-verify + HARD GATE (PTY 退役): an explicit per-bot
     // config (or BACKEND_TYPE env override) bypasses config.ts's default, so the
     // worker re-probes the requested persistent backend here. A requested
@@ -12283,6 +12464,8 @@ async function spawnCli(cfg, opts = {}) {
     bareShellLaunchBlocked = false;
     bareShellChecked = false;
     bareShellCheckInProgress = false;
+    hookReviewInputHold = false;
+    hookReviewInputHoldNotified = false;
     // ── Resume pre-flight check + two-tier fallback ──────────────────────────
     // Tier 0 (adapter capability): adapters whose buildArgs can only resume a
     // PRECISE cliSessionId (cursor/copilot/kimi — no --continue/latest fallback,
@@ -12404,6 +12587,8 @@ async function spawnCli(cfg, opts = {}) {
     // the fresh session's first turn.
     lastSpawnEffectiveResume = effectiveResume;
     lastSpawnEffectiveCliSessionId = effectiveCliSessionId;
+    lastSpawnEffectiveAdapterSessionId = effectiveAdapterSessionId;
+    ompRetiredTranscriptPaths.clear();
     // ttadk 网关：模型走 ttadk 自己的 `-m`（启动期注入到 ttadk 前缀，见下方 wrapperCli
     // 分支），不能再把 cfg.model 透给底层适配器，否则真实 CLI 会再吃一个 --model 重复。
     const ttadkGateway = isTtadkWrapper(cfg.wrapperCli);
@@ -12900,6 +13085,47 @@ async function spawnCli(cfg, opts = {}) {
             }
             return out;
         };
+        // Canonicalize a path whose LEAF may not exist yet (e.g. a lark-cli keystore dir
+        // lark-cli will create on first write): realpath the DEEPEST EXISTING ancestor
+        // (resolving any symlinked prefix — symlinked $HOME, a symlinked data root) and
+        // re-append the non-existent tail. A plain full-path realpath THROWS on the
+        // missing leaf and returns the raw lexical value, so a symlinked ancestor would
+        // stay unresolved and the policy could anchor a DIFFERENT namespace than the one
+        // lark-cli opens after IT canonicalizes (a canonicalization TOCTOU). Input must already be
+        // lexically clean (no `..`); resolveLarkCliLinuxStoreDir Cleans it first.
+        const canonicalNearestAncestor = (p) => {
+            if (!p.startsWith('/'))
+                return p;
+            const segs = p.split('/').filter(Boolean);
+            for (let i = segs.length; i >= 0; i--) {
+                const prefix = '/' + segs.slice(0, i).join('/');
+                try {
+                    const real = realpathSync(prefix);
+                    return i === segs.length ? real : `${real}/${segs.slice(i).join('/')}`;
+                }
+                catch { /* ancestor missing → try a shallower prefix */ }
+            }
+            return p; // not even '/' resolved (impossible) → lexical fallback
+        };
+        // OMP keeps all transcripts under one shared state root. Materialize this
+        // Botmux session's exact directory before allow-path existence filtering;
+        // the policy below masks the shared sessions parent and re-opens only this
+        // deeper directory read-write.
+        const ompCurrentSessionDir = cliAdapter.id === 'oh-my-pi'
+            ? ompSessionDir(effectiveAdapterSessionId)
+            : undefined;
+        if (ompCurrentSessionDir)
+            mkdirSync(ompCurrentSessionDir, { recursive: true, mode: 0o700 });
+        const canonicalOmpSessionsRoot = ompCurrentSessionDir
+            ? canonical(dirname(dirname(ompCurrentSessionDir)))
+            : undefined;
+        const canonicalOmpSessionDir = ompCurrentSessionDir
+            ? canonical(ompCurrentSessionDir)
+            : undefined;
+        if (canonicalOmpSessionsRoot && canonicalOmpSessionDir
+            && relative(canonicalOmpSessionsRoot, canonicalOmpSessionDir) !== join('botmux', effectiveAdapterSessionId)) {
+            throw new Error('[sandbox] OMP session directory escapes its managed sessions root');
+        }
         // User three-tier lists: the new sandboxPaths field, or a pre-migration
         // session/config's legacy fields mapped through the SAME lossless mapping
         // the startup migration uses.
