botmux 3.3.0 → 3.4.1

package/dist/worker.js

@@ -13,18 +13,18 @@
  *   7. On 'restart', kills CLI and re-spawns with --resume
  */
 import { randomBytes } from 'node:crypto';
-import { mkdirSync, writeFileSync, unlinkSync, existsSync, statSync, readdirSync, readlinkSync, readFileSync, realpathSync, copyFileSync, watch as fsWatch, createWriteStream, openSync, closeSync, fstatSync, constants as fsConstants } from 'node:fs';
+import { mkdirSync, writeFileSync, unlinkSync, existsSync, statSync, lstatSync, readdirSync, readlinkSync, readFileSync, realpathSync, copyFileSync, watch as fsWatch, createWriteStream, openSync, closeSync, fstatSync, constants as fsConstants } from 'node:fs';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
 import { join, basename, dirname } from 'node:path';
 import { homedir, tmpdir } from 'node:os';
 import { spawnSync } from 'node:child_process';
-import { evaluateReadIsolationGate, buildSeatbeltProfile, isolatedPaneReattachSafe, sendCredFilePath, botHomePath, buildV2DenyPaths, buildV2DenyRegexes, buildV2CarveOuts, buildReadIsolationProtectedWriteRules, buildCliExecutableReadCarveOuts, buildWriteSandboxRules, buildLinuxReadIsolationMasks, isolationPaneMarkerContent, } from './adapters/cli/read-isolation.js';
+import { evaluateReadIsolationGate, evaluateCredentialOnlyIsolationGate, credentialIsolationRequired, deviceCredentialIsolationMarkerPath, isCredentialIsolationReservedBasename, buildCredentialIsolationRules, buildSeatbeltProfile, isolatedPaneReattachSafe, sendCredFilePath, botHomePath, buildV2DenyPaths, buildV2DenyRegexes, buildV2CarveOuts, buildReadIsolationProtectedWriteRules, buildCliExecutableReadCarveOuts, buildWriteSandboxRules, buildLinuxReadIsolationMasks, isolationPaneMarkerContent, } from './adapters/cli/read-isolation.js';
 import { killPersistentSession } from './core/persistent-backend.js';
 import { readProcessStartIdentity } from './core/session-marker.js';
 import { drainTranscript, joinAssistantText, trailingAssistantText, findJsonlContainingFingerprint, findJsonlsContainingExactContent, findLatestJsonl, extractLastAssistantTurn, extractTurnStartText, splitTranscriptEventsByCutoff } from './services/claude-transcript.js';
 import { BridgeTurnQueue, makeFingerprint, normaliseForFingerprint } from './services/bridge-turn-queue.js';
 import { shouldSuppressBridgeEmit } from './services/bridge-fallback-gate.js';
-import { shouldReleaseFirstPromptTimeout, shouldWriteNow } from './utils/input-gate.js';
+import { decideHardTimeoutAction, decideSettleMarkReady, shouldReleaseFirstPromptTimeout, shouldWriteNow } from './utils/input-gate.js';
 import { canStartInjectionFlush, shouldDeferUserFlush, shouldFlushInjectionsFirst } from './core/inject-queue-policy.js';
 import { stripAnsiForLog, tailChars } from './utils/crash-log.js';
 import { CodexUpdateDialogGuard } from './utils/codex-update-dialog.js';
@@ -88,7 +88,8 @@ import { zellijEnv } from './setup/ensure-zellij.js';
 import { isObserveBackend } from './adapters/backend/types.js';
 import { selectSessionBackend, decideBackendGate, backendGateUserMessage } from './adapters/backend/session-backend-selector.js';
 import { deriveRiffReposFromDirs, deriveRiffRepoFromWorkingDir, isValidRiffBaseUrl, isValidRiffSandboxCluster, } from './adapters/backend/riff-backend.js';
-import { prepareSandbox, attachSandboxOutbox, startOutboxWatcher, sandboxEnabled, sandboxedClaudeDataDir, localSandboxApplies } from './adapters/backend/sandbox.js';
+import { prepareSandbox, prepareCredentialOnlySandbox, credentialOnlySandboxAvailable, probeHostCredentialIsolationMechanism, attachSandboxOutbox, startOutboxWatcher, sandboxEnabled, sandboxedClaudeDataDir, localSandboxApplies, } from './adapters/backend/sandbox.js';
