botmux 3.5.0 → 3.6.0

package/dist/adapters/backend/sandbox.js

@@ -1,128 +1,45 @@
 /**
- * File-isolation sandbox (bubblewrap + overlayfs) for oncall bots.
+ * Linux file sandbox: bwrap DIRECT mode (fs-policy three-tier whitelist).
  *
- * Model (OVERLAYFS read-all / write-isolated, per product decision 2026-06-10):
- * the sandboxed agent READS the entire real filesystem natively — the real CLI
- * config/auth/env/project, NO scrub, the CLI just works. WRITES are isolated via
- * an overlayfs mount: the real lower layer is NEVER modified, only changed files
- * copy-up into a per-session UPPER layer (zero-copy reads, only the delta uses
- * disk, NO git clone). Landing copies that UPPER changeset back to the real
- * project. Privacy masking is per-bot opt-in with NO defaults.
+ * Model (2026-07-16 refactor, design doc "botmux 文件沙盒重构方案"): the
+ * sandboxed CLI writes the PROJECT DIRECTLY (same behaviour as an unsandboxed
+ * run inside the policy's readWrite zones) and sees NOTHING outside the
+ * policy's rules — a fresh tmpfs root, only the rule paths bound in. This
+ * replaced the overlayfs+landing model: no mounts to leak, no landing step,
+ * no bridge redirect (the CLI's data dir is a REAL host path).
  *
- * Mechanism (empirically verified — runs as root on this 5.15 kernel):
- *   mount -t overlay overlay -o lowerdir=REAL,upperdir=UPPER,workdir=WORK MERGED
- * bwrap 0.8.0 has NO --overlay, so we mount the overlay ON THE HOST then bind the
- * merged dir into bwrap. overlayfs forbids upper/work INSIDE lower, so the HOME
- * overlay (lower=/root) puts upper/work OUTSIDE /root (under /var/tmp/...). The
- * merged mountpoints also live there: putting home-merged below HOME makes the
- * rootless FUSE overlay recursively contain itself, and bwrap can block forever
- * while resolving later bind destinations. Project upper/work stay under the
- * data dir because they are the persistent, landable changeset.
+ * The policy is built by the worker (adapters/cli/fs-policy.ts — the single
+ * source of truth for BOTH platforms) and compiled to bwrap argv here. macOS
+ * enforces the SAME policy via Seatbelt (compileToSeatbelt) at the worker's
+ * spawn site — nothing in this module runs on darwin.
  *
- * Linux-only (overlayfs + bwrap depend on Linux). macOS reuses Anthropic's
- * sandbox-exec approach and is handled elsewhere.
+ * `botmux send` relay: unchanged from the previous model. The sandboxed CLI's
+ * `botmux send` writes a validated request into a per-session outbox; the
+ * daemon-side watcher re-executes the send OUTSIDE the sandbox with real
+ * credentials. No Feishu credential ever enters the sandbox.
  */
-import { homedir } from 'node:os';
-import { mkdirSync, existsSync, writeFileSync, chmodSync, readdirSync, readFileSync, rmSync, statSync, lstatSync, realpathSync, symlinkSync, unlinkSync, openSync, fstatSync, readSync, writeSync, closeSync, constants as fsConstants } from 'node:fs';
+import { mkdirSync, existsSync, writeFileSync, chmodSync, readdirSync, readFileSync, rmSync, rmdirSync, unlinkSync, statSync, lstatSync, readlinkSync, realpathSync, openSync, fstatSync, readSync, writeSync, closeSync, constants as fsConstants } from 'node:fs';
 import { atomicWriteFileSync } from '../../utils/atomic-write.js';
-import { basename, isAbsolute, join, dirname, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
+import { compileToBwrap } from '../cli/fs-policy.js';
 import { PROXY_ENV_KEYS } from '../../utils/child-env.js';
 import { MCP_GATEWAY_REQUIRED_ENV, MCP_GATEWAY_SOCKET_ENV, } from '../../core/plugins/mcp/environment.js';
-/** Host root for the HOME overlay's upper/work — MUST be OUTSIDE the home lower
- *  (overlayfs forbids upper/work inside lower). */
-const VARTMP_ROOT = '/var/tmp/botmux-sbx';
-// ───────────────────────────── overlay primitives ────────────────────────────
-/**
- * Mount an overlayfs: reads fall through to `lower` (real, zero copy); writes
- * copy-up into `upper` (the landable changeset). `work` is overlayfs scratch on
- * the same fs as `upper`. Returns true iff `mount` exited 0.
- */
-export function mountOverlay(opts) {
-    for (const d of [opts.upper, opts.work, opts.merged]) {
-        try {
-            mkdirSync(d, { recursive: true });
-        }
-        catch { /* */ }
-    }
-    const optStr = `lowerdir=${opts.lower},upperdir=${opts.upper},workdir=${opts.work}`;
-    // A privileged (root) daemon uses the kernel overlayfs driver — fastest. A
-    // non-root daemon CANNOT mount kernel overlayfs even inside bwrap's userns (the
-    // hardened mount env rejects it on this kernel), so it falls back to
-    // fuse-overlayfs — a userspace overlay needing no root, only /dev/fuse. Same
-    // lowerdir/upperdir/workdir semantics → landing, the bridge redirect, and the
-    // privacy masks all work identically; only the mount mechanism differs.
-    // BOTMUX_SANDBOX_FUSE=1 forces the userspace path even as root (escape hatch +
-    // lets a root daemon exercise exactly what unprivileged users hit).
-    const forceFuse = process.env.BOTMUX_SANDBOX_FUSE === '1';
-    if (!forceFuse && process.getuid?.() === 0) {
-        const r = spawnSync('mount', ['-t', 'overlay', 'overlay', '-o', optStr, opts.merged], { stdio: 'pipe' });
-        if (r.status === 0)
-            return true;
-        // root but kernel mount failed (rare) → fall through to fuse-overlayfs
-    }
-    const f = spawnSync('fuse-overlayfs', ['-o', optStr, opts.merged], { stdio: 'pipe' });
-    return f.status === 0;
-}
-function decodeMountInfoPath(raw) {
-    return raw.replace(/\\([0-7]{3})/g, (_match, octal) => String.fromCharCode(Number.parseInt(octal, 8)));
-}
-/** True iff `path` is currently a mountpoint (host-side overlay still mounted).
- *  Read mountinfo instead of stat'ing the path: a broken recursive FUSE mount can
- *  leave any path-based `mountpoint` probe blocked in uninterruptible I/O. */
-export function isMounted(path) {
-    const target = resolve(path);
-    try {
-        const mountInfo = readFileSync('/proc/self/mountinfo', 'utf8');
-        return mountInfo.split('\n').some(line => {
-            const fields = line.split(' ');
-            return fields.length > 4 && decodeMountInfoPath(fields[4]) === target;
-        });
-    }
-    catch {
-        return spawnSync('mountpoint', ['-q', target], {
-            stdio: 'ignore',
-            timeout: 2_000,
-        }).status === 0;
-    }
-}
-/** Unmount an overlay merged dir. Best-effort: lazy detach if a normal unmount
- *  fails because a still-draining bwrap child holds the FUSE mount busy. */
-export function unmountOverlay(merged) {
-    if (!isMounted(merged))
-        return; // not a mountpoint
-    // kernel overlay → `umount`; fuse-overlayfs → `fusermount -u` (a non-root
-    // daemon can't `umount` its own fuse mount). `fusermount -uz` is the critical
-    // rootless busy-mount fallback; plain `umount -l` is usually not permitted.
-    if (spawnSync('fusermount', ['-u', merged], { stdio: 'ignore' }).status === 0)
-        return;
-    if (spawnSync('umount', [merged], { stdio: 'ignore' }).status === 0)
-        return;
-    if (spawnSync('fusermount', ['-uz', merged], { stdio: 'ignore' }).status === 0)
-        return;
-    spawnSync('umount', ['-l', merged], { stdio: 'ignore' });
-}
-/** Verify (and best-effort auto-install) the sandbox runtime deps so the user
- *  needn't pre-install: `bubblewrap` always, `fuse-overlayfs` when the userspace
- *  overlay path is used (non-root daemon, or BOTMUX_SANDBOX_FUSE=1). Installs via
- *  the system package manager when the daemon can (root, or passwordless sudo);
- *  otherwise logs a one-line manual-install hint and returns false so the caller
- *  fails the spawn (never a silent unsandboxed run). Returns true if all present. */
-function ensureSandboxDeps(needFuse) {
+/** Verify (and best-effort auto-install) bubblewrap so the user needn't
+ *  pre-install. Installs via the system package manager when the daemon can
+ *  (root, or passwordless sudo); otherwise logs a one-line manual-install hint
+ *  and returns false so the caller fails the spawn (never a silent
+ *  unsandboxed run). */
+function ensureSandboxDeps() {
     const has = (cmd) => spawnSync('sh', ['-c', `command -v ${cmd}`], { stdio: 'ignore' }).status === 0;
-    const missing = [];
-    if (!has('bwrap'))
-        missing.push('bubblewrap');
-    if (needFuse && !has('fuse-overlayfs'))
-        missing.push('fuse-overlayfs');
-    if (!missing.length)
+    if (has('bwrap'))
         return true;
-    const pm = has('apt-get') ? ['apt-get', 'install', '-y', ...missing] :
-        has('dnf') ? ['dnf', 'install', '-y', ...missing] :
-            has('yum') ? ['yum', 'install', '-y', ...missing] :
-                has('apk') ? ['apk', 'add', ...missing] :
-                    has('pacman') ? ['pacman', '-S', '--noconfirm', ...missing] :
+    const pm = has('apt-get') ? ['apt-get', 'install', '-y', 'bubblewrap'] :
+        has('dnf') ? ['dnf', 'install', '-y', 'bubblewrap'] :
+            has('yum') ? ['yum', 'install', '-y', 'bubblewrap'] :
+                has('apk') ? ['apk', 'add', 'bubblewrap'] :
+                    has('pacman') ? ['pacman', '-S', '--noconfirm', 'bubblewrap'] :
                         null;
     const isRoot = process.getuid?.() === 0;
     if (pm) {
@@ -130,86 +47,13 @@ function ensureSandboxDeps(needFuse) {
         // (never blocks on an interactive prompt).
