botmux 3.4.3 → 3.5.2

package/dist/worker.js

@@ -15,11 +15,12 @@
 import { randomBytes } from 'node:crypto';
 import { mkdirSync, writeFileSync, unlinkSync, rmdirSync, existsSync, statSync, lstatSync, readdirSync, readlinkSync, readFileSync, realpathSync, copyFileSync, watch as fsWatch, createWriteStream, openSync, closeSync, fstatSync, constants as fsConstants } from 'node:fs';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
-import { join, basename, dirname } from 'node:path';
+import { join, basename, dirname, delimiter } from 'node:path';
 import { homedir, tmpdir } from 'node:os';
 import { spawnSync } from 'node:child_process';
-import { evaluateReadIsolationGate, evaluateCredentialOnlyIsolationGate, credentialIsolationRequired, deviceCredentialIsolationMarkerPath, isCredentialIsolationReservedBasename, buildCredentialIsolationRules, buildSeatbeltProfile, isolatedPaneReattachSafe, sendCredFilePath, botHomePath, buildV2DenyPaths, buildV2DenyRegexes, buildV2CarveOuts, buildReadIsolationProtectedWriteRules, buildCliExecutableReadCarveOuts, buildWriteSandboxRules, buildLinuxReadIsolationMasks, isolationPaneMarkerContent, } from './adapters/cli/read-isolation.js';
-import { killPersistentSession } from './core/persistent-backend.js';
+import { evaluateCredentialOnlyIsolationGate, credentialIsolationRequired, deviceCredentialIsolationMarkerPath, isCredentialIsolationReservedBasename, buildCredentialIsolationRules, buildSeatbeltProfile, isolatedPaneReattachSafe, sendCredFilePath, botHomePath, buildCliExecutableReadCarveOuts, isolationPaneMarkerContent, } from './adapters/cli/read-isolation.js';
+import { buildFsPolicy, compileToSeatbelt, migrateLegacySandboxFields } from './adapters/cli/fs-policy.js';
+import { killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget } from './core/persistent-backend.js';
 import { readProcessStartIdentity } from './core/session-marker.js';
 import { drainTranscript, joinAssistantText, trailingAssistantText, findJsonlContainingFingerprint, findJsonlsContainingExactContent, findLatestJsonl, extractLastAssistantTurn, extractTurnStartText, splitTranscriptEventsByCutoff } from './services/claude-transcript.js';
 import { BridgeTurnQueue, makeFingerprint, normaliseForFingerprint } from './services/bridge-turn-queue.js';
@@ -40,16 +41,19 @@ import { sessionMcpGatewayPathRegex, startSessionMcpGatewayHost, } from './core/
 import { MCP_GATEWAY_REQUIRED_ENV, MCP_GATEWAY_SOCKET_ENV, } from './core/plugins/mcp/environment.js';
 import { readSessionMcpRuntimeManifest, sessionMcpRuntimeHostOnlyPaths, } from './core/plugins/mcp/session-runtime.js';
 import { prepareCliPluginGeneration } from './core/plugins/cli-generation.js';
-import { loadBotConfigs } from './bot-registry.js';
+import { loadBotConfigs, resolveBrandLabel } from './bot-registry.js';
 import { readGlobalConfig } from './global-config.js';
-import { deriveTerminalViewToken, resolveTerminalAccessForRequest, safeTerminalTokenEqual, } from './core/terminal-write-auth.js';
+import { deriveTerminalViewToken, deriveTerminalWriteToken, resolveTerminalAccessForRequest, safeTerminalTokenEqual, } from './core/terminal-write-auth.js';
 import { readPlatformBinding } from './platform/binding.js';
 import { loadDashboardSecret, loadPersistedToken } from './dashboard/auth.js';
 import { InflightInputTracker } from './core/inflight-input-tracker.js';
 import { shouldRunQuietRotation, evaluatePidResolverPullback, decideFingerprintSwitch, shouldHealAbsentBaseline, sessionIdFromJsonlPath, SESSION_ID_FILENAME_RE, } from './services/bridge-rotation-policy.js';
 import { CodexBridgeQueue } from './services/codex-bridge-queue.js';
+import { generateCodexAppThreadTitle, readCodexAppThreadMetadata, setCodexAppThreadName, } from './services/codex-app-threads.js';
+import { buildBotmuxLarkNativeSessionTitle } from './core/session-title.js';
 import { drainCodexRollout, findCodexRolloutBySessionId, findCodexRolloutByPid, splitCodexEventsByCutoff, extractLastCodexTurn, codexSessionIdFromRolloutPath } from './services/codex-transcript.js';
 import { drainTraexRollout, findTraexRolloutBySessionId, findTraexRolloutByPid } from './services/traex-transcript.js';
+import { parseTraexUserInputQuestions } from './services/traex-user-input.js';
 import { cocoEventsPathForSession, drainCocoEvents, findCocoSessionByPid } from './services/coco-transcript.js';
 import { currentHermesStateOffset, drainHermesStateDb, resolveHermesStateDbPath } from './services/hermes-transcript.js';
 import { filterHermesEventsForBotmuxSession } from './services/hermes-session-filter.js';
@@ -62,6 +66,7 @@ import { drainCursorTranscript, findCursorChatIdByPid, findCursorTranscriptByCha
 import { shouldObserveCursorChatId, shouldPersistObservedCursorChatId } from './services/cursor-resume-policy.js';
 import { extractKiroSessionIdFromOutput } from './services/kiro-session.js';
 import { baselineJsonlCursor } from './services/jsonl-cursor.js';
+import { fileURLToPath } from 'node:url';
 import { createServer as createHttpServer } from 'node:http';
 import { WebSocketServer, WebSocket } from 'ws';
 import { listenWebTerminalWithFallback } from './utils/web-terminal-listen.js';
@@ -87,13 +92,16 @@ import { ZellijObserveBackend } from './adapters/backend/zellij-observe-backend.
 import { zellijEnv } from './setup/ensure-zellij.js';
 import { isObserveBackend } from './adapters/backend/types.js';
 import { selectSessionBackend, decideBackendGate, backendGateUserMessage } from './adapters/backend/session-backend-selector.js';
+import { buildReproduceCommand, selectReproduceLaunch } from './adapters/backend/reproduce-command.js';
 import { deriveRiffReposFromDirs, deriveRiffRepoFromWorkingDir, isValidRiffBaseUrl, isValidRiffSandboxCluster, } from './adapters/backend/riff-backend.js';
-import { prepareSandbox, prepareCredentialOnlySandbox, credentialOnlySandboxAvailable, probeHostCredentialIsolationMechanism, attachSandboxOutbox, startOutboxWatcher, sandboxEnabled, sandboxedClaudeDataDir, localSandboxApplies, } from './adapters/backend/sandbox.js';
+import { prepareDirectSandbox, prepareCredentialOnlySandbox, credentialOnlySandboxAvailable, probeHostCredentialIsolationMechanism, attachSandboxOutbox, startOutboxWatcher, sandboxEnabled, localSandboxApplies, } from './adapters/backend/sandbox.js';
 import { DEVICE_AUTHORITY_DIRECTORY, DEVICE_CREDENTIAL_FILE, } from './platform/device-paths.js';
 import { tmuxEnv, probeTmuxFunctionalWithRetry } from './setup/ensure-tmux.js';
 import { tmuxRestartJitterMs } from './core/tmux-recovery.js';
 import { IdleDetector } from './utils/idle-detector.js';
 import { ScreenAnalyzer } from './utils/screen-analyzer.js';
+import { StuckDetector, matchHookReviewScreen } from './utils/stuck-detector.js';
+import { processStuckWarningTuiKeys, shouldRearmStuckDetector } from './utils/stuck-key-guard.js';
 import { captureToPng } from './utils/screenshot-renderer.js';
 import { snapshotToPng, snapshotToText, shouldCaptureScreen, isScreenSelfDriven } from './utils/transient-snapshot.js';
 import { chooseWebTerminalSeed } from './utils/web-terminal-seed.js';
@@ -109,7 +117,8 @@ import * as pty from 'node-pty';
 import { createHash } from 'node:crypto';
 import { hasInstalledSessionReadyHook, installHook, } from './adapters/hook-installer.js';
 import { hookCommandFor } from './adapters/hook-command.js';
-import { parseDaemonIpcPort } from './utils/daemon-discovery.js';
+import { findOnlineDaemon, parseDaemonIpcPort } from './utils/daemon-discovery.js';
+import { fetchDaemonIpc } from './core/daemon-ipc-auth.js';
 import { withCodexAppContext } from './utils/codex-app-context.js';
 import { resolveCodexAppFinalTurnIdentity } from './adapters/cli/codex-app-turn.js';
 import { RunnerControlDecoder } from './adapters/cli/runner-control-channel.js';
@@ -250,6 +259,238 @@ async function codexRolloutProbe(cliId, threadId, promptText, timeoutMs) {
     } while (Date.now() < deadline);
     return false;
 }
+function codexNativeTitleEnv(cfg) {
+    const env = {
+        ...redactChildEnv(process.env),
+        ...sanitizePerBotEnv(cfg.env),
+    };
+    env.PATH = `${join(homedir(), '.botmux', 'bin')}${delimiter}${env.PATH ?? ''}`;
+    return env;
+}
+function registerNativeTitleForceClose(forceClose) {
+    nativeSessionTitleSyncForceClosers.add(forceClose);
+    return () => nativeSessionTitleSyncForceClosers.delete(forceClose);
+}
+async function applyCodexNativeSessionTitle(threadId, title, cfg, engine, wait, expectedRevision) {
+    if (expectedRevision !== nativeSessionTitleRevision)
+        return false;
+    if (engine?.activeThreadId === threadId) {
+        if (wait === 'resume') {
+            await engine.waitForThreadUpdatedAfter(nativeSessionTitleResumeUpdatedAt ?? Math.floor(Date.now() / 1000), 10_000);
+        }
+        else if (wait === 'preview') {
+            await engine.waitForThreadPreview(10_000);
+        }
+        if (expectedRevision !== nativeSessionTitleRevision)
+            return false;
+        await engine.setThreadName(title);
+        return true;
+    }
+    const adapter = createCliAdapterSync('codex', cfg.cliPathOverride);
+    const abortController = new AbortController();
+    nativeSessionTitleSyncAbortControllers.add(abortController);
+    try {
+        await setCodexAppThreadName({
+            threadId,
+            name: title,
+            codexBin: adapter.resolvedBin,
+            cwd: cfg.workingDir,
+            env: codexNativeTitleEnv(cfg),
+            timeoutMs: 10_000,
+            signal: abortController.signal,
+            detached: true,
+            waitForExistingPreview: wait === 'preview',
+            ...(wait === 'resume' ? {
+                waitForUpdatedAfter: nativeSessionTitleResumeUpdatedAt ?? Math.floor(Date.now() / 1000),
+            } : {}),
+            registerForceClose: registerNativeTitleForceClose,
+        });
+        return expectedRevision === nativeSessionTitleRevision;
+    }
+    finally {
+        nativeSessionTitleSyncAbortControllers.delete(abortController);
+    }
+}
+/** 首条 UserMessage 落盘后先写 fallback，再用隔离的临时 turn 生成语义标题。 */
+async function syncFreshCodexNativeSessionTitle(threadId, engine) {
+    const cfg = lastInitConfig;
+    const fallbackTitle = cfg?.nativeSessionTitle?.trim();
+    if (!cfg || cfg.cliId !== 'codex' || cfg.adoptMode || !fallbackTitle || !threadId)
+        return;
+    if (nativeSessionTitleAppliedThreadId === threadId || nativeSessionTitleSyncInFlight === threadId)
+        return;
+    const revision = nativeSessionTitleRevision;
+    const resumeGeneration = nativeSessionTitleCurrentGenerationResume;
+    let syncLatestTitle = false;
+    nativeSessionTitleSyncInFlight = threadId;
+    try {
+        const fallbackApplied = await applyCodexNativeSessionTitle(threadId, fallbackTitle, cfg, engine, resumeGeneration ? 'resume' : 'preview', revision);
+        if (!fallbackApplied || revision !== nativeSessionTitleRevision) {
+            syncLatestTitle = true;
+            return;
+        }
+        nativeSessionTitleAppliedThreadId = threadId;
+        log(`Applied native Codex session title: ${fallbackTitle}`);
+        const sourceText = cfg.nativeSessionTitlePrompt?.trim() ?? '';
+        cfg.nativeSessionTitlePrompt = undefined;
+        if (!sourceText)
+            return;
+        const adapter = createCliAdapterSync('codex', cfg.cliPathOverride);
+        const abortController = new AbortController();
+        nativeSessionTitleSyncAbortControllers.add(abortController);
+        let semanticCore;
+        try {
+            semanticCore = await generateCodexAppThreadTitle({
+                sourceText,
+                codexBin: adapter.resolvedBin,
+                env: codexNativeTitleEnv(cfg),
+                model: cfg.model,
+                timeoutMs: 30_000,
+                signal: abortController.signal,
+                detached: true,
+                registerForceClose: registerNativeTitleForceClose,
+            });
+        }
+        finally {
+            nativeSessionTitleSyncAbortControllers.delete(abortController);
+        }
+        if (revision !== nativeSessionTitleRevision) {
+            syncLatestTitle = true;
+            return;
+        }
+        if (!semanticCore) {
+            log('Native Codex semantic title generation unavailable; keeping fallback title');
+            return;
+        }
+        const semanticTitle = buildBotmuxLarkNativeSessionTitle(semanticCore);
+        if (semanticTitle === fallbackTitle)
+            return;
+        const semanticApplied = await applyCodexNativeSessionTitle(threadId, semanticTitle, cfg, engine, 'none', revision);
+        if (!semanticApplied || revision !== nativeSessionTitleRevision) {
+            syncLatestTitle = true;
+            return;
+        }
+        cfg.nativeSessionTitle = semanticTitle;
+        nativeSessionTitleAppliedThreadId = threadId;
+        send({ type: 'native_session_title_generated', title: semanticTitle });
+        log(`Applied generated native Codex session title: ${semanticTitle}`);
+    }
+    catch (err) {
+        if (revision !== nativeSessionTitleRevision)
+            syncLatestTitle = true;
+        else
+            log(`Native Codex session title sync failed: ${err?.message ?? err}`);
+    }
+    finally {
+        if (nativeSessionTitleSyncInFlight === threadId)
+            nativeSessionTitleSyncInFlight = undefined;
+        if (syncLatestTitle) {
+            void syncFreshCodexNativeSessionTitle(threadId, engine);
+        }
+    }
+}
+/** 在 resume 首条输入前记录 updatedAt，后续用其确认历史派生标题已完成回写。 */
+async function captureCodexResumeTitleBaseline(threadId, engine) {
+    const cfg = lastInitConfig;
+    if (!cfg || cfg.cliId !== 'codex' || cfg.adoptMode || !cfg.nativeSessionTitle)
+        return;
+    nativeSessionTitleResumeUpdatedAt = Math.floor(Date.now() / 1000);
+    try {
+        if (engine?.activeThreadId === threadId) {
+            const metadata = await engine.readThreadMetadata(7000);
+            if (metadata.updatedAt !== undefined)
+                nativeSessionTitleResumeUpdatedAt = metadata.updatedAt;
+            return;
+        }
+        const adapter = createCliAdapterSync('codex', cfg.cliPathOverride);
+        const env = {
+            ...redactChildEnv(process.env),
+            ...sanitizePerBotEnv(cfg.env),
+        };
+        env.PATH = `${join(homedir(), '.botmux', 'bin')}${delimiter}${env.PATH ?? ''}`;
+        const abortController = new AbortController();
+        nativeSessionTitleSyncAbortControllers.add(abortController);
+        try {
+            const metadata = await readCodexAppThreadMetadata({
+                threadId,
+                codexBin: adapter.resolvedBin,
+                cwd: cfg.workingDir,
+                env,
+                timeoutMs: 7000,
+                signal: abortController.signal,
+                detached: true,
+                registerForceClose: registerNativeTitleForceClose,
+            });
+            if (metadata.updatedAt !== undefined)
+                nativeSessionTitleResumeUpdatedAt = metadata.updatedAt;
+        }
+        finally {
+            nativeSessionTitleSyncAbortControllers.delete(abortController);
+        }
+    }
+    catch (err) {
+        log(`Could not capture Codex resume title baseline: ${err?.message ?? err}`);
+    }
+}
+/** 每次 CLI spawn 后重建当前 generation 的标题同步状态。 */
+async function prepareCodexNativeTitleGeneration(cfg, engine) {
+    if (cfg.cliId !== 'codex' || cfg.adoptMode || !cfg.nativeSessionTitle)
+        return;
+    nativeSessionTitleAppliedThreadId = undefined;
+    nativeSessionTitleResumeUpdatedAt = undefined;
+    nativeSessionTitleCurrentGenerationResume = lastSpawnEffectiveResume;
+    if (!lastSpawnEffectiveResume)
+        return;
+    const threadId = engine?.activeThreadId ?? lastSpawnEffectiveCliSessionId ?? cfg.cliSessionId;
+    if (threadId)
+        await captureCodexResumeTitleBaseline(threadId, engine);
+}
+/** Bridge TRAE app-server's native request_user_input request to botmux's
+ * existing Lark ask broker. The app-server owns tool execution in RPC mode, so
+ * returning this response resumes the same turn without terminal key driving. */
+async function bridgeTraexUserInput(cfg, params) {
+    const parsed = parseTraexUserInputQuestions(params);
+    if (parsed.kind === 'unsupported') {
+        // Returning empty answers makes TraeX silently complete the tool as if no
+        // one answered, dropping the whole batch. Throw instead so the RPC engine
+        // replies with a JSON-RPC error and the failure is visible on the turn.