+import { DEVICE_AUTHORITY_DIRECTORY, DEVICE_CREDENTIAL_FILE, } from './platform/device-paths.js';
 import { tmuxEnv, probeTmuxFunctionalWithRetry } from './setup/ensure-tmux.js';
 import { tmuxRestartJitterMs } from './core/tmux-recovery.js';
 import { IdleDetector } from './utils/idle-detector.js';
@@ -689,6 +690,10 @@ let lastCliExitSignal = null;
  *  of per-WS attach-session PTYs. Set in spawnCli's adopt branch. */
 let isPipeMode = false;
 let effectiveBackendType = 'pty';
+/** Worker-owned statement about the confinement attached to the CURRENT CLI
+ * generation. The daemon receives this over private IPC; child-writable PID
+ * marker files remain diagnostics only. */
+let currentCliCredentialIsolated = false;
 /** pty-under-zellij backend (BACKEND_TYPE=zellij). Behaves like the non-tmux
  *  pty path for the worker (renderer screenshots, relay web terminal) but owns
  *  a persistent zellij session that survives daemon restart. */
@@ -832,6 +837,15 @@ let isSettlingFirstFlush = false;
  *  ready yet, or flushPending will be blocked by isSettlingFirstFlush and a
  *  later markPromptReady call would return early with the first prompt stranded. */
 let promptReadyDetectedDuringSettle = false;
+/** While the ready-gate is holding, the IdleDetector may still fire on a real
+ *  readyPattern (e.g. Hermes's ❯) — proving the input box exists — but
+ *  markPromptReady() returns early because the gate is armed. Record that the
+ *  pattern was seen so the gate's timeout-fallback settle can mark the prompt
+ *  ready immediately instead of delivering into a !isPromptReady state that
+ *  flushPending() rejects for non-type-ahead adapters. Without this, a Hermes
+ *  spawn that renders ❯ but never fires BOTMUX_READY_COMMAND waits the full
+ *  hard timeout (and previously never delivered at all). */
+let readyPatternSeenDuringHold = false;
 /** Wait until the PTY has been quiet for READY_FLUSH_SETTLE_MS (Ink render
  *  drained), capped at READY_FLUSH_SETTLE_CAP_MS, then flush the held prompt.
  *  A real SessionStart/BOTMUX_READY_COMMAND signal is itself authoritative
@@ -843,8 +857,13 @@ function settleThenFlush(startedAtMs, promptReadyAfterSettle) {
     const quietForMs = now - lastPtyOutputAtMs;
     if (quietForMs >= READY_FLUSH_SETTLE_MS || now - startedAtMs >= READY_FLUSH_SETTLE_CAP_MS) {
         isSettlingFirstFlush = false;
-        const shouldMarkPromptReady = promptReadyAfterSettle || promptReadyDetectedDuringSettle;
+        const shouldMarkPromptReady = decideSettleMarkReady({
+            promptReadyAfterSettle,
+            promptReadyDetectedDuringSettle,
+            readyPatternSeenDuringHold,
+        });
         promptReadyDetectedDuringSettle = false;
+        readyPatternSeenDuringHold = false;
         log(`Ready-gate settle done (quiet ${quietForMs}ms); ${shouldMarkPromptReady ? 'marking prompt ready' : 'delivering held first prompt'}`);
         if (shouldMarkPromptReady) {
             markPromptReady();
@@ -4519,6 +4538,11 @@ function markPromptReady() {
     // releaseReadyGate() drives flushPending() once the real signal lands, and a
     // later genuine idle then runs this fully. No-op for non-armed gates.
     if (readyGate.shouldHold()) {
+        // A real readyPattern fired while the gate was holding — the input box
+        // exists. Remember it so the gate's timeout-fallback settle can mark the
+        // prompt ready (see settleThenFlush) instead of letting flushPending()
+        // reject the held message for non-type-ahead adapters.
