botmux 3.4.3 → 3.5.2

package/dist/dashboard.js

@@ -1,7 +1,7 @@
 // src/dashboard.ts
 import { createServer, get as httpGet, request as httpRequest } from 'node:http';
 import { createServer as createTcpServer, connect as netConnect } from 'node:net';
-import { readFileSync, existsSync, mkdirSync, readdirSync, statSync, createReadStream, } from 'node:fs';
+import { readFileSync, existsSync, mkdirSync, readdirSync, statSync, createReadStream, realpathSync, } from 'node:fs';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
 import { join, dirname, extname, resolve, relative, isAbsolute } from 'node:path';
 import { homedir } from 'node:os';
@@ -11,8 +11,9 @@ import { logger } from './utils/logger.js';
 import { config } from './config.js';
 import { listenWithProbe } from './utils/listen-with-probe.js';
 import { generateToken, parseCookie, buildSetCookie, verifyHmac, cliAuthBind, decideDashboardAuth, loadPersistedToken, persistToken, loadDashboardSecret, loadOrCreateDashboardSecret, } from './dashboard/auth.js';
-import { DaemonRegistry } from './dashboard/registry.js';
+import { DaemonRegistry, botsRosterSignature } from './dashboard/registry.js';
 import { Aggregator, subscribeDaemon } from './dashboard/aggregator.js';
+import { createDebugTerminalManager } from './dashboard/debug-terminal.js';
 import { pickCreatorForGroup } from './dashboard/operator-selector.js';
 import { buildTeamGroupCreatePayload, planGroupCreator } from './dashboard/team-group.js';
 import { jsonRes } from './dashboard/http.js';
@@ -21,7 +22,7 @@ import { defaultRunsDir as v3RunsDir } from './workflows/v3/ops-projection.js';
 import { verifyWorkflowDaemonIpcResponse, workflowDaemonIpcHeaders, WORKFLOW_DAEMON_IPC_ROUTE_PREFIX, } from './workflows/v3/daemon-ipc-auth.js';
 import { handleDashboardTriggerApi } from './dashboard/trigger-api.js';
 import { handleConnectorApi } from './dashboard/connector-api.js';
-import { redactGroupsForPublic, redactSchedulesForPublic } from './dashboard/public-redact.js';
+import { redactGroupsForPublic, redactSchedulesForPublic, redactSettingsForPublic, } from './dashboard/public-redact.js';
 import { handleWebhookRoute } from './dashboard/webhook-routes.js';
 import { handleFederationApi } from './dashboard/federation-api.js';
 import { handleFederationSpokeApi, syncAllMemberships, autoBindOwnerIfUnambiguous } from './dashboard/federation-spoke-api.js';
@@ -46,7 +47,7 @@ import { listCliRuntimeUpdateEntries } from './core/cli-runtime-update.js';
 import { claimRestartLease, clearRestartIntent, clearRestartLease, hasActiveRestartLease, writeManualIntentIfAbsent, writeRestartIntent, } from './services/restart-intent-store.js';
 import { withFileLock } from './utils/file-lock.js';
 import { spawn } from 'node:child_process';
-import { applySettingsWrite, defaultSettingsWriteApplierDeps, } from './dashboard/settings-write-applier.js';
+import { applySettingsWrite, defaultSettingsWriteApplierDeps, hasResolvedCodexNotifierRecipient, resolveCodexNotifierRecipientView, } from './dashboard/settings-write-applier.js';
 import { addBotsToGroup, bindOncall, disbandGroup, leaveGroup, unbindOncall, } from './dashboard/groups-action-helpers.js';
 import { createDaemonInternalApi } from './dashboard/daemon-internal-api.js';
 import { listTeamReports, readTeamBoard, setTeamBoardEntry } from './services/team-board-store.js';