+        throw new Error(`requestUserInput cannot be represented as an ask card: ${parsed.reason}`);
+    }
+    const { questions } = parsed;
+    const daemon = findOnlineDaemon(cfg.larkAppId);
+    if (!daemon)
+        throw new Error(`daemon not found for larkAppId=${cfg.larkAppId}`);
+    const response = await fetchDaemonIpc(daemon.ipcPort, '/api/asks', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            sessionId: cfg.sessionId,
+            chatId: cfg.chatId,
+            larkAppId: cfg.larkAppId,
+            rootMessageId: cfg.rootMessageId || null,
+            questions: questions.map(entry => entry.question),
+            timeoutMs: 3_600_000,
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`ask broker HTTP ${response.status}: ${(await response.text()).slice(0, 200)}`);
+    }
+    const result = await response.json();
+    // Timeout/cancel/invalidated — surface as an error rather than an empty answer
+    // that TraeX would treat as "no one answered" and silently skip.
+    if (result.kind !== 'answered') {
+        throw new Error(`ask not answered (${result.kind ?? 'unknown'})`);
+    }
+    const customText = result.comment?.trim() ?? '';
+    const answers = {};
+    questions.forEach((entry, index) => {
+        const selected = result.answers?.[index] ?? [];
+        const values = selected.length > 0 ? [...selected] : customText ? [customText] : [];
+        if (values.length > 0)
+            answers[entry.id] = { answers: values };
+    });
+    return { answers };
+}
 /** Stand up (or re-establish) the per-session codex app-server + botmux-owned
  *  thread and point remote{WsUrl,ThreadId} at it, so the next spawnCli launches
  *  `codex --remote <ws> resume <thread>` and input flows over JSON-RPC. Fully
@@ -276,7 +517,21 @@ async function engageCodexRpc(cfg) {
         const engineEnv = { ...redactChildEnv(process.env) };
         engineEnv.PATH = `${join(homedir(), '.botmux', 'bin')}:${engineEnv.PATH ?? ''}`;
         engineEnv.BOTMUX_SESSION_ID = cfg.sessionId;
+        // In Codex/TraeX RPC mode the app-server, not the remote viewer TUI, runs
+        // model shell tools. Give that process the same non-secret route binding as
+        // spawnCli so `botmux ask` can post into the current Lark thread.
+        engineEnv.BOTMUX_CHAT_ID = cfg.chatId;
+        if (cfg.chatType)
+            engineEnv.BOTMUX_CHAT_TYPE = cfg.chatType;
+        else
+            delete engineEnv.BOTMUX_CHAT_TYPE;
         engineEnv.BOTMUX_LARK_APP_ID = cfg.larkAppId;
+        engineEnv.BOTMUX_ROOT_MESSAGE_ID = cfg.rootMessageId;
+        engineEnv.BOTMUX_SESSION_SCOPE = cfg.rootMessageId?.startsWith('om_') ? 'thread' : 'chat';
+        if (cfg.ownerOpenId)
+            engineEnv.BOTMUX_OWNER_OPEN_ID = cfg.ownerOpenId;
+        else
+            delete engineEnv.BOTMUX_OWNER_OPEN_ID;
         // The app-server owns model execution in RPC mode. Its MCP gateway child
         // must inherit the trusted host socket just like a native CLI process does.
         if (sessionMcpGatewayHost) {
@@ -295,6 +550,10 @@ async function engageCodexRpc(cfg) {
         engine = new CodexRpcEngine({
             cliBin, cwd: cfg.workingDir, env: engineEnv, sessionId: cfg.sessionId,
             model: cfg.model, log: (m) => log(m),
+            appServerFeatures: cfg.cliId === 'traex' ? ['default_mode_request_user_input'] : undefined,
+            onRequestUserInput: cfg.cliId === 'traex'
+                ? (params) => bridgeTraexUserInput(cfg, params)
+                : undefined,
             onDead: () => {
                 if (codexRpcEngine === engine) {
                     log('Codex RPC app-server died; replacing the tmux session and re-engaging the thread');
@@ -348,10 +607,13 @@ async function engageCodexRpc(cfg) {
                 codexBridgeMarkPendingTurn(cfg.prompt, cfg.turnId);
             outcome = first; // 'accepted' | 'ambiguous' — both stay engaged, prompt never re-queued
         }
-        persistCliSessionId(threadId);
         codexRpcEngine = engine;
         remoteWsUrl = engine.wsUrl;
         remoteThreadId = threadId;
+        persistCliSessionId(threadId);
+        if (!wantResume && cfg.prompt && outcome === 'accepted') {
+            void syncFreshCodexNativeSessionTitle(threadId, engine);
+        }
         log(`Codex RPC input engaged (${outcome}${wantResume ? '/resume' : '/fresh'}): app-server ${engine.wsUrl} thread ${threadId}`);
         return outcome;
     }
@@ -739,7 +1001,12 @@ const authedClients = new WeakSet();
 const clientPtys = new Map();
 /** Managed-Herdr viewers survive an in-worker /restart while backend changes. */
 const herdrWebBindings = new Map();
-const writeToken = randomBytes(16).toString('hex');
+// Standalone/test fallback. Production replaces this after init with a stable
+// per-session HMAC derived from the host-only dashboard secret, so an
+// already-issued 「操作链接」/write link survives a worker restart (a silent
+// daemon restart re-forks every worker — a per-process random token would 403
+// every previously-issued operate link).
+let writeToken = randomBytes(16).toString('hex');
 // Standalone/test fallback. Production replaces this after init with a stable
 // per-session HMAC derived from the host-only dashboard secret.
 let viewToken = randomBytes(32).toString('base64url');
@@ -754,6 +1021,15 @@ function refreshTerminalViewToken() {
     if (secret && sessionId)
         viewToken = deriveTerminalViewToken(secret, sessionId);
 }
+/** Re-derive the stable write (operate) token from the host-only dashboard
+ *  secret so a restarted worker mints the SAME token — keeping already-issued
+ *  「操作链接」/write links valid across restarts. Falls back to the random
+ *  boot token when the secret is unavailable (standalone/test). */
+function refreshTerminalWriteToken() {
+    const secret = loadDashboardSecret(DASHBOARD_SECRET_PATH);
+    if (secret && sessionId)
+        writeToken = deriveTerminalWriteToken(secret, sessionId);
+}
 /**
  * Resolve terminal write permission for one request. The platform-injected
  * `X-Botmux-Role` header is trusted only when this machine is bound to a central
@@ -790,6 +1066,10 @@ function ensureZellijAttachConfig() {
 }
 let sessionId = '';
 let lastInitConfig = null;
+/** Dashboard「复现命令」：session 冷启时最终交给 backend.spawn 的真实调用
+ *  （bin + argv + cwd + 关键 env）。原样保留，worker `ready` 时随消息上报给 daemon
+ *  持久化。仅有写权限的 dashboard 视图可见。 */
+let capturedSpawnCommand = null;
 let deferredTopicOutputTail = '';
 const reportedDeferredTopicRoots = new Set();
 const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff' };
@@ -1073,6 +1353,21 @@ const pendingRawInputs = [];
  * administrative TUI command: never type-ahead while the agent is busy, never
  * open a model turn, and latest-wins if several renames arrive before idle. */
 let pendingSessionRename = null;
+let nativeSessionTitleSyncInFlight;
+let nativeSessionTitleAppliedThreadId;
+let nativeSessionTitleRevision = 0;
+let nativeSessionTitleResumeUpdatedAt;
+let nativeSessionTitleCurrentGenerationResume = false;
+const nativeSessionTitleSyncAbortControllers = new Set();
+const nativeSessionTitleSyncForceClosers = new Set();
+function stopNativeSessionTitleSync() {
+    for (const abortController of nativeSessionTitleSyncAbortControllers)
+        abortController.abort();
+    nativeSessionTitleSyncAbortControllers.clear();
+    for (const forceClose of nativeSessionTitleSyncForceClosers)
+        forceClose();
+    nativeSessionTitleSyncForceClosers.clear();
+}
 /** True after the rename command's Enter lands and until the TUI returns to its
  * prompt. Blocks type-ahead user messages from racing into the command UI. */
 let sessionRenameInFlight = false;
@@ -3734,6 +4029,7 @@ function parkCrashDiagnosticTerminal(code, signal) {
     // both when the next message respawns the CLI.
     stopScreenUpdates();
     stopScreenAnalyzer();
+    stopStuckDetector();
     log(`Crash diagnostic tmux session parked at ${TmuxBackend.diagnosticSessionName(sessionId)}`);
     return true;
 }
@@ -3849,6 +4145,68 @@ function stopScreenAnalyzer() {
     screenAnalyzer = null;
     tuiPromptBlocking = false;
 }
+// ─── Stuck Detector (AI-free fallback for blocked CLI states) ───────────────
+let stuckDetector = null;
+// Monotonic counter bumped on every CLI/backend (re)start within this worker.
+// Paired with the backend object identity, it lets the worker verify that a
+// stuck-warning card click still targets the same CLI instance that was stuck —
+// a restart within the same Node worker must invalidate outstanding cards.
+let cliLifetimeNonce = 0;
+function startStuckDetector() {
+    const sd = config.stuckDetector;
+    if (!sd.enabled)
+        return;
+    stopStuckDetector();
+    stuckDetector = new StuckDetector(sd.timeoutMs, {
+        isActuallyStuck: () => {
+            // Scope gate: this PR only handles the Codex PreToolUse hook-review
+            // screen. Other CLIs (Claude Code, Gemini, ...) must never see the
+            // Codex-specific t/Enter/Esc card, even if their output happens to
+            // contain the same strings.
+            if (lastInitConfig?.cliId !== 'codex')
+                return false;
+            // Only warn if the CLI is not at its idle prompt AND no TUI prompt card
+            // is already posted. A long legitimate turn (model thinking, tool calls)
+            // must not trigger this.
+            if (isPromptReady)
+                return false;
+            if (tuiPromptBlocking)
+                return false;
+            // Anti-false-positive: if the PTY produced output recently the CLI is
+            // still actively working (model streaming, tool output, spinner) — not
+            // stuck. Require quiescence before firing.
+            const sincePty = Date.now() - lastPtyActivityAtMs;
+            if (sincePty < 15_000)
+                return false;
+            // Do NOT gate on durableTurnInFlight: the original hook-review incident
+            // ran on a non-durable (ordinary IM) turn, and a durable turn's 20s
+            // submit-recheck failure clears durableTurnInFlight before the 45s
+            // detector fires. The PTY-quiescence + !isPromptReady combination is
+            // sufficient to detect a genuinely stalled turn.
+            return true;
+        },
+        onStuck: (elapsedMs, matchedLabel) => {
+            // Prefer lastAnalyzerSnapshot (the capture-pane authoritative current
+            // screen) over the long-lived renderer, which can drift under tmux.
+            const snapshot = lastAnalyzerSnapshot || renderer?.rawSnapshot() || '';
+            log(`StuckDetector: turn unresolved for ${Math.round(elapsedMs / 1000)}s${matchedLabel ? ` (${matchedLabel})` : ''}`);
+            send({
+                type: 'stuck_warning',
+                elapsedMs,
+                snapshot: snapshot.slice(-3000),
+                matchedPattern: matchedLabel,
+                turnId: currentBotmuxTurnId,
+                dispatchAttempt: currentBotmuxDispatchAttempt,
+                cliLifetime: cliLifetimeNonce,
+            });
+        },
+        getSnapshot: () => lastAnalyzerSnapshot || renderer?.rawSnapshot() || '',
+    });
+}
+function stopStuckDetector() {
+    stuckDetector?.dispose();
+    stuckDetector = null;
+}
 // ─── Screenshot Capture (PNG → Feishu image_key) ────────────────────────────
 const SCREENSHOT_INTERVAL_MS = 10_000;
 const POST_ACTION_DELAY_MS = 1_000;
@@ -4096,24 +4454,32 @@ const KEY_TO_ANSI = {
  * Execute an AI-provided key sequence with delays between each key.
  * @param keys — key names like ["Down","Down","Space","Up","Up"]
  * @param isFinal — if true, this action ends the prompt (clear blocking state)
+ * @returns true if all keys were written successfully; false if backend is gone
+ *          or a write threw (caller must NOT send tui_keys_delivered on false).
  */
 async function handleTuiKeys(keys, isFinal) {
     if (!backend || keys.length === 0)
-        return;
-    if ('sendSpecialKeys' in backend) {
-        const b = backend;
-        // Send each key individually with 100ms delay for TUI state processing
-        for (const key of keys) {
-            b.sendSpecialKeys(key);
-            await new Promise(r => setTimeout(r, 100));
+        return false;
+    try {
+        if ('sendSpecialKeys' in backend) {
+            const b = backend;
+            // Send each key individually with 100ms delay for TUI state processing
+            for (const key of keys) {
+                b.sendSpecialKeys(key);
+                await new Promise(r => setTimeout(r, 100));
+            }
         }
-    }
-    else {
-        for (const key of keys) {
-            backend.write(KEY_TO_ANSI[key] ?? key);
-            await new Promise(r => setTimeout(r, 100));
+        else {
+            for (const key of keys) {
+                backend.write(KEY_TO_ANSI[key] ?? key);
+                await new Promise(r => setTimeout(r, 100));
+            }
         }
     }
+    catch (e) {
+        logError(`handleTuiKeys write failed: ${e?.message ?? e}`);
+        return false;
+    }
     if (isFinal) {
         tuiPromptBlocking = false;
         if (isPromptReady) {
@@ -4123,6 +4489,7 @@ async function handleTuiKeys(keys, isFinal) {
         screenAnalyzer?.notifySelection('final');
     }
     log(`TUI keys: ${keys.join(' ')}${isFinal ? ' (final)' : ''}`);
+    return true;
 }
 // 待注入的 TUI 命令队列。生命周期绑定当前 CLI 进程：killCli() 会清空它，
 // 防止 restart 后残留命令重放进新 CLI——新增清理状态时记得同步那里。
@@ -4630,6 +4997,7 @@ function markPromptReady() {
     // worker-local replay of the durable attempt.
     if (!durableTurnInFlight)
         inflightInputs.onTurnComplete();
+    stuckDetector?.disarm();
     maybeEmitWorkflowTranscriptOutput();
     if (awaitingFirstPrompt) {
         awaitingFirstPrompt = false;
@@ -4814,6 +5182,7 @@ function scheduleSubmitFailureNotify(msg, recheck, transcriptLabel, bridgeTurnId
                     persistCliSessionId(cliSessionId);
                     if (codexBridgeFallbackActive())
                         codexBridgeNotifyCliSessionId(cliSessionId);
+                    void syncFreshCodexNativeSessionTitle(cliSessionId, codexRpcEngine);
                 }
                 log(`Deferred recheck found submit in ${transcriptLabel} — suppressing warning. preview="${preview}"`);
                 return;
@@ -5098,8 +5467,10 @@ async function flushPending() {
             // auto-re-queued: a lost/late ack surfaces as a submit-failure the user can
             // resend manually, and the stable clientUserMessageId lets codex dedupe a
             // resend (Codex delta P1-1).