@@ -13019,6 +13245,9 @@ async function spawnCli(cfg, opts = {}) {
         if (process.platform === 'linux') {
             mandatoryDenyPaths.push(join(canonical(dataDir), 'sandboxes', cfg.sessionId));
         }
+        if (canonicalOmpSessionsRoot) {
+            mandatoryDenyPaths.push(canonicalOmpSessionsRoot);
+        }
         if (process.platform === 'darwin') {
             const osUserHomeDir = userInfo().homedir;
             if (!osUserHomeDir) {
@@ -13150,6 +13379,23 @@ async function spawnCli(cfg, opts = {}) {
             // arbitrary parent dir (`/tmp`, `/etc`, a project root) and bricking the
             // core CLI (codex P1). Canonicalized so it shares the roots' namespace.
             loadedBotsConfigPath: cfg.loadedBotsConfigPath ? canonical(cfg.loadedBotsConfigPath) : undefined,
+            // Linux lark-cli keystore (holds every bot's appsecret ciphertext + the shared
+            // master key). Resolve it EXACTLY as the in-sandbox lark-cli will:
+            // `<clean(LARKSUITE_CLI_DATA_DIR)>/lark-cli` when that env var is a valid ABSOLUTE
+            // path (lexically Cleaned — `..`/`.`/`//` resolved, control chars rejected), else
+            // `$HOME/.local/share/lark-cli` — lark-cli does NOT read XDG_DATA_HOME (verified by
+            // strace on v1.0.76 + its keychain_other.go::StorageDir / SafeEnvDirPath). The
+            // Clean happens INSIDE resolveLarkCliLinuxStoreDir (a `..`-bearing value
+            // must be normalized here, or realpath throws on the nonexistent leaf, the raw `..`
+            // survives, normalizeFsPath rejects it, and the policy anchors the DEFAULT store
+            // while lark-cli opens the Clean'd real one → leak). canonicalNearestAncestor then
+            // resolves any SYMLINKED ancestor even when the store leaf does not exist yet (a
+            // full-path realpath would throw and skip symlink resolution → policy/CLI namespace
+            // divergence). bwrap has no --clearenv, so the child inherits this bot's
+            // LARKSUITE_CLI_DATA_DIR from the worker's own (frozen, non-agent-controllable)
+            // process.env, and sandbox.ts pins the child to the SAME cleaned resolution
+            // (--setenv/--unsetenv) so policy == CLI by construction. Ignored on darwin.
+            larkCliLinuxStore: canonicalNearestAncestor(resolveLarkCliLinuxStoreDir(process.env.LARKSUITE_CLI_DATA_DIR, lexicalHome)),
             redirectedCliData: willRedirectCliData,
             cliDataPaths: willRedirectCliData ? undefined : keepExisting([
                 cliAdapter.claudeDataDir,
@@ -13201,7 +13447,7 @@ async function spawnCli(cfg, opts = {}) {
             ]),
             botmuxInstallRoot,
             outbox,
-            extraWritePaths: keepExisting([process.env.TMPDIR]),
+            extraWritePaths: keepExisting([process.env.TMPDIR, canonicalOmpSessionDir]),
             userPaths,
             mandatoryDenyPaths,
             mandatoryDenyRegexes,
@@ -13288,6 +13534,25 @@ async function spawnCli(cfg, opts = {}) {
             }
         }
         else {
+            // Canonical lark-cli data root pinned into the child so the in-sandbox lark-cli
+            // resolves the SAME physical keystore the policy denied/carved-out (avoiding a
+            // symlinked-data-root namespace split). fsPolicyCtx.larkCliLinuxStore is the FULLY-canonical store dir (leaf
+            // symlinks followed) — the physical location the policy protects. The child opens
+            // `<pin>/lark-cli`, so pin = dirname(store) is same-source ONLY when the canonical
+            // store's basename is still `lark-cli` (the common case, incl. a symlink that
+            // resolves to another `lark-cli` dir). If the `lark-cli` leaf was a symlink to a
+            // DIFFERENTLY-named dir (basename !== 'lark-cli'), dirname(store)+'/lark-cli' would
+            // NOT equal the canonical store → child would open an unbound path (auth breaks) OR
+            // a foreign one. There is no leak either way (the policy still denies the real dir,
+            // and both candidate stores are locked), so degrade SAFELY: pin nothing → child
+            // falls back to the default store (also locked), and log the exotic layout.
+            const canonStore = fsPolicyCtx.larkCliLinuxStore;
+            const childLarkDataRoot = larkCliChildDataRoot(canonStore);
+            if (canonStore && childLarkDataRoot === null) {
+                log(`[sandbox] lark-cli keystore ${canonStore} does not end in 'lark-cli' (symlinked leaf?) — `
+                    + `not pinning a custom LARKSUITE_CLI_DATA_DIR into the sandbox; the in-sandbox lark-cli will `
+                    + `use the default store. The real keystore is still denied/carve-out'd by policy (no leak).`);
+            }
             const sbx = prepareDirectSandbox({
                 sessionId: cfg.sessionId,
                 dataDir,
@@ -13298,6 +13563,7 @@ async function spawnCli(cfg, opts = {}) {
                 cliArgs: args,
                 trustedBotmuxCommandPaths: [defaultGatewayEntry().command],
                 mcpGatewaySocketPath: sessionMcpGatewayHost?.socketPath,
+                larkCliDataDir: childLarkDataRoot,
             });
             if (!sbx) {
                 // FAIL-SAFE: never silently run unsandboxed.