+        readyPatternSeenDuringHold = true;
         log('Idle detected but holding for SessionStart ready signal (startup selector guard)');
         return;
     }
@@ -5581,6 +5605,40 @@ function scheduleBusyPatternIdleProbe(source) {
 }
 async function spawnCli(cfg, opts = {}) {
     clearSessionRenameInFlight();
+    currentCliCredentialIsolated = false;
+    // Enrollment writes the fixed marker before any device credential appears.
+    // From that instant onward every NEW local CLI must carry a credential
+    // boundary, regardless of adapter capability or optional sandbox toggles.
+    // lstat (not existsSync) deliberately treats a hostile/broken symlink as a
+    // present authority signal and therefore fails closed.
+    const hostHomeDir = homedir();
+    const defaultBotmuxHome = join(hostHomeDir, '.botmux');
+    const configuredBotmuxHome = process.env.SESSION_DATA_DIR
+        ? dirname(process.env.SESSION_DATA_DIR)
+        : defaultBotmuxHome;
+    const hostEntryExistsNoFollow = (path) => {
+        try {
+            lstatSync(path);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const deviceIsolationMarkerExists = hostEntryExistsNoFollow(deviceCredentialIsolationMarkerPath(hostHomeDir));
+    const deviceCredentialExists = [...new Set([defaultBotmuxHome, configuredBotmuxHome])]
+        .some(root => hostEntryExistsNoFollow(join(root, DEVICE_AUTHORITY_DIRECTORY, DEVICE_CREDENTIAL_FILE))
+        // Upgrade fail-safe: a pre-dedicated-directory credential still activates
+        // mandatory confinement until the host explicitly removes/migrates it.
+        || hostEntryExistsNoFollow(join(root, DEVICE_CREDENTIAL_FILE)));
+    const mandatoryCredentialIsolation = credentialIsolationRequired({
+        markerExists: deviceIsolationMarkerExists,
+        deviceCredentialExists,
+    });
+    if (mandatoryCredentialIsolation && cfg.adoptMode) {
+        throw new Error(`[device-credential-isolation] refusing adopt session ${cfg.sessionId}: `
+            + 'an already-running external CLI cannot be retrofitted with the mandatory credential boundary');
+    }
     // (startupCommands one-shot is re-armed below, AFTER the reattach-vs-fresh
     // prediction — only a genuinely fresh CLI process replays them; see
     // willReattachPersistent.)
@@ -5940,6 +5998,56 @@ async function spawnCli(cfg, opts = {}) {
     // established (unsandboxable backend, no SESSION_DATA_DIR) is a hard error at the
     // spawn site below, never a silent unconfined run.
     const willWriteSandbox = process.platform === 'darwin' && wantsFileSandbox;
+    if (willWriteSandbox && !process.env.SESSION_DATA_DIR) {
+        throw new Error(`[file-sandbox] refusing to start session ${cfg.sessionId}: missing SESSION_DATA_DIR`);
+    }
+    const fullIsolationCoversCredentials = !riffRemoteBackend && ((process.platform === 'darwin' && (willReadIsolate || willWriteSandbox))
+        || (process.platform === 'linux' && wantsFileSandbox));
+    let credentialMechanismAvailable = true;
+    let credentialMechanismExecutable;
+    if (mandatoryCredentialIsolation && !riffRemoteBackend && !fullIsolationCoversCredentials) {
+        if (process.platform === 'darwin') {
+            const probe = probeHostCredentialIsolationMechanism();
+            credentialMechanismAvailable = probe.supported;
+            if (probe.supported)
+                credentialMechanismExecutable = probe.executable;
+        }
+        else {
+            credentialMechanismAvailable = process.platform === 'linux'
+                ? credentialOnlySandboxAvailable()
+                : false;