-            if (!codexRpcEngine)
+            if (!codexRpcEngine) {
                 inflightInputs.onWrite(item);
+                stuckDetector?.arm();
+            }
             const msg = item.content;
             const logicalMsg = item.logicalContent ?? msg;
             currentBotmuxTurnId = item.turnId;
@@ -5197,6 +5568,13 @@ async function flushPending() {
                 if (codexBridgeActive)
                     codexBridgeNotifyCliSessionId(result.cliSessionId);
             }
+            if (lastInitConfig?.cliId === 'codex' && result?.submitted !== false) {
+                const threadId = result?.cliSessionId
+                    ?? codexRpcEngine?.activeThreadId
+                    ?? lastInitConfig.cliSessionId;
+                if (threadId)
+                    void syncFreshCodexNativeSessionTitle(threadId, codexRpcEngine);
+            }
             // `&& backend`: if the CLI exited during this write (pane gone → onExit
             // nulled backend) the user already got a "CLI exited" notice; don't also
             // nag that the submit wasn't confirmed.
@@ -5222,7 +5600,7 @@ async function flushPending() {
 }
 function sendToPty(content, turnId, opts = {}) {
     if (!cliAdapter)
-        return;
+        return false;
     const next = {
         content,
         turnId,
@@ -5239,7 +5617,7 @@ function sendToPty(content, turnId, opts = {}) {
     if (cliRestartInProgress || !backend) {
         pendingMessages.push(next);
         log(`Queued message while CLI backend is restarting (${pendingMessages.length} pending)`);
-        return;
+        return true;
     }
     const supportsTypeAhead = pendingInputAllowsTypeAhead(cliAdapter.supportsTypeAhead === true, durableTurnInFlight, next);
     const shouldMergeQueued = opts.dispatchAttempt === undefined && !durableTurnInFlight
@@ -5296,6 +5674,7 @@ function sendToPty(content, turnId, opts = {}) {
             log(`Queued message (${pendingMessages.length} pending): "${content.substring(0, 80)}" — ${cliName()} ${awaitingFirstPrompt ? 'still booting' : 'is busy'}`);
         scheduleBusyPatternIdleProbe(`${cliName()} queued-message`);
     }
+    return true;
 }
 // ─── Screen Update Timer ─────────────────────────────────────────────────────
 function startScreenUpdates() {
@@ -5733,6 +6112,7 @@ async function spawnCli(cfg, opts = {}) {
         });
         effectiveBackendType = 'herdr';
         backend = herdrBe;
+        cliLifetimeNonce++;
         // Same as tmux/zellij adopt: writeInput (grok preferSessionId via
         // findGrokSessionByPid, claude pid-state) needs cliPid/cliCwd on the
         // PtyHandle. spawn() overwrites cliCwd from opts.cwd — use adoptCwd when
@@ -5791,6 +6171,7 @@ async function spawnCli(cfg, opts = {}) {
             : new TmuxPipeBackend(cfg.adoptTmuxTarget, { cliPid: cfg.adoptCliPid });
         effectiveBackendType = cfg.adoptZellijPaneId ? 'zellij' : 'tmux';
         backend = observeBe;
+        cliLifetimeNonce++;
         // writeInput (grok concurrent prompt_history binding, claude pid-state)
         // reads these fields off the PtyHandle — constructor only stores
         // watchCliPid for liveness, so surface them explicitly for adopt.
@@ -5970,11 +6351,6 @@ async function spawnCli(cfg, opts = {}) {
             }
         }
     }
-    const selectedBackend = selectSessionBackend({ sessionId: cfg.sessionId, backendType: effectiveBackend, backendConfig: riffBackendConfig });
-    isTmuxMode = selectedBackend.isTmuxMode;
-    isPipeMode = selectedBackend.isPipeMode;
-    isZellijMode = selectedBackend.isZellijMode;
-    backend = selectedBackend.backend;
     const adapterSessionId = cfg.resume
         ? (cfg.originalSessionId ?? cfg.sessionId)
         : cfg.sessionId;
@@ -5990,81 +6366,20 @@ async function spawnCli(cfg, opts = {}) {
     // so a fork inherits the whole submit-confirm + bridge-fallback machinery.
     let claudeDataDir = cliAdapter.claudeDataDir;
     let effectiveReadyHookInstall = cliAdapter.hookInstall;
-    // When this session will be file-sandboxed, the CLI's session jsonl is written
-    // into the overlay's EPHEMERAL home upper (CLAUDE_CONFIG_DIR lives under $HOME),
-    // invisible at the real path the bridge normally watches → "Bridge mark expired"
-    // and the turn never relays (2026-06-10 incident). Redirect every jsonl/pid/
-    // bridge gate below to the upper copy where the sandboxed CLI actually writes.
-    const willFileSandbox = process.platform === 'linux' && // bwrap overlay is Linux-only; macOS uses the Seatbelt write-sandbox below
-        (cfg.sandbox === true || sandboxEnabled()) &&
-        (effectiveBackendType === 'pty' || effectiveBackendType === 'tmux') &&
-        !!process.env.SESSION_DATA_DIR;
-    if (claudeDataDir && willFileSandbox) {
-        const redirected = sandboxedClaudeDataDir(cfg.sessionId, claudeDataDir, {
-            sourceWorkingDir: cfg.workingDir,
-            dataDir: process.env.SESSION_DATA_DIR,
-        });
-        log(`[sandbox] redirecting Claude bridge dataDir → overlay upper: ${redirected}`);
-        claudeDataDir = redirected;
-    }
-    // v2 read isolation: relocate the CLI's data root into the per-bot BOT_HOME
-    // (`<BOTMUX_HOME>/bots/<appId>/{claude,codex}`) so each bot's transcripts/memory
-    // land in its OWN (Seatbelt-allowed) dir, NOT the shared/global ~/.claude|~/.codex
-    // (which v2 denies wholesale). Decided EARLY — like willFileSandbox above — so
-    // every JSONL/bridge/resume path below already targets the per-bot dir. The
-    // matching CLAUDE_CONFIG_DIR/CODEX_HOME env, per-bot provisioning and Seatbelt
-    // wrapper are applied at spawn time further down. This gate is the SINGLE
-    // decision point: configured-but-unenforceable fail-closes HERE (never run a
-    // session unisolated that asked for isolation).
-    // UNIFIED file sandbox: read isolation engages with the same toggle as write
-    // isolation. On darwin the legacy standalone `readIsolation` flag ALSO engages it
-    // (Seatbelt can read-deny without a write overlay). On Linux read isolation RIDES
-    // the bwrap sandbox (its masks go into the same bwrap plan), so it requires the
-    // sandbox to be on — hence the trigger is the sandbox toggle there, never the bare
-    // legacy flag (which would redirect the data dir but apply no masks → a hole).
-    // riff runs in its own REMOTE sandbox with no local CLI process — every
-    // local isolation flavor (Linux bwrap, macOS Seatbelt write-sandbox, read
-    // isolation incl. the legacy fail-closed flag) is meaningless for it and
-    // must be bypassed on ALL platforms, or a sandbox/readIsolation-enabled bot
-    // bricks the moment it switches to riff.
-    const riffRemoteBackend = effectiveBackendType === 'riff';
+    // ── UNIFIED file sandbox (fs-policy, 2026-07-16 refactor) ──
+    // ONE toggle, BOTH platforms, identical three-tier deny-by-default semantics
+    // (adapters/cli/fs-policy.ts). Legacy `readIsolation` is auto-migrated to
+    // `sandbox` at daemon startup; honored here too for an unmigrated read-only
+    // BOTS_CONFIG. riff runs in its own REMOTE sandbox with no local CLI process —
+    // local confinement is meaningless there and must be bypassed on ALL
+    // platforms, or a sandbox-enabled bot bricks the moment it switches to riff.
+    const riffRemoteBackend = !localSandboxApplies(effectiveBackendType);
     if (riffRemoteBackend && (cfg.sandbox === true || cfg.readIsolation === true)) {
-        log('Sandbox/read-isolation flags set but backend is riff (remote sandbox, no local process) — local isolation bypassed');
-    }
-    const wantsFileSandbox = !riffRemoteBackend && (cfg.sandbox === true || sandboxEnabled());
-    // Legacy EXPLICIT read-isolation opt-in (macOS only — Linux read-iso rides the
-    // bwrap sandbox, so it's driven solely by the sandbox toggle there). Keeps
-    // FAIL-CLOSED semantics: you asked for read isolation → refuse to start without it.
-    const explicitLegacyReadIso = process.platform === 'darwin' && cfg.readIsolation === true && !riffRemoteBackend;
-    const readIsolationGate = evaluateReadIsolationGate({
-        configured: wantsFileSandbox || explicitLegacyReadIso,
-        adapterSupports: cliAdapter.supportsReadIsolation === true,
-        wrapperCliSet: !!cfg.wrapperCli,
-        platform: process.platform,
-        sessionDataDirSet: !!process.env.SESSION_DATA_DIR,
-    });
-    // Fail-closed ONLY for the explicit legacy flag. Under the UNIFIED sandbox toggle
-    // read isolation is BEST-EFFORT: a CLI/platform that can't enforce the read-deny
-    // (e.g. a non-supporting adapter) still runs WRITE-isolated — it just doesn't get
-    // the read masks. Never brick a sandboxed session just because read-iso is N/A.
-    if (readIsolationGate.failClosedReason && explicitLegacyReadIso) {
-        throw new Error(`[read-isolation] refusing to start session ${cfg.sessionId}: ${readIsolationGate.failClosedReason}`);
-    }
-    const willReadIsolate = readIsolationGate.enabled;
-    // macOS FILE SANDBOX — the Seatbelt WRITE-isolation twin of the Linux bwrap
-    // overlay. On darwin, `sandbox: true` (or the global sandboxEnabled()) confines
-    // WRITES via the same `sandbox-exec` wrapper as read isolation instead of bwrap
-    // (Linux-only). Reads stay open, matching the Linux "read-all / write-isolated"
-    // model; if read isolation is ALSO on, its read-deny set layers into the SAME
-    // profile. Like bwrap this is FAIL-SAFE: a requested sandbox that can't be
-    // established (unsandboxable backend, no SESSION_DATA_DIR) is a hard error at the
-    // spawn site below, never a silent unconfined run.
-    const willWriteSandbox = process.platform === 'darwin' && wantsFileSandbox;
-    if (willWriteSandbox && !process.env.SESSION_DATA_DIR) {
-        throw new Error(`[file-sandbox] refusing to start session ${cfg.sessionId}: missing SESSION_DATA_DIR`);
-    }
-    const fullIsolationCoversCredentials = !riffRemoteBackend && ((process.platform === 'darwin' && (willReadIsolate || willWriteSandbox))
-        || (process.platform === 'linux' && wantsFileSandbox));
+        log('Sandbox flag set but backend is riff (remote sandbox, no local process) — local sandbox bypassed');
+    }
+    const sandboxRequested = !riffRemoteBackend
+        && (cfg.sandbox === true || cfg.readIsolation === true || sandboxEnabled());
+    const fullIsolationCoversCredentials = sandboxRequested;
     let credentialMechanismAvailable = true;
     let credentialMechanismExecutable;
     if (mandatoryCredentialIsolation && !riffRemoteBackend && !fullIsolationCoversCredentials) {
@@ -6097,19 +6412,50 @@ async function spawnCli(cfg, opts = {}) {
     const credentialOnlySeatbelt = credentialIsolationGate.mode === 'seatbelt';
     const credentialOnlyBwrap = credentialIsolationGate.mode === 'bwrap';
     const appliedIsolationCapabilities = [];
-    if (credentialBoundaryActive
-        || willReadIsolate
-        || (process.platform === 'linux' && wantsFileSandbox)) {
+    if (credentialBoundaryActive || sandboxRequested) {
         appliedIsolationCapabilities.push('credential');
     }
-    if (willReadIsolate)
-        appliedIsolationCapabilities.push('read');
-    if (willWriteSandbox || (process.platform === 'linux' && wantsFileSandbox)) {
-        appliedIsolationCapabilities.push('write');
-    }
+    if (sandboxRequested)
+        appliedIsolationCapabilities.push('read', 'write');
     currentCliCredentialIsolated = appliedIsolationCapabilities.includes('credential');
     const isolationRuntimeDataDir = process.env.SESSION_DATA_DIR
         ?? join(defaultBotmuxHome, 'data');
+    let mcpRuntimeManifest = readSessionMcpRuntimeManifest(cfg.sessionId, config.session.dataDir);
+    const hasMcpRuntimeEntries = !!cliAdapter.mcpGateway && !!mcpRuntimeManifest?.entries.length;
+    const selectBackend = () => selectSessionBackend({
+        sessionId: cfg.sessionId,
+        backendType: effectiveBackend,
+        backendConfig: riffBackendConfig,
+        persistentBackendTarget: cfg.persistentBackendTarget,
+        // Old builds could place managed agents in a user's shared Herdr session.
+        // Preserve that recorded target for compatibility unless this incarnation
+        // requires an isolation/MCP boundary that only a Botmux-owned session can
+        // safely provide. Fresh tasks use distinct agents in one machine-wide host.
+        reuseRecordedHerdrTarget: !sandboxRequested
+            && !hasMcpRuntimeEntries,
+    });
+    let selectedBackend = selectBackend();
+    isTmuxMode = selectedBackend.isTmuxMode;
+    isPipeMode = selectedBackend.isPipeMode;
+    isZellijMode = selectedBackend.isZellijMode;
+    backend = selectedBackend.backend;
+    // BOT_HOME CLI-data redirect: sandboxed bots whose adapter supports it keep
+    // their CLI data (transcripts/memory/auth) in their own BOT_HOME via
+    // CLAUDE_CONFIG_DIR/CODEX_HOME — under deny-by-default the global ~/.claude|
+    // ~/.codex are simply not exposed. Best-effort: a non-supporting adapter
+    // keeps its REAL data dirs instead, which the policy exposes readWrite (the
+    // sandbox itself still applies). Decided EARLY so every JSONL/bridge/resume
+    // path below already targets the right dir. wrapperCli strips spawn args, so
+    // the redirect (and its env) can't be guaranteed there → not redirected.
+    const willRedirectCliData = sandboxRequested
+        && cliAdapter.supportsReadIsolation === true
+        && !cfg.wrapperCli
+        && !!process.env.SESSION_DATA_DIR;
+    // Bump the CLI-lifetime nonce: any stuck-warning card posted by a previous
+    // backend instance (within this same worker) must not inject keys into the
+    // new one. The worker echoes this nonce in stuck_warning and re-checks it on
+    // tui_keys, alongside the backend object identity.
+    cliLifetimeNonce++;
     // Every bot — isolated OR not — gets its own BOT_HOME dir as a ready-made private-
     // storage slot. An isolated sibling denies this path regardless of whether the owner
     // is isolated (deny uses the full bots.json), so a non-isolated bot can drop private
@@ -6128,7 +6474,7 @@ async function spawnCli(cfg, opts = {}) {
     }
     let isolationBotHome;
     let isolatedCodexHome;
-    if (willReadIsolate) {
+    if (willRedirectCliData) {
         isolationBotHome = ownBotHome;
         const isClaudeFam = !!claudeDataDir;
         if (isClaudeFam)
@@ -6175,28 +6521,21 @@ async function spawnCli(cfg, opts = {}) {
     // on EVERY restart, e.g. for a sandboxed session whose transcript lives in
     // an ephemeral overlay upper that the probe can't see). Computed here (not at
     // the spawn site below) so the pre-flight can short-circuit on it.
-    const persistentSessionName = effectiveBackendType === 'tmux'
-        ? TmuxBackend.sessionName(cfg.sessionId)
-        : effectiveBackendType === 'herdr'
-            ? HerdrBackend.sessionName(cfg.sessionId)
-            : effectiveBackendType === 'zellij'
-                ? ZellijBackend.sessionName(cfg.sessionId)
-                : undefined;
+    let persistentSessionName = selectedBackend.persistentSessionName;
     // [read-isolation] Before we decide to reattach a persistent pane: a pane can
     // survive a daemon restart still running a CLI that may NOT be isolated (e.g.
     // spawned before isolation was enabled, or by an old build). Isolation is only
     // injectable at spawn time, so reattaching such a pane would silently run
-    // unisolated. We stamp a versioned policy marker when we spawn an isolated
-    // pane; if an existing pane was not spawned under the current policy, kill it
-    // so the probe below sees no pane and we cold-spawn fresh isolated. A current-
-    // policy pane survives daemon restarts and suspend→resume safely because the
-    // confinement remains attached to the live process.