@@ -56,6 +57,7 @@ import { buildSkillInstallAuditSummary, installLocalSkillLinks, readSkillRegistr
 import { redactGitUrlCredentials } from './core/skills/sources.js';
 import { effectiveDefaultWorkingDir, getBot, loadBotConfigs, parseBotConfigsFromText } from './bot-registry.js';
 import { findEntryIndex, readRawConfig, requireConfigPath, writeRawConfigAtomic } from './services/config-store.js';
+import { emitCodexNotifierOutboxItem, installCodexNotifierHook, isCodexNotifierWorkerStateFresh, isCodexNotifierHookInstalled, listCodexNotifierOutbox, readCodexNotifierWorkerState, resolveCodexNotifierConfig, runCodexSideConversationMonitor, runCodexNotifierWorkerSupervisor, } from './features/codex-notifier/index.js';
 import { discoverNativeCliSkillGroups } from './core/skills/discovery.js';
 import { analyzeSkillReferences } from './core/skills/references.js';
 import { discoverDashboardSkills, installDashboardSkill, parseDashboardSkillInstallRequest, parseInstallLocalLinksSources, MAX_LOCAL_LINK_SOURCES } from './dashboard/skill-install-request.js';
@@ -189,6 +191,20 @@ function verifyDashboardBinding(port) {
 mkdirSync(REGISTRY_DIR, { recursive: true });
 const registry = new DaemonRegistry(REGISTRY_DIR);
 const aggregator = new Aggregator();
+// 调试终端（owner-only 裸 bash）。默认工作目录取当前所有 session 的工作目录去重，
+// 让 owner 从熟悉的目录起终端复现问题；都没有时模块内退回 homedir。
+const debugTerminalManager = createDebugTerminalManager({
+    getActiveToken: () => activeToken,
+    defaultWorkingDirs: () => {
+        const dirs = new Set();
+        for (const s of aggregator.getSessions()) {
+            const wd = s.workingDir;
+            if (typeof wd === 'string' && wd.trim())
+                dirs.add(wd.trim());
+        }
+        return [...dirs];
+    },
+});
 /**
  * Resolve which daemon owns a schedule row. For rows with an explicit
  * `larkAppId`, returns that. For legacy rows (no owner stamp), falls back to
@@ -196,6 +212,64 @@ const aggregator = new Aggregator();
  * tasks (see scheduler.belongsToOwner). Returns undefined when the row is
  * genuinely unknown or no daemon is online.
  */
+/**
+ * Read-only directory listing for the dashboard sandbox-paths tree picker.
+ * Served locally by the dashboard process (same host as the daemons). Returns
+ * immediate CHILD DIRECTORIES only — never file contents. Trust model matches
+ * validateWorkingDir: the caller is an authed admin and the daemon already runs
+ * prompts with full FS access, so this is a convenience browser, not a security
+ * boundary. Symlinks are realpath-resolved; a raw path is never echoed into an
+ * error the browser renders verbatim.
+ */
+function listDirLocally(rawPath) {
+    // Canonicalize $HOME so the root entry + the `~` the frontend expands both use
+    // the SAME canonical form the child listings (realpathSync below) and the
+    // worker's sandbox binds use. On a symlinked-$HOME host (/home/u →
+    // /data00/home/u) the lexical homedir() would make `~/.claude` expand to
+    // /home/u/.claude while the tree's child nodes come back as /data00/... — the
+    // picker would then never match its own recommendation entries.
+    let home = homedir();
+    try {
+        home = realpathSync(home);
+    }
+    catch { /* lexical fallback if unresolvable */ }
+    if (!rawPath) {
+        // Root view: HOME first (the common case), then filesystem root. `home` is
+        // also returned explicitly so the frontend doesn't guess from entries[0].