+        }
+    }
+    const credentialIsolationGate = evaluateCredentialOnlyIsolationGate({
+        markerExists: deviceIsolationMarkerExists,
+        deviceCredentialExists,
+        remoteBackend: riffRemoteBackend,
+        platform: process.platform,
+        mechanismAvailable: credentialMechanismAvailable,
+        fullIsolationCoversCredentials,
+    });
+    if (credentialIsolationGate.mode === 'blocked') {
+        throw new Error(`[device-credential-isolation] refusing to start session ${cfg.sessionId}: `
+            + credentialIsolationGate.failClosedReason);
+    }
+    const credentialBoundaryActive = credentialIsolationGate.required
+        && credentialIsolationGate.mode !== 'remote-bypass';
+    const credentialOnlySeatbelt = credentialIsolationGate.mode === 'seatbelt';
+    const credentialOnlyBwrap = credentialIsolationGate.mode === 'bwrap';
+    const appliedIsolationCapabilities = [];
+    if (credentialBoundaryActive
+        || willReadIsolate
+        || (process.platform === 'linux' && wantsFileSandbox)) {
+        appliedIsolationCapabilities.push('credential');
+    }
+    if (willReadIsolate)
+        appliedIsolationCapabilities.push('read');
+    if (willWriteSandbox || (process.platform === 'linux' && wantsFileSandbox)) {
+        appliedIsolationCapabilities.push('write');
+    }
+    currentCliCredentialIsolated = appliedIsolationCapabilities.includes('credential');
+    const isolationRuntimeDataDir = process.env.SESSION_DATA_DIR
+        ?? join(defaultBotmuxHome, 'data');
     // Every bot — isolated OR not — gets its own BOT_HOME dir as a ready-made private-
     // storage slot. An isolated sibling denies this path regardless of whether the owner
     // is isolated (deny uses the full bots.json), so a non-isolated bot can drop private
@@ -6021,7 +6129,7 @@ async function spawnCli(cfg, opts = {}) {
     // so the probe below sees no pane and we cold-spawn fresh isolated. A current-
     // policy pane survives daemon restarts and suspend→resume safely because the
     // confinement remains attached to the live process.
-    if ((willReadIsolate || willWriteSandbox) && persistentSessionName && effectiveBackendType !== 'pty') {
+    if (appliedIsolationCapabilities.length > 0 && persistentSessionName && effectiveBackendType !== 'pty') {
         const paneLive = effectiveBackendType === 'tmux'
             ? TmuxBackend.hasSession(persistentSessionName)
             : effectiveBackendType === 'zellij'
@@ -6029,8 +6137,8 @@ async function spawnCli(cfg, opts = {}) {
                 : HerdrBackend.hasSession(persistentSessionName);
         if (paneLive) {
             let marker = null;
-            marker = readRegularHostFileNoFollow(join(process.env.SESSION_DATA_DIR ?? '', 'read-isolation', `${cfg.sessionId}.boot`));
-            if (isolatedPaneReattachSafe(marker)) {
+            marker = readRegularHostFileNoFollow(join(isolationRuntimeDataDir, 'read-isolation', `${cfg.sessionId}.boot`));
+            if (isolatedPaneReattachSafe(marker, appliedIsolationCapabilities)) {
                 // Pane was spawned under the current isolation policy → still confined
                 // on the running process across daemon restarts; warm reattach preserves
                 // resume/context + tmux idle-suspend.
@@ -6270,16 +6378,20 @@ async function spawnCli(cfg, opts = {}) {
         const sessionDataDir = process.env.SESSION_DATA_DIR;
         // Regex rules cannot be realpath'd after construction, so build their home
         // prefix from the canonical path up front (Seatbelt matches canonical paths).
