botmux 3.2.1 → 3.4.0

package/dist/worker.js

@@ -13,12 +13,12 @@
  *   7. On 'restart', kills CLI and re-spawns with --resume
  */
 import { randomBytes } from 'node:crypto';
-import { mkdirSync, writeFileSync, unlinkSync, existsSync, statSync, readdirSync, readlinkSync, readFileSync, realpathSync, copyFileSync, watch as fsWatch, createWriteStream, openSync, closeSync, fstatSync, constants as fsConstants } from 'node:fs';
+import { mkdirSync, writeFileSync, unlinkSync, existsSync, statSync, lstatSync, readdirSync, readlinkSync, readFileSync, realpathSync, copyFileSync, watch as fsWatch, createWriteStream, openSync, closeSync, fstatSync, constants as fsConstants } from 'node:fs';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
 import { join, basename, dirname } from 'node:path';
 import { homedir, tmpdir } from 'node:os';
 import { spawnSync } from 'node:child_process';
-import { evaluateReadIsolationGate, buildSeatbeltProfile, isolatedPaneReattachSafe, sendCredFilePath, botHomePath, buildV2DenyPaths, buildV2DenyRegexes, buildV2CarveOuts, buildReadIsolationProtectedWriteRules, buildCliExecutableReadCarveOuts, buildWriteSandboxRules, buildLinuxReadIsolationMasks, isolationPaneMarkerContent, } from './adapters/cli/read-isolation.js';
+import { evaluateReadIsolationGate, evaluateCredentialOnlyIsolationGate, credentialIsolationRequired, deviceCredentialIsolationMarkerPath, isCredentialIsolationReservedBasename, buildCredentialIsolationRules, buildSeatbeltProfile, isolatedPaneReattachSafe, sendCredFilePath, botHomePath, buildV2DenyPaths, buildV2DenyRegexes, buildV2CarveOuts, buildReadIsolationProtectedWriteRules, buildCliExecutableReadCarveOuts, buildWriteSandboxRules, buildLinuxReadIsolationMasks, isolationPaneMarkerContent, } from './adapters/cli/read-isolation.js';
 import { killPersistentSession } from './core/persistent-backend.js';
 import { readProcessStartIdentity } from './core/session-marker.js';
 import { drainTranscript, joinAssistantText, trailingAssistantText, findJsonlContainingFingerprint, findJsonlsContainingExactContent, findLatestJsonl, extractLastAssistantTurn, extractTurnStartText, splitTranscriptEventsByCutoff } from './services/claude-transcript.js';
@@ -29,7 +29,7 @@ import { canStartInjectionFlush, shouldDeferUserFlush, shouldFlushInjectionsFirs
 import { stripAnsiForLog, tailChars } from './utils/crash-log.js';
 import { CodexUpdateDialogGuard } from './utils/codex-update-dialog.js';
 import { installStdioEpipeGuard, isIgnorableStreamError } from './utils/stdio-epipe-guard.js';
-import { mergeQueuedCliInput, pendingInputMayFlush, pendingInputAllowsTypeAhead, shouldDeferArgsBakedDurablePrompt, shouldStopPendingBatch, terminalReleasesDurableTurn, } from './utils/pending-input-queue.js';
+import { mergeQueuedCliInput, pendingInputMayFlush, pendingInputAllowsTypeAhead, shouldDeferArgsBakedDurablePrompt, shouldDeferInitialPromptForArgLimit, shouldStopPendingBatch, terminalReleasesDurableTurn, } from './utils/pending-input-queue.js';
 import { ReadyGate, shouldArmReadyGate } from './utils/ready-gate.js';
 import { shouldRunStartupCommandsOnSpawn, shouldDeferInitialPromptForStartup } from './core/startup-commands.js';
 import { sanitizePerBotEnv } from './core/per-bot-env.js';
@@ -88,7 +88,8 @@ import { zellijEnv } from './setup/ensure-zellij.js';
 import { isObserveBackend } from './adapters/backend/types.js';
 import { selectSessionBackend, decideBackendGate, backendGateUserMessage } from './adapters/backend/session-backend-selector.js';
 import { deriveRiffReposFromDirs, deriveRiffRepoFromWorkingDir, isValidRiffBaseUrl, isValidRiffSandboxCluster, } from './adapters/backend/riff-backend.js';
-import { prepareSandbox, attachSandboxOutbox, startOutboxWatcher, sandboxEnabled, sandboxedClaudeDataDir, localSandboxApplies } from './adapters/backend/sandbox.js';
+import { prepareSandbox, prepareCredentialOnlySandbox, credentialOnlySandboxAvailable, probeHostCredentialIsolationMechanism, attachSandboxOutbox, startOutboxWatcher, sandboxEnabled, sandboxedClaudeDataDir, localSandboxApplies, } from './adapters/backend/sandbox.js';
+import { DEVICE_AUTHORITY_DIRECTORY, DEVICE_CREDENTIAL_FILE, } from './platform/device-paths.js';
 import { tmuxEnv, probeTmuxFunctionalWithRetry } from './setup/ensure-tmux.js';
 import { tmuxRestartJitterMs } from './core/tmux-recovery.js';
 import { IdleDetector } from './utils/idle-detector.js';
@@ -100,7 +101,7 @@ import { mergeHerdrWebSnapshot, renderHerdrWebHistory, } from './utils/herdr-web
 import { parseWorkerRequestUrl } from './utils/worker-http.js';
 import { detectCliUsageLimit, usageLimitStateKey } from './utils/cli-usage-limit.js';
 import { uploadImageBuffer } from './utils/lark-upload.js';
-import { redactChildEnv } from './utils/child-env.js';
+import { redactChildEnv, scrubSessionCliHomeEnv } from './utils/child-env.js';
 import { decideSubmitConfirmationAction } from './services/submit-confirmation.js';
 import { config, resolveChatBotDiscoveryConfig } from './config.js';
 import * as sessionStore from './services/session-store.js';
@@ -114,6 +115,22 @@ import { resolveCodexAppFinalTurnIdentity } from './adapters/cli/codex-app-turn.