         const argv = isRoot ? pm : ['sudo', '-n', ...pm];
         const r = spawnSync(argv[0], argv.slice(1), { stdio: 'ignore', timeout: 180_000 });
-        if (r.status === 0 && !missing.some(m => !has(m === 'bubblewrap' ? 'bwrap' : m)))
+        if (r.status === 0 && has('bwrap'))
             return true;
     }
-    const guide = pm ? `${isRoot ? '' : 'sudo '}${pm.join(' ')}` : `install: ${missing.join(', ')}`;
-    console.error(`[sandbox] missing deps (${missing.join(', ')}); auto-install unavailable — install manually then retry: ${guide}`);
+    const guide = pm ? `${isRoot ? '' : 'sudo '}${pm.join(' ')}` : 'install bubblewrap';
+    console.error(`[sandbox] bwrap missing; auto-install unavailable — install manually then retry: ${guide}`);
     return false;
 }
-/**
- * Build the bwrap argv prefix. Final spawn becomes:
- *   bwrap <these args> -- <cliBin> <cliArgs...>
- *
- * Mount order matters (later mounts win): the whole real fs read-only first, then
- * the home + project merged overlays bind over it (so writes there are isolated),
- * then user readonly inputs, then privacy masks blank specific paths (masks bind
- * after user readonly roots so an overlapping readonly entry can never re-expose
- * masked content), then trusted runtime roots, then the outbox binds LAST so it
- * stays writable even if a mask covers a parent dir.
- */
-export function buildSandboxArgs(plan) {
-    const a = [];
-    // Read the entire real fs (zero scrub — the CLI's config/auth/env just work).
-    a.push('--ro-bind', '/', '/');
-    // Fresh kernel/runtime dirs (the ro-bind of / would otherwise carry host /tmp etc.).
-    a.push('--proc', '/proc', '--dev', '/dev', '--tmpfs', '/tmp', '--tmpfs', '/run', '--tmpfs', '/dev/shm');
-    if (plan.mcpGatewaySocket) {
-        a.push('--dir', plan.mcpGatewaySocket.sandboxDir);
-        a.push('--ro-bind', plan.mcpGatewaySocket.hostDir, plan.mcpGatewaySocket.sandboxDir);
-    }
-    // Write-isolated home + project (overlay merged: reads=real lower, writes=upper).
-    // If cwd IS HOME, two binds to the same destination would make the later
-    // project bind silently shadow the home overlay. Use the project overlay as
-    // the single winning layer in that case.
-    if (plan.projectMount !== plan.home) {
-        a.push('--bind', plan.homeMerged, plan.home);
-    }
-    a.push('--bind', plan.projectMerged, plan.projectMount);
-    // CLI auth/login dirs kept REAL + writable (bind over the isolated home) so token
-    // refresh / login persists. Narrow (auth only) keeps session history isolated;
-    // some CLIs widen to their whole state dir for SQLite locks (CliAdapter.authPaths).
-    for (const p of plan.authReal ?? [])
-        a.push('--bind', p, p);
-    // User-configured read-only inputs — BEFORE the masks so hidePaths always win
-    // over an overlapping (e.g. ancestor) readonly entry.
-    for (const root of plan.userReadonlyRoots ?? [])
-        a.push('--ro-bind', root, root);
-    // Per-bot privacy masks (opt-in, no defaults).
-    for (const dir of plan.hideDirs)
-        a.push('--tmpfs', dir);
-    for (const f of plan.hideFiles)
-        a.push('--ro-bind', f.empty, f.path);
-    // Re-open only daemon-derived private roots (for example this bot's own
-    // BOT_HOME) after their parent BOTMUX_HOME was blanked.
-    for (const root of plan.trustedWritableRoots ?? [])
-        a.push('--bind', root, root);
-    // A private root can itself contain a credential that the sandbox must not
-    // recover (notably send-cred.json). Re-deny those after the carve-out.
-    for (const dir of plan.finalHideDirs ?? [])
-        a.push('--tmpfs', dir);
-    for (const f of plan.finalHideFiles ?? [])
-        a.push('--ro-bind', f.empty, f.path);
-    // Session-scoped TRUSTED runtime inputs, e.g. generated skill/plugin dirs —
-    // after the masks so a broad hideDir can't blank skill delivery.
-    for (const root of plan.readonlyRoots ?? [])
-        a.push('--ro-bind', root, root);
-    // A readonly runtime root can contain install-time credentials that the child
-    // does not need. Re-mask those paths after the root bind so mount order cannot
-    // re-expose them.
-    for (const dir of plan.postReadonlyHideDirs ?? [])
-        a.push('--tmpfs', dir);
-    for (const f of plan.postReadonlyHideFiles ?? [])
-        a.push('--ro-bind', f.empty, f.path);
-    // Outbox LAST so it wins even if a mask covers a parent dir.
-    a.push('--bind', plan.outbox, plan.outbox);
-    // Isolate namespaces (keep net unless explicitly disabled).
-    a.push('--unshare-user', '--unshare-pid', '--unshare-ipc', '--unshare-uts', '--unshare-cgroup-try');
-    if (plan.net === false)
-        a.push('--unshare-net');
-    a.push('--die-with-parent', '--new-session', '--chdir', plan.projectMount);
-    return a;
-}
 function assertCredentialIsolationPath(path, kind) {
     const normalized = resolve(path);
     if (!isAbsolute(path) || normalized !== path || normalized === '/') {
@@ -217,15 +61,8 @@ function assertCredentialIsolationPath(path, kind) {
     }
     return normalized;
 }
-/**
- * Build the lightweight bwrap wrapper used when full overlay sandboxing is off.
- * The host filesystem, including BOTMUX_HOME itself, remains live/read-write.
- * Device credentials and their arbitrary future sidecars live below a dedicated
- * authority directory which is replaced wholesale with a private tmpfs. The
- * few legacy/root authority files are masked individually with read-only
- * /dev/null mounts. This preserves root-level atomic writes, newly created
- * plugin/skill/run directories, symlinks, and live config replacement.
- */
+/** Lightweight bwrap used when only the one-way device credential boundary is
+ * required and the full file sandbox is off. */
 export function buildCredentialOnlySandboxArgs(input) {
     if (!isAbsolute(input.workingDir) || !isAbsolute(input.cliBin)) {
         throw new Error('credential isolation requires absolute cwd and CLI binary paths');
@@ -237,17 +74,12 @@ export function buildCredentialOnlySandboxArgs(input) {
     }
     const args = [
         '--bind', '/', '/',
-        // Do not expose host PIDs: `/proc/<worker-pid>/root/...` would otherwise
-        // cross back into the worker's unfiltered mount namespace and recover a
-        // credential despite the private authority mounts below.
         '--proc', '/proc',
     ];
     for (const path of [...new Set(input.readonlyPaths ?? [])].sort()) {
         const normalized = assertCredentialIsolationPath(path, 'readonly path');
         args.push('--ro-bind', normalized, normalized);
     }
-    // Authority masks are deliberately LAST so no readonly carve-out can
-    // accidentally re-expose a credential ancestor.
     for (const directory of hideDirectories.sort())
         args.push('--tmpfs', directory);
     for (const file of hideFiles.sort())
@@ -268,15 +100,8 @@ function probeBubblewrapCredentialMasks() {
     catch { /* spawn probe reports failure below */ }
     const probe = spawnSync(executable, ['--help'], { encoding: 'utf8' });
     if (probe.status !== 0) {
-        return {
-            supported: false,
-            mechanism: null,
-            reason: 'bubblewrap is unavailable',
-        };
+        return { supported: false, mechanism: null, reason: 'bubblewrap is unavailable' };
     }
-    // Prove this host can actually create the namespaces/mounts, not merely that
-    // a binary exists. A private /tmp exercises the directory-mask primitive
-    // without touching host files.