+        const roots = [...new Set([home, '/'])];
+        return {
+            ok: true, path: null, parent: null, home,
+            entries: roots.map(p => ({ name: p, path: p, kind: 'dir' })),
+        };
+    }
+    const expanded = rawPath.startsWith('~') ? join(home, rawPath.slice(1)) : rawPath;
+    let resolved;
+    try {
+        resolved = realpathSync(expanded);
+    }
+    catch {
+        return { ok: false, path: null, parent: null, entries: [], error: 'path_not_found' };
+    }
+    let entries;
+    try {
+        entries = readdirSync(resolved, { withFileTypes: true })
+            .filter(d => {
+            try {
+                return d.isDirectory() || (d.isSymbolicLink() && statSync(join(resolved, d.name)).isDirectory());
+            }
+            catch {
+                return false;
+            }
+        })
+            .map(d => ({ name: d.name, path: join(resolved, d.name), kind: 'dir' }))
+            .sort((a, b) => a.name.localeCompare(b.name));
+    }
+    catch (e) {
+        return { ok: false, path: resolved, parent: null, entries: [], error: e?.code === 'EACCES' ? 'permission_denied' : 'cannot_read_dir' };
+    }
+    const parent = resolved === '/' ? null : dirname(resolved);
+    return { ok: true, path: resolved, parent, entries };
+}
 function resolveScheduleOwner(id) {
     const explicit = aggregator.scheduleOwnerOf(id);
     if (explicit)
@@ -269,8 +343,58 @@ function spawnStartBotLive(appId) {
         }
     });
 }
+function spawnStopBotLive(appId) {
+    return new Promise((resolve) => {
+        let out = '';
+        let err = '';
+        let settled = false;
+        const done = (r) => { if (!settled) {
+            settled = true;
+            resolve(r);
+        } };
+        try {
+            const child = spawn(process.execPath, [botmuxCliEntry(), 'stop-bot', appId, '--json'], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: process.env,
+                cwd: globalInstallUpdateCwd(),
+            });
+            const timer = setTimeout(() => {
+                try {
+                    child.kill('SIGKILL');
+                }
+                catch { /* already gone */ }
+                done({ ok: false, message: 'stop-bot 超时（30s）' });
+            }, 30_000);
+            timer.unref?.();
+            child.stdout?.on('data', (d) => { out += String(d); });
+            child.stderr?.on('data', (d) => { err += String(d); });
+            child.on('error', (e) => {
+                clearTimeout(timer);
+                done({ ok: false, message: e instanceof Error ? e.message : String(e) });
+            });
+            child.on('exit', (code) => {
+                clearTimeout(timer);
+                let parsed;
+                try {
+                    parsed = JSON.parse(out.trim());
+                }
+                catch { /* non-JSON */ }
+                if (code === 0) {
+                    done({ ok: true, message: parsed?.processName ? `${parsed.processName} 已停止` : undefined });
+                }
+                else {
+                    done({ ok: false, message: parsed?.message || err.trim() || `stop-bot 退出码 ${code}` });
+                }
+            });
+        }
+        catch (e) {
+            done({ ok: false, message: e instanceof Error ? e.message : String(e) });
+        }
+    });
+}
 const botOnboarding = new BotOnboardingManager({
     botsJsonPath: BOTS_JSON_PATH,
+    stopBotLive: spawnStopBotLive,
     startBotLive: spawnStartBotLive,
 });
 // 飞书 Web 登录态刷新（机器人改名缺登录态时的 dashboard 扫码入口）。机器级单例，
@@ -306,6 +430,51 @@ async function validateVcMeetingListenerBotAppId(appId) {
         return { ok: false, error: 'vcMeetingAgent_listenerBot_unknown' };
     return { ok: true };
 }
+async function validateCodexNotifierTargetBotAppId(appId, options = {}) {
+    try {
+        const bot = loadBotConfigs().find(candidate => candidate.larkAppId === appId);
+        if (!bot)
+            return { ok: false, error: 'codexNotifier_target_unknown' };
+        if (bot.cliId !== 'codex' && bot.cliId !== 'codex-app') {
+            return { ok: false, error: 'codexNotifier_target_cli_unsupported' };
+        }
+        if (!(bot.allowedUsers ?? []).some(user => typeof user === 'string' && user.trim())) {