@@ -13839,6 +14105,13 @@ async function spawnCli(cfg, opts = {}) {
     // can verify they were spawned inside a botmux session by walking the
     // process tree and looking for a matching pid file in this directory.
     const cliPid = backend.getChildPid?.();
+    if (cfg.existingAppServerEndpoint !== undefined) {
+        // The local `codex --remote` client does not own the selected rollout fd;
+        // writeInput must accept only the explicitly bound remote thread in the
+        // shared history.jsonl instead of applying its normal local-PID ownership
+        // filter (which would reject the correct App Server submission).
+        backend.expectedCodexSessionId = cfg.cliSessionId;
+    }
     publishLocalProcessAttestation(cliPid ?? undefined);
     if (cliPid && process.env.SESSION_DATA_DIR) {
         const markersDir = join(process.env.SESSION_DATA_DIR, '.botmux-cli-pids');
@@ -14042,10 +14315,21 @@ async function spawnCli(cfg, opts = {}) {
         hermesBridgeAttach(effectiveResume ? 'baseline-existing' : 'fresh-empty');
     }
     else if (cfg.cliId === 'codex') {
+        if (cfg.existingAppServerEndpoint) {
+            // A shared Codex App thread has two legitimate writers: the App and
+            // BotMux's official `codex --remote` client. Enable local-turn
+            // synthesis only from this share's attach boundary, so older thread
+            // history is absorbed while future App-side turns are mirrored to Lark.
+            codexAdoptStartMs = Date.now();
+            codexBridgeQueue.setLocalTurns(true, codexAdoptStartMs);
+            log('Codex bridge enabled App Server shared-turn forwarding');
+        }
         if (effectiveCliSessionId) {
             const rolloutPath = findCodexRolloutBySessionId(effectiveCliSessionId);
             if (rolloutPath) {
-                codexBridgeAttach(rolloutPath, effectiveResume ? 'baseline-existing' : 'fresh-empty');
+                codexBridgeAttach(rolloutPath, cfg.existingAppServerEndpoint
+                    ? 'split-live'
+                    : effectiveResume ? 'baseline-existing' : 'fresh-empty');
             }
             else {
                 codexBridgePendingSessionId = effectiveCliSessionId;
@@ -14091,7 +14375,7 @@ async function spawnCli(cfg, opts = {}) {
             codexBridgeStartTimer();
         }
     }
-    else if (cfg.cliId === 'pi' || cfg.cliId === 'grok') {
+    else if (cfg.cliId === 'pi' || cfg.cliId === 'grok' || cfg.cliId === 'oh-my-pi') {
         // File-backed: pin path when known (pi session id / grok --session-id
         // UUID), else arm the poller. Grok collision-fallback (dir already
         // exists → no --session-id → grok mints id) is recovered via writeInput
@@ -14245,7 +14529,8 @@ async function spawnCli(cfg, opts = {}) {
             // itself fail-opens on non-authoritative screens (ZMX), so a stale
             // `Working...` in ZMX history can never block a structured terminal.