 import { RunnerControlDecoder } from './adapters/cli/runner-control-channel.js';
 import { hasMatchingManagedOriginCapability, managedOriginCapabilityPath, RELAY_ORIGIN_CAPABILITY_BASENAME, replaceManagedOriginCapabilityFile, } from './core/managed-origin-capability.js';
 import { CodexRpcEngine } from './codex-rpc-engine.js';
+// A worker must never trust an INHERITED session-level CLI home pointer
+// (CLAUDE_CONFIG_DIR / CODEX_HOME): a stale pm2 dump can resurrect the daemon
+// with a sibling bot's home baked in (see the index-daemon.ts boot scrub —
+// this one covers any worker spawn path that bypasses it). Scrubbing
+// process.env — not just the spawned child's env — matters because worker-side
+// resolvers consult it dynamically (codex submit confirmation / resume
+// fallback / transcript bridge via services/codex-paths.ts, slash-command
+// discovery), and childEnv is seeded from process.env below: cleaning only one
+// side would leave the worker watching a different data root than the CLI
+// writes (the exact failure mode documented at the isolated-codex re-pin in
+// spawnCli). Per-session values are re-pinned AFTER this scrub — isolation
+// sets process.env.CODEX_HOME / childEnv, adapter spawnEnv re-injects fork
+// dirs. See SESSION_CLI_HOME_ENV_KEYS for why deleting beats pinning a
+// default (~/.claude relocates Claude's state file → onboarding rerun) and
+// why GROK_HOME is exempt.
+scrubSessionCliHomeEnv(process.env);
 // ─── State ───────────────────────────────────────────────────────────────────
 let cliAdapter = null;
 let backend = null;
@@ -673,6 +690,10 @@ let lastCliExitSignal = null;
  *  of per-WS attach-session PTYs. Set in spawnCli's adopt branch. */
 let isPipeMode = false;
 let effectiveBackendType = 'pty';
+/** Worker-owned statement about the confinement attached to the CURRENT CLI
+ * generation. The daemon receives this over private IPC; child-writable PID
+ * marker files remain diagnostics only. */
+let currentCliCredentialIsolated = false;
 /** pty-under-zellij backend (BACKEND_TYPE=zellij). Behaves like the non-tmux
  *  pty path for the worker (renderer screenshots, relay web terminal) but owns
  *  a persistent zellij session that survives daemon restart. */
@@ -736,6 +757,8 @@ function ensureZellijAttachConfig() {
 }
 let sessionId = '';
 let lastInitConfig = null;
+let deferredTopicOutputTail = '';
+const reportedDeferredTopicRoots = new Set();
 const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff' };
 function cliName() { return CLI_DISPLAY_NAMES[lastInitConfig?.cliId ?? ''] ?? 'CLI'; }
 let isPromptReady = false;
@@ -4370,12 +4393,52 @@ function maybeCaptureKiroSessionId(data) {
 function splitCodexAppControl(data) {
     return appRunnerControlDecoder.push(data, APP_RUNNER_OSC_CLI_IDS.has(lastInitConfig?.cliId ?? ''), handleCodexAppMarker);
 }
+/** Riff runs `botmux send` in a remote filesystem, so its local binding
+ * sidecar is invisible to the host daemon. The CLI includes the claimed root
+ * in its success JSON; harvest that trusted-session/turn tuple from terminal
+ * output and forward it over worker IPC. The daemon accepts this relay only
+ * for Riff and verifies the claimed root belongs to the target chat; local
+ * backends use the host-visible sidecar directly. */
+function maybeReportDeferredTopicMaterialization(data) {
+    const run = lastInitConfig?.deferredScheduleRun;
+    if (!run)
+        return;
+    deferredTopicOutputTail = tailChars(deferredTopicOutputTail + stripAnsiForLog(data), 16_000);
+    const lines = deferredTopicOutputTail.split(/\r?\n/);
+    deferredTopicOutputTail = lines.pop() ?? '';
+    for (const line of lines) {
+        const start = line.indexOf('{"success":true');
+        const end = line.lastIndexOf('}');
+        if (start < 0 || end < start)
+            continue;
+        try {
+            const parsed = JSON.parse(line.slice(start, end + 1));
+            const root = parsed.deferredTopicRootMessageId;
+            if (parsed.success !== true
+                || parsed.sessionId !== sessionId
+                || parsed.turnId !== run.turnId
+                || typeof root !== 'string'