-        const sandboxHome = (() => { try {
-            return realpathSync(homedir());
-        }
-        catch {
-            return homedir();
-        } })();
+        const canonicalSandboxPath = (path) => {
+            try {
+                return realpathSync(path);
+            }
+            catch {
+                return path;
+            }
+        };
+        const sandboxHome = canonicalSandboxPath(homedir());
         writeSandboxRules = buildWriteSandboxRules({
             homeDir: sandboxHome,
-            botmuxHome: dirname(sessionDataDir),
-            sessionDataDir,
+            botmuxHome: canonicalSandboxPath(dirname(sessionDataDir)),
+            defaultBotmuxHome: canonicalSandboxPath(join(homedir(), '.botmux')),
+            sessionDataDir: canonicalSandboxPath(sessionDataDir),
             workingDir: cfg.workingDir,
             currentAppId: cfg.larkAppId,
             // TMPDIR on macOS resolves under /private/var/folders (already allowed), but
@@ -6536,6 +6648,31 @@ async function spawnCli(cfg, opts = {}) {
                 sessionDataDirs: [readIsolationCtx.sessionDataDir],
             });
         }
+        if (credentialBoundaryActive) {
+            const credentialRules = buildCredentialIsolationRules({
+                homeDir: canonical(hostHomeDir),
+                botmuxHome: canonical(configuredBotmuxHome),
+                defaultBotmuxHome: canonical(defaultBotmuxHome),
+            });
+            denyPaths = [...new Set([...denyPaths, ...credentialRules.denyPaths.map(canonical)])];
+            denyRegexes = [...new Set([...denyRegexes, ...credentialRules.denyRegexes])];
+            protectedWrites = {
+                denyWritePaths: [...new Set([
+                        ...(protectedWrites?.denyWritePaths ?? []),
+                        ...credentialRules.denyWritePaths.map(canonical),
+                    ])],
+                denyWriteRegexes: [...new Set([
+                        ...(protectedWrites?.denyWriteRegexes ?? []),
+                        ...credentialRules.denyWriteRegexes,
+                    ])],
+                denyWriteLiterals: [...new Set([
+                        ...(protectedWrites?.denyWriteLiterals ?? []),
+                        ...credentialRules.denyWriteLiterals.map(canonical),
+                        defaultBotmuxHome,
+                        configuredBotmuxHome,
+                    ])],
+            };
+        }
         if (mcpRuntimeManifest) {
             finalDenyPaths.push(...sessionMcpRuntimeHostOnlyPaths(mcpRuntimeManifest, config.session.dataDir).map(canonical));
         }
@@ -6561,29 +6698,30 @@ async function spawnCli(cfg, opts = {}) {
                 allowWritePaths: writeSandboxRules.allowWritePaths.map(canonical),
                 allowWriteRegexes: writeSandboxRules.allowWriteRegexes,
                 denyWritePaths: writeSandboxRules.denyWritePaths.map(canonical),
+                denyWriteRegexes: writeSandboxRules.denyWriteRegexes,
             }
             : undefined;
         if (!locateOnPath('sandbox-exec')) {
             throw new Error(`[file-sandbox] refusing to start session ${cfg.sessionId}: sandbox-exec not found`);
         }
-        const profileDir = join(process.env.SESSION_DATA_DIR, 'read-isolation');
+        const profileDir = join(isolationRuntimeDataDir, 'read-isolation');
         mkdirSync(profileDir, { recursive: true });
         const profilePath = join(profileDir, `${cfg.sessionId}.sb`);
         replaceManagedOriginCapabilityFile(profilePath, buildSeatbeltProfile(denyPaths, allowPaths, finalDenyPaths, traverseDirs, denyRegexes, writeRules, protectedWrites));
         seatbeltProfilePath = profilePath;
         spawnArgs = ['-f', profilePath, spawnBin, ...spawnArgs];
-        spawnBin = 'sandbox-exec';
+        spawnBin = credentialMechanismExecutable ?? '/usr/bin/sandbox-exec';
         log(`[file-sandbox] wrapping ${cliAdapter.id} in Seatbelt (read-isolation=${!!readIsolationCtx}, write-sandbox=${!!writeRules}): sandbox-exec -f ${profilePath}`);
     }
     // Fresh sandboxed spawn on a persistent backend: stamp the pane with this daemon's
     // policy version + boot id so a later suspend→resume reattach can be trusted (see the stale-pane
     // guard above). Applies to read-isolation AND write-sandbox panes (both carry the
     // Seatbelt confinement on the live process). pty needs no marker (never reattached).