+            return { ok: false, error: 'codexNotifier_target_owner_missing' };
+        }
+        if (options.requireReady !== true)
+            return { ok: true };
+        const daemon = registry.list().find(candidate => candidate.larkAppId === appId);
+        if (!daemon)
+            return { ok: false, error: 'codexNotifier_target_daemon_offline' };
+        const resolvedOwners = daemon.resolvedAllowedUsers ?? [];
+        if (!hasResolvedCodexNotifierRecipient(resolvedOwners)) {
+            return { ok: false, error: 'codexNotifier_target_owner_unverified' };
+        }
+        return { ok: true };
+    }
+    catch {
+        return { ok: false, error: 'codexNotifier_target_unknown' };
+    }
+}
+function codexNotifierBotOptions() {
+    try {
+        const onlineByAppId = new Map(registry.list().map(bot => [bot.larkAppId, bot]));
+        return loadBotConfigs()
+            .filter(bot => bot.cliId === 'codex' || bot.cliId === 'codex-app')
+            .map(bot => {
+            const resolvedOwners = onlineByAppId.get(bot.larkAppId)?.resolvedAllowedUsers ?? [];
+            return {
+                larkAppId: bot.larkAppId,
+                botName: bot.displayName ?? onlineByAppId.get(bot.larkAppId)?.botName ?? bot.name ?? null,
+                cliId: onlineByAppId.get(bot.larkAppId)?.cliId ?? bot.cliId,
+                ...resolveCodexNotifierRecipientView(bot.allowedUsers, resolvedOwners),
+            };
+        });
+    }
+    catch {
+        return [];
+    }
+}
 function normalizeVcMeetingAgentRecord(raw) {
     return raw && typeof raw === 'object' && !Array.isArray(raw)
         ? { ...raw }
@@ -664,6 +833,9 @@ async function syncVcMeetingListenerBotConfig(listenerBotAppId, previousListener
 function resolveDashboardSettings() {
     const global = readGlobalConfig();
     const dashboard = global.dashboard ?? {};
+    const codexNotifier = resolveCodexNotifierConfig();
+    const codexNotifierBots = codexNotifierBotOptions();
+    const codexNotifierState = readCodexNotifierWorkerState(config.session.dataDir);
     const larkCli = checkLarkCliVersion();
     return {
         publicReadOnly: dashboard.publicReadOnly ?? config.dashboard.publicReadOnly,
@@ -679,6 +851,19 @@ function resolveDashboardSettings() {
             recommendedRef: TRAEX_RECOMMENDED_REF,
         },
         codexRpcInput: dashboard.codexRpcInput === true, // default OFF until live-verified
+        codexNotifier: {
+            enabled: codexNotifier.enabled,
+            targetBotAppId: codexNotifier.targetBotAppId ?? null,
+            notifyWhen: codexNotifier.notifyWhen,
+            platformSupported: process.platform === 'darwin',
+            hookInstalled: isCodexNotifierHookInstalled(),
+            botOptions: codexNotifierBots,
+            targetDaemonOnline: !!codexNotifier.targetBotAppId
+                && registry.list().some(bot => bot.larkAppId === codexNotifier.targetBotAppId),
+            pendingCount: listCodexNotifierOutbox(config.session.dataDir).length,
+            workerOnline: isCodexNotifierWorkerStateFresh(codexNotifierState),
+            lastError: codexNotifierState?.lastError ?? null,
+        },
         vcMeetingAgent: {
             enabled: global.vcMeetingAgent?.enabled !== false,
             listenerBotAppId: global.vcMeetingAgent?.listenerBotAppId ?? null,
@@ -707,6 +892,7 @@ async function reloadLocaleOnAllDaemons() {
 const settingsWriteApplierDeps = defaultSettingsWriteApplierDeps(resolveDashboardSettings, reloadLocaleOnAllDaemons);
 settingsWriteApplierDeps.syncVcMeetingListenerBotConfig = syncVcMeetingListenerBotConfig;
 settingsWriteApplierDeps.validateVcMeetingListenerBotAppId = validateVcMeetingListenerBotAppId;
+settingsWriteApplierDeps.validateCodexNotifierTargetBotAppId = validateCodexNotifierTargetBotAppId;
 /** Helper to render a {status, body} HandlerResult through `res`. */
 function writeHandlerResult(res, result) {
     const headers = { 'content-type': 'application/json', ...(result.headers ?? {}) };
@@ -940,6 +1126,29 @@ registry.on(syncSubscriptions);
 // Initial attach for every daemon already known. Run in parallel so a slow
 // daemon doesn't block the others.