+                || !root.startsWith('om_')
+                || reportedDeferredTopicRoots.has(root))
+                continue;
+            reportedDeferredTopicRoots.add(root);
+            send({
+                type: 'deferred_topic_materialized',
+                sessionId,
+                turnId: run.turnId,
+                rootMessageId: root,
+            });
+        }
+        catch { /* not a botmux send JSON line */ }
+    }
+}
 // ─── Prompt Detection ────────────────────────────────────────────────────────
 function onPtyData(data) {
     data = splitCodexAppControl(data);
     if (data.length === 0)
         return;
     lastPtyActivityAtMs = Date.now();
+    maybeReportDeferredTopicMaterialization(data);
     maybeCaptureKiroSessionId(data);
     captureWorkflowTranscript(data);
     renderer?.write(data);
@@ -5523,6 +5586,40 @@ function scheduleBusyPatternIdleProbe(source) {
 }
 async function spawnCli(cfg, opts = {}) {
     clearSessionRenameInFlight();
+    currentCliCredentialIsolated = false;
+    // Enrollment writes the fixed marker before any device credential appears.
+    // From that instant onward every NEW local CLI must carry a credential
+    // boundary, regardless of adapter capability or optional sandbox toggles.
+    // lstat (not existsSync) deliberately treats a hostile/broken symlink as a
+    // present authority signal and therefore fails closed.
+    const hostHomeDir = homedir();
+    const defaultBotmuxHome = join(hostHomeDir, '.botmux');
+    const configuredBotmuxHome = process.env.SESSION_DATA_DIR
+        ? dirname(process.env.SESSION_DATA_DIR)
+        : defaultBotmuxHome;
+    const hostEntryExistsNoFollow = (path) => {
+        try {
+            lstatSync(path);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const deviceIsolationMarkerExists = hostEntryExistsNoFollow(deviceCredentialIsolationMarkerPath(hostHomeDir));
+    const deviceCredentialExists = [...new Set([defaultBotmuxHome, configuredBotmuxHome])]
+        .some(root => hostEntryExistsNoFollow(join(root, DEVICE_AUTHORITY_DIRECTORY, DEVICE_CREDENTIAL_FILE))
+        // Upgrade fail-safe: a pre-dedicated-directory credential still activates
+        // mandatory confinement until the host explicitly removes/migrates it.
+        || hostEntryExistsNoFollow(join(root, DEVICE_CREDENTIAL_FILE)));
+    const mandatoryCredentialIsolation = credentialIsolationRequired({
+        markerExists: deviceIsolationMarkerExists,
+        deviceCredentialExists,
+    });
+    if (mandatoryCredentialIsolation && cfg.adoptMode) {
+        throw new Error(`[device-credential-isolation] refusing adopt session ${cfg.sessionId}: `
+            + 'an already-running external CLI cannot be retrofitted with the mandatory credential boundary');
+    }
     // (startupCommands one-shot is re-armed below, AFTER the reattach-vs-fresh
     // prediction — only a genuinely fresh CLI process replays them; see
     // willReattachPersistent.)
@@ -5746,6 +5843,15 @@ async function spawnCli(cfg, opts = {}) {
             sessionEnv.BOTMUX_ROOT_MESSAGE_ID = cfg.rootMessageId;
         if (cfg.turnId)
             sessionEnv.BOTMUX_TURN_ID = cfg.turnId;
+        if (cfg.deferredScheduleRun) {
+            sessionEnv.BOTMUX_DEFERRED_SCHEDULE_TASK_ID = cfg.deferredScheduleRun.taskId;
+            sessionEnv.BOTMUX_DEFERRED_SCHEDULE_TURN_ID = cfg.deferredScheduleRun.turnId;
+            sessionEnv.BOTMUX_DEFERRED_SCHEDULE_ROUTING_ANCHOR = cfg.deferredScheduleRun.routingAnchor;
+            sessionEnv.BOTMUX_DEFERRED_SCHEDULE_CREATED_AT = cfg.deferredScheduleRun.createdAt;
+            if (cfg.deferredScheduleRun.topicTitle) {
+                sessionEnv.BOTMUX_DEFERRED_SCHEDULE_TOPIC_TITLE = cfg.deferredScheduleRun.topicTitle;
+            }
+        }
         // Turn sender so `--mention-back` can resolve an @ target in the sandbox.
         if (cfg.ownerOpenId)
             sessionEnv.BOTMUX_OWNER_OPEN_ID = cfg.ownerOpenId;
@@ -5873,6 +5979,56 @@ async function spawnCli(cfg, opts = {}) {
     // established (unsandboxable backend, no SESSION_DATA_DIR) is a hard error at the
     // spawn site below, never a silent unconfined run.