-    if ((readIsolationCtx || writeSandboxRules) && persistentSessionName && !willReattachPersistent) {
+    if (appliedIsolationCapabilities.length > 0 && persistentSessionName && !willReattachPersistent) {
         try {
-            const markerDir = join(process.env.SESSION_DATA_DIR, 'read-isolation');
+            const markerDir = join(isolationRuntimeDataDir, 'read-isolation');
             mkdirSync(markerDir, { recursive: true });
-            replaceManagedOriginCapabilityFile(join(markerDir, `${cfg.sessionId}.boot`), isolationPaneMarkerContent(cfg.daemonBootId ?? ''));
+            replaceManagedOriginCapabilityFile(join(markerDir, `${cfg.sessionId}.boot`), isolationPaneMarkerContent(cfg.daemonBootId ?? '', appliedIsolationCapabilities));
         }
         catch { /* non-fatal: worst case a same-lifetime reattach cold-spawns instead */ }
     }
@@ -6836,6 +6974,143 @@ async function spawnCli(cfg, opts = {}) {
             }
         }
     }
+    // Mandatory credential-only confinement is the OUTERMOST launch wrapper so
+    // wrapperCli and every descendant it starts inherit the boundary. Full
+    // Seatbelt/bwrap sessions were already wrapped above and never enter these
+    // branches (gate mode `covered`), avoiding nested/double sandboxes.
+    if (!willReattachPersistent && credentialOnlySeatbelt) {
+        const canonical = (path) => {
+            try {
+                return realpathSync(path);
+            }
+            catch {
+                return path;
+            }
+        };
+        const rules = buildCredentialIsolationRules({
+            homeDir: canonical(hostHomeDir),
+            botmuxHome: canonical(configuredBotmuxHome),
+            defaultBotmuxHome: canonical(defaultBotmuxHome),
+        });
+        const profileDir = join(isolationRuntimeDataDir, 'read-isolation');
+        mkdirSync(profileDir, { recursive: true });
+        const profilePath = join(profileDir, `${cfg.sessionId}.sb`);
+        replaceManagedOriginCapabilityFile(profilePath, buildSeatbeltProfile(rules.denyPaths.map(canonical), [], [], [], rules.denyRegexes, undefined, {
+            denyWritePaths: [...new Set([
+                    ...rules.denyWritePaths.map(canonical),
+                    canonical(profileDir),
+                ])],
+            denyWriteRegexes: rules.denyWriteRegexes,
+            denyWriteLiterals: [...new Set([
+                    ...rules.denyWriteLiterals.map(canonical),
+                    canonical(profileDir),
+                    defaultBotmuxHome,
+                    configuredBotmuxHome,
+                ])],
+        }));
+        seatbeltProfilePath = profilePath;
+        spawnArgs = ['-f', profilePath, spawnBin, ...spawnArgs];
+        // Absolute path only: a pre-activation unconfined CLI could plant a fake
+        // sandbox-exec earlier on PATH. Prefer the probe result; fall back to the
+        // well-known system location used by full Seatbelt wrapping above.
+        spawnBin = credentialMechanismExecutable ?? '/usr/bin/sandbox-exec';
+        log(`[device-credential-isolation] wrapping ${cliAdapter.id} in credential-only Seatbelt: ${spawnBin} -f ${profilePath}`);
+    }
+    if (!willReattachPersistent && credentialOnlyBwrap) {
+        const panePolicyDir = join(isolationRuntimeDataDir, 'read-isolation');
+        mkdirSync(panePolicyDir, { recursive: true });
+        const hideDirectories = new Set();
+        const hideFiles = new Set();
+        const processedRoots = new Set();
+        const isDashboardAuthorityBasename = (name) => name === '.dashboard-secret'
+            || name.startsWith('.dashboard-secret.')