+    // unisolated. We stamp a boot-id marker when we spawn an isolated pane; if this
+    // isolated bot's existing pane is NOT stamped by THIS daemon lifetime, kill it
+    // so the probe below sees no pane and we cold-spawn fresh isolated. A pane from
+    // this lifetime (suspend→resume) keeps its marker → reattaches normally (it is
+    // still the isolated process). This lets isolated bots use tmux/zellij/herdr.
     if (appliedIsolationCapabilities.length > 0 && persistentSessionName && effectiveBackendType !== 'pty') {
-        const paneLive = effectiveBackendType === 'tmux'
-            ? TmuxBackend.hasSession(persistentSessionName)
-            : effectiveBackendType === 'zellij'
-                ? ZellijBackend.hasSession(persistentSessionName)
-                : HerdrBackend.hasSession(persistentSessionName);
+        const persistentTarget = selectedBackend.persistentBackendTarget;
+        const paneLive = persistentTarget
+            ? probePersistentBackendTarget(persistentTarget) === 'exists'
+            : false;
         if (paneLive) {
             let marker = null;
             marker = readRegularHostFileNoFollow(join(isolationRuntimeDataDir, 'read-isolation', `${cfg.sessionId}.boot`));
@@ -6211,7 +6550,18 @@ async function spawnCli(cfg, opts = {}) {
                 // obsolete permissions. Kill it before publishing any new capability.
                 log(`[read-isolation] legacy/unmarked persistent pane for ${cfg.sessionId} — killing + cold-spawning with current policy`);
                 try {
-                    killPersistentSession(effectiveBackendType, persistentSessionName);
+                    const persistentTarget = selectedBackend.persistentBackendTarget;
+                    if (persistentTarget)
+                        killPersistentBackendTarget(persistentTarget);
+                    else
+                        killPersistentSession(effectiveBackendType, persistentSessionName);
+                    selectedBackend = selectBackend();
+                    isTmuxMode = selectedBackend.isTmuxMode;
+                    isPipeMode = selectedBackend.isPipeMode;
+                    isZellijMode = selectedBackend.isZellijMode;
+                    backend = selectedBackend.backend;
+                    cliLifetimeNonce++;
+                    persistentSessionName = selectedBackend.persistentSessionName;
                 }
                 catch (e) {
                     throw new Error(`[read-isolation] refusing to start session ${cfg.sessionId}: could not kill stale persistent pane (${e.message})`);
@@ -6219,28 +6569,32 @@ async function spawnCli(cfg, opts = {}) {
             }
         }
     }
-    let mcpRuntimeManifest = readSessionMcpRuntimeManifest(cfg.sessionId, config.session.dataDir);
+    let willReattachPersistent = selectedBackend.isReattach === true;
     if (cliAdapter.mcpGateway && mcpRuntimeManifest?.entries.length && persistentSessionName && effectiveBackendType !== 'pty') {
-        const paneLive = effectiveBackendType === 'tmux'
-            ? TmuxBackend.hasSession(persistentSessionName)
-            : effectiveBackendType === 'zellij'
-                ? ZellijBackend.hasSession(persistentSessionName)
-                : HerdrBackend.hasSession(persistentSessionName);
+        const persistentTarget = selectedBackend.persistentBackendTarget;
+        const paneLive = persistentTarget
+            ? probePersistentBackendTarget(persistentTarget) === 'exists'
+            : false;
         if (paneLive) {
             // The trusted Gateway host belongs to the worker and cannot survive a
             // worker/daemon replacement. Cold-resume the CLI so its MCP client gets a
             // fresh relay socket instead of reattaching to a dead connection.
             log(`[mcp-gateway] persistent pane ${cfg.sessionId} has plugin MCP state — cold-resuming with a fresh host`);
-            killPersistentSession(effectiveBackendType, persistentSessionName);
+            const persistentTarget = selectedBackend.persistentBackendTarget;
+            if (persistentTarget)
+                killPersistentBackendTarget(persistentTarget);
+            else
+                killPersistentSession(effectiveBackendType, persistentSessionName);
+            selectedBackend = selectBackend();
+            isTmuxMode = selectedBackend.isTmuxMode;
+            isPipeMode = selectedBackend.isPipeMode;
+            isZellijMode = selectedBackend.isZellijMode;
+            backend = selectedBackend.backend;
+            cliLifetimeNonce++;
+            persistentSessionName = selectedBackend.persistentSessionName;
+            willReattachPersistent = selectedBackend.isReattach === true;
         }
     }
-    const willReattachPersistent = persistentSessionName
-        ? effectiveBackendType === 'tmux'
-            ? TmuxBackend.hasSession(persistentSessionName)
-            : effectiveBackendType === 'zellij'
-                ? ZellijBackend.hasSession(persistentSessionName)
-                : HerdrBackend.hasSession(persistentSessionName)
-        : false;
     // The plugin set is stable only for the lifetime of one real CLI process.
     // A warm worker reattach keeps the existing Gateway and catalog untouched;
     // every fresh/resumed CLI spawn atomically refreshes both from current Bot config.
@@ -6428,81 +6782,39 @@ async function spawnCli(cfg, opts = {}) {
     lastSpawnDeferInitialPrompt = deferInitialPrompt;
     kiroSessionIdCaptureArmed = cfg.cliId === 'kiro-cli' && !effectiveCliSessionId && !willReattachPersistent;
     kiroSessionIdCaptureBuffer = '';
-    // Per-bot local read isolation: assemble the Seatbelt profile context (the gate
-    // already fail-closed above — reaching here with willReadIsolate means it is
-    // enforceable). The worker is on the host (NOT sandboxed), so it holds the
-    // secret; only the spawned CLI child is confined. A reattach that reaches here
-    // is safe: the stale-pane guard above already killed any persistent pane not
-    // stamped as isolated, so `willReattachPersistent` can now only be true for a
-    // pane spawned isolated (still the confined process).
-    let readIsolationCtx;
-    if (willReadIsolate) {
-        const sessionDataDir = process.env.SESSION_DATA_DIR;
-        readIsolationCtx = {
-            homeDir: homedir(),
-            botmuxHome: dirname(sessionDataDir),
-            defaultBotmuxHome: join(homedir(), '.botmux'),
-            sessionDataDir,
-            currentAppId: cfg.larkAppId,
-            currentSessionId: cfg.sessionId,
-            extraDenyPaths: cfg.readDenyExtraPaths,
-        };
-        readIsolationOriginCapabilityFile = process.platform === 'darwin'
-            ? managedOriginCapabilityPath(sessionDataDir, cfg.sessionId)
-            : null;
-        // Replace any legacy child-planted symlink before Seatbelt canonicalizes
-        // carve-outs. A failure is fatal: spawning with a missing/ambiguous
-        // capability transport would either break all IPC or reopen an attacker-
-        // selected realpath in the generated profile.
-        if (readIsolationOriginCapabilityFile) {
-            publishSandboxRelayCapability({ failClosed: true });
-        }
-        // Write this bot's OWN send-credential into its BOT_HOME (the same per-bot
-        // private storage as its CLI data; siblings' BOT_HOMEs are whole-denied).
-        // `botmux send` reads the secret from here instead of bots.json — so the
-        // secret never travels via env/argv (no cross-bot `ps aux` leak) and the CLI
-        // never needs to escape the sandbox.
+    // Sandboxed sessions: write this bot's OWN send-credential into its BOT_HOME.
+    // `botmux send` reads the secret from here instead of bots.json (which
+    // deny-by-default never exposes) — the secret never travels via env/argv (no
+    // cross-bot `ps aux` leak) and the CLI never needs to escape the sandbox.
+    // The worker itself runs on the host (NOT sandboxed) and keeps full access.
+    if (sandboxRequested && process.env.SESSION_DATA_DIR) {
         try {
-            const credPath = sendCredFilePath(sessionDataDir, cfg.larkAppId);
+            const credPath = sendCredFilePath(process.env.SESSION_DATA_DIR, cfg.larkAppId);
             mkdirSync(dirname(credPath), { recursive: true });
             writeFileSync(credPath, JSON.stringify({ larkAppId: cfg.larkAppId, larkAppSecret: cfg.larkAppSecret, brand: cfg.brand }), { mode: 0o600 });
         }
         catch (e) {
-            log(`[read-isolation] WARN could not write send-cred file: ${e.message}`);
+            log(`[sandbox] WARN could not write send-cred file: ${e.message}`);
         }
     }
-    // macOS write-sandbox rules (pure): the writable-zone allow-list + crown-jewel
-    // re-denies. Realpath'd + emitted into the Seatbelt profile at the spawn site.
-    let writeSandboxRules;
-    if (willWriteSandbox && process.env.SESSION_DATA_DIR) {
-        const sessionDataDir = process.env.SESSION_DATA_DIR;
-        // Regex rules cannot be realpath'd after construction, so build their home
-        // prefix from the canonical path up front (Seatbelt matches canonical paths).
-        const canonicalSandboxPath = (path) => {
-            try {
-                return realpathSync(path);
-            }
-            catch {
-                return path;
-            }
-        };
-        const sandboxHome = canonicalSandboxPath(homedir());
-        writeSandboxRules = buildWriteSandboxRules({
-            homeDir: sandboxHome,
-            botmuxHome: canonicalSandboxPath(dirname(sessionDataDir)),
-            defaultBotmuxHome: canonicalSandboxPath(join(homedir(), '.botmux')),
-            sessionDataDir: canonicalSandboxPath(sessionDataDir),
-            workingDir: cfg.workingDir,
-            currentAppId: cfg.larkAppId,
-            // TMPDIR on macOS resolves under /private/var/folders (already allowed), but
-            // pass it explicitly so a customized TMPDIR is covered too.
-            extraWritePaths: process.env.TMPDIR ? [process.env.TMPDIR] : [],
-        });
-    }
+    // In the file sandbox, canonicalize the workingDir handed to buildArgs. CLIs
+    // that pass it as a chdir arg (codex/traex `-C`) fail otherwise on a symlinked
+    // $HOME host: the lexical /home/u/... prefix doesn't exist inside the bwrap
+    // root (only canonical /data00/... is bound), so the CLI's chdir/readlink
+    // ENOENTs and it aborts with "No such file or directory (os error 2)". Off
+    // sandbox this is a no-op (same dir); best-effort if unresolvable.
+    const buildArgsWorkingDir = sandboxRequested
+        ? (() => { try {
+            return realpathSync(cfg.workingDir);
+        }
+        catch {
+            return cfg.workingDir;
+        } })()
+        : cfg.workingDir;
     const args = cliAdapter.buildArgs({
         sessionId: effectiveAdapterSessionId,
         resume: effectiveResume,
-        workingDir: cfg.workingDir,
+        workingDir: buildArgsWorkingDir,
         resumeSessionId: effectiveCliSessionId,
         initialPrompt: preparedInitialPrompt,
         botName: cfg.botName,
@@ -6512,12 +6824,7 @@ async function spawnCli(cfg, opts = {}) {
         model: ttadkGateway ? undefined : cfg.model,
         disableCliBypass: cfg.disableCliBypass === true,
         skillPluginDir: cfg.skillPluginDir,
-        readIsolation: willReadIsolate,
-        // Set (as a pair) by the init handler when hybrid RPC input is engaged;
-        // makes buildArgs launch `codex --remote <ws> resume <thread>` instead of
-        // the normal paste-mode codex. Undefined for every other bot/CLI.
-        remoteWsUrl,
-        remoteThreadId,
+        readIsolation: willRedirectCliData,
     });
     // Pi's deferred long-first-prompt command is implemented by a session-scoped
     // extension. Keep its launch args across owned process restarts while the
@@ -6616,15 +6923,18 @@ async function spawnCli(cfg, opts = {}) {
         delete childEnv.BOTMUX_CHAT_TYPE;
     childEnv.BOTMUX_LARK_APP_ID = cfg.larkAppId;
     childEnv.BOTMUX_ROOT_MESSAGE_ID = cfg.rootMessageId;
-    // Session owner under the standard BOTMUX_* name (the riff backend already
-    // exposes it; `__OWNER_OPEN_ID` stays for back-compat). Custom CLI wrappers
-    // use it for per-user permission isolation. Advisory identity only — botmux's
-    // own authz paths (v3 command authority, host.ts) ignore env owner values and
-    // resolve the current-turn caller from turn provenance instead.
-    if (cfg.ownerOpenId)
-        childEnv.BOTMUX_OWNER_OPEN_ID = cfg.ownerOpenId;
-    else
-        delete childEnv.BOTMUX_OWNER_OPEN_ID;
+    // This bot's resolved brandLabel template, injected so a SANDBOXED `botmux
+    // send` renders the role-name footer without reading bots.json (deny-by-
+    // default → EPERM → role footer would silently fall back to the default
+    // [botmux] label). resolveBrandLabel honours this env first (gated on the
+    // own appId). Only set the key when a brandLabel is configured (present-but-
+    // empty '' = suppress is preserved; unset key → the CLI falls through). It is
+    // a cosmetic markdown template, not a credential, so env-passing is safe.
+    {
+        const bl = resolveBrandLabel(cfg.larkAppId);
+        if (typeof bl === 'string')
+            childEnv.BOTMUX_BRAND_LABEL = bl;
+    }
     // NOTE: under read isolation `botmux send` gets this bot's secret from the worker-
     // written cred FILE in its BOT_HOME (send-cred.json, see sendCredFilePath) located
     // via the BOTMUX_LARK_APP_ID above — NOT from the env. The secret is deliberately kept OUT
@@ -6668,10 +6978,27 @@ async function spawnCli(cfg, opts = {}) {
     // already guarantee the pane starts clean, and the CLI's built-in default
     // preserves stock semantics.
     if (isolationBotHome) {
+        // In the file sandbox, bwrap binds only CANONICAL paths (the fs-policy
+        // realpaths every rule). On a symlinked-$HOME host (/home/u → /data00/home/u)
+        // the lexical BOT_HOME (/home/u/.botmux/bots/…/claude) does NOT exist in the
+        // fresh bwrap root, so the CLI can't open its own CLAUDE_CONFIG_DIR/CODEX_HOME
+        // → settings.json (with ANTHROPIC_BASE_URL/token) is unreadable → it falls
+        // back to the public endpoint and fails to connect. Canonicalize so the env
+        // points at the same path bwrap bound. Best-effort: keep lexical if unresolved.
+        const canonicalizeForSandbox = (p) => {
+            if (!sandboxRequested)
+                return p;
+            try {
+                return realpathSync(p);
+            }
+            catch {
+                return p;
+            }
+        };
         if (claudeDataDir)
-            childEnv.CLAUDE_CONFIG_DIR = claudeDataDir; // = <BOT_HOME>/claude
+            childEnv.CLAUDE_CONFIG_DIR = canonicalizeForSandbox(claudeDataDir); // = <BOT_HOME>/claude
         else
-            childEnv.CODEX_HOME = isolatedCodexHome;
+            childEnv.CODEX_HOME = canonicalizeForSandbox(isolatedCodexHome);
     }
     // Per-bot env (bots.json `env`): extra vars for THIS bot's CLI only — e.g.
     // ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN to run a bot on GLM/a 3rd-party
@@ -6694,356 +7021,362 @@ async function spawnCli(cfg, opts = {}) {
     let spawnBin = cliAdapter.resolvedBin;
     let spawnArgs = args;
     let spawnCwd = cfg.workingDir;
-    // Read isolation (macOS): wrap the whole CLI process in a Seatbelt sandbox that
-    // denies reads of the sensitive paths (blocklist). The CLI bypasses its OWN
-    // sandbox (see adapter) so the outer wrapper is the sole enforcer. DARWIN ONLY —
-    // on Linux read isolation is enforced by bwrap masks fed into the overlay sandbox
-    // below (see readIsoLinuxMasks), NOT sandbox-exec (which doesn't exist there).
-    if (process.platform === 'darwin' && (readIsolationCtx || writeSandboxRules)) {
-        // Seatbelt matches CANONICAL paths (it resolves symlinks), so realpath every
-        // deny/allow before emitting the profile — otherwise a sensitive root reached
-        // through a symlinked prefix (e.g. a symlinked home / SESSION_DATA_DIR) would
-        // silently fail-open (the /tmp→/private/tmp class of miss). realpath-if-exists:
-        // a non-existent path has nothing to read, so its literal form is harmless.
-        // The ROOT dirs are canonicalized FIRST (profileCtx) so the regex patterns —
-        // which can't be realpath'd as a result — are built on canonical prefixes too.