             const busyGuardedIdle = evidenceSource === 'screen'
-                || (evidenceSource === 'external' && structuredBridgeIsPi());
+                || (evidenceSource === 'external'
+                    && (structuredBridgeIsPi() || structuredBridgeIsOmp()));
             if (busyGuardedIdle && idleBackend
                 && deferPromptReadyWhileBusy(`${cliName()} ${evidenceSource}-idle`, idleBackend))
                 return;
@@ -14487,7 +14772,7 @@ async function spawnCli(cfg, opts = {}) {
             log('Suppressed claude_exit for intentional in-worker restart');
         }
         else {
-            send({ type: 'claude_exit', code, signal, logTail, canParkDiagnostic, turnId: exitedTurnId, dispatchAttempt: exitedDispatchAttempt });
+            send({ type: 'claude_exit', code, signal, logTail, canParkDiagnostic, turnId: exitedTurnId, dispatchAttempt: exitedDispatchAttempt, ...(lastInitConfig?.cliId === 'codex-app' && code === CODEX_APP_ACTIVE_WRITER_EXIT_CODE ? { codexAppActiveWriter: true } : {}) });
         }
     });
     const isPersistentBackendReattach = actuallyReattachedPersistent;
@@ -14757,8 +15042,8 @@ function killCli(opts = {}) {
     appRunnerControlDecoder.reset();
 }
 async function restartCliProcess(reason, opts = {}) {
-    if (lastInitConfig?.adoptMode) {
-        log(`Restart ignored in adopt mode (${reason})`);
+    if (lastInitConfig?.adoptMode || lastInitConfig?.existingAppServerEndpoint) {
+        log(`Restart ignored in shared-adopt mode (${reason})`);
         return;
     }
     // Invalidate queued/deferred callbacks before async teardown begins. Waiting
@@ -14951,6 +15236,12 @@ function startWebServer(host, preferredPort) {
                 res.end('Forbidden');
                 return;
             }
+            // #933 回归修复：平台注入的 Cookie/Role 会被中央前门剥掉（P1-6 / 内部 grant），
+            // 此时 platformReadonly 判不出来；前门改用这个展示层提示头把「平台认证过的只读
+            // 访客」这一事实带过来。只影响只读页渲染哪条横幅（SSO 登录引导 vs 纯只读提示），
+            // 不参与任何授权判定——hasRead/hasWrite 在它之前就已定死。
+            const platformReadonlyHint = !hasWrite
+                && req.headers[TERMINAL_PLATFORM_READONLY_HINT_HEADER] !== undefined;
             const loginHdr = req.headers['x-botmux-login-url'];
             // The central front proxy only injects X-Botmux-Login-Url on the SPA 401
             // path, never on `/s/` terminal requests — so a read-only web terminal
@@ -14991,7 +15282,7 @@ function startWebServer(host, preferredPort) {
                 || effectiveBackendType === 'tmux'
                 || effectiveBackendType === 'zellij';
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(getTerminalHtml(hasWrite, platformReadonly, loginUrl, forceRemoteScroll, localTerminalBackend, allowReadOnlyRemoteScroll));
+            res.end(getTerminalHtml(hasWrite, platformReadonly || platformReadonlyHint, loginUrl, forceRemoteScroll, localTerminalBackend, allowReadOnlyRemoteScroll));
         });
         wss = new WebSocketServer({
             server: httpServer,
@@ -15047,6 +15338,26 @@ function startWebServer(host, preferredPort) {
             if (hasWrite)
                 authedClients.add(ws);
             log(`WS client connected (total: ${wsClients.size}, write: ${hasWrite})`);
+            // The page only knows the verdict of its own HTTP GET. This upgrade was a
+            // SECOND, independent authorization — and an iOS WebView does not send
+            // cookies on it, so the very same page can be judged writable over HTTP
+            // and read-only here. Tell the page what THIS socket actually got: it
+            // stops forwarding input it knows will be dropped, and reports the truth
+            // up to whatever embeds it (the Workbench terminal pane reads it to label
+            // the channel).
+            //
+            // It used to ride the PTY byte stream as an OSC sequence, which the page
+            // then scanned for on EVERY frame — so any process running inside a
+            // read-only terminal could print the same bytes and flip the page's own
+            // write verdict (or DoS itself into read-only). It is now an out-of-band
+            // control frame that MUST be the first message on this socket, sent in the
+            // same synchronous tick that registered it: the page only ever decodes
+            // frame #1 of a connection as control, so PTY output can never be mistaken
+            // for it. Nothing awaits between `wsClients.add` above and this send.