     const runtime = spawnSync(executable, [
         '--bind', '/', '/',
         '--proc', '/proc',
@@ -300,10 +125,6 @@ function probeBubblewrapCredentialMasks() {
             : 'bubblewrap cannot establish the required user/mount/PID namespaces',
     };
 }
-/** Host-side pre-enrollment probe. It accepts no child/session environment or
- * adapter input, performs no writes/installation, and therefore can safely run
- * before the fixed marker is created. Enrollment uses this to refuse enabling
- * device credentials on a host where future workers could not confine them. */
 export function probeHostCredentialIsolationMechanism() {
     if (process.platform === 'darwin') {
         const executable = '/usr/bin/sandbox-exec';
@@ -325,10 +146,8 @@ export function probeHostCredentialIsolationMechanism() {
         reason: `credential isolation unsupported on ${process.platform}`,
     };
 }
-/** Probe/install the one lightweight Linux dependency. Kept separate so the
- * worker can make the mandatory gate decision before any local CLI is spawned. */
 export function credentialOnlySandboxAvailable() {
-    if (process.platform !== 'linux' || !ensureSandboxDeps(false))
+    if (process.platform !== 'linux' || !ensureSandboxDeps())
         return false;
     const probe = probeBubblewrapCredentialMasks();
     if (probe.supported)
@@ -337,7 +156,7 @@ export function credentialOnlySandboxAvailable() {
     return false;
 }
 export function prepareCredentialOnlySandbox(input) {
-    if (process.platform !== 'linux' || !ensureSandboxDeps(false))
+    if (process.platform !== 'linux' || !ensureSandboxDeps())
         return null;
     const probe = probeBubblewrapCredentialMasks();
     if (!probe.supported || probe.mechanism !== 'bwrap')
@@ -347,174 +166,30 @@ export function prepareCredentialOnlySandbox(input) {
         args: buildCredentialOnlySandboxArgs(input),
     };
 }
-/**
- * After `buildSandboxArgs` masks `/run` with a fresh tmpfs, any executable whose
- * resolved path lives UNDER `/run` (the common case: fnm/nvm/volta expose the
- * active toolchain's bin dir as a per-session symlink farm under
- * `/run/user/<uid>/fnm_multishells/<hash>/bin`, and `which codex` / the daemon's
- * own `process.execPath` for node land there) would VANISH inside the sandbox →
- * bwrap `execvp` fails → the CLI exits instantly → Botmux's crash-loop guard
- * trips after 4 retries. This re-exposes each such bin dir read-only at its real
- * path so the binary (and the node interpreter its `#!/usr/bin/env node` shebang
- * needs, which lives in the same fnm bin dir) survive the tmpfs.
- *
- * The caller feeds in EVERY path that will be exec'd inside the sandbox, not just
- * the direct bwrap target: the cliBin, the daemon's own node (process.execPath),
- * AND each adapter-declared SECOND-STAGE executable (CliAdapter.sandboxExtraExecPaths)
- * — e.g. the codex-app adapter's resolved `codex` (its resolvedBin is the daemon
- * node running the runner, which spawns the real codex later for the app-server,
- * so without this the codex path would still be masked). We deliberately do NOT
- * scan raw cliArgs: a path arg like `--cwd /run/user/<uid>/proj` would re-bind its
- * PARENT `/run/user/<uid>`, shadowing the project overlay mounted there and
- * exposing sibling files / IPC sockets — re-exposing must be limited to declared
- * executables.
- *
- * Pure: returns the `--ro-bind-try <dir> <dir>` args (deduped, `/run/`-subpaths
- * only — NEVER `/run` itself, which would clobber the tmpfs and the relay shim
- * mounted at /run/sbxbin). `-try` so a stale/racing path can't fail the spawn.
- * Returns [] for binaries already outside /run (system node, npm/pnpm globals) —
- * non-fnm users are unaffected.
- */
+/** Re-expose trusted executable directories hidden below the fresh /run tmpfs. */
 export function reexposeRunBinArgs(binPaths) {
     const dirs = new Set();
-    for (const p of binPaths) {
-        if (!p || typeof p !== 'string')
+    for (const path of binPaths) {
+        if (!path || typeof path !== 'string')
             continue;
-        const d = dirname(p);
-        if (d.startsWith('/run/'))
-            dirs.add(d); // startsWith('/run/') excludes '/run' itself
+        const dir = dirname(path);
+        if (dir.startsWith('/run/'))
+            dirs.add(dir);
     }
     const out = [];
-    for (const d of dirs)
-        out.push('--ro-bind-try', d, d);
-    return out;
-}
-/** Expand a leading `~` (bare `~` or `~/…` only — never `~user`) to `home`. */
-function expandTilde(raw, home) {
-    return raw.replace(/^~(?=\/|$)/, home);
-}
-/** Tilde-expand each entry and keep only paths that exist on the host. */
-function resolveExistingPaths(paths, home) {
-    const out = [];
-    for (const raw of paths ?? []) {
-        if (!raw || typeof raw !== 'string')
-            continue;
-        const p = expandTilde(raw, home);
-        try {
-            if (existsSync(p))
-                out.push(p);
-        }
-        catch { /* */ }
-    }
+    for (const dir of dirs)
+        out.push('--ro-bind-try', dir, dir);
     return out;
 }
-/** Does readonly-binding `p` swallow the overlay root `root` (p === root or an
- *  ancestor of it)? Later binds win in bwrap, so such a bind would replace the
- *  whole write-isolated overlay with the real read-only tree. Both args must be
- *  canonicalized first — a raw `/repo/`, `/repo/../repo`, or a symlink to the
- *  project would slip past a plain string-prefix check yet still shadow the
- *  overlay once bwrap normalizes/resolves the mount. */
-function coversRoot(p, root) {
-    if (p === root)
-        return true;
-    const prefix = p.endsWith('/') ? p : `${p}/`; // '/' stays '/', '/a' → '/a/'
-    return root.startsWith(prefix);
-}
-/** Canonicalize an existing path: resolve symlinks + `.`/`..`/trailing slash.
- *  Falls back to a lexical resolve if realpath fails (e.g. a racing unlink). */
-function canonicalize(p) {
+/** Canonicalize if possible (Seatbelt/bwrap both resolve symlinks). */
+function canonical(p) {
     try {
         return realpathSync(p);
     }
     catch {
-        return resolve(p);
+        return p;
     }
 }
-/** Canonicalize through the deepest existing ancestor while preserving a
- *  possibly-missing tail. `realpathSync('/home-link/x/missing')` cannot resolve
- *  `/home-link`, so a lexical fallback would leave a bwrap destination under a
- *  symlink even though related mounts use the canonical home. */
-function canonicalizeWithMissingTail(p) {
-    let cursor = resolve(p);
-    const tail = [];
-    while (true) {
-        try {
-            return join(realpathSync(cursor), ...tail);
-        }
-        catch { /* walk upward */ }
-        const parent = dirname(cursor);
-        if (parent === cursor)
-            return resolve(p);
-        tail.unshift(basename(cursor));
-        cursor = parent;
-    }
-}
-/** bwrap cannot bind-mount over a symlink mount destination. Some hosts expose
- *  $HOME through a symlink, so bind overlays — and set the child HOME env — at
- *  canonical targets so the mount point always exists and $HOME resolves even
- *  when the symlink's parent is masked inside the sandbox. */
-export function resolveSandboxMountPath(p) {
-    return canonicalize(p);
-}
-/** Host-side overlay mountpoints must not live below HOME, because HOME is the
- *  lower layer of the home overlay. The old layout did exactly that and allowed
- *  fuse-overlayfs to recursively expose its own mountpoint. Keep the legacy
- *  paths here only so upgrades can tear down pre-fix sessions safely. */
-export function sandboxOverlayPaths(dataDir, sessionId) {
-    const sessionRoot = join(resolveSandboxMountPath(dataDir), 'sandboxes', sessionId);
-    const runtimeRoot = join(VARTMP_ROOT, sessionId);
-    return {
-        sessionRoot,
-        runtimeRoot,
-        projectMerged: join(runtimeRoot, 'proj-merged'),
-        homeMerged: join(runtimeRoot, 'home-merged'),
-        legacyProjectMerged: join(sessionRoot, 'proj-merged'),
-        legacyHomeMerged: join(sessionRoot, 'home-merged'),
-    };
-}
-function overlayMountCandidates(paths) {
-    return [
-        paths.projectMerged,
-        paths.homeMerged,
-        paths.legacyProjectMerged,
-        paths.legacyHomeMerged,
-    ];
-}
-function unmountSandboxOverlays(paths) {
-    for (const merged of overlayMountCandidates(paths))
-        unmountOverlay(merged);
-}
-function hasMountedSandboxOverlay(paths) {
-    return overlayMountCandidates(paths).some(isMounted);
-}
-/**
- * Resolve user-configured sandboxReadonlyPaths: tilde-expand, drop non-existent
- * entries, and REJECT entries that (after resolving symlinks + normalizing) are
- * equal to or an ancestor of an overlay root (home / projectMount) — those would
- * shadow the entire write-isolated overlay with the real read-only tree,
- * silently breaking write isolation. The overlap check runs on the CANONICAL
- * path so a symlink (`/tmp/ref -> /repo`) or a non-normalized string (`/repo/`,
- * `/repo/../repo`) can't alias past the guard. Entries strictly UNDER an overlay
- * root stay allowed: that's the documented "reference material, read-only,
- * excluded from /land" use case. Returns the tilde-expanded original paths (the
- * docs promise "mounted at the same path"); bwrap resolves any symlink source.
- * Exported for tests.
- */
-export function resolveUserReadonlyRoots(paths, home, projectMount) {
-    const homeReal = canonicalize(home);
-    const projReal = canonicalize(projectMount);
-    const out = [];
-    for (const p of resolveExistingPaths(paths, home)) {
-        const real = canonicalize(p);
-        if (coversRoot(real, homeReal) || coversRoot(real, projReal)) {
-            console.error(`[sandbox] sandboxReadonlyPaths entry ignored (resolves to an overlay root, would shadow write isolation): ${p}`);
-            continue;
-        }
-        out.push(p);
-    }
-    return out;
-}
-// ───────────────────────────── orchestration ─────────────────────────────────
 /** Absolute path to this build's compiled cli.js (dist/cli.js), derived from
  *  this module's own location (dist/adapters/backend/sandbox.js → ../../cli.js). */
 function distCliJs() {
@@ -525,394 +200,359 @@ function distCliJs() {
     // sandbox shim must still execute the built CLI entrypoint.
     return fileURLToPath(new URL('../../../dist/cli.js', import.meta.url));
 }
-/** Is file-sandbox enabled for this session? Spike gate = env; the real
- *  per-bot BotConfig.sandbox flag is decided by the caller. */
+/** Is the file sandbox globally forced for this daemon? The real per-bot
+ *  BotConfig.sandbox flag is decided by the caller. */
 export function sandboxEnabled() {
     return process.env.BOTMUX_SANDBOX === '1';
 }
-/** The host path where a sandboxed session actually writes a Claude-family
- *  data dir. Usually this is the HOME overlay upper. If the project mount is
- *  HOME (or otherwise contains the data dir), the later project overlay is the
- *  winning mount and the data lands in proj-upper instead.