     const willWriteSandbox = process.platform === 'darwin' && wantsFileSandbox;
+    if (willWriteSandbox && !process.env.SESSION_DATA_DIR) {
+        throw new Error(`[file-sandbox] refusing to start session ${cfg.sessionId}: missing SESSION_DATA_DIR`);
+    }
+    const fullIsolationCoversCredentials = !riffRemoteBackend && ((process.platform === 'darwin' && (willReadIsolate || willWriteSandbox))
+        || (process.platform === 'linux' && wantsFileSandbox));
+    let credentialMechanismAvailable = true;
+    let credentialMechanismExecutable;
+    if (mandatoryCredentialIsolation && !riffRemoteBackend && !fullIsolationCoversCredentials) {
+        if (process.platform === 'darwin') {
+            const probe = probeHostCredentialIsolationMechanism();
+            credentialMechanismAvailable = probe.supported;
+            if (probe.supported)
+                credentialMechanismExecutable = probe.executable;
+        }
+        else {
+            credentialMechanismAvailable = process.platform === 'linux'
+                ? credentialOnlySandboxAvailable()
+                : false;
+        }
+    }
+    const credentialIsolationGate = evaluateCredentialOnlyIsolationGate({
+        markerExists: deviceIsolationMarkerExists,
+        deviceCredentialExists,
+        remoteBackend: riffRemoteBackend,
+        platform: process.platform,
+        mechanismAvailable: credentialMechanismAvailable,
+        fullIsolationCoversCredentials,
+    });
+    if (credentialIsolationGate.mode === 'blocked') {
+        throw new Error(`[device-credential-isolation] refusing to start session ${cfg.sessionId}: `
+            + credentialIsolationGate.failClosedReason);
+    }
+    const credentialBoundaryActive = credentialIsolationGate.required
+        && credentialIsolationGate.mode !== 'remote-bypass';
+    const credentialOnlySeatbelt = credentialIsolationGate.mode === 'seatbelt';
+    const credentialOnlyBwrap = credentialIsolationGate.mode === 'bwrap';
+    const appliedIsolationCapabilities = [];
+    if (credentialBoundaryActive
+        || willReadIsolate
+        || (process.platform === 'linux' && wantsFileSandbox)) {
+        appliedIsolationCapabilities.push('credential');
+    }
+    if (willReadIsolate)
+        appliedIsolationCapabilities.push('read');
+    if (willWriteSandbox || (process.platform === 'linux' && wantsFileSandbox)) {
+        appliedIsolationCapabilities.push('write');
+    }
+    currentCliCredentialIsolated = appliedIsolationCapabilities.includes('credential');
+    const isolationRuntimeDataDir = process.env.SESSION_DATA_DIR
+        ?? join(defaultBotmuxHome, 'data');
     // Every bot — isolated OR not — gets its own BOT_HOME dir as a ready-made private-
     // storage slot. An isolated sibling denies this path regardless of whether the owner
     // is isolated (deny uses the full bots.json), so a non-isolated bot can drop private
@@ -5954,7 +6110,7 @@ async function spawnCli(cfg, opts = {}) {
     // so the probe below sees no pane and we cold-spawn fresh isolated. A current-
     // policy pane survives daemon restarts and suspend→resume safely because the
     // confinement remains attached to the live process.
-    if ((willReadIsolate || willWriteSandbox) && persistentSessionName && effectiveBackendType !== 'pty') {
+    if (appliedIsolationCapabilities.length > 0 && persistentSessionName && effectiveBackendType !== 'pty') {
         const paneLive = effectiveBackendType === 'tmux'
             ? TmuxBackend.hasSession(persistentSessionName)
             : effectiveBackendType === 'zellij'
@@ -5962,8 +6118,8 @@ async function spawnCli(cfg, opts = {}) {
                 : HerdrBackend.hasSession(persistentSessionName);
         if (paneLive) {
             let marker = null;
-            marker = readRegularHostFileNoFollow(join(process.env.SESSION_DATA_DIR ?? '', 'read-isolation', `${cfg.sessionId}.boot`));
-            if (isolatedPaneReattachSafe(marker)) {
+            marker = readRegularHostFileNoFollow(join(isolationRuntimeDataDir, 'read-isolation', `${cfg.sessionId}.boot`));
+            if (isolatedPaneReattachSafe(marker, appliedIsolationCapabilities)) {
                 // Pane was spawned under the current isolation policy → still confined
                 // on the running process across daemon restarts; warm reattach preserves
                 // resume/context + tmux idle-suspend.
@@ -6135,6 +6291,8 @@ async function spawnCli(cfg, opts = {}) {
     // Also defer on RESUME for adapters whose initial-prompt launch flag is
     // silently ignored when continuing a session (OpenCode `--prompt` + `-s`):
     // baking it into args would drop the message that triggered the resume.