+            try {
+                ws.send(terminalWriteFrame(hasWrite));
+            }
+            catch { /* already closing */ }
             // A signed Dashboard grant is fixed-expiry — for READ scope as much as
             // for write (P1-5). Even if the central proxy's socket invalidation is
             // delayed or bypassed, the worker independently removes any granted
@@ -15502,6 +15813,18 @@ ${loginUrl ? `<a id="login-banner" href="${loginUrl}" target="_top" rel="noopene
 var isTouch='ontouchstart'in window||navigator.maxTouchPoints>0;
 if(isTouch){document.body.classList.add('touch');}
 var hasToken=${hasWrite};
+// hasToken 是**这一次 HTTP GET** 的判定，只当初值。真正说了算的是下面这条：worker 在
+// WebSocket 握手完成时把「这条连接实际拿到什么权限」发下来（OSC 1989 write），落成
+// wsHasWrite。两者会不一致——iOS WebView 的 WS 升级不带 Cookie，页面 HTTP 判可写、
+// WS 却只读，照抄 hasToken 就会让人对着一个不收字的终端打字。null = 还没连上。
+var wsHasWrite=null;
+// 「这条连接拿到什么权限」的解码器 —— 与 worker 侧同一份实现，原样嵌进来（这段页面
+// 代码住在模板字符串里，import 不进来，所以只能一份源码两处跑）。
+// 规则：只在**本连接的第一帧**上尝试，且要求整帧精确匹配。PTY 里跑的进程打出一模
+// 一样的字节也翻不动权限——它永远不可能是第一帧。
+var _wbDecodeWriteFrame=${decodeTerminalWriteFrameSource};
+// 本连接还没消费过首帧。每次 connect() 重置：上一条连接的结论套不到新连接上。
+var _wbFirstFrame=true;
 var platformReadonly=${platformReadonly};
 var remoteScroll=${forceRemoteScroll};
 var localTerminalBackend=${localTerminalBackend};
@@ -15579,6 +15902,39 @@ function _wbApplyAutoFontSize(){
   return true;
 }
 fit.fit();
+// 这条通道到底能不能写，以**已经建立的 WS** 为准（见页面顶部 wsHasWrite 那段注释）。
+// 结论一到手就做两件事：① 页面自己收起输入，别把注定被丢掉的字发出去；② 上抛给嵌入
+// 方（工作台终端面板据此显示「可输入 / 只读」，而不是照抄 HTTP 的 hasToken）。
+// 上抛的目标 origin 绝不用星号：优先取 location.ancestorOrigins（WebKit / Blink 都有，
+// iOS WebView 正是 WebKit），取不到就退回「父页给我们发外观消息时带的那个 origin」；
+// 两者都没有就不发——宁可不上抛，也不广播出去。
+// 注意：这一整段在 worker.ts 的模板字符串里，注释和代码都不能出现反引号，
+// 也不能出现「美元号 + 左花括号」的插值起始序列，否则会把模板字符串截断。
+var _wbParentOrigin=null;
+try{
+  var _wbAo=window.location.ancestorOrigins;
+  if(_wbAo&&_wbAo.length&&_wbAo[0]&&_wbAo[0]!=='null')_wbParentOrigin=_wbAo[0];
+}catch(_e){}
+function _wbPostWrite(){
+  if(window.parent===window||!_wbParentOrigin)return;
+  // wsHasWrite===null 也要上抛：那是「这条连接退回未知」的一次明确通知（重连开始时
+  // 发），嵌入方据此把上一条连接的结论清掉，而不是继续显示一个过期的判定。
+  try{window.parent.postMessage({type:'botmux:wb-terminal-write',write:wsHasWrite},_wbParentOrigin)}catch(_e){}
+}
+function _wbSetWsWrite(v){
+  var changed=wsHasWrite!==v;
+  wsHasWrite=v;
+  if(changed){
+    var _wb=document.getElementById('readonly-banner');
+    // 页面以为自己可写、这条连接其实只读：把只读横幅亮出来。反过来（连上后确认可写）
+    // 就把它收掉，别留一条与事实相反的提示。null（未知）两边都不动：还没有依据。
+    if(_wb&&!platformReadonly){
+      if(v===false&&hasToken)_wb.classList.add('show');
+      else if(v===true)_wb.classList.remove('show');
+    }
+  }
+  _wbPostWrite();
+}
 // 工作台下发的终端外观（消息类型 botmux:wb-appearance）。终端画布住在这个跨文档
 // iframe 里，父页换 class / 换 CSS 变量都传不进来，配色只能靠 postMessage 递过来。
 // 注意：这一整段在 worker.ts 的模板字符串里，注释和代码都不能出现反引号，
@@ -15602,17 +15958,22 @@ window.addEventListener('message',function(_ev){