+/**
+ * Whether a LOCAL sandbox engine applies to this backend at all. riff has NO
+ * local CLI process to wrap (execution happens in riff's own remote sandbox);
+ * without this bypass the worker's fail-safe "backend not sandboxable" hard
+ * error would brick every sandbox-enabled bot the moment it switches to riff.
+ * Platform is no longer a factor — fs-policy sandboxes darwin AND linux.
+ */
+export function localSandboxApplies(backendType) {
+    return backendType !== 'riff';
+}
+/** Top-level dirs that are symlinks on usrmerge distros (/bin → usr/bin …) —
+ *  replicated inside the tmpfs root so `#!/bin/sh` etc. resolve. */
+const USRMERGE_CANDIDATES = ['/bin', '/sbin', '/lib', '/lib64', '/lib32', '/libx32'];
+/** Basename of the per-session manifest of deny-mask mountpoints the worker
+ *  had to CREATE on the host (they didn't pre-exist) so bwrap could bind an
+ *  empty mask over them. Persisted (not just held in an in-memory cleanup
+ *  closure) because a Linux tmux sandbox can survive a daemon restart — after
+ *  restart the close path only knows `sessionRoot`, and without this manifest
+ *  the empty host mountpoints would leak forever. Read + acted on by EVERY
+ *  teardown path (normal close, reattach-then-close, spawn-failure rollback,
+ *  stale sweep) BEFORE the sessionRoot is removed.
  *
- *  The home overlay is bound (and $HOME set) at the CANONICAL home, so copy-ups
- *  land relative to that root. Compute the in-home relative path robustly whether
- *  realDataDir arrives in symlink or canonical form: adapters build it from the
- *  raw homedir() (so the raw base cancels cleanly in the common case), but a
- *  canonicalized dataDir under a symlink home would otherwise escape via `..`.
- *  Data roots outside both HOME and the project are returned unchanged because
- *  neither overlay owns them (Claude read isolation normally relocates those
- *  roots into BOT_HOME before spawn). */
-export function sandboxedClaudeDataDir(sessionId, realDataDir, context = {}) {
-    const relativeWithin = (root, target) => {
-        const rel = relative(root, target);
-        return rel === '' || (rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`) && !isAbsolute(rel))
-            ? rel
-            : null;
-    };
-    const rawHome = homedir();
-    const home = resolveSandboxMountPath(rawHome);
-    const rawHomeRel = relativeWithin(rawHome, realDataDir);
-    const canonicalDataDir = rawHomeRel !== null
-        ? join(home, rawHomeRel)
-        : canonicalize(realDataDir);
-    if (context.sourceWorkingDir && context.dataDir) {
-        const projectMount = resolveSandboxMountPath(context.sourceWorkingDir);
-        const projectRel = relativeWithin(projectMount, canonicalDataDir);
-        if (projectRel !== null) {
-            return join(resolveSandboxMountPath(context.dataDir), 'sandboxes', sessionId, 'proj-upper', projectRel);
+ *  TRUST MODEL: the manifest lives inside `sessionRoot`, which the policy makes
+ *  a MANDATORY deny in-sandbox (only the outbox is a nested RW carve-out), so a
+ *  sandboxed CLI cannot read or rewrite it. But it can be reached OUT of band
+ *  (a custom data dir under the project, a future policy hole), so cleanup does
+ *  NOT trust the self-reported path as a delete authorization: each entry also
+ *  records the (dev, ino) captured at creation, and cleanup re-`lstat`s and
+ *  removes ONLY when the on-disk inode still matches. That defeats both a
+ *  swapped manifest pointing at a victim path AND the "empty mountpoint deleted,
+ *  a new empty object created at the same path" reuse race. */
+const MASK_MANIFEST_NAME = 'mask-mounts.json';
+/** Atomically persist the created-mountpoint manifest (0600). Returns false on
+ *  failure so the caller can FAIL CLOSED (roll back + abort spawn) rather than
+ *  start a session whose pre-created host mountpoints could later leak. */
+function writeMaskManifest(sessionRoot, created) {
+    if (!created.length)
+        return true;
+    try {
+        atomicWriteFileSync(join(sessionRoot, MASK_MANIFEST_NAME), JSON.stringify(created), { mode: 0o600 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Reclaim a list of created-mountpoint entries (the IN-MEMORY truth). Runs on
+ *  ALL teardown paths — normal close reads the entries back from the manifest,
+ *  spawn-failure rollback passes the in-memory accumulator directly (the
+ *  manifest may never have been written). Fail-safe & NON-RECURSIVE:
+ *  - rejects any entry whose path is non-absolute, contains `..`, or is a
+ *    symlink on disk (a swapped entry can't trick us into deleting elsewhere);
+ *  - IDENTITY-BINDS: removes only when the on-disk (dev, ino) still matches what
+ *    WE recorded at creation — so a tampered manifest pointing at a pre-existing
+ *    victim, or a path whose empty object was replaced after we created ours,
+ *    is left untouched;
+ *  - a dir is removed with `rmdir` only (throws ENOTEMPTY if the host/a
+ *    concurrent process wrote into it → content preserved, never rm -rf);
+ *  - a file is `unlink`ed only when it is a regular, zero-byte file.
+ *  Entries are processed in order; the caller records them deepest-first so a
+ *  child is removed before its now-empty parent. */
+function reclaimMaskEntries(entries) {
+    if (!Array.isArray(entries))
+        return;
+    for (const e of entries) {
+        if (!e || typeof e !== 'object')
+            continue;
+        const { path, kind, dev, ino } = e;
+        if (typeof path !== 'string' || !isAbsolute(path))
+            continue;
+        if (path.split('/').includes('..'))
+            continue;
+        if (kind !== 'dir' && kind !== 'file')
+            continue;
+        if (typeof dev !== 'number' || typeof ino !== 'number')
+            continue; // pre-identity / forged → refuse
+        let st;
+        try {
+            st = lstatSync(path);
         }
+        catch {
+            continue;
+        } // already gone
+        if (st.isSymbolicLink())
+            continue; // never follow a swapped symlink
+        if (st.dev !== dev || st.ino !== ino)
+            continue; // not the object WE created → leave it
+        try {
+            if (kind === 'dir' && st.isDirectory()) {
+                rmdirSync(path); // rmdir — throws ENOTEMPTY if host wrote into it → kept
+            }
+            else if (kind === 'file' && st.isFile() && st.size === 0) {
+                unlinkSync(path); // unlink a still-empty placeholder only
+            }
+        }
+        catch { /* non-empty / concurrent write / perms → leave it, never recurse */ }
     }
-    const homeRel = rawHomeRel ?? relativeWithin(home, canonicalDataDir);
-    if (homeRel !== null) {
-        return join(VARTMP_ROOT, sessionId, 'home-upper', homeRel);
+}
+/** Reclaim the empty deny-mask mountpoints recorded in the persisted manifest,
+ *  then (implicitly) the manifest goes with the sessionRoot. Used by the NORMAL
+ *  teardown paths (close, reattach-close, stale sweep) — where the manifest was
+ *  written successfully. Spawn-failure rollback does NOT use this (it can't
+ *  trust a manifest that may never have been written); it passes the in-memory
+ *  accumulator to reclaimMaskEntries directly. MUST run BEFORE removing
+ *  sessionRoot (which holds the manifest). */
+function reclaimMaskMounts(sessionRoot) {
+    const manifestPath = join(sessionRoot, MASK_MANIFEST_NAME);
+    let raw;
+    try {
+        raw = readFileSync(manifestPath, 'utf8');
     }
-    return canonicalDataDir;
+    catch {
+        return;
+    } // none created / already gone
+    let entries;
+    try {
+        entries = JSON.parse(raw);
+    }
+    catch {
+        return;
+    }
+    reclaimMaskEntries(entries);
 }
-/** Credential roots that must never be readable inside the file sandbox.
- * Relay mode is the only credentialed send path; otherwise an agent could
- * unset BOTMUX_SEND_RELAY and execute an absolute botmux binary against the
- * real bots.json/send-cred files exposed by the HOME overlay lowerdir. */
-export function sandboxCredentialHidePaths(home, botmuxHome = join(home, '.botmux')) {
-    // Mask the entire botmux state root. Exact-file masks are insufficient:
-    // setup/update creates timestamped bots.json backups, including ones created
-    // after a long-lived sandbox starts. Trusted skill roots and the per-session
-    // outbox are explicitly re-bound after privacy masks by buildSandboxArgs.