 await Promise.all(registry.list().map(attachDaemon));
+const codexNotifierAbort = new AbortController();
+if (resolveCodexNotifierConfig().enabled) {
+    try {
+        installCodexNotifierHook();
+    }
+    catch (error) {
+        logger.warn(`[codex-notifier] Hook reconcile failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+void runCodexNotifierWorkerSupervisor({
+    dataDir: config.session.dataDir,
+    signal: codexNotifierAbort.signal,
+    emit: item => emitCodexNotifierOutboxItem(item, { signal: codexNotifierAbort.signal }),
+    runProducer: signal => runCodexSideConversationMonitor({
+        dataDir: config.session.dataDir,
+        signal,
+        logger,
+    }),
+    logger,
+    onLeaseUnavailable: path => {
+        logger.warn(`[codex-notifier] outbox worker 已由另一 Dashboard 持有，等待接管：${path}`);
+    },
+});
 const resourceMonitor = createResourceMonitorService({
     intervalMs: 10_000,
     topSessionLimit: 30,
@@ -2104,14 +2313,15 @@ const server = createServer(async (req, res) => {
             return jsonRes(res, 200, { ok: true });
         }
         const presentedToken = authedToken(req, url);
-        const dashboardSettings = resolveDashboardSettings();
+        const globalDashboardConfig = readGlobalConfig().dashboard;
         const decision = decideDashboardAuth({
             method: req.method ?? 'GET',
             pathname: url.pathname,
             hasTokenParam: url.searchParams.has('t'),
             presentedToken,
             activeToken: activeToken ?? '',
-            publicReadOnly: dashboardSettings.publicReadOnly,
+            publicReadOnly: globalDashboardConfig?.publicReadOnly
+                ?? config.dashboard.publicReadOnly,
         });
         // `authed` is consumed by route handlers that distinguish the public-read
         // carve-out from a valid management cookie (notably v3 run details).
@@ -2160,6 +2370,16 @@ const server = createServer(async (req, res) => {
             && await handlePluginManagementApi(req, res, url)) {
             return;
         }
+        // 调试终端（owner-only）：HTTP 路由挂在 auth gate 之后 → 已确保是管理 token。
+        // /api/debug-terminal（创建/关闭）+ /debug-terminal/<id>（xterm 页面）。
+        // WS 升级 /debug-terminal/<id>/ws 在下方 server.on('upgrade') 里由本 manager
+        // 自行校验 cookie（upgrade 不经这段 gate）。
+        if (url.pathname === '/api/debug-terminal'
+            || url.pathname.startsWith('/api/debug-terminal/')
+            || url.pathname.startsWith('/debug-terminal/')) {
+            if (debugTerminalManager.handleHttp(req, res, url))
+                return;
+        }
         if (req.method === 'GET' && url.pathname === '/api/plugins/dashboard') {
             return jsonRes(res, 200, { plugins: listDashboardPluginEntries() });
         }
@@ -2326,6 +2546,7 @@ const server = createServer(async (req, res) => {
             return jsonRes(res, 200, { schedules, timezone: scheduleTimeZone() });
         }
         if (req.method === 'GET' && url.pathname === '/api/settings') {
+            const dashboardSettings = resolveDashboardSettings();
             // `authed` lets the Settings page disable toggles for read-only
             // visitors up front, instead of letting them flip a switch that
             // 401s + rolls back on save.