   if(_ev.source===window||_ev.source!==window.parent)return;
   var _d=_ev.data;
   if(!_d||_d.type!=='botmux:wb-appearance')return;
+  // 这一条消息本身就证明了父页的 origin（来源已经校验过是 window.parent）。
+  // ancestorOrigins 拿不到时（Firefox）靠它补上，并把攒着的写权限结论补发一次。
+  if(!_wbParentOrigin&&_ev.origin&&_ev.origin!=='null'){_wbParentOrigin=_ev.origin;_wbPostWrite();}
   var _theme=_wbSanitizeTheme(_d.theme);
   if(!_theme)return;
   try{
     term.options.theme=_theme;
-    // 阅读风是大行距 1.3；经典保持 xterm 默认的 1，「经典 = 原样」的一部分。
+    // 阅读风走 1.15 的行距；经典保持 xterm 默认的 1，「经典 = 原样」的一部分。
     // 经典那套色值与上面写死的字面量逐色相同，所以没开阅读风的用户零变化。
     // 这两个数字的唯一出处是 WORKBENCH_TERM_LINE_HEIGHTS（agent-workbench-appearance.ts），
     // 接缝测试按那张表比对这一行的字面量：改一处必须两处一起改。
     // 曾经是 1.55，单元格高约 24.5px，CLI 底部那块固定 8 行的 chrome（提示 + 输入框 +
-    // 状态条）就要占掉约 196px —— 一屏四分之一全是 chrome，正文被挤走。
-    term.options.lineHeight=_d.termStyle==='reader'?1.3:1;
+    // 状态条）就要占掉约 196px —— 一屏四分之一全是 chrome，正文被挤走，所以先降到 1.3。
+    // 1.3 对中文密集的 TUI 内容还是偏松：汉字撑满 em 框，行间空隙观感接近隔行，于是
+    // 再收一档到 1.15（单元格高约 18.2px），比经典松一成半，读起来才连成一段。
+    term.options.lineHeight=_d.termStyle==='reader'?1.15:1;
     // 行距变了可视行数就变，必须复算一次。几何契约不动：只有画布内重绘。
     fit.fit();
   }catch(_e){}
@@ -15798,10 +16159,17 @@ function _sendInput(d){if(ws_&&ws_.readyState===1)ws_.send(JSON.stringify({type:
 var _MOTION_RE=/^(?:\\x1b\\[<(?:35|39|43|47|51|55|59|63);\\d+;\\d+[Mm])+$/;
 var _motionPend=null,_motionT=0;
 term.onData(function(d){
-  if(!hasToken){
+  // 只有已建立的 WS 明确回报「可写」(wsHasWrite===true) 才放行输入。null（还没确认，
+  // 含重连中）和 false（这条连接判成只读）一律不发——桌面也要等首帧。照抄 hasToken
+  // （这一次 HTTP GET 的判定）会在 WS 不带 Cookie 的 iOS WebView 上让人对着一个不收字
+  // 的终端打字，按键石沉大海最难自查（第 17 点）。
+  if(wsHasWrite!==true){
     // Mouse escape sequences are input too: a TUI can bind clicks or wheel
     // events to actions. View links never forward terminal bytes.
-    _showReadonlyToast();return;
+    // 已经确定只读（这条连接判 false，或 HTTP GET 本来就没给写）才弹只读提示；null 是
+    // 还没连上的短暂过渡，此时 ws 多半也没 OPEN，静默丢弃即可，别闪一条与事实相反的只读。
+    if(!hasToken||wsHasWrite===false)_showReadonlyToast();
+    return;
   }
   if(_MOTION_RE.test(d)){
     // Trailing throttle: keep only the LATEST motion, flush every 90ms. Hover
@@ -15862,6 +16230,10 @@ if(typeof ResizeObserver!=='undefined'){
   var proto=location.protocol==='https:'?'wss':'ws';
   var ws=new WebSocket(proto+'://'+location.host+base+'/'+location.search);
   ws_=ws;ws.binaryType='arraybuffer';
+  // 新连接 = 新的一次鉴权。上一条连接拿到的权限说明不了这一条，先退回未知（并把这
+  // 个「未知」上抛给嵌入方），等这条连接自己的首帧说话。
+  _wbFirstFrame=true;
+  _wbSetWsWrite(null);
   // Force a resize on every (re)connect: clear the dedup memory first. On
   // reconnect the browser grid is usually unchanged, so without this the
   // dedup in sendResize() would suppress the resize — but a reconnect often
@@ -15871,6 +16243,14 @@ if(typeof ResizeObserver!=='undefined'){
   // (status-line update bleeds into the line below). Always re-assert size.