-    return [...new Set([
-            join(home, '.botmux'),
-            botmuxHome,
-            join(home, '.lark-cli'),
-            join(home, '.lark-cli-bots'),
-        ])].sort();
+/** Spawn-setup rollback: reclaim the mountpoints we pre-created FROM THE
+ *  IN-MEMORY accumulator (NOT the manifest — on the failure paths the manifest
+ *  may never have been written, so reading it back would reclaim nothing and
+ *  leak every created ancestor), then drop the per-session tree. Used when
+ *  prepareDirectSandbox bails after masks were materialised (a mkdir/write
+ *  threw mid-way, the MCP gateway socket check fails, or the manifest write
+ *  itself fails). */
+function rollbackSandboxSetup(sessionRoot, createdMasks) {
+    reclaimMaskEntries(createdMasks);
+    try {
+        rmSync(sessionRoot, { recursive: true, force: true });
+    }
+    catch { /* */ }
 }
-/**
- * Whether the LOCAL bwrap file sandbox applies to this spawn at all.
- * - macOS enforces `sandbox: true` via the Seatbelt write-sandbox instead.
- * - riff has NO local CLI process to wrap (execution happens in riff's own
- *   remote sandbox); without this bypass the worker's fail-safe "backend not
- *   sandboxable" hard error would brick every sandbox-enabled bot the moment
- *   it switches to riff (the dashboard agent switch does not clear `sandbox`).
- */
-export function localSandboxApplies(platform, backendType) {
-    return platform !== 'darwin' && backendType !== 'riff';
+/** Create a mask mountpoint on the host (all missing ancestors too), pushing
+ *  EACH level we actually create — deepest first — into the caller-owned
+ *  `sink` accumulator IMMEDIATELY (before attempting the next level), each with
+ *  its (dev, ino). This is what lets rollback reclaim partially-created chains:
+ *  if a deeper level throws (e.g. ENAMETOOLONG on the leaf), every ancestor we
+ *  already made is already in `sink` for the caller's rollback. `kind` applies
+ *  to the leaf; ancestors are always dirs. No-op when the leaf already exists
+ *  (a pre-existing host path is never our cleanup target). Throws on failure so
+ *  the caller can fail closed — with `sink` holding whatever succeeded. */
+function createMaskMount(leaf, kind, sink) {
+    if (existsSync(leaf))
+        return; // pre-existing host path — never our cleanup target
+    // Walk up to the shallowest missing ancestor, creating each level so we can
+    // record + later reclaim exactly what WE added (mkdir recursive would create
+    // them but hide which levels were ours).
+    const toCreate = [];
+    let p = leaf;
+    while (!existsSync(p)) {
+        toCreate.push(p);
+        const parent = dirname(p);
+        if (parent === p)
+            break; // reached '/'
+        p = parent;
+    }
+    toCreate.reverse(); // shallowest → deepest so mkdir parents exist first
+    for (let i = 0; i < toCreate.length; i++) {
+        const path = toCreate[i];
+        const isLeaf = i === toCreate.length - 1;
+        if (isLeaf && kind === 'file')
+            writeFileSync(path, '');
+        else
+            mkdirSync(path);
+        const st = lstatSync(path);
+        // record deepest-first (unshift) so teardown removes children before parents
+        // — and record IMMEDIATELY so a throw on the next level still leaves this
+        // one visible to the caller's rollback.
+        sink.unshift({ path, kind: isLeaf ? kind : 'dir', dev: st.dev, ino: st.ino });
+    }
 }
+// Test-only surface for the deny-mask lifecycle (trust-boundary regression
+// coverage: manifest tamper defense, dev+ino identity, multi-level cleanup,
+// partial-create rollback).
+export const __testOnly_maskMounts = {
+    MASK_MANIFEST_NAME,
+    createMaskMount,
+    writeMaskManifest,
+    reclaimMaskMounts,
+    reclaimMaskEntries,
+};
 /**
- * Build the sandboxed spawn for a CLI session, or return null when sandboxing
- * is off / unsupported / a required overlay mount fails (fail-safe = the worker
- * treats null as a hard error and does NOT silently run unsandboxed).
+ * Build the bwrap DIRECT-mode spawn for a CLI session, or return null when the
+ * runtime deps are unavailable / setup fails (fail-safe: the worker treats
+ * null as a hard error and never silently runs unsandboxed).
  *
- * Layout under <dataDir>/sandboxes/<sessionId>/: outbox, shimbin, and the
- * landable proj-upper. When the project contains dataDir (notably cwd=HOME),
- * proj-upper is a symlink to scratch under /var/tmp/botmux-sbx/<sessionId>/ so
- * overlay upper/work never sit inside their own lower. Host-only merged
- * mountpoints and the HOME overlay upper/work also live under that runtime root.
+ * Layout under <dataDir>/sandboxes/<sessionId>/: outbox, shimbin, empties.
+ * No overlays, no upper/work dirs — writes inside readWrite zones hit the
+ * real filesystem directly.
  */
-export function prepareSandbox(opts) {
-    if (!opts.enabled)
-        return null;
+export function prepareDirectSandbox(opts) {
     if (process.platform !== 'linux')
-        return null; // overlayfs + bwrap are Linux-only
-    // Auto-provision deps so the user needn't pre-install (bwrap; + fuse-overlayfs
-    // for the rootless/userspace overlay path). Fail the spawn if unavailable.
-    const needFuse = process.env.BOTMUX_SANDBOX_FUSE === '1' || process.getuid?.() !== 0;
-    if (!ensureSandboxDeps(needFuse))
         return null;
-    const dataDir = resolveSandboxMountPath(opts.dataDir);
-    const botmuxHome = dirname(dataDir);
-    const overlayPaths = sandboxOverlayPaths(dataDir, opts.sessionId);
-    const sessionRoot = overlayPaths.sessionRoot;
+    if (!ensureSandboxDeps())
+        return null;
+    const sessionRoot = join(canonical(opts.dataDir), 'sandboxes', opts.sessionId);
     const outbox = join(sessionRoot, 'outbox');
     const shimBin = join(sessionRoot, 'shimbin');
     const empties = join(sessionRoot, 'empties');
-    const landingProjUpper = join(sessionRoot, 'proj-upper'); // stable /land path
-    const landingProjWork = join(sessionRoot, 'proj-work');
-    const projMerged = overlayPaths.projectMerged;
-    const homeMerged = overlayPaths.homeMerged;
-    // HOME overlay upper/work and both merged mountpoints MUST be outside HOME.
-    const vartmp = overlayPaths.runtimeRoot;
-    const homeUpper = join(vartmp, 'home-upper');
-    const homeWork = join(vartmp, 'home-work');
-    for (const d of [outbox, shimBin, empties])
+    // A single, always-empty directory ro-bound over DIRECTORY-shaped deny rules
+    // (real content hidden + read-only mount). Kept empty for the session's life.
+    const emptyDir = join(sessionRoot, 'empty');
+    for (const d of [outbox, shimBin, empties, emptyDir])
         mkdirSync(d, { recursive: true });
-    const home = resolveSandboxMountPath(homedir());
-    // Masking BOTMUX_HOME is mandatory for the credential boundary.  A layout
-    // that makes it `/` or the whole user home cannot be masked without erasing
-    // the sandbox runtime itself, so refuse the spawn instead of silently
-    // exposing the custom session/config root.
-    if (botmuxHome === '/' || botmuxHome === home) {
-        console.error(`[sandbox] unsafe SESSION_DATA_DIR layout: BOTMUX_HOME resolves to ${botmuxHome}`);
-        return null;
-    }
-    // BOTMUX_SANDBOX_SRC overrides the LOWER project source for spike testing only.
-    const projectSource = resolveSandboxMountPath(process.env.BOTMUX_SANDBOX_SRC || opts.sourceWorkingDir);
-    const projectMount = resolveSandboxMountPath(opts.sourceWorkingDir);
-    const projectSharesHome = projectMount === home;
-    // A same-session re-spawn (e.g. in-pane /clear) re-enters here; unmount any
-    // stale merged overlays first so we don't stack a second mount on the same dir.
-    unmountSandboxOverlays(overlayPaths);
-    // overlayfs/fuse-overlayfs upper+work must not live inside lower. The normal
-    // project layout keeps them under dataDir, but cwd=HOME makes dataDir a child
-    // of the project lower. Put the actual scratch outside HOME and leave a
-    // host-only symlink at the stable /land path. Preserve an old real directory
-    // on same-session upgrade so an existing changeset is never discarded.
-    let projUpper = landingProjUpper;
-    let projWork = landingProjWork;
-    if (coversRoot(projectSource, dataDir)) {
-        const externalUpper = join(vartmp, 'proj-upper');
-        const externalWork = join(vartmp, 'proj-work');
-        if (coversRoot(projectSource, vartmp)) {
-            console.error(`[sandbox] cannot place project overlay scratch outside lower ${projectSource}`);
-            return null;
-        }
-        let existing = null;
+    // `botmux` shim → THIS build's cli.js so in-sandbox `botmux send` hits relay
+    // mode (and never needs bots.json, which the policy doesn't expose).
+    const shim = join(shimBin, 'botmux');
+    writeFileSync(shim, `#!/bin/sh\nexec node ${JSON.stringify(distCliJs())} "$@"\n`);
+    chmodSync(shim, 0o755);
+    // usrmerge symlinks to replicate; deny rules that are FILES on the host need
+    // a file-shaped mask, everything else (existing dir OR a not-yet-existing
+    // path) is masked as a directory. We do NOT skip absent denies: leaving a
+    // denied path unmasked inside a read-write parent let the sandbox mkdir+write
+    // it onto the host and read anything created there mid-session (a TOCTOU).