+    // Finally, defer adapter-declared over-limit prompts to avoid backend command
+    // string limits (tmux "command too long") while preserving short argv prompts.
     const deferInitialPrompt = shouldDeferInitialPromptForStartup({
         hasStartupCommands: !!cfg.startupCommands?.length,
         adoptMode: cfg.adoptMode === true,
@@ -6143,7 +6301,12 @@ async function spawnCli(cfg, opts = {}) {
         passesInitialPromptViaArgs: cliAdapter.passesInitialPromptViaArgs === true,
         adoptMode: cfg.adoptMode === true,
         dispatchAttempt: cfg.dispatchAttempt,
-    }) || (effectiveResume && cliAdapter.initialPromptArgsIgnoredOnResume === true);
+    }) || (effectiveResume && cliAdapter.initialPromptArgsIgnoredOnResume === true)
+        || shouldDeferInitialPromptForArgLimit({
+            passesInitialPromptViaArgs: cliAdapter.passesInitialPromptViaArgs === true,
+            prompt: cfg.prompt,
+            maxInitialPromptArgBytes: cliAdapter.maxInitialPromptArgBytes,
+        });
     kiroSessionIdCaptureArmed = cfg.cliId === 'kiro-cli' && !effectiveCliSessionId && !willReattachPersistent;
     kiroSessionIdCaptureBuffer = '';
     // Per-bot local read isolation: assemble the Seatbelt profile context (the gate
@@ -6196,16 +6359,20 @@ async function spawnCli(cfg, opts = {}) {
         const sessionDataDir = process.env.SESSION_DATA_DIR;
         // Regex rules cannot be realpath'd after construction, so build their home
         // prefix from the canonical path up front (Seatbelt matches canonical paths).
-        const sandboxHome = (() => { try {
-            return realpathSync(homedir());
-        }
-        catch {
-            return homedir();
-        } })();
+        const canonicalSandboxPath = (path) => {
+            try {
+                return realpathSync(path);
+            }
+            catch {
+                return path;
+            }
+        };
+        const sandboxHome = canonicalSandboxPath(homedir());
         writeSandboxRules = buildWriteSandboxRules({
             homeDir: sandboxHome,
-            botmuxHome: dirname(sessionDataDir),
-            sessionDataDir,
+            botmuxHome: canonicalSandboxPath(dirname(sessionDataDir)),
+            defaultBotmuxHome: canonicalSandboxPath(join(homedir(), '.botmux')),
+            sessionDataDir: canonicalSandboxPath(sessionDataDir),
             workingDir: cfg.workingDir,
             currentAppId: cfg.larkAppId,
             // TMPDIR on macOS resolves under /private/var/folders (already allowed), but
@@ -6324,6 +6491,15 @@ async function spawnCli(cfg, opts = {}) {
         delete childEnv.BOTMUX_CHAT_TYPE;
     childEnv.BOTMUX_LARK_APP_ID = cfg.larkAppId;
     childEnv.BOTMUX_ROOT_MESSAGE_ID = cfg.rootMessageId;
+    // Session owner under the standard BOTMUX_* name (the riff backend already
+    // exposes it; `__OWNER_OPEN_ID` stays for back-compat). Custom CLI wrappers
+    // use it for per-user permission isolation. Advisory identity only — botmux's
+    // own authz paths (v3 command authority, host.ts) ignore env owner values and
+    // resolve the current-turn caller from turn provenance instead.
+    if (cfg.ownerOpenId)
+        childEnv.BOTMUX_OWNER_OPEN_ID = cfg.ownerOpenId;
+    else
+        delete childEnv.BOTMUX_OWNER_OPEN_ID;
     // NOTE: under read isolation `botmux send` gets this bot's secret from the worker-
     // written cred FILE in its BOT_HOME (send-cred.json, see sendCredFilePath) located
     // via the BOTMUX_LARK_APP_ID above — NOT from the env. The secret is deliberately kept OUT
@@ -6353,11 +6529,16 @@ async function spawnCli(cfg, opts = {}) {
     // them past the server's global env.
     if (cliAdapter.spawnEnv)
         Object.assign(childEnv, cliAdapter.spawnEnv);
-    // v2 read isolation: point the CLI at its PER-BOT config dir (set AFTER spawnEnv so
-    // it overrides any adapter default). claude → CLAUDE_CONFIG_DIR, codex → CODEX_HOME.
-    // Both are in BOTMUX_INJECTED_ENV_KEYS so the tmux backend forwards them into the
-    // pane; without this the CLI falls back to the global ~/.claude|~/.codex which the
-    // Seatbelt wrapper denies → it can't read its own data and won't start.