   ws.onopen=function(){el.textContent='connected';el.className='ok';_lastC=_lastR=0;sendResize()};
   ws.onmessage=function(e){
+    // 带外控制帧只可能是**本连接的第一帧**，而且必须整帧精确匹配（见页面顶部
+    // _wbDecodeWriteFrame 那段注释）。首帧一旦消费掉，这条连接上之后的每一个字节
+    // 就都只是 PTY 输出 —— 里面的进程再怎么打印控制帧的字面量也翻不动权限。
+    if(_wbFirstFrame){
+      _wbFirstFrame=false;
+      var _ctl=_wbDecodeWriteFrame(e.data,true);
+      if(_ctl!==null){_wbSetWsWrite(_ctl);return;}
+    }
     var data=typeof e.data==='string'?e.data:new TextDecoder().decode(e.data);
     // Snapshot-aware Herdr history replaces the buffer instead of appending a
     // mostly-overlapping full screen. Preserve the reader's anchor when older
@@ -15911,7 +16291,15 @@ if(typeof ResizeObserver!=='undefined'){
     if(m){try{_clipBuf=new TextDecoder().decode(Uint8Array.from(atob(m[1]),function(c){return c.charCodeAt(0)}));_doCopy(_clipBuf);_showCopied()}catch(ex){}}
     term.write(data,_settleInitialBottom);
   };
-  ws.onclose=function(){ws_=null;el.textContent='disconnected';el.className='err';setTimeout(connect,2000)};
+  ws.onclose=function(){
+    ws_=null;el.textContent='disconnected';el.className='err';
+    // 关闭当下就把这条连接的写权限退回未知：先复位首帧标志（重连后要等新首帧才恢复
+    // 结论），再 _wbSetWsWrite(null) —— 它同时收起输入（term.onData/toolbar/_fwdScroll
+    // 的门禁都以 wsHasWrite===true 为准）并向嵌入方上抛 write:null。不这样做的话，断线
+    // 到 2 秒后重连的空窗里，页面仍以上一条连接的旧判定放行输入、父页也还显示旧的可写。
+    _wbFirstFrame=true;_wbSetWsWrite(null);
+    setTimeout(connect,2000);
+  };
   ws.onerror=function(){ws.close()};
 })();
 
@@ -15982,6 +16370,12 @@ function _cellAt(clientX,clientY){
 }
 function _fwdScroll(px,coord){
   if((!hasToken&&!readOnlyRemoteScroll)||!ws_||ws_.readyState!==1||!px)return;
+  // 写链路(hasToken)转发的是 type:'input'，与 term.onData / toolbar 同一条判据：只有已
+  // 建立的 WS 明确回报可写(wsHasWrite===true)才放行；null（未确认，含重连中）与 false
+  // （这条连接只读）一律不发——照抄 hasToken 会在 WS 不带 Cookie 时把输入打进一个原地
+  // 丢字的终端（第 17 点）。只读远程滚动(hasToken=false)发的是 type:'scroll'，不是输入，
+  // 不受这道门约束（服务端另有校验）。
+  if(hasToken&&wsHasWrite!==true)return;
   coord=coord||(((term.cols>>1)+1)+';'+((term.rows>>1)+1)); // never (1,1)
   var dir=px<0?-1:1;
   if(_scrollBurstDir&&dir!==_scrollBurstDir){_scrollAccum=0;_scrollBurstTicks=0;}
@@ -16226,6 +16620,9 @@ if(isTouch&&hasToken){
     var press=null;
     function fire(){
       if(!ws_||ws_.readyState!==1)return;
+      // 与 term.onData 同一条判据：只有 WS 明确回报可写(wsHasWrite===true)才发；null
+      // （还没确认）与 false（只读）都不发，桌面也等首帧（第 17 点）。
+      if(wsHasWrite!==true){if(wsHasWrite===false)_showReadonlyToast();return;}
       var k=km[btn.getAttribute('data-k')];
       if(k)ws_.send(JSON.stringify({type:'input',data:k}));
     }
@@ -16598,6 +16995,10 @@ process.on('message', async (raw) => {
             if (msg.locale === 'zh' || msg.locale === 'en') {
                 setDefaultLocale(msg.locale);
             }
+            // Wire user prompt-key overrides into t() so worker-side prompt building
+            // (claude-family `--append-system-prompt` via buildBotmuxSystemPromptText,
+            // mojo catalog, etc.) honours customizations. Idempotent per worker.
+            registerPromptOverrideResolver();
             // Scope session store to this bot's per-bot file.
             // Slice C0: workflow-spawned workers (BOTMUX_WORKFLOW=1) skip this —
             // their `sessionId` is synthetic (`wf-<runId>-<activityId>-...`) and
@@ -17048,12 +17449,23 @@ process.on('message', async (raw) => {
             // shell。bareShellCheckInProgress 覆盖“检查进行中”、bareShellLaunchBlocked
             // 覆盖“仍停在裸 shell 的安全 hold”两种状态，一并入队；若该进程随后出现
             // 真实 PTY prompt 且 leaf 已变为非 shell，markPromptReady 会恢复排空。
+            // Hook-review menus are another direct-write hazard: raw_input normally
+            // preserves busy delivery, but its Enter/arrow sequence must never drive
+            // the menu's current selection.