+            || name === '.dashboard-token'
+            || name.startsWith('.dashboard-token.');
+        for (const rawRoot of [defaultBotmuxHome, configuredBotmuxHome]) {
+            let root = rawRoot;
+            try {
+                root = realpathSync(rawRoot);
+            }
+            catch { /* gate authority root is checked below */ }
+            if (processedRoots.has(root))
+                continue;
+            let rootStat;
+            try {
+                rootStat = lstatSync(root);
+            }
+            catch {
+                // An unrelated/default root can be absent when the activation signal
+                // came from a custom BOTMUX_HOME. At least one signalled root must
+                // survive; the builder below rejects an empty root set.
+                continue;
+            }
+            if (!rootStat.isDirectory()) {
+                throw new Error(`[device-credential-isolation] authority root is not a directory: ${rawRoot}`);
+            }
+            processedRoots.add(root);
+            const authorityDirectory = join(root, DEVICE_AUTHORITY_DIRECTORY);
+            try {
+                const authorityStat = lstatSync(authorityDirectory);
+                if (!authorityStat.isDirectory()) {
+                    throw new Error(`[device-credential-isolation] device authority path is not a directory: ${authorityDirectory}`);
+                }
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                // A fixed empty mount target lets the child mask the entire authority
+                // namespace while leaving BOTMUX_HOME itself live and writable.
+                mkdirSync(authorityDirectory, { mode: 0o700 });
+            }
+            hideDirectories.add(realpathSync(authorityDirectory));
+            for (const name of readdirSync(root)) {
+                if (name === DEVICE_AUTHORITY_DIRECTORY)
+                    continue;
+                if (!isCredentialIsolationReservedBasename(name)
+                    && !isDashboardAuthorityBasename(name))
+                    continue;
+                const entry = join(root, name);
+                try {
+                    const stat = lstatSync(entry);
+                    if (!stat.isFile()) {
+                        // Never follow a host-authority symlink or special file. Exact mask
+                        // destinations must be stable regular files or the launch fails
+                        // closed before an untrusted CLI starts.
+                        throw new Error(`[device-credential-isolation] authority entry is not a regular file: ${entry}`);
+                    }
+                    hideFiles.add(entry);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                    // A racing removal needs no mask; a later exact credential rotation
+                    // is host-only and the long-lived device secret namespace itself is
+                    // protected wholesale above.
+                }
+            }
+        }
+        let credentialCliBin = spawnBin;
+        try {
+            credentialCliBin = realpathSync(spawnBin);
+        }
+        catch { /* spawn will fail closed if unresolved */ }
+        const credentialSandbox = prepareCredentialOnlySandbox({
+            hideDirectories: [...hideDirectories],
+            hideFiles: [...hideFiles],
+            readonlyPaths: [realpathSync(panePolicyDir)],
+            workingDir: spawnCwd,
+            cliBin: credentialCliBin,
+            cliArgs: spawnArgs,
+        });
+        if (!credentialSandbox) {
+            throw new Error(`[device-credential-isolation] refusing to start session ${cfg.sessionId}: `
+                + 'credential-only bubblewrap could not be established');
+        }
+        spawnBin = credentialSandbox.bin;
+        spawnArgs = credentialSandbox.args;
+        log(`[device-credential-isolation] wrapping ${cliAdapter.id} in credential-only bwrap `
+            + `(${hideDirectories.size} authority dir(s), ${hideFiles.size} exact file(s))`);
+    }
     backend.spawn(spawnBin, spawnArgs, {
         cwd: spawnCwd,
         cols: PTY_COLS,
@@ -6848,6 +7123,7 @@ async function spawnCli(cfg, opts = {}) {
     // can verify they were spawned inside a botmux session by walking the
     // process tree and looking for a matching pid file in this directory.
     const cliPid = backend.getChildPid?.();
+    publishLocalProcessAttestation(cliPid ?? undefined);
     if (cliPid && process.env.SESSION_DATA_DIR) {
         const markersDir = join(process.env.SESSION_DATA_DIR, '.botmux-cli-pids');
         try {
@@ -6890,6 +7166,7 @@ async function spawnCli(cfg, opts = {}) {
                 // Per-tick maybeFollowSessionRotationViaPid (bridge 1s poller) reads the
                 // module-level bridgeCliPid and re-points to the real CLI's jsonl.