+    // v2 read isolation: point the CLI at its PER-BOT config dir (set AFTER spawnEnv
+    // so it overrides any adapter default). claude → CLAUDE_CONFIG_DIR, codex →
+    // CODEX_HOME. Both are in BOTMUX_INJECTED_ENV_KEYS so the tmux backend forwards
+    // them into the pane; without this the CLI falls back to the global
+    // ~/.claude|~/.codex which the Seatbelt wrapper denies → it can't read its own
+    // data and won't start. Non-isolated sessions get NO explicit value: the
+    // worker-boot scrubSessionCliHomeEnv (module top) plus the pane wrapper's
+    // unset clause (PANE_ENV_UNSET_CLAUSE covers BOTMUX_INJECTED_ENV_KEYS)
+    // already guarantee the pane starts clean, and the CLI's built-in default
+    // preserves stock semantics.
     if (isolationBotHome) {
         if (claudeDataDir)
             childEnv.CLAUDE_CONFIG_DIR = claudeDataDir; // = <BOT_HOME>/claude
@@ -6448,6 +6629,31 @@ async function spawnCli(cfg, opts = {}) {
                 sessionDataDirs: [readIsolationCtx.sessionDataDir],
             });
         }
+        if (credentialBoundaryActive) {
+            const credentialRules = buildCredentialIsolationRules({
+                homeDir: canonical(hostHomeDir),
+                botmuxHome: canonical(configuredBotmuxHome),
+                defaultBotmuxHome: canonical(defaultBotmuxHome),
+            });
+            denyPaths = [...new Set([...denyPaths, ...credentialRules.denyPaths.map(canonical)])];
+            denyRegexes = [...new Set([...denyRegexes, ...credentialRules.denyRegexes])];
+            protectedWrites = {
+                denyWritePaths: [...new Set([
+                        ...(protectedWrites?.denyWritePaths ?? []),
+                        ...credentialRules.denyWritePaths.map(canonical),
+                    ])],
+                denyWriteRegexes: [...new Set([
+                        ...(protectedWrites?.denyWriteRegexes ?? []),
+                        ...credentialRules.denyWriteRegexes,
+                    ])],
+                denyWriteLiterals: [...new Set([
+                        ...(protectedWrites?.denyWriteLiterals ?? []),
+                        ...credentialRules.denyWriteLiterals.map(canonical),
+                        defaultBotmuxHome,
+                        configuredBotmuxHome,
+                    ])],
+            };
+        }
         if (mcpRuntimeManifest) {
             finalDenyPaths.push(...sessionMcpRuntimeHostOnlyPaths(mcpRuntimeManifest, config.session.dataDir).map(canonical));
         }
@@ -6473,29 +6679,30 @@ async function spawnCli(cfg, opts = {}) {
                 allowWritePaths: writeSandboxRules.allowWritePaths.map(canonical),
                 allowWriteRegexes: writeSandboxRules.allowWriteRegexes,
                 denyWritePaths: writeSandboxRules.denyWritePaths.map(canonical),
+                denyWriteRegexes: writeSandboxRules.denyWriteRegexes,
             }
             : undefined;
         if (!locateOnPath('sandbox-exec')) {
             throw new Error(`[file-sandbox] refusing to start session ${cfg.sessionId}: sandbox-exec not found`);
         }
-        const profileDir = join(process.env.SESSION_DATA_DIR, 'read-isolation');
+        const profileDir = join(isolationRuntimeDataDir, 'read-isolation');
         mkdirSync(profileDir, { recursive: true });
         const profilePath = join(profileDir, `${cfg.sessionId}.sb`);
         replaceManagedOriginCapabilityFile(profilePath, buildSeatbeltProfile(denyPaths, allowPaths, finalDenyPaths, traverseDirs, denyRegexes, writeRules, protectedWrites));
         seatbeltProfilePath = profilePath;
         spawnArgs = ['-f', profilePath, spawnBin, ...spawnArgs];
-        spawnBin = 'sandbox-exec';
+        spawnBin = credentialMechanismExecutable ?? '/usr/bin/sandbox-exec';
         log(`[file-sandbox] wrapping ${cliAdapter.id} in Seatbelt (read-isolation=${!!readIsolationCtx}, write-sandbox=${!!writeRules}): sandbox-exec -f ${profilePath}`);
     }
     // Fresh sandboxed spawn on a persistent backend: stamp the pane with this daemon's
     // policy version + boot id so a later suspend→resume reattach can be trusted (see the stale-pane
     // guard above). Applies to read-isolation AND write-sandbox panes (both carry the
     // Seatbelt confinement on the live process). pty needs no marker (never reattached).
-    if ((readIsolationCtx || writeSandboxRules) && persistentSessionName && !willReattachPersistent) {
+    if (appliedIsolationCapabilities.length > 0 && persistentSessionName && !willReattachPersistent) {
         try {
-            const markerDir = join(process.env.SESSION_DATA_DIR, 'read-isolation');
+            const markerDir = join(isolationRuntimeDataDir, 'read-isolation');
             mkdirSync(markerDir, { recursive: true });
-            replaceManagedOriginCapabilityFile(join(markerDir, `${cfg.sessionId}.boot`), isolationPaneMarkerContent(cfg.daemonBootId ?? ''));
+            replaceManagedOriginCapabilityFile(join(markerDir, `${cfg.sessionId}.boot`), isolationPaneMarkerContent(cfg.daemonBootId ?? '', appliedIsolationCapabilities));
         }
         catch { /* non-fatal: worst case a same-lifetime reattach cold-spawns instead */ }
     }
@@ -6748,6 +6955,143 @@ async function spawnCli(cfg, opts = {}) {
             }
         }
     }
+    // Mandatory credential-only confinement is the OUTERMOST launch wrapper so
+    // wrapperCli and every descendant it starts inherit the boundary. Full
+    // Seatbelt/bwrap sessions were already wrapped above and never enter these
+    // branches (gate mode `covered`), avoiding nested/double sandboxes.