+    // Dashboard「复现命令」：在**任何** sandbox 包装（下方 macOS Seatbelt / Linux bwrap /
+    // credential-only）之前，记下**基础 CLI** 的 bin/args（cliAdapter.resolvedBin +
+    // buildArgs 产出）。独立维护、绝不从已被外层包装的 spawnBin/spawnArgs 回推。最终
+    // 复现形态（是否套 wrapperCli）由 selectReproduceLaunch 在 spawn 时统一决策——见
+    // reproduce-command.ts。这里只锁定"包装前的基础"这个事实。
+    const reproduceBaseBin = spawnBin;
+    const reproduceBaseArgs = [...spawnArgs];
+    // ── UNIFIED file sandbox (fs-policy): ONE policy source, BOTH platforms. ──
+    // Three-tier deny-by-default whitelist compiled to Seatbelt (darwin) or bwrap
+    // (linux). Cross-bot read isolation is inherent (siblings' data simply isn't
+    // exposed) — no enumeration, no deny-list to keep in sync.
+    if (sandboxRequested) {
+        const dataDir = process.env.SESSION_DATA_DIR;
+        // FAIL-SAFE (not fail-open): a requested sandbox that can't be established
+        // must be a HARD ERROR, never a silent unconfined run.
+        if (effectiveBackendType !== 'pty' && effectiveBackendType !== 'tmux') {
+            const msg = `Sandbox ENABLED but backend "${effectiveBackendType}" is not sandboxable (only pty/tmux) — aborting spawn to avoid an unsandboxed run`;
+            log(msg);
+            throw new Error(msg);
+        }
+        if (!dataDir) {
+            const msg = 'Sandbox ENABLED but SESSION_DATA_DIR is unset — aborting spawn to avoid an unsandboxed run';
+            log(msg);
+            throw new Error(msg);
+        }
+        // Both engines match CANONICAL paths (Seatbelt resolves symlinks, bwrap
+        // resolves mount sources) — realpath everything, or a symlinked prefix
+        // (the /tmp→/private/tmp class) silently fail-opens.
         const canonical = (p) => { try {
             return realpathSync(p);
         }
         catch {
             return p;
         } };
-        // READ rules — only when read isolation is on. v2 HYBRID model: whole-deny
-        // ~/.claude|~/.codex (F1 fix — own CLI data is redirected into BOT_HOME,
-        // readable) + surgical-deny only the cross-bot-SENSITIVE parts of the otherwise-
-        // readable ~/.botmux + system creds; the own slice is re-opened via carve-outs.
-        // For a WRITE-sandbox-only session these stay empty → reads wide open (Linux parity).
-        let denyPaths = [], denyRegexes = [], allowPaths = [], finalDenyPaths = [], traverseDirs = [];
-        let protectedWrites;
-        if (readIsolationCtx) {
-            const profileCtx = {
-                ...readIsolationCtx,
-                homeDir: canonical(readIsolationCtx.homeDir),
-                botmuxHome: canonical(readIsolationCtx.botmuxHome),
-                defaultBotmuxHome: canonical(readIsolationCtx.defaultBotmuxHome ?? join(readIsolationCtx.homeDir, '.botmux')),
-                sessionDataDir: canonical(readIsolationCtx.sessionDataDir),
-            };
-            denyPaths = buildV2DenyPaths(profileCtx).map(canonical);
-            denyRegexes = buildV2DenyRegexes(profileCtx);
-            const carve = buildV2CarveOuts(profileCtx);
-            const capabilityCarvePath = managedOriginCapabilityPath(profileCtx.sessionDataDir, profileCtx.currentSessionId);
-            allowPaths = [
-                // Never realpath the capability leaf: another legacy sandbox can race
-                // a symlink into that shared host directory while multiple persistent
-                // sessions recover. Keeping the exact path may fail closed on a raced
-                // symlink, but can never turn its target into a Seatbelt allow rule.
-                ...carve.allowPaths.map(path => path === capabilityCarvePath ? path : canonical(path)),
-                ...buildCliExecutableReadCarveOuts({
-                    homeDir: profileCtx.homeDir,
-                    cliId: cliAdapter.id,
-                    resolvedBin: canonical(cliAdapter.resolvedBin),
-                }),
-                // buildV2DenyPaths masks the shared pi-initial-prompts root. Re-open
-                // only this session's private child directory for Pi's @file/extension.
-                ...piInitialPromptReadonlyRoots.map(canonical),
-            ];
-            finalDenyPaths = carve.finalDenyPaths.map(canonical);
-            traverseDirs = carve.traverseDirs.map(canonical);
-            protectedWrites = buildReadIsolationProtectedWriteRules(profileCtx, {
-                // Keep lexical roots as well as their canonical targets. Canonical
-                // rules protect contents reached through a symlink; lexical literals
-                // prevent replacing the symlink/root directory entry itself.
-                dashboardRoots: [
-                    readIsolationCtx.defaultBotmuxHome ?? join(readIsolationCtx.homeDir, '.botmux'),
-                    readIsolationCtx.botmuxHome,
-                ],
-                sessionDataDirs: [readIsolationCtx.sessionDataDir],
-            });
-        }
-        if (credentialBoundaryActive) {
-            const credentialRules = buildCredentialIsolationRules({
-                homeDir: canonical(hostHomeDir),
-                botmuxHome: canonical(configuredBotmuxHome),
-                defaultBotmuxHome: canonical(defaultBotmuxHome),
-            });
-            denyPaths = [...new Set([...denyPaths, ...credentialRules.denyPaths.map(canonical)])];
-            denyRegexes = [...new Set([...denyRegexes, ...credentialRules.denyRegexes])];
-            protectedWrites = {
-                denyWritePaths: [...new Set([
-                        ...(protectedWrites?.denyWritePaths ?? []),
-                        ...credentialRules.denyWritePaths.map(canonical),
-                    ])],
-                denyWriteRegexes: [...new Set([
-                        ...(protectedWrites?.denyWriteRegexes ?? []),
-                        ...credentialRules.denyWriteRegexes,
-                    ])],
-                denyWriteLiterals: [...new Set([
-                        ...(protectedWrites?.denyWriteLiterals ?? []),
-                        ...credentialRules.denyWriteLiterals.map(canonical),
-                        defaultBotmuxHome,
-                        configuredBotmuxHome,
-                    ])],
-            };
-        }
-        if (mcpRuntimeManifest) {
-            finalDenyPaths.push(...sessionMcpRuntimeHostOnlyPaths(mcpRuntimeManifest, config.session.dataDir).map(canonical));
-        }
-        // Every isolated macOS CLI is denied access to all same-UID Gateway socket
-        // directories. A session with its own Gateway gets one narrow, later READ
-        // carve-out for its token; writes stay denied so the CLI cannot unlink or
-        // replace even its own worker-managed socket. Sessions without plugin MCP
-        // state get no read carve-out at all.
-        const gatewaySocketRoot = canonical(sessionMcpGatewayHost ? dirname(sessionMcpGatewayHost.socketDir) : tmpdir());
-        const gatewaySocketRegex = sessionMcpGatewayPathRegex(gatewaySocketRoot);
-        denyRegexes.push(gatewaySocketRegex);
-        if (sessionMcpGatewayHost)
-            allowPaths.push(canonical(sessionMcpGatewayHost.socketDir));
-        protectedWrites = {
-            denyWritePaths: protectedWrites?.denyWritePaths ?? [],
-            denyWriteRegexes: [...(protectedWrites?.denyWriteRegexes ?? []), gatewaySocketRegex],
-            denyWriteLiterals: protectedWrites?.denyWriteLiterals ?? [],
+        const sandboxHome = canonical(homedir());
+        const expandTilde = (raw) => raw.replace(/^~(?=\/|$)/, sandboxHome);
+        const keepExisting = (paths) => {
+            const out = [];
+            for (const raw of paths) {
+                if (!raw || typeof raw !== 'string')
+                    continue;
+                const p = expandTilde(raw);
+                try {
+                    if (existsSync(p))
+                        out.push(canonical(p));
+                }
+                catch { /* */ }
+            }
+            return out;
         };
-        // WRITE rules — the macOS file-sandbox (Linux-bwrap twin). Realpath the writable
-        // zones + crown-jewel re-denies for the same symlink-safety reason as reads.
-        const writeRules = writeSandboxRules
-            ? {
-                allowWritePaths: writeSandboxRules.allowWritePaths.map(canonical),
-                allowWriteRegexes: writeSandboxRules.allowWriteRegexes,
-                denyWritePaths: writeSandboxRules.denyWritePaths.map(canonical),
-                denyWriteRegexes: writeSandboxRules.denyWriteRegexes,
+        // User three-tier lists: the new sandboxPaths field, or a pre-migration
+        // session/config's legacy fields mapped through the SAME lossless mapping
+        // the startup migration uses.
+        const legacyMapped = migrateLegacySandboxFields({
+            sandbox: cfg.sandbox,
+            readIsolation: cfg.readIsolation,
+            sandboxReadonlyPaths: cfg.sandboxReadonlyPaths,
+            sandboxHidePaths: cfg.sandboxHidePaths,
+            readDenyExtraPaths: cfg.readDenyExtraPaths,
+            sandboxPaths: cfg.sandboxPaths,
+        });
+        const userLists = cfg.sandboxPaths ?? legacyMapped?.sandboxPaths;
+        const droppedUser = [];
+        const resolveUser = (paths) => {
+            const out = [];
+            for (const raw of paths ?? []) {
+                if (!raw || typeof raw !== 'string')
+                    continue;
+                const p = expandTilde(raw);
+                if (existsSync(p))
+                    out.push(canonical(p));
+                else
+                    droppedUser.push(raw);
             }
+            return out;
+        };
+        // deny paths are NOT existence-filtered on EITHER platform: a deny must guard
+        // a path that does not exist YET (else the agent creates it under an exposed
+        // rw parent and the deny is bypassed — codex review finding). Seatbelt keeps
+        // the rule literally; bwrap masks it with a tmpfs the mount creates (writes
+        // land in the ephemeral tmpfs, the real path is never created).
+        const resolveDeny = (paths) => (paths ?? []).filter((p) => typeof p === 'string' && !!p).map(p => canonical(expandTilde(p)));
+        const userPaths = {
+            readWrite: resolveUser(userLists?.readWrite),
+            readOnly: resolveUser(userLists?.readOnly),
+            deny: resolveDeny(userLists?.deny),
+        };
+        if (droppedUser.length)
+            log(`[sandbox] sandboxPaths entries dropped (path not found): ${droppedUser.join(', ')}`);
+        // Every executable spawned INSIDE the sandbox must be readable: the CLI
+        // binary's dir, the daemon's own node (fnm farms under /run land here),
+        // adapter second-stage bins, plus the standalone-codex package tree.
+        const execDirs = [cliAdapter.resolvedBin, process.execPath, ...(cliAdapter.sandboxExtraExecPaths?.() ?? [])]
+            .filter((p) => typeof p === 'string' && !!p)
+            .map(p => dirname(canonical(p)));
+        const execCarve = buildCliExecutableReadCarveOuts({
+            homeDir: sandboxHome,
+            cliId: cliAdapter.id,
+            resolvedBin: canonical(cliAdapter.resolvedBin),
+        }).map(canonical);
+        // Linux relay outbox (created by prepareDirectSandbox; in the policy so the
+        // compiled plan binds it read-write).
+        const outbox = process.platform === 'linux'
+            ? join(canonical(dataDir), 'sandboxes', cfg.sessionId, 'outbox')
             : undefined;
-        if (!locateOnPath('sandbox-exec')) {
-            throw new Error(`[file-sandbox] refusing to start session ${cfg.sessionId}: sandbox-exec not found`);
-        }
-        const profileDir = join(isolationRuntimeDataDir, 'read-isolation');
-        mkdirSync(profileDir, { recursive: true });
-        const profilePath = join(profileDir, `${cfg.sessionId}.sb`);
-        replaceManagedOriginCapabilityFile(profilePath, buildSeatbeltProfile(denyPaths, allowPaths, finalDenyPaths, traverseDirs, denyRegexes, writeRules, protectedWrites));
-        seatbeltProfilePath = profilePath;
-        spawnArgs = ['-f', profilePath, spawnBin, ...spawnArgs];
-        spawnBin = credentialMechanismExecutable ?? '/usr/bin/sandbox-exec';
-        log(`[file-sandbox] wrapping ${cliAdapter.id} in Seatbelt (read-isolation=${!!readIsolationCtx}, write-sandbox=${!!writeRules}): sandbox-exec -f ${profilePath}`);
-    }
-    // Fresh sandboxed spawn on a persistent backend: stamp the pane with this daemon's
-    // policy version + boot id so a later suspend→resume reattach can be trusted (see the stale-pane
-    // guard above). Applies to read-isolation AND write-sandbox panes (both carry the
-    // Seatbelt confinement on the live process). pty needs no marker (never reattached).
-    if (appliedIsolationCapabilities.length > 0 && persistentSessionName && !willReattachPersistent) {
+        // Pre-create the outbox BEFORE buildFsPolicy so it survives the allow-rule
+        // existence-filter below (a not-yet-existing readWrite path is dropped, and
+        // bwrap can't bind a missing source → the sandboxed `botmux send` relay
+        // would EPERM/ENOENT writing its <hash>.content into an unbound dir).
+        // prepareDirectSandbox re-mkdirs it too; recursive make is idempotent.
+        if (outbox) {
+            try {
+                mkdirSync(outbox, { recursive: true });
+            }
+            catch { /* best-effort; prepareDirectSandbox retries */ }
+        }
+        // The botmux install/checkout root (dir containing dist/ + node_modules).
+        // This module compiles to <checkout>/dist/worker.js, so `../../` from here is
+        // the checkout root. Exposed readOnly so `botmux` + claude hooks can exec
+        // `node <checkout>/dist/cli.js`.
+        const botmuxInstallRoot = canonical(dirname(dirname(fileURLToPath(import.meta.url))));
+        // Pre-create the OWN writable dirs/files the sandboxed CLI creates on
+        // demand, so they EXIST at spawn and survive the existence-filter below
+        // (bwrap can't bind a nonexistent source; a dropped rule → the CLI's
+        // mkdir/write EPERMs).
+        //  - data/turn-sends/<sessionId>.jsonl: `botmux send` appends its dedup
+        //    marker. The policy grants ONLY this exact file (not the whole dir) so a
+        //    sandboxed CLI can't rewrite another session's marker — pre-create the
+        //    file itself (touch) so the single-file bind has a source.
+        //  - data/attachments/<self>: `botmux quoted`/downloadResources writes here
+        // (BOT_HOME + outbox are created elsewhere.) Best-effort — a failure just
+        // reverts to the pre-existing drop behaviour.
         try {
-            const markerDir = join(isolationRuntimeDataDir, 'read-isolation');
-            mkdirSync(markerDir, { recursive: true });
-            replaceManagedOriginCapabilityFile(join(markerDir, `${cfg.sessionId}.boot`), isolationPaneMarkerContent(cfg.daemonBootId ?? '', appliedIsolationCapabilities));
+            const tsDir = join(dataDir, 'turn-sends');
+            mkdirSync(tsDir, { recursive: true });
+            const tsFile = join(tsDir, `${cfg.sessionId}.jsonl`);
+            if (!existsSync(tsFile))
+                writeFileSync(tsFile, '');
         }
-        catch { /* non-fatal: worst case a same-lifetime reattach cold-spawns instead */ }
-    }
-    // Sandbox wraps the spawned binary in bwrap. Works for pty (PtyBackend runs
-    // bwrap directly) and tmux (the tmux pane's command becomes `bwrap … -- cli`);
-    // env is carried via bwrap --setenv (see prepareSandbox), not the backend.
-    // Linux ONLY — on macOS the same `sandbox: true` is enforced by the Seatbelt
-    // write-sandbox above (willWriteSandbox), so bwrap must not run here.
-    //
-    // riff bypass: there is NO local CLI process to wrap — execution happens in
-    // riff's own remote sandbox, and the fail-safe "backend not sandboxable"
-    // hard error below would otherwise brick every sandbox-enabled bot the
-    // moment it switches to riff (the dashboard agent switch clears only
-    // readIsolation, not `sandbox`). Bypassing is safe (nothing local runs);
-    // log it so the state is visible.