+    const symlinks = [];
+    for (const p of USRMERGE_CANDIDATES) {
         try {
-            existing = lstatSync(landingProjUpper);
-        }
-        catch { /* first spawn */ }
-        if (existing?.isSymbolicLink()) {
-            mkdirSync(externalUpper, { recursive: true });
-            let linked = '';
-            try {
-                linked = realpathSync(landingProjUpper);
-            }
-            catch { /* broken link */ }
-            if (linked && linked !== realpathSync(externalUpper)) {
-                console.error(`[sandbox] refusing unexpected proj-upper symlink target: ${linked}`);
-                return null;
-            }
-            if (!linked) {
-                try {
-                    unlinkSync(landingProjUpper);
-                }
-                catch {
-                    return null;
-                }
-                symlinkSync(externalUpper, landingProjUpper, 'dir');
-            }
-            projUpper = externalUpper;
-            projWork = externalWork;
+            if (lstatSync(p).isSymbolicLink())
+                symlinks.push({ path: p, target: readlinkSync(p) });
         }
-        else if (!existing) {
-            mkdirSync(externalUpper, { recursive: true });
-            symlinkSync(externalUpper, landingProjUpper, 'dir');
-            projUpper = externalUpper;
-            projWork = externalWork;
+        catch { /* absent on this distro */ }
+    }
+    const filePaths = new Set();
+    for (const r of opts.policy.rules) {
+        if (r.access !== 'deny')
+            continue;
+        try {
+            if (statSync(r.path).isFile())
+                filePaths.add(r.path);
         }
-        else {
-            // Upgrade compatibility: an EMPTY pre-fix upper has no changes to save,
-            // so convert it in place. A non-empty one may contain whiteouts/xattrs
-            // that cannot be copied losslessly across filesystems; fail safe and keep
-            // it untouched rather than reintroducing a recursive in-lower overlay.
-            let entries = null;
-            try {
-                entries = readdirSync(landingProjUpper);
-            }
-            catch { /* not a readable dir */ }
-            if (entries?.length === 0) {
-                try {
-                    rmSync(landingProjUpper, { recursive: true, force: true });
-                    rmSync(landingProjWork, { recursive: true, force: true });
-                    mkdirSync(externalUpper, { recursive: true });
-                    symlinkSync(externalUpper, landingProjUpper, 'dir');
-                    projUpper = externalUpper;
-                    projWork = externalWork;
-                }
-                catch {
-                    return null;
-                }
-            }
-            else {
-                console.error(`[sandbox] refusing legacy in-lower proj-upper with pending changes for session ${opts.sessionId}; land or back up the changeset before restarting`);
-                return null;
-            }
+        catch { /* absent → dir-shaped mask */ }
+    }
+    const compiled = compileToBwrap(opts.policy, { symlinks, emptyDir, emptiesDir: empties, filePaths, chdir: opts.chdir });
+    // The shared empty dir + every empty placeholder file are the ro-bind SOURCES
+    // for deny masks. mode 000 → the mask itself is unreadable/unlistable (a real
+    // deny reads as EPERM, not "empty").
+    try {
+        chmodSync(emptyDir, 0o000);
+    }
+    catch { /* */ }
+    for (const f of compiled.emptyFiles) {
+        try {
+            writeFileSync(f.path, '', { mode: 0o000 });
         }
+        catch { /* */ }
     }
-    // Mount the HOME overlay unless the project itself is HOME. In that overlap
-    // case the project overlay is the single layer bound at HOME; mounting a
-    // second home overlay would only waste a FUSE mount before being shadowed.
-    if (!projectSharesHome) {
-        const homeOk = mountOverlay({ lower: home, upper: homeUpper, work: homeWork, merged: homeMerged });
-        if (!homeOk) {
-            return null; // fail-safe: no silent unsandboxed run
+    // bwrap cannot bind onto a MISSING target, and a missing target under a
+    // read-write parent would make bwrap materialise it on the host anyway (true
+    // for BOTH the ro-bind and the tmpfs mask branches). So pre-create every mask
+    // mountpoint that doesn't already exist — recording EACH host level we create
+    // (leaf + any missing ancestors, with dev+ino identity) in a persisted
+    // manifest so any teardown path (incl. after a daemon restart, when only
+    // sessionRoot is known) can rmdir/unlink-if-empty exactly those, never a user
+    // path. Pre-creating a DIRECTORY for a not-yet-existing deny also blocks the
+    // host from later creating a same-named FILE there — fail-closed, an accepted
+    // compat cost of never leaking a denied path.
+    //
+    // FAIL CLOSED: if creating a mountpoint OR persisting the manifest fails, roll
+    // back everything and abort the spawn — starting the session anyway would
+    // either break the mask (bwrap bind fails) or leak host mountpoints with no
+    // record to reclaim them.
+    const createdMasks = [];
+    try {
+        for (const m of compiled.maskMounts) {
+            // createMaskMount pushes each level into createdMasks IMMEDIATELY, so a
+            // mid-chain throw still leaves the partial ancestors visible for rollback.
+            createMaskMount(m.path, m.kind, createdMasks);
         }
     }
-    // Mount the PROJECT overlay. proj-upper = the landable changeset.
-    const projOk = mountOverlay({ lower: projectSource, upper: projUpper, work: projWork, merged: projMerged });
-    if (!projOk) {
-        if (!projectSharesHome)
-            unmountOverlay(homeMerged);
-        return null; // fail-safe
+    catch (err) {
+        rollbackSandboxSetup(sessionRoot, createdMasks);
+        console.error(`[sandbox] failed to pre-create deny mask mountpoint (${err?.message ?? err}) — aborting spawn (fail closed)`);
+        return null;
     }
-    // Record the project LOWER source so landing can tell a wholesale-REPLACED dir
-    // (existed in the lower at create time) from a purely-NEW dir (overlayfs marks
-    // BOTH opaque, so the lower is the only reliable discriminator — and the live
-    // landing target may have drifted, so we must check the lower-at-create, not it).
-    try {
-        writeFileSync(join(sessionRoot, 'meta.json'), JSON.stringify({ projectLower: projectSource }));
+    if (!writeMaskManifest(sessionRoot, createdMasks)) {
+        rollbackSandboxSetup(sessionRoot, createdMasks);
+        console.error('[sandbox] failed to persist deny-mask cleanup manifest — aborting spawn (fail closed)');
+        return null;
     }
-    catch { /* */ }
-    // `botmux` shim → THIS build's cli.js (readable natively via --ro-bind / /), so
-    // in-sandbox `botmux send` hits relay mode (and never the host bots.json).
-    const shim = join(shimBin, 'botmux');
-    writeFileSync(shim, `#!/bin/sh\nexec node ${JSON.stringify(distCliJs())} "$@"\n`);
-    chmodSync(shim, 0o755);
-    // Credential masks are mandatory; per-bot privacy masks extend them.
-    // Existing dirs → tmpfs blank; files → empty read-only placeholder. A missing
-    // path that contains another requested mask must also be a directory: mounting
-    // it as an empty file makes a later child mount fail with ENOTDIR (for example
-    // a missing ~/.lark-cli-bots plus ~/.lark-cli-bots/<sibling>).
-    // `~` resolves like the docs' examples (`~/.ssh`) — an unexpanded tilde would
-    // fail existsSync and mask a literal `~/...` path, leaving the real one readable.
-    const hideDirs = [];
-    const hideFiles = [];
-    const finalHideDirs = [];
-    const finalHideFiles = [];
-    const postReadonlyHideDirs = [];
-    const postReadonlyHideFiles = [];
-    let emptyIdx = 0;
-    const customBotsConfig = process.env.BOTS_CONFIG?.trim();
-    const credentialPaths = [
-        // SESSION_DATA_DIR may live outside ~/.botmux.  Its parent is the
-        // authoritative BOTMUX_HOME everywhere else (send-cred, per-bot homes,
-        // sessions/receipts); mask that exact root so a custom location cannot be
-        // recovered through the sandbox's initial read-only bind of `/`.
-        ...sandboxCredentialHidePaths(home, botmuxHome),
-        ...(customBotsConfig ? [resolve(customBotsConfig)] : []),
-    ];
-    const classifyMasks = (rawPaths, dirs, files) => {
-        const paths = [...new Set(rawPaths
-                .filter((raw) => typeof raw === 'string' && raw.length > 0)
-                .map(raw => canonicalizeWithMissingTail(expandTilde(raw, home))))];
-        const hasMaskedDescendant = (parent) => paths.some(candidate => {
-            if (candidate === parent)
-                return false;
-            const rel = relative(resolve(parent), resolve(candidate));
-            return rel !== ''
-                && rel !== '..'
-                && !rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`)
-                && !isAbsolute(rel);
-        });
-        for (const p of paths) {
-            let isDir = false;
-            try {
-                isDir = existsSync(p) ? statSync(p).isDirectory() : hasMaskedDescendant(p);
-            }
-            catch {
-                isDir = hasMaskedDescendant(p);
-            }
-            if (isDir) {
-                dirs.push(p);
-            }
-            else {
-                const empty = join(empties, `mask-${emptyIdx++}`);
-                try {
-                    writeFileSync(empty, '');
-                }
-                catch { /* */ }
-                files.push({ path: p, empty });
-            }
+    const args = [...compiled.args];
+    // Shim bin at a fixed path under the fresh /run tmpfs — appended after the
+    // rule mounts (later mount wins over the tmpfs). PATH points here first.