+    if (!willReattachPersistent && credentialOnlySeatbelt) {
+        const canonical = (path) => {
+            try {
+                return realpathSync(path);
+            }
+            catch {
+                return path;
+            }
+        };
+        const rules = buildCredentialIsolationRules({
+            homeDir: canonical(hostHomeDir),
+            botmuxHome: canonical(configuredBotmuxHome),
+            defaultBotmuxHome: canonical(defaultBotmuxHome),
+        });
+        const profileDir = join(isolationRuntimeDataDir, 'read-isolation');
+        mkdirSync(profileDir, { recursive: true });
+        const profilePath = join(profileDir, `${cfg.sessionId}.sb`);
+        replaceManagedOriginCapabilityFile(profilePath, buildSeatbeltProfile(rules.denyPaths.map(canonical), [], [], [], rules.denyRegexes, undefined, {
+            denyWritePaths: [...new Set([
+                    ...rules.denyWritePaths.map(canonical),
+                    canonical(profileDir),
+                ])],
+            denyWriteRegexes: rules.denyWriteRegexes,
+            denyWriteLiterals: [...new Set([
+                    ...rules.denyWriteLiterals.map(canonical),
+                    canonical(profileDir),
+                    defaultBotmuxHome,
+                    configuredBotmuxHome,
+                ])],
+        }));
+        seatbeltProfilePath = profilePath;
+        spawnArgs = ['-f', profilePath, spawnBin, ...spawnArgs];
+        // Absolute path only: a pre-activation unconfined CLI could plant a fake
+        // sandbox-exec earlier on PATH. Prefer the probe result; fall back to the
+        // well-known system location used by full Seatbelt wrapping above.
+        spawnBin = credentialMechanismExecutable ?? '/usr/bin/sandbox-exec';
+        log(`[device-credential-isolation] wrapping ${cliAdapter.id} in credential-only Seatbelt: ${spawnBin} -f ${profilePath}`);
+    }
+    if (!willReattachPersistent && credentialOnlyBwrap) {
+        const panePolicyDir = join(isolationRuntimeDataDir, 'read-isolation');
+        mkdirSync(panePolicyDir, { recursive: true });
+        const hideDirectories = new Set();
+        const hideFiles = new Set();
+        const processedRoots = new Set();
+        const isDashboardAuthorityBasename = (name) => name === '.dashboard-secret'
+            || name.startsWith('.dashboard-secret.')
+            || name === '.dashboard-token'
+            || name.startsWith('.dashboard-token.');
+        for (const rawRoot of [defaultBotmuxHome, configuredBotmuxHome]) {
+            let root = rawRoot;
+            try {
+                root = realpathSync(rawRoot);
+            }
+            catch { /* gate authority root is checked below */ }
+            if (processedRoots.has(root))
+                continue;
+            let rootStat;
+            try {
+                rootStat = lstatSync(root);
+            }
+            catch {
+                // An unrelated/default root can be absent when the activation signal
+                // came from a custom BOTMUX_HOME. At least one signalled root must
+                // survive; the builder below rejects an empty root set.
+                continue;
+            }
+            if (!rootStat.isDirectory()) {
+                throw new Error(`[device-credential-isolation] authority root is not a directory: ${rawRoot}`);
+            }
+            processedRoots.add(root);
+            const authorityDirectory = join(root, DEVICE_AUTHORITY_DIRECTORY);
+            try {
+                const authorityStat = lstatSync(authorityDirectory);
+                if (!authorityStat.isDirectory()) {
+                    throw new Error(`[device-credential-isolation] device authority path is not a directory: ${authorityDirectory}`);
+                }
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                // A fixed empty mount target lets the child mask the entire authority
+                // namespace while leaving BOTMUX_HOME itself live and writable.
+                mkdirSync(authorityDirectory, { mode: 0o700 });
+            }
+            hideDirectories.add(realpathSync(authorityDirectory));
+            for (const name of readdirSync(root)) {
+                if (name === DEVICE_AUTHORITY_DIRECTORY)
+                    continue;
+                if (!isCredentialIsolationReservedBasename(name)
+                    && !isDashboardAuthorityBasename(name))
+                    continue;
+                const entry = join(root, name);
+                try {
+                    const stat = lstatSync(entry);
+                    if (!stat.isFile()) {
+                        // Never follow a host-authority symlink or special file. Exact mask
+                        // destinations must be stable regular files or the launch fails
+                        // closed before an untrusted CLI starts.