@@ -2335,7 +2556,7 @@ const server = createServer(async (req, res) => {
             // `bound` reflects central-platform binding; the Settings UI only shows the
             // 远程访问 toggle when bound (the central URLs are meaningless otherwise).
             return jsonRes(res, 200, {
-                settings: dashboardSettings,
+                settings: authed ? dashboardSettings : redactSettingsForPublic(dashboardSettings),
                 lang: readGlobalConfig().lang ?? null,
                 authed,
                 bound: readPlatformBinding() !== null,
@@ -3053,6 +3274,14 @@ const server = createServer(async (req, res) => {
                 return jsonRes(res, 400, { ok: false, error: 'missing_expected_identity', message: '免扫码添加前必须确认当前账号与企业' });
             }
             const sessionMode = sessionModeRaw === 'reuse' ? 'reuse' : 'qr';
+            if (parsed.requireCriticalScopesBeforeActivation !== undefined
+                && typeof parsed.requireCriticalScopesBeforeActivation !== 'boolean') {
+                return jsonRes(res, 400, {
+                    ok: false,
+                    error: 'invalid_critical_scope_activation_gate',
+                    message: 'requireCriticalScopesBeforeActivation 必须是 boolean',
+                });
+            }
             const job = botOnboarding.start({
                 appName,
                 registrationMode,
@@ -3062,9 +3291,93 @@ const server = createServer(async (req, res) => {
                 workingDir,
                 dirMode,
                 model,
+                ...(parsed.requireCriticalScopesBeforeActivation === true
+                    ? { requireCriticalScopesBeforeActivation: true }
+                    : {}),
             });
             return jsonRes(res, 202, { job: botOnboarding.get(job.id) });
         }
+        if (req.method === 'POST' && url.pathname === '/api/bot-onboarding/recover-permissions') {
+            let parsed;
+            try {
+                const chunks = [];
+                for await (const c of req)
+                    chunks.push(c);
+                const raw = Buffer.concat(chunks).toString('utf8');
+                parsed = raw ? JSON.parse(raw) : {};
+            }
+            catch {
+                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+            }
+            const workingDir = typeof parsed.workingDir === 'string' ? parsed.workingDir.trim() : '';
+            const predecessorJobId = typeof parsed.predecessorJobId === 'string' ? parsed.predecessorJobId.trim() : '';
+            const expectedAppId = typeof parsed.expectedAppId === 'string' ? parsed.expectedAppId.trim() : '';
+            const priorRecoveryJobId = typeof parsed.priorRecoveryJobId === 'string' ? parsed.priorRecoveryJobId.trim() : undefined;
+            if (parsed.requireCriticalScopesBeforeActivation !== undefined
+                && typeof parsed.requireCriticalScopesBeforeActivation !== 'boolean') {
+                return jsonRes(res, 400, {
+                    ok: false,
+                    error: 'invalid_critical_scope_activation_gate',
+                    message: 'requireCriticalScopesBeforeActivation 必须是 boolean',
+                });
+            }
+            if (!workingDir || !predecessorJobId || !expectedAppId || invalidWorkingDirs({ workingDir }).length > 0) {
+                return jsonRes(res, 400, { ok: false, error: 'permission_recovery_target_invalid' });
+            }
+            const recovered = botOnboarding.startPermissionRecovery({
+                workingDir,
+                predecessorJobId,
+                expectedAppId,
+                priorRecoveryJobId,
+                ...(parsed.requireCriticalScopesBeforeActivation === true
+                    ? { requireCriticalScopesBeforeActivation: true }
+                    : {}),
+            });
+            if (!recovered.ok) {
+                const status = recovered.error === 'permission_recovery_target_missing' ? 404