                 bridgeCliPid = realPid;
+                publishLocalProcessAttestation(realPid);
             },
             schedule: (fn, ms) => { setTimeout(fn, ms); },
         });
@@ -6924,6 +7201,7 @@ async function spawnCli(cfg, opts = {}) {
                 return;
             const pid = backend.getChildPid?.();
             if (pid) {
+                publishLocalProcessAttestation(pid);
                 if (process.env.SESSION_DATA_DIR && !cliPidMarker) {
                     try {
                         const markersDir = join(process.env.SESSION_DATA_DIR, '.botmux-cli-pids');
@@ -7090,6 +7368,7 @@ async function spawnCli(cfg, opts = {}) {
     }
     isSettlingFirstFlush = false;
     promptReadyDetectedDuringSettle = false;
+    readyPatternSeenDuringHold = false;
     // Reset quiescence baseline so the settle measures silence from THIS spawn.
     lastPtyOutputAtMs = Date.now();
     const readyHookAvailable = effectiveReadyHookInstall
@@ -7315,8 +7594,23 @@ async function spawnCli(cfg, opts = {}) {
         // invoking markPromptReady() would claim the CLI is idle while it's still
         // mid-boot, so flushPending() alone is safer — it respects typeAheadAllowed
         // and drains pendingMessages now.
-        if (cliAdapter?.supportsTypeAhead)
+        //
+        // Non-type-ahead adapters (Hermes etc.) flushPending() rejects the held
+        // message while isPromptReady is false — it bails on
+        // `!isPromptReady && !typeAheadAllowed`. The hard cap means we've waited
+        // long enough. By now the ready gate's 45s fallback has already released
+        // the gate (READY_SIGNAL_TIMEOUT_MS < this 90s hard cap) and the post-
+        // release settle has drained, so markPromptReady() proceeds: it sets
+        // isPromptReady and drains the held first prompt. Without this, a spawn
+        // that never fires the ready signal (and whose readyPattern the idle
+        // detector never matched) would hold the first queued message forever —
+        // the previous code only logged "forcing flush" without actually flushing
+        // for non-type-ahead adapters.
+        if (decideHardTimeoutAction(cliAdapter?.supportsTypeAhead === true) === 'flush') {
             flushPending();
+            return;
+        }
+        markPromptReady();
     };
     setTimeout(() => releaseFirstPromptTimeout(FIRST_PROMPT_TIMEOUT_MS, false), FIRST_PROMPT_TIMEOUT_MS);
     // Riff (and other remote HTTP backends) have no local boot process — the
@@ -7329,6 +7623,7 @@ async function spawnCli(cfg, opts = {}) {
     }
 }
 function killCli(opts = {}) {
+    currentCliCredentialIsolated = false;
     stopSessionMcpGatewayHost();
     stopCodexRpcEngine();
     destroyCrashDiagnosticTerminal('killCli');
@@ -7347,6 +7642,7 @@ function killCli(opts = {}) {
     }
     isSettlingFirstFlush = false;
     promptReadyDetectedDuringSettle = false;
+    readyPatternSeenDuringHold = false;
     stopScreenAnalyzer();
     stopScreenUpdates();
     backend?.kill();
@@ -8639,6 +8935,16 @@ function send(msg) {
     }
     process.send?.(payload);
 }
+function publishLocalProcessAttestation(cliPid) {
+    const cliProcStart = cliPid ? readProcessStartIdentity(cliPid) : undefined;
+    send({
+        type: 'local_process_attestation',
+        backendType: effectiveBackendType,
+        credentialIsolated: currentCliCredentialIsolated,
+        ...(cliPid ? { cliPid } : {}),
+        ...(cliProcStart ? { cliProcStart } : {}),
+    });
+}
 /** Deliver a terminal IPC message before exiting the worker. `process.send()`
  * only queues asynchronously; calling process.exit() on the next line can drop
  * the exact startup diagnostic the user needs and recreate the silent-bot bug.