-    if (cfg.sandbox === true && effectiveBackendType === 'riff') {
-        log('Sandbox flag set but backend is riff (remote sandbox, no local process) — local file sandbox bypassed');
-    }
-    const sandboxOn = localSandboxApplies(process.platform, effectiveBackendType) && (cfg.sandbox === true || sandboxEnabled());
-    // Linux read isolation: build the bwrap MASK set (the Seatbelt read-deny twin) and
-    // fold it into the SAME overlay sandbox plan below. Enumerate sibling bots from the
-    // FILESYSTEM (the worker runs unsandboxed on the host; bots.json may be denied) —
-    // spawn-time-static, so a bot added after this spawn is covered on its next cold
-    // start (the accepted Linux tradeoff vs the macOS regex). Only when read isolation
-    // is enforceable here (willReadIsolate ⇒ readIsolationCtx set) AND on Linux.
-    let readIsoLinuxMasks;
-    if (readIsolationCtx && process.platform === 'linux') {
-        const canon = (p) => { try {
-            return realpathSync(p);
+        catch { /* */ }
+        try {
+            mkdirSync(join(dataDir, 'attachments', cfg.larkAppId), { recursive: true });
         }
-        catch {
-            return p;
-        } };
-        // Canonicalize the root prefixes FIRST so every derived mask path is symlink-safe
-        // (bwrap masks resolve symlinks — a symlinked home/data root would else fail-open).
-        const ctxReal = {
-            ...readIsolationCtx,
-            homeDir: canon(readIsolationCtx.homeDir),
-            botmuxHome: canon(readIsolationCtx.botmuxHome),
-            defaultBotmuxHome: canon(readIsolationCtx.defaultBotmuxHome ?? join(readIsolationCtx.homeDir, '.botmux')),
-            sessionDataDir: canon(readIsolationCtx.sessionDataDir),
-        };
-        const ids = new Set();
-        const scan = (dir, pick) => {
-            try {
-                for (const name of readdirSync(dir)) {
-                    const id = pick(name);
-                    if (id)
-                        ids.add(id);
-                }
-            }
-            catch { /* dir absent → no siblings there */ }
-        };
-        scan(join(ctxReal.botmuxHome, 'bots'), n => n); // sibling BOT_HOME dirs
-        scan(join(ctxReal.homeDir, '.lark-cli-bots'), n => n); // sibling lark configs
-        scan(ctxReal.sessionDataDir, n => { const m = /^sessions-(.+)\.json$/.exec(n); return m ? m[1] : null; });
-        ids.delete(cfg.larkAppId); // never mask own
-        let sidecars = [];
+        catch { /* */ }
+        // schedules.json is a shared RMW store (`botmux schedule`); pre-create as an
+        // empty map if absent (same content schedule-store itself writes) so a fresh
+        // install's first in-sandbox `schedule add` can bind+write it on bwrap too.
         try {
-            sidecars = readdirSync(ctxReal.botmuxHome).filter(n => n.startsWith('bots.json.')).map(n => join(ctxReal.botmuxHome, n));
+            const sf = join(dataDir, 'schedules.json');
+            if (!existsSync(sf))
+                writeFileSync(sf, '{}');
         }
         catch { /* */ }
-        const m = buildLinuxReadIsolationMasks({ ctx: ctxReal, siblingAppIds: [...ids], botsJsonSidecars: sidecars });
-        // Same execvp carve-out as macOS (Codex 342a3e1c): a standalone Codex whose
-        // binary lives UNDER the now-masked ~/.codex would fail execvp. Re-expose ONLY
-        // its executable package tree (read-only, after the masks) — auth/config/sessions
-        // stay masked. No-op for npm/system installs (binary not under ~/.codex) + non-codex.
-        const execCarveOuts = buildCliExecutableReadCarveOuts({
-            homeDir: ctxReal.homeDir,
-            cliId: cliAdapter.id,
-            resolvedBin: canon(cliAdapter.resolvedBin),
-        }).map(canon);
-        readIsoLinuxMasks = {
-            hidePaths: m.hidePaths.map(canon),
-            ownReadWritePaths: m.ownReadWritePaths.map(canon),
-            ownReadOnlyPaths: [...m.ownReadOnlyPaths.map(canon), ...execCarveOuts],
-        };
-        log(`[read-isolation] linux bwrap masks: ${m.hidePaths.length} hide, ${[...ids].length} siblings enumerated${execCarveOuts.length ? ', +codex-standalone exec carve' : ''}`);
-    }
-    if (sandboxOn) {
-        // FAIL-SAFE (not fail-open): when the sandbox is requested, a missing
-        // precondition (no SESSION_DATA_DIR, or a backend we can't wrap) must be a
-        // HARD ERROR, never a silent skip — otherwise the CLI would spawn UNSANDBOXED
-        // with full host write access and no log, the exact opposite of the
-        // oncall-untrusted-agent invariant. In normal operation worker-pool sets
-        // SESSION_DATA_DIR and the backend is pty/tmux, so this never trips.
-        const dataDir = process.env.SESSION_DATA_DIR;
-        if (effectiveBackendType !== 'pty' && effectiveBackendType !== 'tmux') {
-            const msg = `Sandbox ENABLED but backend "${effectiveBackendType}" is not sandboxable (only pty/tmux) — aborting spawn to avoid an unsandboxed run`;
-            log(msg);
-            throw new Error(msg);
+        const mandatoryDenyPaths = [];
+        const mandatoryDenyRegexes = [];
+        const mandatoryReadOnlyPaths = [];
+        // Linux: the per-session sandbox tree (`sandboxes/<sid>`) holds the deny-mask
+        // cleanup manifest + the mode-000 empty ro-bind SOURCES. If SESSION_DATA_DIR
+        // is configured INSIDE the working dir (a custom data dir under a RW-bound
+        // project), the project's readWrite rule would otherwise cover the whole
+        // tree and let the sandboxed CLI tamper with the manifest (→ trick teardown
+        // into deleting arbitrary host paths) or the empty sources. Deny the tree
+        // as a MANDATORY rule (user paths can't override); the outbox is re-granted
+        // readWrite via ctx.outbox as a deeper carve-out (the compiler masks the
+        // tree with a tmpfs that hosts the nested outbox bind, then remounts it RO —
+        // manifest/empties stay unreadable AND unwritable in-sandbox). bwrap reads
+        // ro-bind SOURCES from the host FS, so the empty masks still work even though
+        // the child can't see them.
+        if (process.platform === 'linux') {
+            mandatoryDenyPaths.push(join(canonical(dataDir), 'sandboxes', cfg.sessionId));
         }
-        if (!dataDir) {
-            const msg = 'Sandbox ENABLED but SESSION_DATA_DIR is unset — aborting spawn to avoid an unsandboxed run';
-            log(msg);
-            throw new Error(msg);
+        readIsolationOriginCapabilityFile = process.platform === 'darwin'
+            ? managedOriginCapabilityPath(dataDir, cfg.sessionId)
+            : null;
+        // The macOS child reads the per-session rotating capability directly.
+        // Materialize it before the policy's existence filter, and make the exact
+        // file a mandatory read-only carve-out that user rules cannot shadow.
+        if (readIsolationOriginCapabilityFile) {
+            publishSandboxRelayCapability({ failClosed: true });
+            mandatoryReadOnlyPaths.push(readIsolationOriginCapabilityFile);
         }
-        try {
-            if (willReattachPersistent) {
-                // Daemon-restart reattach to a persistent (tmux/herdr/zellij) pane whose
-                // bwrap'd CLI is STILL ALIVE. backend.spawn() ignores bin/args here and
-                // just re-attaches, and the live CLI is bound to its own namespace-pinned
-                // overlay — so we must NOT unmount/remount (prepareSandbox would leave a
-                // duplicate host-side overlay the CLI isn't using). We only re-wire the
-                // outbox watcher (so the live CLI's `botmux send` keeps being serviced)
-                // and the cleanup ref (so close/exit reclaims the residue). No re-prep.
-                const att = attachSandboxOutbox({ sessionId: cfg.sessionId, dataDir });
-                if (att) {
-                    if (sandboxStopWatcher) {
-                        try {
-                            sandboxStopWatcher();
-                        }
-                        catch { /* */ }
-                    }
-                    if (sandboxCleanup) {
-                        try {
-                            sandboxCleanup();
+        if (credentialBoundaryActive) {
+            const credentialRules = buildCredentialIsolationRules({
+                homeDir: sandboxHome,
+                botmuxHome: canonical(configuredBotmuxHome),
+                defaultBotmuxHome: canonical(defaultBotmuxHome),
+            });
+            mandatoryDenyPaths.push(...credentialRules.denyPaths.map(canonical));
+            mandatoryDenyRegexes.push(...credentialRules.denyRegexes);
+            // Materialize every existing atomic sidecar as a concrete Linux mask.
+            // Seatbelt additionally keeps the regexes above for files created later.
+            for (const root of [...new Set([defaultBotmuxHome, configuredBotmuxHome])]) {
+                try {
+                    for (const name of readdirSync(root)) {
+                        if (isCredentialIsolationReservedBasename(name)) {
+                            mandatoryDenyPaths.push(canonical(join(root, name)));
                         }
-                        catch { /* */ }
                     }
-                    sandboxCleanup = att.cleanup;
-                    sandboxRelayOutbox = att.outbox;
-                    sandboxStopWatcher = startOutboxWatcher(att.outbox, childEnv, cfg.sessionId, { authorize: authorizeManagedSend });
-                    publishSandboxRelayCapability();
-                    log(`Sandbox REATTACH (${cfg.cliId}): live pane CLI kept, re-wired outbox=${att.outbox} (no remount)`);
                 }
-                else {
-                    // No sandbox tree on disk for a session we're reattaching to: the
-                    // pane's CLI may be unsandboxed (sandbox enabled after it spawned). Do
-                    // NOT remount under a live CLI; just continue the reattach as-is.
-                    log(`Sandbox REATTACH (${cfg.cliId}): no on-disk sandbox tree — reattaching live pane without re-prep`);
+                catch { /* absent authority root */ }
+            }
+        }
+        if (mcpRuntimeManifest) {
+            mandatoryDenyPaths.push(...sessionMcpRuntimeHostOnlyPaths(mcpRuntimeManifest, config.session.dataDir).map(canonical));
+        }
+        if (process.platform === 'darwin') {
+            const gatewaySocketRoot = canonical(sessionMcpGatewayHost ? dirname(sessionMcpGatewayHost.socketDir) : tmpdir());
+            mandatoryDenyRegexes.push(sessionMcpGatewayPathRegex(gatewaySocketRoot));
+            if (sessionMcpGatewayHost) {
+                mandatoryReadOnlyPaths.push(canonical(sessionMcpGatewayHost.socketDir));
+            }
+        }
+        const policy = buildFsPolicy({
+            platform: process.platform,
+            homeDir: sandboxHome,
+            botmuxHome: canonical(dirname(dataDir)),
+            sessionDataDir: canonical(dataDir),
+            workingDir: canonical(cfg.workingDir),
+            currentAppId: cfg.larkAppId,
+            sessionId: cfg.sessionId,
+            botHome: canonical(ownBotHome),
+            redirectedCliData: willRedirectCliData,
+            cliDataPaths: willRedirectCliData ? undefined : keepExisting([
+                cliAdapter.claudeDataDir,
+                claudeDataDir ? `${sandboxHome}/.claude.json` : undefined,
+                claudeDataDir ? `${sandboxHome}/.claude.json.lock` : undefined,
+                claudeDataDir ? `${sandboxHome}/.claude.lock` : undefined,
+                claudeDataDir ? `${sandboxHome}/.local/state/claude` : undefined,
+            ]),
+            authPaths: keepExisting([...(cliAdapter.authPaths ?? [])]),
+            execPaths: keepExisting([...execDirs, ...execCarve]),
+            readonlyRoots: keepExisting([
+                ...(cfg.skillReadonlyRoots ?? []),
+                ...piInitialPromptReadonlyRoots,
+            ]),
+            botmuxInstallRoot,
+            outbox,
+            extraWritePaths: keepExisting([process.env.TMPDIR]),
+            userPaths,
+            mandatoryDenyPaths,
+            mandatoryDenyRegexes,
+            mandatoryReadOnlyPaths,
+            net: cfg.sandboxNetwork !== false,
+            // Claude Code saves ~/.claude.json atomically via a PID/random-suffixed
+            // sibling — only relevant when the data dir is NOT redirected to BOT_HOME.
+            writeRegexes: process.platform === 'darwin' && !willRedirectCliData && claudeDataDir
+                ? [`^${sandboxHome.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}/\\.claude\\.json\\.tmp\\.[^/]+$`]
+                : [],
+        });
+        // Existence-filter only the ALLOW rules (baseline entries are candidates,
+        // not guarantees): a non-existent allow path has nothing to expose, and
+        // bwrap cannot bind a non-existent SOURCE. DENY rules are kept regardless —
+        // they must guard a path created later in the session (Seatbelt keeps the
+        // literal rule; bwrap masks with a tmpfs whose mountpoint the mount creates).
+        policy.rules = policy.rules.filter(r => {
+            if (r.access === 'deny')
+                return true;
+            try {
+                return existsSync(r.path);
+            }
+            catch {
+                return false;
+            }
+        });
+        if (process.platform === 'darwin') {
+            if (!locateOnPath('sandbox-exec')) {
+                throw new Error(`[file-sandbox] refusing to start session ${cfg.sessionId}: sandbox-exec not found`);
+            }
+            const profileDir = join(dataDir, 'read-isolation');
+            mkdirSync(profileDir, { recursive: true });
+            const profilePath = join(profileDir, `${cfg.sessionId}.sb`);
+            writeFileSync(profilePath, compileToSeatbelt(policy), { mode: 0o600 });
+            seatbeltProfilePath = profilePath;
+            spawnArgs = ['-f', profilePath, spawnBin, ...spawnArgs];
+            spawnBin = 'sandbox-exec';
+            log(`[file-sandbox] wrapping ${cliAdapter.id} in Seatbelt (fs-policy, ${policy.rules.length} rules): sandbox-exec -f ${profilePath}`);
+        }
+        else if (willReattachPersistent) {
+            // Daemon-restart reattach to a live bwrap'd pane: backend.spawn() ignores
+            // bin/args and just re-attaches. Only re-wire the outbox watcher (so the
+            // live CLI's `botmux send` keeps being serviced) + the cleanup ref. The
+            // direct model has NO mounts — cleanup is a plain rm at close/exit.
+            const att = attachSandboxOutbox({ sessionId: cfg.sessionId, dataDir });
+            if (att) {
+                if (sandboxStopWatcher) {
+                    try {
+                        sandboxStopWatcher();
+                    }
+                    catch { /* */ }
                 }
+                sandboxCleanup = att.cleanup;
+                sandboxRelayOutbox = att.outbox;
+                sandboxStopWatcher = startOutboxWatcher(att.outbox, childEnv, cfg.sessionId, { authorize: authorizeManagedSend });
+                publishSandboxRelayCapability();
+                log(`Sandbox REATTACH (${cfg.cliId}): live pane CLI kept, re-wired outbox=${att.outbox}`);
             }
             else {
-                const sbx = prepareSandbox({
-                    enabled: sandboxOn,
-                    cliId: cfg.cliId,
-                    sessionId: cfg.sessionId,
-                    sourceWorkingDir: cfg.workingDir,
-                    dataDir,
-                    cliBin: cliAdapter.resolvedBin,
-                    cliArgs: args,
-                    // Read-isolation masks (Linux) fold into the same plan: hide the cross-bot
-                    // sensitive set, keep the own BOT_HOME real+writable (authPaths), and re-
-                    // expose the own attachments bucket read-only after the masks (readonlyRoots).
-                    hidePaths: [...(cfg.sandboxHidePaths ?? []), ...(readIsoLinuxMasks?.hidePaths ?? [])],
-                    authPaths: [...(cliAdapter.authPaths ?? [])],
-                    // BOTMUX_HOME is credential-masked wholesale. Re-open only this
-                    // bot's daemon-derived private CLI home after that parent mask, then
-                    // re-mask its send credential so an untrusted receiver cannot bypass
-                    // the host-authorized relay with a direct Lark API call.