+                    : recovered.error === 'permission_recovery_target_ambiguous' ? 409
+                        : recovered.error === 'permission_recovery_state_unavailable' ? 503
+                            : 400;
+                return jsonRes(res, status, recovered);
+            }
+            return jsonRes(res, 202, { job: botOnboarding.get(recovered.job.id) });
+        }
+        let mScopePropagation;
+        if (req.method === 'POST'
+            && (mScopePropagation = url.pathname.match(/^\/api\/bot-onboarding\/([^/]+)\/complete-scope-propagation$/))) {
+            const onboardingId = decodeURIComponent(mScopePropagation[1]);
+            let parsed;
+            try {
+                const chunks = [];
+                for await (const c of req)
+                    chunks.push(c);
+                const raw = Buffer.concat(chunks).toString('utf8');
+                parsed = raw ? JSON.parse(raw) : {};
+            }
+            catch {
+                return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+            }
+            const workingDir = typeof parsed.workingDir === 'string' ? parsed.workingDir.trim() : '';
+            const expectedAppId = typeof parsed.expectedAppId === 'string' ? parsed.expectedAppId.trim() : '';
+            if (!workingDir || !expectedAppId || invalidWorkingDirs({ workingDir }).length > 0) {
+                return jsonRes(res, 400, { ok: false, error: 'permission_recovery_target_invalid' });
+            }
+            const completed = await botOnboarding.completeScopePropagation({
+                jobId: onboardingId,
+                workingDir,
+                expectedAppId,
+            });
+            if (!completed.ok) {
+                const status = completed.error === 'permission_recovery_target_missing' ? 404
+                    : completed.error === 'permission_recovery_target_ambiguous' ? 409
+                        : completed.error === 'permission_recovery_scopes_pending' ? 425
+                            : (completed.error === 'permission_recovery_state_unavailable'
+                                || completed.error === 'permission_recovery_activation_failed') ? 503
+                                : 400;
+                return jsonRes(res, status, completed);
+            }
+            return jsonRes(res, 200, { job: botOnboarding.get(onboardingId) });
+        }
         let mOwner;
         if (req.method === 'POST' && (mOwner = url.pathname.match(/^\/api\/bot-onboarding\/([^/]+)\/owner$/))) {
             // needs_owner 状态下用户手动提交 owner：扫码人身份验证不了时的兜底入口。
@@ -3219,6 +3532,18 @@ const server = createServer(async (req, res) => {
             res.end(await upstream.text());
             return;
         }
+        // Dashboard「复现命令」：透传到 owning daemon 取该 session 的真实 CLI 调用。
+        // 与 write-link 同样只在管理 cookie（写权限）下可达：命令含 token/凭证。
+        if (req.method === 'GET' && (m = url.pathname.match(/^\/api\/sessions\/([^/]+)\/spawn-command$/))) {
+            const sid = decodeURIComponent(m[1]);
+            const owner = aggregator.ownerOf(sid);
+            if (!owner)
+                return jsonRes(res, 404, { ok: false, error: 'unknown_session' });
+            const upstream = await proxyToDaemon(owner, `/api/sessions/${sid}/spawn-command`, { method: 'GET' });
+            res.writeHead(upstream.status, { 'content-type': 'application/json' });
+            res.end(await upstream.text());
+            return;
+        }
         // Sandbox landing: review the clone's diff (GET) then apply/discard (POST).
         if (req.method === 'GET' && (m = url.pathname.match(/^\/api\/sessions\/([^/]+)\/sandbox-diff$/))) {
             const sid = decodeURIComponent(m[1]);
@@ -3805,6 +4130,33 @@ const server = createServer(async (req, res) => {
             res.end(await upstream.text());
             return;
         }
+        // PUT /api/bots/:appId/sandbox-paths — proxy to that bot's daemon.
+        // Body `{ readWrite?: string[]; readOnly?: string[]; deny?: string[] }`.