+                        throw new Error(`[device-credential-isolation] authority entry is not a regular file: ${entry}`);
+                    }
+                    hideFiles.add(entry);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                    // A racing removal needs no mask; a later exact credential rotation
+                    // is host-only and the long-lived device secret namespace itself is
+                    // protected wholesale above.
+                }
+            }
+        }
+        let credentialCliBin = spawnBin;
+        try {
+            credentialCliBin = realpathSync(spawnBin);
+        }
+        catch { /* spawn will fail closed if unresolved */ }
+        const credentialSandbox = prepareCredentialOnlySandbox({
+            hideDirectories: [...hideDirectories],
+            hideFiles: [...hideFiles],
+            readonlyPaths: [realpathSync(panePolicyDir)],
+            workingDir: spawnCwd,
+            cliBin: credentialCliBin,
+            cliArgs: spawnArgs,
+        });
+        if (!credentialSandbox) {
+            throw new Error(`[device-credential-isolation] refusing to start session ${cfg.sessionId}: `
+                + 'credential-only bubblewrap could not be established');
+        }
+        spawnBin = credentialSandbox.bin;
+        spawnArgs = credentialSandbox.args;
+        log(`[device-credential-isolation] wrapping ${cliAdapter.id} in credential-only bwrap `
+            + `(${hideDirectories.size} authority dir(s), ${hideFiles.size} exact file(s))`);
+    }
     backend.spawn(spawnBin, spawnArgs, {
         cwd: spawnCwd,
         cols: PTY_COLS,
@@ -6760,6 +7104,7 @@ async function spawnCli(cfg, opts = {}) {
     // can verify they were spawned inside a botmux session by walking the
     // process tree and looking for a matching pid file in this directory.
     const cliPid = backend.getChildPid?.();
+    publishLocalProcessAttestation(cliPid ?? undefined);
     if (cliPid && process.env.SESSION_DATA_DIR) {
         const markersDir = join(process.env.SESSION_DATA_DIR, '.botmux-cli-pids');
         try {
@@ -6802,6 +7147,7 @@ async function spawnCli(cfg, opts = {}) {
                 // Per-tick maybeFollowSessionRotationViaPid (bridge 1s poller) reads the
                 // module-level bridgeCliPid and re-points to the real CLI's jsonl.
                 bridgeCliPid = realPid;
+                publishLocalProcessAttestation(realPid);
             },
             schedule: (fn, ms) => { setTimeout(fn, ms); },
         });
@@ -6836,6 +7182,7 @@ async function spawnCli(cfg, opts = {}) {
                 return;
             const pid = backend.getChildPid?.();
             if (pid) {
+                publishLocalProcessAttestation(pid);
                 if (process.env.SESSION_DATA_DIR && !cliPidMarker) {
                     try {
                         const markersDir = join(process.env.SESSION_DATA_DIR, '.botmux-cli-pids');
@@ -7241,6 +7588,7 @@ async function spawnCli(cfg, opts = {}) {
     }
 }
 function killCli(opts = {}) {
+    currentCliCredentialIsolated = false;
     stopSessionMcpGatewayHost();
     stopCodexRpcEngine();
     destroyCrashDiagnosticTerminal('killCli');
@@ -8551,6 +8899,16 @@ function send(msg) {
     }
     process.send?.(payload);
 }
+function publishLocalProcessAttestation(cliPid) {
+    const cliProcStart = cliPid ? readProcessStartIdentity(cliPid) : undefined;
+    send({
+        type: 'local_process_attestation',
+        backendType: effectiveBackendType,
+        credentialIsolated: currentCliCredentialIsolated,
+        ...(cliPid ? { cliPid } : {}),
+        ...(cliProcStart ? { cliProcStart } : {}),
+    });
+}
 /** Deliver a terminal IPC message before exiting the worker. `process.send()`
  * only queues asynchronously; calling process.exit() on the next line can drop
  * the exact startup diagnostic the user needs and recreate the silent-bot bug.
@@ -8711,7 +9069,12 @@ process.on('message', async (raw) => {
                     passesInitialPromptViaArgs: cliAdapter?.passesInitialPromptViaArgs === true,
                     adoptMode: msg.adoptMode === true,
                     dispatchAttempt: msg.dispatchAttempt,
-                }) || (msg.adoptMode !== true && lastSpawnEffectiveResume && cliAdapter?.initialPromptArgsIgnoredOnResume === true);
+                }) || (msg.adoptMode !== true && lastSpawnEffectiveResume && cliAdapter?.initialPromptArgsIgnoredOnResume === true)
+                    || shouldDeferInitialPromptForArgLimit({
+                        passesInitialPromptViaArgs: cliAdapter?.passesInitialPromptViaArgs === true,
+                        prompt: msg.prompt,
+                        maxInitialPromptArgBytes: cliAdapter?.maxInitialPromptArgBytes,
+                    });
                 if (msg.prompt && cliAdapter?.passesInitialPromptViaArgs && !deferInitialPrompt && codexBridgeFallbackActive()) {
                     // Args-baked first prompts (notably Pi) never pass through the normal
                     // 'message' IPC path, so the structured bridge would otherwise see the