+            refreshHookReviewInputHold(lastAnalyzerSnapshot || renderer?.rawSnapshot() || '');
             if (cliRestartInProgress || rawInputRestartGate || sessionRenameInFlight()
                 || shouldHoldCodexRunnerInput(codexRunnerFreshness)
                 || injectionFlushing || shouldDeferUserFlush(pendingInjections)
-                || bareShellCheckInProgress || bareShellLaunchBlocked) {
+                || bareShellCheckInProgress || bareShellLaunchBlocked
+                || hookReviewInputHold) {
                 freshnessInputQueue.enqueueRaw(msg);
-                log(`Deferred passthrough slash command until CLI input gate settles: ${msg.content}`);
+                if (hookReviewInputHold) {
+                    notifyHookReviewInputHold();
+                    log(`Deferred passthrough slash command while Hook review is visible: ${msg.content}`);
+                }
+                else {
+                    log(`Deferred passthrough slash command until CLI input gate settles: ${msg.content}`);
+                }
             }
             else {
                 await deliverRawInput(msg);
@@ -17446,6 +17858,15 @@ process.on('message', async (raw) => {
                 log('Late ready signal after timeout fallback — marking prompt ready now');
                 markPromptReady();
             }
+            // CLI 启动确证（SessionStart hook 已跑）：复位连续重启计数——resume 目标
+            // 显然存在且加载成功。这和 prompt 侧复位是同一语义，但更早：2026-08-20
+            // 事故里 resume 后的 CLI 已 ready 二十多秒、还没等到 prompt 复位就被共享
+            // server 抖动误杀，第二次重启因此被 tier-2 强制 FRESH 白丢上下文。到过
+            // ready 的 spawn 崩溃不是「resume 目标不存在」问题，下一轮应有全新预算。
+            if (consecutiveInWorkerRestarts > 0) {
+                log(`SessionStart ready — resetting consecutive restart count (was ${consecutiveInWorkerRestarts})`);
+                consecutiveInWorkerRestarts = 0;
+            }
             if (msg.requestId) {
                 send({ type: 'session_ready_ack', requestId: msg.requestId });
             }
@@ -17946,10 +18367,29 @@ function cleanup() {
     // cleanup retires the lease. SIGKILL residue is reclaimed by the next worker.
     releaseCodexAppPosixOwnerLease();
 }
-process.on('SIGTERM', () => { stopScreenshotLoop(); killCli(); cleanup(); process.exit(0); });
-process.on('SIGINT', () => { stopScreenshotLoop(); killCli(); cleanup(); process.exit(0); });
+/**
+ * A shared existing-App-Server session owns this worker and its bmx-* remote
+ * TUI, but never owns the App Server/thread behind that TUI. On daemon
+ * restart, preserve the remote TUI so the replacement daemon can reattach it;
+ * only retire this worker's HTTP/WebSocket observers. Ordinary managed sessions
+ * retain the historical killCli shutdown path.
+ */
+function shutdownWorkerForParentExit(reason) {
+    stopScreenshotLoop();
+    if (lastInitConfig?.existingAppServerEndpoint) {
+        log(`Preserving existing-App-Server remote TUI during ${reason}`);
+        cleanup();
+        process.exit(0);
+        return;
+    }
+    killCli();
+    cleanup();
+    process.exit(0);
+}
+process.on('SIGTERM', () => shutdownWorkerForParentExit('SIGTERM'));
+process.on('SIGINT', () => shutdownWorkerForParentExit('SIGINT'));
 // If parent daemon dies, IPC channel closes — clean up
-process.on('disconnect', () => { log('Daemon disconnected'); stopScreenshotLoop(); killCli(); cleanup(); process.exit(0); });
+process.on('disconnect', () => { log('Daemon disconnected'); shutdownWorkerForParentExit('IPC disconnect'); });
 // Watchdog: belt-and-braces parent-death detection. SIGTERM and 'disconnect'
 // should both reach us when the daemon dies, but if main thread is stuck in
 // a sync path V8 silently buffers the signal and we end up as a ppid=1
@@ -17966,16 +18406,12 @@ setInterval(() => {
     const currentPpid = process.ppid;
     if (currentPpid !== ORIGINAL_PARENT_PID || currentPpid === 1) {
         log(`Watchdog: parent pid changed (${ORIGINAL_PARENT_PID} → ${currentPpid}) — daemon died, exiting`);
-        stopScreenshotLoop();
         try {
-            killCli();
+            shutdownWorkerForParentExit('parent watchdog');
         }
-        catch { /* best-effort */ }
-        try {
-            cleanup();
+        catch {
+            process.exit(0); /* best-effort exit if teardown itself faults */
         }
-        catch { /* best-effort */ }
-        process.exit(0);
     }
 }, 30_000).unref();
 // ─── Sandbox crash-time teardown ─────────────────────────────────────────────