+        let mBotSandboxPaths;
+        if (req.method === 'PUT' && (mBotSandboxPaths = url.pathname.match(/^\/api\/bots\/([^/]+)\/sandbox-paths$/))) {
+            const appId = decodeURIComponent(mBotSandboxPaths[1]);
+            const chunks = [];
+            for await (const c of req)
+                chunks.push(c);
+            const raw = Buffer.concat(chunks).toString('utf8') || '{}';
+            const upstream = await proxyToDaemon(appId, `/api/bot-sandbox-paths`, {
+                method: 'PUT',
+                headers: { 'content-type': 'application/json' },
+                body: raw,
+            });
+            res.writeHead(upstream.status, { 'content-type': 'application/json' });
+            res.end(await upstream.text());
+            return;
+        }
+        // GET /api/fs/list?path=… — read-only directory listing for the sandbox-paths
+        // tree picker. Not bot-specific (the filesystem is shared with this host's
+        // daemons — the dashboard process runs on the SAME machine), so serve it
+        // locally instead of proxying. Returns immediate child directories only.
+        if (req.method === 'GET' && url.pathname === '/api/fs/list') {
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify(listDirLocally(url.searchParams.get('path') ?? '')));
+            return;
+        }
         // PUT /api/bots/:appId/sandbox — proxy to that bot's daemon. Body `{ enabled: boolean }`.
         let mBotSandbox;
         if (req.method === 'PUT' && (mBotSandbox = url.pathname.match(/^\/api\/bots\/([^/]+)\/sandbox$/))) {
@@ -4325,7 +4677,20 @@ const server = createServer(async (req, res) => {
             const hb = setInterval(() => {
                 res.write(`event: heartbeat\ndata: ${JSON.stringify({ ts: Date.now() })}\n\n`);
             }, 15_000);
-            res.on('close', () => { off(); clearInterval(hb); });
+            // Push a bots.changed frame whenever the online bot roster actually
+            // changes (bot added / removed / renamed / re-indexed) so the Bot 配置
+            // page can auto-refresh without a manual reload. registry.on fires on
+            // every 15s poll and 30s heartbeat rewrite, so gate on a roster signature
+            // that ignores lastHeartbeat — otherwise we'd spam a frame every poll.
+            let lastRoster = botsRosterSignature(registry.list());
+            const offRoster = registry.on(online => {
+                const sig = botsRosterSignature(online);
+                if (sig === lastRoster)
+                    return;
+                lastRoster = sig;
+                res.write(`event: bots.changed\ndata: ${JSON.stringify({ body: { signature: sig } })}\n\n`);
+            });
+            res.on('close', () => { off(); offRoster(); clearInterval(hb); });
             return;
         }
         // Public API + static frontend land in Task 17 / 18. For now: 404.
@@ -4346,6 +4711,11 @@ const server = createServer(async (req, res) => {
 server.on('upgrade', (req, clientSocket, head) => {
     try {
         const rawUrl = req.url ?? '/';
+        // 调试终端 WS（owner-only）：manager 内部自校验管理 cookie。命中即接管。
+        if (rawUrl.startsWith('/debug-terminal/')) {
+            if (debugTerminalManager.handleUpgrade(req, clientSocket, head))
+                return;
+        }
         if (!(rawUrl === '/s' || rawUrl.startsWith('/s/') || rawUrl.startsWith('/s?'))) {
             return clientSocket.destroy();
         }
@@ -4671,12 +5041,14 @@ async function maybeAnnounceHallPresence() {
 }
 // Graceful shutdown
 function shutdown() {
+    codexNotifierAbort.abort();
     for (const off of subs.values())
         off();
     subs.clear();
     registry.stop();
     resourceMonitor.stop();
     platformTunnel?.stop();
+    debugTerminalManager.shutdown();
     server.close(() => process.exit(0));
     // Hard-exit fallback after 5s
     setTimeout(() => process.exit(0), 5_000).unref();