-                    trustedWritablePaths: readIsoLinuxMasks?.ownReadWritePaths ?? [],
-                    finalHidePaths: readIsoLinuxMasks
-                        ? [sendCredFilePath(dataDir, cfg.larkAppId)]
-                        : [],
-                    extraExecPaths: cliAdapter.sandboxExtraExecPaths?.(),
-                    readonlyRoots: [
-                        ...(cfg.skillReadonlyRoots ?? []),
-                        ...piInitialPromptReadonlyRoots,
-                        ...(readIsoLinuxMasks?.ownReadOnlyPaths ?? []),
-                    ],
-                    mcpGatewaySocketPath: sessionMcpGatewayHost?.socketPath,
-                    trustedBotmuxCommandPaths: [defaultGatewayEntry().command],
-                    userReadonlyPaths: cfg.sandboxReadonlyPaths ?? [],
-                    net: cfg.sandboxNetwork !== false,
-                });
-                if (sbx) {
-                    spawnBin = sbx.bin;
-                    spawnArgs = sbx.args;
-                    // In the overlay model the child still chdirs to projectMount (via bwrap
-                    // --chdir), so spawnCwd stays the real workingDir; the overlay merged dir
-                    // is bound there. sbx.workDir is the UPPER changeset (for landing), NOT a cwd.
-                    Object.assign(childEnv, sbx.env);
-                    if (sandboxStopWatcher) {
-                        try {
-                            sandboxStopWatcher();
-                        }
-                        catch { /* */ }
-                    }
-                    if (sandboxCleanup) {
-                        try {
-                            sandboxCleanup();
-                        }
-                        catch { /* */ }
-                    }
-                    sandboxCleanup = sbx.cleanup;
-                    sandboxRelayOutbox = sbx.outbox;
-                    // session-id is FORCED here so a relayed send can't target another session.
-                    sandboxStopWatcher = startOutboxWatcher(sbx.outbox, childEnv, cfg.sessionId, { authorize: authorizeManagedSend });
-                    publishSandboxRelayCapability();
-                    log(`Sandbox ON (${cfg.cliId}): upper=${sbx.workDir} outbox=${sbx.outbox}`);
+                log(`Sandbox REATTACH (${cfg.cliId}): no on-disk sandbox tree — reattaching live pane as-is`);
+            }
+        }
+        else {
+            const sbx = prepareDirectSandbox({
+                sessionId: cfg.sessionId,
+                dataDir,
+                policy,
+                chdir: canonical(cfg.workingDir),
+                home: sandboxHome,
+                cliBin: cliAdapter.resolvedBin,
+                cliArgs: args,
+                trustedBotmuxCommandPaths: [defaultGatewayEntry().command],
+                mcpGatewaySocketPath: sessionMcpGatewayHost?.socketPath,
+            });
+            if (!sbx) {
+                // FAIL-SAFE: never silently run unsandboxed.
+                const msg = 'sandbox requested but could not be established (bwrap missing or setup failed) — aborting spawn';
+                log(msg);
+                throw new Error(msg);
+            }
+            spawnBin = sbx.bin;
+            spawnArgs = sbx.args;
+            Object.assign(childEnv, sbx.env);
+            if (sandboxStopWatcher) {
+                try {
+                    sandboxStopWatcher();
                 }
-                else {
-                    // Sandbox was requested but prepareSandbox returned null (a required
-                    // overlay mount failed, or non-Linux). Fail safe: do NOT silently run
-                    // unsandboxed — surface a hard error so the session doesn't leak.
-                    log(`Sandbox ENABLED but prepare returned null (mount failed / unsupported) — aborting spawn to avoid an unsandboxed run`);
-                    throw new Error('sandbox requested but could not be established');
+                catch { /* */ }
+            }
+            if (sandboxCleanup) {
+                try {
+                    sandboxCleanup();
                 }
+                catch { /* */ }
             }
+            sandboxCleanup = sbx.cleanup;
+            sandboxRelayOutbox = sbx.outbox;
+            // session-id is FORCED here so a relayed send can't target another session.
+            sandboxStopWatcher = startOutboxWatcher(sbx.outbox, childEnv, cfg.sessionId, { authorize: authorizeManagedSend });
+            publishSandboxRelayCapability();
+            log(`Sandbox ON (${cfg.cliId}, fs-policy ${policy.rules.length} rules): outbox=${sbx.outbox}`);
         }
-        catch (err) {
-            log(`Sandbox prepare failed (${err.message}) — aborting (sandbox is a hard requirement when enabled)`);
-            throw err;
+    }
+    // Fresh sandboxed spawn on a persistent backend: stamp the pane with this
+    // daemon's boot id so a later reattach can be trusted (see the stale-pane
+    // guard above). pty needs no marker (never reattached).
+    if (appliedIsolationCapabilities.length > 0 && persistentSessionName && !willReattachPersistent) {
+        try {
+            const markerDir = join(isolationRuntimeDataDir, 'read-isolation');
+            mkdirSync(markerDir, { recursive: true });
+            writeFileSync(join(markerDir, `${cfg.sessionId}.boot`), isolationPaneMarkerContent(cfg.daemonBootId ?? '', appliedIsolationCapabilities), { mode: 0o600 });
         }
+        catch { /* non-fatal: worst case a same-lifetime reattach cold-spawns instead */ }
     }
     // 通用启动前缀（wrapperCli）：把启动命令重写成 `<wrapperCli> <CLI 参数>`（首 token 当
     // bin 走 PATH 解析），无需 wrapper 脚本、跨系统。aiden x claude 形态会剥掉 aiden 拒收的
     // --settings（见 buildWrappedLaunch）。与文件沙盒互斥：沙盒已把命令重写成 bwrap，叠加
-    // 前缀会破坏隔离，故 sandboxOn 时跳过并告警（网关 + oncall 沙盒本就不是合理组合）。
+    // 前缀会破坏隔离，故沙盒开启时跳过并告警（网关 + oncall 沙盒本就不是合理组合）。
     // CJADK_INTERACTIVE is a cjadk-only knob we set on the cjadk wrapper branch
     // below. Strip any value inherited from the daemon's own env first so a
     // daemon launched under `cjadk feishu` (which exports it) can't leak it via
@@ -7052,8 +7385,8 @@ async function spawnCli(cfg, opts = {}) {
     // keeps the behaviour intentional rather than ambient. (Codex review note.)
     delete childEnv.CJADK_INTERACTIVE;
     if (cfg.wrapperCli && cfg.wrapperCli.trim()) {
-        if (sandboxOn) {
-            log(`wrapperCli="${cfg.wrapperCli}" ignored: file sandbox enabled and takes precedence (cannot combine launch prefix with bwrap)`);
+        if (sandboxRequested) {
+            log(`wrapperCli="${cfg.wrapperCli}" ignored: file sandbox enabled and takes precedence (cannot combine launch prefix with the sandbox wrapper)`);
         }
         else {
             const launch = buildWrappedLaunch(cfg.wrapperCli, spawnArgs, (b) => locateOnPath(b) ?? b, {
@@ -7087,6 +7420,19 @@ async function spawnCli(cfg, opts = {}) {
             }
         }
     }
+    // Publish the exact selected resource BEFORE spawn. This both restores host
+    // affinity for later in-worker restarts and closes the crash window where a
+    // shared Herdr agent could be created but the daemon still knew only bmx-*.
+    // A failed spawn leaving an intent stamp is safe: lifecycle probes see the
+    // missing agent and close/cold-resume instead of leaking an untracked pane.
+    cfg.persistentBackendTarget = selectedBackend.persistentBackendTarget;
+    if (lastInitConfig) {
+        lastInitConfig.persistentBackendTarget = selectedBackend.persistentBackendTarget;
+    }
+    send({
+        type: 'persistent_backend_target',
+        target: selectedBackend.persistentBackendTarget,
+    });
     // Mandatory credential-only confinement is the OUTERMOST launch wrapper so
     // wrapperCli and every descendant it starts inherit the boundary. Full
     // Seatbelt/bwrap sessions were already wrapped above and never enter these
@@ -7224,6 +7570,32 @@ async function spawnCli(cfg, opts = {}) {
         log(`[device-credential-isolation] wrapping ${cliAdapter.id} in credential-only bwrap `
             + `(${hideDirectories.size} authority dir(s), ${hideFiles.size} exact file(s))`);
     }
+    // Dashboard「复现命令」：算出本次冷启的**近似**可复现命令（bin + argv + cwd +
+    // 权威注入 env），随 ready 上报、只驻 daemon 内存（含凭证，绝不落盘）。基础 CLI
+    // bin/args 取 sandbox 包装前的快照，最终形态（含/不含 wrapperCli）由
+    // selectReproduceLaunch 决策——绝不含 sandbox-exec/bwrap 外层。riff 返回 null。
+    try {
+        const reproduceLaunch = selectReproduceLaunch({
+            baseBin: reproduceBaseBin,
+            baseArgs: reproduceBaseArgs,
+            wrapperCli: cfg.wrapperCli,
+            sandboxOn: sandboxRequested,
+            binResolver: (b) => locateOnPath(b) ?? b,
+            ttadkModel: cfg.model,
+        });
+        capturedSpawnCommand = buildReproduceCommand({
+            backendType: effectiveBackendType,
+            bin: reproduceLaunch.bin,
+            args: reproduceLaunch.args,
+            cwd: spawnCwd,
+            env: childEnv,
+            injectEnv: perBotInjectKeys.length ? perBotInjectEnv : undefined,
+        });
+    }
+    catch (err) {
+        capturedSpawnCommand = null;
+        log(`Failed to capture reproduce command: ${err?.message ?? err}`);
+    }
     backend.spawn(spawnBin, spawnArgs, {
         cwd: spawnCwd,
         cols: PTY_COLS,
@@ -7232,6 +7604,13 @@ async function spawnCli(cfg, opts = {}) {
         injectEnv: perBotInjectKeys.length ? perBotInjectEnv : undefined,
         launchShell: lastInitConfig?.launchShell,
     });
+    if (selectedBackend.createdHerdrSessionName) {
+        send({
+            type: 'user_notify',
+            turnId: currentBotmuxTurnId,
+            message: `已创建 Botmux 专属 Herdr 会话：\`${selectedBackend.createdHerdrSessionName}\``,
+        });
+    }
     // Write CLI PID marker so agent-facing subcommands (`botmux send`, etc.)
     // can verify they were spawned inside a botmux session by walking the
     // process tree and looking for a matching pid file in this directory.
@@ -7266,7 +7645,7 @@ async function spawnCli(cfg, opts = {}) {
     // MARKER inference is unaffected (the launcher-pid marker is still a valid
     // ancestor of an in-CLI `botmux send`, and the env fallback covers it too).
     const startWrapperRealPidResolve = (launcherPid) => {
-        if (!cfg.wrapperCli || !cfg.wrapperCli.trim() || sandboxOn || !claudeDataDir)
+        if (!cfg.wrapperCli || !cfg.wrapperCli.trim() || sandboxRequested || !claudeDataDir)
             return;
         const targetCliId = cfg.cliId;
         scheduleWrapperRealCliPid(launcherPid, {
@@ -7488,7 +7867,7 @@ async function spawnCli(cfg, opts = {}) {
     const readyHookAvailable = effectiveReadyHookInstall
         ? hasInstalledSessionReadyHook(effectiveReadyHookInstall)
         : true; // Hermes emits BOTMUX_READY_COMMAND directly instead of a config hook.
-    const isolatedReadyTransportRequired = sandboxOn || willReadIsolate;
+    const isolatedReadyTransportRequired = sandboxRequested || credentialBoundaryActive;
     const readyPortAvailable = !isolatedReadyTransportRequired
         || parseDaemonIpcPort(childEnv.BOTMUX_DAEMON_IPC_PORT) !== undefined;
     const readyCapabilityAvailable = !isolatedReadyTransportRequired
@@ -7519,44 +7898,59 @@ async function spawnCli(cfg, opts = {}) {
         }, READY_SIGNAL_TIMEOUT_MS);
         readySignalTimer.unref?.();
     }
+    // A settled signal is a turn boundary. Drain structured transcripts before
+    // markPromptReady(): that call may synchronously flush a type-ahead turn and
+    // advance bridge attribution. Both screen-idle and authoritative Herdr status
+    // must preserve this ordering.
+    const drainBridgesThenMarkReady = (evidenceSource) => {
+        if (bridgeJsonlPath) {
+            try {
+                bridgeDrainAndMaybeEmit();
+            }
+            catch (err) {
+                log(`Bridge emit error: ${err.message}`);
+            }
+        }
+        if (codexBridgeFallbackActive()) {
+            try {
+                codexBridgeDrainAndMaybeEmit();
+            }
+            catch (err) {
+                log(`Codex bridge emit error: ${err.message}`);
+            }
+        }
+        if (evidenceSource === 'screen')
+            markPromptReadyFromPty();
+        else
+            markPromptReady();
+    };
     // Set up idle detection. Riff (remote HTTP backend) has no PTY output and
     // is marked ready immediately after spawn (see below), so the idle detector
     // is unnecessary — and without a readyPattern it would fire on every
     // quiescence, repeatedly triggering markPromptReady() and duplicate cards.
     if (effectiveBackendType !== 'riff') {
         idleDetector = new IdleDetector(cliAdapter);
-        idleDetector.onIdle(async (evidenceSource) => {
+        idleDetector.onIdle((evidenceSource) => {
             log('Prompt detected (idle)');
-            // Bridge drain MUST run before markPromptReady() — the latter calls
-            // flushPending() which can immediately fire the next queued message
-            // (type-ahead adapters), shifting bridgeQueue's notion of "current
-            // turn" before we've had a chance to emit the previous one.
-            if (bridgeJsonlPath) {
-                try {
-                    bridgeDrainAndMaybeEmit();
-                }
-                catch (err) {
-                    log(`Bridge emit error: ${err.message}`);
-                }
-            }
-            if (codexBridgeFallbackActive()) {
-                try {
-                    codexBridgeDrainAndMaybeEmit();
-                }
-                catch (err) {
-                    log(`Codex bridge emit error: ${err.message}`);
-                }
-            }
-            if (evidenceSource === 'screen') {
-                markPromptReadyFromPty();
-            }
-            else {
-                markPromptReady();
-            }
+            drainBridgesThenMarkReady(evidenceSource);
         });
     }
     backend.onData(onPtyData);
     const observedBackend = backend;
+    if (observedBackend instanceof HerdrBackend) {
+        observedBackend.onAgentStatus((status) => {
+            if (backend !== observedBackend)
+                return;
+            if (status === 'idle' || status === 'done') {
+                log(`Herdr agent ${status} — draining bridges before marking prompt ready`);
+                drainBridgesThenMarkReady('structured');
+            }
+            else if (status === 'working') {
+                isPromptReady = false;
+                idleDetector?.reset();
+            }
+        });
+    }
     backend.onAccessUrl?.((url) => {
         send({
             type: 'riff_access_url',
@@ -7744,6 +8138,7 @@ async function spawnCli(cfg, opts = {}) {
 }
 function killCli(opts = {}) {
     currentCliCredentialIsolated = false;
+    stopNativeSessionTitleSync();
     stopSessionMcpGatewayHost();
     stopCodexRpcEngine();
     if (!opts.preservePending)
@@ -7767,6 +8162,7 @@ function killCli(opts = {}) {
     readyPatternSeenDuringHold = false;
     awaitingPostSessionStartPromptEvidence = false;
     stopScreenAnalyzer();
+    stopStuckDetector();
     stopScreenUpdates();
     backend?.kill();
     backend = null;
@@ -7883,6 +8279,7 @@ async function restartCliProcess(reason, opts = {}) {
                 if (lastInitConfig) {
                     startScreenUpdates();
                     startScreenAnalyzer();
+                    startStuckDetector();
                     try {
                         const restartCfg = { ...lastInitConfig, resume: true, prompt: '', cliSessionId: rpcThreadId ?? lastInitConfig.cliSessionId };
                         // Re-engage RPC so the new --remote pane binds to the CURRENT app-server
@@ -7896,6 +8293,7 @@ async function restartCliProcess(reason, opts = {}) {
                             await engageCodexRpc(restartCfg);
                         }
                         await spawnCli(restartCfg, { pluginGenerationPrepared: rpcPluginGenerationPrepared });
+                        await prepareCodexNativeTitleGeneration(restartCfg, codexRpcEngine);
                         if (codexRpcEngine)
                             armRpcStartupDialogDismiss();
                     }
@@ -7960,8 +8358,24 @@ function startWebServer(host, preferredPort) {
             // normal buffer until resize causes a redraw. Preserve that mode so
             // scroll gestures continue to target the CLI's own transcript.
             const forceRemoteScroll = effectiveBackendType === 'herdr' && cliAdapter?.altScreen === true;
+            // The wheel burst cap throttles backends where a forwarded wheel is
+            // EXPENSIVE or has no local terminal to drive:
+            //   • Herdr — each forwarded wheel → pane send-text + snapshot re-render.