+    args.push('--ro-bind', shimBin, '/run/sbxbin');
+    for (const rawTarget of [...new Set(opts.trustedBotmuxCommandPaths ?? [])]) {
+        if (typeof rawTarget !== 'string' || !isAbsolute(rawTarget))
+            continue;
+        const target = resolve(rawTarget);
+        try {
+            if (!lstatSync(target).isFile())
+                continue;
+            args.push('--ro-bind', shim, target);
         }
-    };
-    classifyMasks([...credentialPaths, ...(opts.hidePaths ?? [])], hideDirs, hideFiles);
-    classifyMasks(opts.finalHidePaths ?? [], finalHideDirs, finalHideFiles);
-    classifyMasks(opts.postReadonlyHidePaths ?? [], postReadonlyHideDirs, postReadonlyHideFiles);
-    let mcpGatewaySocket;
+        catch { /* missing/stale config target — PATH shim remains available */ }
+    }
     let sandboxMcpGatewaySocketPath;
     if (opts.mcpGatewaySocketPath) {
         try {
             const socketPath = resolve(opts.mcpGatewaySocketPath);
-            if (!lstatSync(socketPath).isSocket())
+            if (!lstatSync(socketPath).isSocket()) {
+                rollbackSandboxSetup(sessionRoot, createdMasks);
                 return null;
+            }
             const hostDir = realpathSync(dirname(socketPath));
             const sandboxDir = '/run/botmux-mcp';
-            mcpGatewaySocket = { hostDir, sandboxDir };
+            args.push('--dir', sandboxDir, '--ro-bind', hostDir, sandboxDir);
             sandboxMcpGatewaySocketPath = join(sandboxDir, basename(socketPath));
         }
         catch {
+            // Spawn-setup failure AFTER mask mountpoints were pre-created: reclaim the
+            // empty ones (from the in-memory list) and drop the tree so nothing leaks.
+            rollbackSandboxSetup(sessionRoot, createdMasks);
             return null;
         }
     }
-    // CLI auth/login paths kept real+writable (token refresh / login must persist,
-    // unlike isolated project edits). Resolve `~` and bind only existing paths — a
-    // missing auth file isn't a valid mountpoint (the CLI must be logged in on the
-    // host; login-from-scratch inside the sandbox isn't supported).
-    const authReal = resolveExistingPaths(opts.authPaths, home);
-    const trustedWritableRoots = resolveExistingPaths(opts.trustedWritablePaths, home);
-    const readonlyRoots = resolveExistingPaths(opts.readonlyRoots, home);
-    const userReadonlyRoots = resolveUserReadonlyRoots(opts.userReadonlyPaths, home, projectMount);
-    const plan = {
-        projectMount,
-        projectMerged: projMerged,
-        home,
-        homeMerged,
-        outbox,
-        mcpGatewaySocket,
-        hideDirs,
-        hideFiles,
-        authReal,
-        trustedWritableRoots,
-        finalHideDirs,
-        finalHideFiles,
-        readonlyRoots,
-        postReadonlyHideDirs,
-        postReadonlyHideFiles,
-        userReadonlyRoots,
-        net: opts.net !== false,
-    };
-    const args = buildSandboxArgs(plan);
-    // Shim bin at a fixed path UNDER the /run tmpfs — the whole real fs is bound
-    // read-only (`--ro-bind / /`), so bwrap can't mkdir a new mountpoint at the
-    // root (/sbxbin) → it must live under a writable tmpfs (/run). PATH points here.
-    args.push('--ro-bind', shimBin, '/run/sbxbin');
-    const trustedBotmuxRoots = [...new Set([
-            canonicalizeWithMissingTail(join(home, '.botmux')),
-            canonicalizeWithMissingTail(botmuxHome),
-        ])];
-    for (const rawTarget of [...new Set(opts.trustedBotmuxCommandPaths ?? [])]) {
-        if (!rawTarget || typeof rawTarget !== 'string')
-            continue;
-        const target = canonicalizeWithMissingTail(expandTilde(rawTarget, home));
-        const trustedRoot = trustedBotmuxRoots.find(root => {
-            const rel = relative(root, target);
-            return rel !== '' && rel !== '..' && !rel.startsWith('../') && !isAbsolute(rel);
-        });
-        // External commands stay visible through the initial read-only bind of `/`.
-        // Only replace commands below a masked Botmux root, and reject symlink escapes.
-        if (!trustedRoot)
-            continue;
-        const rel = relative(trustedRoot, target);
-        let current = trustedRoot;
-        for (const segment of dirname(rel).split('/').filter(segment => segment && segment !== '.')) {
-            current = join(current, segment);
-            args.push('--dir', current);
+    // Authoritative child env via bwrap --setenv (works on pty AND tmux — the
+    // tmux backend only forwards a fixed whitelist).
+    //
+    // PATH: the fresh tmpfs root binds executable dirs at their CANONICAL host
+    // paths (the policy's readOnly exec rules are realpath'd by the worker). The
+    // host's own $PATH is LEXICAL and can point at symlink-form dirs (e.g.
+    // ~/.local/bin → a shared-drive/fnm/nvm path) that don't exist in the fresh
+    // root — so the trusted `botmux` shim's bare `node` would fail `not found`
+    // and the MCP gateway would exit (Connection closed). Prepend the canonical
+    // dirs of node + the CLI bin (deduped) so bare-name resolution always hits a
+    // bound path, THEN keep the host PATH as a lexical fallback.
+    const canonicalExecDirs = [];
+    const pushExecDir = (p) => {
+        if (!p)
+            return;
+        try {
+            const dir = dirname(realpathSync(p));
+            if (isAbsolute(dir) && !canonicalExecDirs.includes(dir))
+                canonicalExecDirs.push(dir);
         }
-        args.push('--ro-bind', shim, target);
-    }
-    // botmux skill/plugin dir (claude `--plugin-dir` points here; carries the
-    // botmux-send etc. skills, no secrets). Re-exposed read-only at its real path.
-    const pluginDir = join(home, '.botmux', 'claude-plugin');
-    args.push('--ro-bind-try', pluginDir, pluginDir);
-    // Re-expose any bin dir living under /run (fnm/nvm/volta symlink farms) that the
-    // `--tmpfs /run` above just masked — else the resolved cliBin / the node its
-    // shebang needs / an adapter's declared second-stage binary vanish in-sandbox
-    // and the CLI crash-loops on spawn. ONLY executable paths (never cwd/path args):
-    //  - opts.cliBin: the direct bwrap target
-    //  - process.execPath: the daemon's own node (under /run too when fnm-managed)
-    //  - opts.extraExecPaths: adapter-declared second-stage execs, e.g. codex-app's
-    //    real codex (its resolvedBin is the daemon node, so cliBin alone misses it).
-    args.push(...reexposeRunBinArgs([opts.cliBin, process.execPath, ...(opts.extraExecPaths ?? [])]));
-    // Authoritative child env via bwrap --setenv (works on pty AND tmux — the tmux
-    // backend only forwards a fixed whitelist, which excludes HOME/PATH/relay).
+        catch { /* unresolvable — skip */ }
+    };
+    pushExecDir(process.execPath); // node
+    pushExecDir(opts.cliBin); // the CLI binary
     const env = {
-        HOME: home, // MUST match where the overlay is bound (canonical);
-        // a symlink-form HOME dangles when its parent is masked (e.g. tmpfs /tmp)
-        BOTMUX_SEND_RELAY: outbox, // routes `botmux send` to the daemon outbox watcher
-        PATH: `/run/sbxbin:${process.env.PATH ?? ''}`, // /run/sbxbin first so `botmux` = the relay shim
+        HOME: opts.home,
+        BOTMUX_SEND_RELAY: outbox,
+        PATH: ['/run/sbxbin', ...canonicalExecDirs, process.env.PATH ?? ''].filter(Boolean).join(':'),
     };
-    // The daemon discovery dir lives under the masked BOTMUX_HOME, so the only
-    // way an in-sandbox CLI can dial the daemon's loopback IPC (session-scoped,
-    // capability-gated routes like the v3 workflow relay) is this port marker.
-    // Not a credential: every route it reaches authenticates independently.
     if (process.env.BOTMUX_DAEMON_IPC_PORT) {
         env.BOTMUX_DAEMON_IPC_PORT = process.env.BOTMUX_DAEMON_IPC_PORT;
     }
@@ -920,100 +560,82 @@ export function prepareSandbox(opts) {
         env[MCP_GATEWAY_SOCKET_ENV] = sandboxMcpGatewaySocketPath;
         env[MCP_GATEWAY_REQUIRED_ENV] = '1';
     }
-    // Never inherit a custom credential config path into the sandbox. Its host
-    // path is masked above as defense in depth, while unsetenv prevents an
-    // absolute botmux/lark client from being pointed at it explicitly.
-    args.push('--unsetenv', 'BOTS_CONFIG');
-    args.push('--unsetenv', 'BOTMUX_HOST_RELAY_AUTHORIZED');
-    // Forward proxy vars so the CLI reaches the API on the tmux backend too.
     for (const k of PROXY_ENV_KEYS) {
         const v = process.env[k];
         if (typeof v === 'string' && v)
             env[k] = v;
     }
+    args.push('--unsetenv', 'BOTS_CONFIG');
+    args.push('--unsetenv', 'BOTMUX_HOST_RELAY_AUTHORIZED');
     for (const [k, v] of Object.entries(env))
         args.push('--setenv', k, v);
-    args.push('--', opts.cliBin, ...opts.cliArgs);
+    // Canonicalize the CLI binary before execvp: on a symlinked-$HOME host
+    // (e.g. /home/u → /data00/home/u shared-drive mount) the worker hands us the
+    // lexical path (~/.local/bin/claude → /home/u/.local/bin/claude), but the
+    // sandbox only binds CANONICAL exec dirs (/data00/...). The lexical /home/u
+    // prefix does not exist in the fresh bwrap root, so bwrap's execvp fails with
+    // "No such file or directory" and the CLI never starts (pane dies instantly).