+            //   • Riff  — has NO drivable terminal; writes become remote task/follow-up
+            //             creations (handleTermAction even rejects ANSI to Riff), so an
+            //             uncapped spin would flood remote task creation.
+            // This is a BACKEND property, independent of the adapter's declared
+            // altScreen: an altScreen:false CLI (Claude/Codex) that enters the
+            // alternate buffer at runtime (vim/less, or the CLI's own alt-screen) still
+            // forwards via _fwdScroll and must inherit its backend's cap. So gate the
+            // cap on a POSITIVE allowlist of cheap, locally-drivable terminal backends
+            // (pty/tmux/zellij); every other backend — Herdr, Riff, and any future one
+            // — stays safely capped by default.
+            const localTerminalBackend = effectiveBackendType === 'pty'
+                || effectiveBackendType === 'tmux'
+                || effectiveBackendType === 'zellij';
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(getTerminalHtml(hasWrite, platformReadonly, loginUrl, forceRemoteScroll));
+            res.end(getTerminalHtml(hasWrite, platformReadonly, loginUrl, forceRemoteScroll, localTerminalBackend));
         });
         wss = new WebSocketServer({
             server: httpServer,
@@ -8258,7 +8672,7 @@ function startWebServer(host, preferredPort) {
             .then(resolve, reject);
     });
 }
-function getTerminalHtml(hasWrite, platformReadonly = false, loginUrl = '', forceRemoteScroll = false) {
+function getTerminalHtml(hasWrite, platformReadonly = false, loginUrl = '', forceRemoteScroll = false, localTerminalBackend = false) {
     const label = sessionId.substring(0, 8);
     return `<!DOCTYPE html>
 <html>
@@ -8395,6 +8809,7 @@ if(isTouch){document.body.classList.add('touch');}
 var hasToken=${hasWrite};
 var platformReadonly=${platformReadonly};
 var remoteScroll=${forceRemoteScroll};
+var localTerminalBackend=${localTerminalBackend};
 if(!hasToken){
   if(platformReadonly){var _lb=document.getElementById('login-banner');_lb.classList.add('show');}
   else{var _rb=document.getElementById('readonly-banner');_rb.classList.add('show');_rb.addEventListener('click',function(){_rb.classList.remove('show')});}
@@ -8601,8 +9016,21 @@ window.addEventListener('resize',onViewportResize);
 // A high-resolution trackpad emits dozens of wheel events for one gesture, so
 // cap the whole continuous burst — not each browser event — then require an idle
 // gap (or direction reversal) before loading the next history chunk.
+//
+// The burst ceiling throttles backends where a forwarded wheel is EXPENSIVE or
+// has no local terminal to drive: Herdr (each tick → pane send-text + snapshot
+// re-render) and Riff (no drivable terminal — writes become remote task/follow-up
+// creations, so an uncapped spin would flood remote task creation). That cost is
+// a BACKEND property, not the adapter's declared altScreen — an altScreen:false
+// CLI (Claude/Codex) that enters the alternate buffer at runtime (vim/less, the
+// CLI's own alt-screen) still hits this path and inherits its backend's cap. A
+// local PTY/tmux/zellij backend repaints its own alt-screen cheaply, so capping
+// it at 6 ticks is what froze a continuous wheel spin after ~2 notches — the
+// "not smooth / stuck" symptom. Gate the release on a POSITIVE allowlist of
+// cheap local terminal backends (localTerminalBackend); every other backend —
+// Herdr, Riff, and any future one — stays safely capped by default.
 var _scrollAccum=0,_scrollBurstTicks=0,_scrollBurstDir=0,_scrollBurstT=0;
-var _SCROLL_STEP=33;var _SCROLL_BURST_MAX=6;var _SCROLL_BURST_IDLE_MS=250;
+var _SCROLL_STEP=33;var _SCROLL_BURST_MAX=localTerminalBackend?Infinity:6;var _SCROLL_BURST_IDLE_MS=250;
 function _endScrollBurst(){
   clearTimeout(_scrollBurstT);_scrollBurstT=0;
   _scrollAccum=0;_scrollBurstTicks=0;_scrollBurstDir=0;
@@ -9058,6 +9486,10 @@ function send(msg) {
     }
     process.send?.(payload);
 }
+function acknowledgeTurnInputCommitted(turnId) {
+    if (turnId)
+        send({ type: 'turn_input_committed', turnId });
+}
 function publishLocalProcessAttestation(cliPid) {
     const cliProcStart = cliPid ? readProcessStartIdentity(cliPid) : undefined;
     send({
@@ -9115,11 +9547,13 @@ process.on('message', async (raw) => {
     const msg = raw;
     switch (msg.type) {
         case 'init': {
+            const initStartedAtMs = Date.now();
             if (lastInitConfig)
                 return; // already initialized
             lastInitConfig = msg;
             sessionId = msg.sessionId;
             refreshTerminalViewToken();
+            refreshTerminalWriteToken();
             if (msg.ownerOpenId)
                 process.env.__OWNER_OPEN_ID = msg.ownerOpenId;
             // Pin this worker's i18n locale early so every t() call below resolves
@@ -9163,6 +9597,7 @@ process.on('message', async (raw) => {
                     port = await startWebServer(config.web.workerHost, msg.webPort);
                     startScreenUpdates();
                     startScreenAnalyzer();
+                    startStuckDetector();
                 }
                 else {
                     // Workflow attempts still expose a read-only web terminal so the
@@ -9206,6 +9641,7 @@ process.on('message', async (raw) => {
                     throw new Error('codex RPC resume: could not replace stale --remote pane; aborting init');
                 }
                 await spawnCli(msg, { pluginGenerationPrepared: rpcPluginGenerationPrepared });
+                await prepareCodexNativeTitleGeneration(msg, codexRpcEngine);
                 if (codexRpcEngine)
                     armRpcStartupDialogDismiss(); // boundary #4: keep the --remote pane from freezing on a startup dialog
                 // Queue the initial prompt — flushed when CLI shows idle.
@@ -9237,6 +9673,7 @@ process.on('message', async (raw) => {
                 //    execution — exactly-once, Codex P1-1). Ambiguous never reaches here.
                 //  - RPC RESUME: queuePrompt=true → queue for post-ready flush (bridge
                 //    marked at flush time, P0-1).
+                let initialInputCommitted = false;
                 if (shouldQueueInitialPrompt({
                     hasPrompt: !!msg.prompt,
                     rpcEngineActive: !!codexRpcEngine,
@@ -9254,13 +9691,22 @@ process.on('message', async (raw) => {
                         vcMeetingImTurnOrigin: msg.vcMeetingImTurnOrigin,
                         codexAppInput: msg.promptCodexAppInput,
                     });
+                    initialInputCommitted = true;
                 }
-                // Riff (remote HTTP backends): spawnCli already marked the prompt ready
-                // (no local boot → isPromptReady=true immediately), but the initial prompt
-                // was queued AFTER spawnCli returned, so flushPending() ran on an empty
-                // queue. Flush now that the prompt is enqueued. isPromptReady is already
-                // true so the flush gates all pass.
-                if (effectiveBackendType === 'riff' && pendingMessages.length > 0) {
+                else if (msg.prompt) {
+                    // A successful spawn with a non-queued prompt means the adapter baked
+                    // it into argv or the RPC engine already accepted it.
+                    initialInputCommitted = true;
+                }
+                if (initialInputCommitted)
+                    acknowledgeTurnInputCommitted(msg.turnId);
+                // A backend may become prompt-ready before spawnCli() returns. The
+                // initial prompt is queued only afterwards, so the earlier
+                // markPromptReady() necessarily flushed an empty queue. This is normal
+                // for riff (ready immediately) and can also happen when Herdr reports a
+                // fast-starting TUI as idle during spawn. Flush again after enqueueing;
+                // the ready flag keeps booting/busy backends gated.
+                if (isPromptReady && pendingMessages.length > 0) {
                     flushPending();
                 }
                 send({
@@ -9268,6 +9714,11 @@ process.on('message', async (raw) => {
                     port,
                     token: writeToken,
                     viewToken,
+                    ...(capturedSpawnCommand ? { spawnCommand: capturedSpawnCommand } : {}),
+                    // A fast initial turn can complete via `botmux send` before Herdr
+                    // reports idle and this ready IPC is emitted. Tell the daemon not to
+                    // post a stale Starting card after the final reply is already visible.
+                    replyAlreadySent: readSendMarkers().some(marker => marker.sentAtMs >= initStartedAtMs),
                     turnId: currentBotmuxTurnId,
                     dispatchAttempt: currentBotmuxDispatchAttempt,
                 });
@@ -9282,6 +9733,21 @@ process.on('message', async (raw) => {
             // Mark new turn baseline so the streaming card only shows this turn's content
             renderer?.markNewTurn();
             const turnSeq = usageLimitTracker.beginTurn(currentUsageLimitSnapshot());
+            if (msg.nativeSessionTitlePrompt
+                && msg.nativeSessionTitle
+                && lastInitConfig?.cliId === 'codex'
+                && !lastInitConfig.adoptMode) {
+                nativeSessionTitleRevision += 1;
+                nativeSessionTitleAppliedThreadId = undefined;
+                lastInitConfig.nativeSessionTitle = msg.nativeSessionTitle;
+                lastInitConfig.nativeSessionTitlePrompt = msg.nativeSessionTitlePrompt;
+                stopNativeSessionTitleSync();
+                const threadId = codexRpcEngine?.activeThreadId
+                    ?? lastSpawnEffectiveCliSessionId
+                    ?? lastInitConfig.cliSessionId;
+                if (threadId)
+                    void syncFreshCodexNativeSessionTitle(threadId, codexRpcEngine);
+            }
             // Cancel any active tmux copy-mode scroll so user input reaches the CLI.
             if (tmuxScrolledHalfPages > 0)
                 exitTmuxScrollMode();
@@ -9299,12 +9765,16 @@ process.on('message', async (raw) => {
                 log('Message received after crash-loop stop; retrying CLI start');
                 destroyCrashDiagnosticTerminal('retry after message');
                 stopScreenAnalyzer();
+                stopStuckDetector();
                 stopScreenUpdates();
                 awaitingFirstPrompt = true;
                 startScreenUpdates();
                 startScreenAnalyzer();
+                startStuckDetector();
                 try {
-                    await spawnCli({ ...lastInitConfig, resume: true, prompt: '' });
+                    const restartCfg = { ...lastInitConfig, resume: true, prompt: '' };
+                    await spawnCli(restartCfg);
+                    await prepareCodexNativeTitleGeneration(restartCfg, codexRpcEngine);
                 }
                 catch (err) {
                     // Pass the message's own attempt (not the stale currentBotmux* from a
@@ -9386,6 +9856,9 @@ process.on('message', async (raw) => {
                             if (result && result.submitted === false) {
                                 scheduleSubmitFailureNotify(content, result.recheck, 'submit history', undefined, result.failureReason, turnSeq);
                             }
+                            else {
+                                acknowledgeTurnInputCommitted(msg.turnId);
+                            }
                         }
                         catch (err) {
                             log(`Adopt writeInput error (${lastInitConfig?.cliId}): ${err.message}`);
@@ -9403,9 +9876,11 @@ process.on('message', async (raw) => {
                         // command (raw_input) fix.
                         await new Promise(r => setTimeout(r, 200));
                         backend.sendSpecialKeys('Enter');
+                        acknowledgeTurnInputCommitted(msg.turnId);
                     }
                     else {
                         backend.write(content + '\r');
+                        acknowledgeTurnInputCommitted(msg.turnId);
                     }
                     isPromptReady = false;
                     idleDetector?.reset();
@@ -9417,11 +9892,13 @@ process.on('message', async (raw) => {
                 // arrival. Marking now would race with a still-running previous
                 // turn whose `botmux send` could sneak its sentAtMs past this
                 // turn's markTimeMs and falsely suppress its fallback.
-                sendToPty(content, msg.turnId, {
+                const inputCommitted = sendToPty(content, msg.turnId, {
                     codexAppInput,
                     dispatchAttempt: msg.dispatchAttempt,
                     vcMeetingImTurnOrigin: msg.vcMeetingImTurnOrigin,
                 });
+                if (inputCommitted)
+                    acknowledgeTurnInputCommitted(msg.turnId);
             }
             break;
         }
@@ -9449,6 +9926,13 @@ process.on('message', async (raw) => {
             // IPC handlers are concurrent with async init, so queue first even when
             // the adapter/backend has not finished initializing. flushPending will
             // capability-check and deliver the latest title once a real prompt is idle.
+            nativeSessionTitleRevision += 1;
+            nativeSessionTitleAppliedThreadId = undefined;
+            if (lastInitConfig) {
+                lastInitConfig.nativeSessionTitle = msg.title;
+                lastInitConfig.nativeSessionTitlePrompt = undefined;
+            }
+            stopNativeSessionTitleSync();
             pendingSessionRename = msg.title;
             log(`Queued native session rename: ${msg.title}`);
             void flushPending();
@@ -9545,7 +10029,49 @@ process.on('message', async (raw) => {
             break;
         }
         case 'tui_keys': {
-            handleTuiKeys(msg.keys, msg.isFinal);
+            // Stale-card guard: if this key press came from a stuck-warning card,
+            // delegate to processStuckWarningTuiKeys which does a FRESH capture (not
+            // the 2s-cached lastAnalyzerSnapshot) and re-verifies the current screen
+            // still matches the page type the card was built for. Fail-closed: any
+            // mismatch (lifetime, capture, backend, page type, write failure) sends
+            // stuck_warning_expired and drops the keys. ScreenAnalyzer TUI cards
+            // (no stuckNonce) bypass the guard and write keys directly.
+            let wroteKeys = false;
+            if (msg.stuckNonce !== undefined && msg.stuckPageType) {
+                const result = await processStuckWarningTuiKeys({
+                    stuckNonce: msg.stuckNonce,
+                    stuckPageType: msg.stuckPageType,
+                    stuckCliLifetime: msg.stuckCliLifetime,
+                    keys: msg.keys,
+                    isFinal: msg.isFinal,
+                }, {
+                    getBackend: () => backend,
+                    getCurrentLifetime: () => cliLifetimeNonce,
+                    renderCols,
+                    renderRows,
+                    turnId: currentBotmuxTurnId,
+                    dispatchAttempt: currentBotmuxDispatchAttempt,
+                    capture: snapshotToText,
+                    match: matchHookReviewScreen,
+                    writeKeys: handleTuiKeys,
+                    sendExpired: (nonce, turnId, dispatchAttempt) => send({ type: 'stuck_warning_expired', nonce, turnId, dispatchAttempt }),
+                    sendDelivered: (nonce, turnId, dispatchAttempt) => send({ type: 'tui_keys_delivered', nonce, turnId, dispatchAttempt }),
+                    log,
+                });
+                wroteKeys = result.wroteKeys;
+            }
+            else {
+                await handleTuiKeys(msg.keys, msg.isFinal);
+                wroteKeys = true;
+            }
+            // Re-arm the stuck detector ONLY when the card-handler explicitly flags
+            // this as a stuck-warning card's Enter action (advances to the next
+            // review layer) AND keys were actually written. An expired click (CLI
+            // recovered, page changed) must NOT re-arm — the detector should stay
+            // disarmed until the next real stall. t/Esc and all ScreenAnalyzer cards
+            // never set this flag.
+            if (shouldRearmStuckDetector(!!msg.rearmStuckDetector, wroteKeys))
+                stuckDetector?.arm();
             break;
         }
         case 'inject_command': {
@@ -9710,6 +10236,7 @@ process.on('message', async (raw) => {
 });
 // ─── Cleanup ─────────────────────────────────────────────────────────────────
 function cleanup() {
+    stopNativeSessionTitleSync();
     cleanupPiInitialPromptFiles();
     stopSessionMcpGatewayHost();
     if (tmuxRestartTimer) {
@@ -9814,7 +10341,11 @@ function teardownSandboxBestEffort() {
 // and process.exit(1), killing a live session over a dropped log write. Install
 // the guard before any further stdout writes (log() writes to process.stdout).
 installStdioEpipeGuard();
-process.on('exit', () => { teardownSandboxBestEffort(); stopCodexRpcEngine(); });
+process.on('exit', () => {
+    stopNativeSessionTitleSync();
+    teardownSandboxBestEffort();
+    stopCodexRpcEngine();
+});
 process.on('uncaughtException', (err) => {
     // A broken pipe on stdout/stderr (or any socket) must not tear down a live
     // session — the stdio guard handles those it can; this is the backstop.