+    // realpath makes the exec target land on a bound path. Best-effort: an
+    // unresolvable path falls back to the lexical form (bwrap will fail-closed).
+    let execBin = opts.cliBin;
+    try {
+        execBin = realpathSync(opts.cliBin);
+    }
+    catch { /* keep lexical; spawn fails closed */ }
+    args.push('--', execBin, ...opts.cliArgs);
     return {
         bin: 'bwrap',
         args,
         env,
         outbox,
-        workDir: landingProjUpper,
-        homeUpper,
         cleanup: () => {
-            unmountSandboxOverlays(overlayPaths);
+            // Reclaim empty deny-mask mountpoints we created on the host BEFORE
+            // dropping the manifest with the rest of the tree.
+            reclaimMaskMounts(sessionRoot);
             try {
                 rmSync(sessionRoot, { recursive: true, force: true });
             }
             catch { /* */ }
-            try {
-                rmSync(vartmp, { recursive: true, force: true });
-            }
-            catch { /* */ }
         },
     };
 }
 /**
- * Re-attach the daemon/worker side to an ALREADY-spawned sandbox session WITHOUT
- * touching the overlays. Used on daemon-restart reattach to a persistent
- * (tmux/herdr/zellij) pane whose bwrap'd CLI is still alive: the CLI is bound to
- * its own namespace-pinned overlay, so we must NOT unmount/remount (that would
- * leave a duplicate host-side mount the CLI isn't using). We only need the outbox
- * path back so the watcher can keep servicing the live CLI's `botmux send`, plus
- * the workDir (upper changeset for landing) and a cleanup that tears the residue
- * down at close/exit. Returns null if the session has no sandbox tree on disk
- * (never sandboxed). Linux-only, mirrors prepareSandbox's layout.
+ * Re-attach the daemon/worker side to an ALREADY-spawned sandbox session (a
+ * live bwrap'd CLI surviving in a tmux/herdr/zellij pane across a daemon
+ * restart). Only the outbox path is needed back so the watcher keeps servicing
+ * the live CLI's `botmux send`, plus a cleanup that removes the tree at
+ * close/exit. Returns null if the session has no sandbox tree on disk (never
+ * sandboxed). Linux-only, mirrors prepareDirectSandbox's layout.
  */
 export function attachSandboxOutbox(opts) {
     if (process.platform !== 'linux')
         return null;
-    const overlayPaths = sandboxOverlayPaths(opts.dataDir, opts.sessionId);
-    const sessionRoot = overlayPaths.sessionRoot;
-    const outbox = join(sessionRoot, 'outbox');
-    const projUpper = join(sessionRoot, 'proj-upper');
-    if (!existsSync(outbox) && !existsSync(projUpper))
+    const sessionRoot = join(canonical(opts.dataDir), 'sandboxes', opts.sessionId);
+    if (!existsSync(sessionRoot))
         return null; // never sandboxed
-    // Ensure the outbox exists (the watcher reads it); never (re)mount here.
+    const outbox = join(sessionRoot, 'outbox');
     try {
         mkdirSync(outbox, { recursive: true });
     }
     catch { /* */ }
     return {
         outbox,
-        workDir: projUpper,
         cleanup: () => {
-            unmountSandboxOverlays(overlayPaths);
+            // Reclaim empty deny-mask mountpoints we created on the host BEFORE
+            // dropping the manifest with the rest of the tree.
+            reclaimMaskMounts(sessionRoot);
             try {
                 rmSync(sessionRoot, { recursive: true, force: true });
             }
             catch { /* */ }
-            try {
-                rmSync(overlayPaths.runtimeRoot, { recursive: true, force: true });
-            }
-            catch { /* */ }
         },
     };
 }
-/** Reclaim one session's overlay residue: unmount both merged overlays + rm the
- *  per-session tree (incl. the /var/tmp home scratch). Idempotent / best-effort. */
-function reclaimSandbox(dataDir, sid) {
-    const overlayPaths = sandboxOverlayPaths(dataDir, sid);
-    unmountSandboxOverlays(overlayPaths);
-    try {
-        rmSync(overlayPaths.sessionRoot, { recursive: true, force: true });
-    }
-    catch { /* */ }
-    try {
-        rmSync(overlayPaths.runtimeRoot, { recursive: true, force: true });
-    }
-    catch { /* */ }
-}
 /** Scan the process table for sandbox session-ids referenced by any running
- *  process's argv. A live bwrap's bind/overlay paths contain `sandboxes/<sid>`
- *  and `botmux-sbx/<sid>`, so this physically detects which sandbox dirs are
- *  still in use — by overlay sessions AND old clone-model sessions alike. Used as
- *  a hard guard so the sweep never deletes a dir out from under a live CLI. */
+ *  process's argv (a live bwrap's bind paths contain `sandboxes/<sid>`). Hard
+ *  guard so the sweep never deletes an outbox out from under a live CLI whose
+ *  session record was lost — the outbox is bind-mounted INTO the live sandbox,
+ *  so removing the host-side source would break its relay. */
 function liveSandboxSids() {
     const live = new Set();
     let pids;
@@ -1023,7 +645,7 @@ function liveSandboxSids() {
     catch {
         return live;
     }
-    const re = /(?:sandboxes|botmux-sbx)\/([^/\0]+)/g;
+    const re = /sandboxes\/([^/\0]+)/g;
     for (const pid of pids) {
         if (!/^\d+$/.test(pid))
             continue;
@@ -1042,29 +664,16 @@ function liveSandboxSids() {
     return live;
 }
 /**
- * Reclaim leaked sandbox residue.
- *
- * Two classes of leak are reclaimed:
- *  1. NON-ACTIVE orphans — sid not in `activeSessionIds`: the session is gone, so
- *     any leftover mount/dir is pure residue (the original startup-sweep case,
- *     guarding against a daemon crash/kill that skipped killCli()).
- *  2. ACTIVE-but-DEAD — sid IS in `activeSessionIds`, yet NEITHER of its merged
- *     overlays is still mounted. This closes the blind spot where a sandboxed
- *     worker was SIGKILL'd (straggler reaper) or crashed: the session stays
- *     status='active' on disk, so the old "skip if active" rule would let the
- *     leaked upper/work dirs survive across restarts indefinitely. We only GC an
- *     active sid when its mounts are ALREADY gone — we NEVER tear down a live
- *     mount (a CLI persisting in a tmux/herdr/zellij pane is still bound to it),
- *     so a genuinely-live persistent session keeps its changeset.
- *
- * Safe to call repeatedly: wire once at daemon bootstrap AND on a periodic timer
- * (the SIGKILL/straggler path can't run worker-side killCli(), so a startup-only
- * sweep would let a crashed-active session's mount survive for the whole next
- * daemon lifetime — one daemon per bot can run for days).
+ * Reclaim leaked per-session sandbox trees (outbox/shim/empties of sessions
+ * that no longer exist) — plain directory residue in the direct model, no
+ * mounts. Guards: never touch an ACTIVE session's tree (it may be suspended,
+ * intending to resume — its outbox must survive) and never touch a tree
+ * referenced by a live process (a reattached pane whose session record was
+ * lost). Safe to call repeatedly: wired at daemon bootstrap AND on a periodic
+ * timer.
  */
 export function sweepOrphanSandboxes(dataDir, activeSessionIds) {
-    const sandboxDataDir = resolveSandboxMountPath(dataDir);
-    const root = join(sandboxDataDir, 'sandboxes');
+    const root = join(canonical(dataDir), 'sandboxes');
     let sids = [];
     try {
         sids = readdirSync(root);
@@ -1072,45 +681,34 @@ export function sweepOrphanSandboxes(dataDir, activeSessionIds) {
     catch {
         return;
     } // no sandboxes dir yet
-    // Grace before reclaiming an ACTIVE-but-unmounted sandbox: a worker that just
-    // (re)spawned creates the outbox/shimbin dirs a few syscalls BEFORE it mounts
-    // the overlay. Without this, a sweep firing in that tiny window would nuke an
-    // in-progress session's outbox. Non-active orphans are reclaimed immediately
-    // (no live worker can be mid-spawn for a session that isn't active).
-    const ACTIVE_DEAD_GRACE_MS = 60_000;
+    // Grace so a worker mid-spawn (dirs created a few syscalls before the CLI
+    // process appears in /proc) can't have its outbox swept.
+    const GRACE_MS = 60_000;
     const now = Date.now();
-    // Hard physical guard: NEVER reclaim a session whose dir is referenced by a
-    // live process. A running bwrap binds/overlays paths containing the sid, so a
-    // process-table scan catches BOTH overlay sessions (merged mounts) AND old
-    // clone-model sessions re-attached after a daemon restart (which have NO
-    // overlay mount, so the isMounted check below would wrongly deem them dead and
-    // delete their bind-source dirs out from under the live CLI). This is the root
-    // cause of the 2026-06-10 incident — keep it as the FIRST gate.
     const live = liveSandboxSids();
     for (const sid of sids) {
-        const overlayPaths = sandboxOverlayPaths(sandboxDataDir, sid);
-        const sessionRoot = overlayPaths.sessionRoot;
         if (live.has(sid))
-            continue; // a running process holds this sandbox — leave it
-        if (activeSessionIds.has(sid)) {
-            // Active session: keep it while a host-side overlay is still mounted (= a
-            // live CLI may be bound to the changeset). If BOTH merged overlays are gone
-            // AND the tree is older than the spawn grace, the worker/CLI is dead →
-            // reclaim the dead residue. We NEVER tear down a live mount, so a genuinely
-            // live persistent (tmux/herdr/zellij) session keeps its changeset.
-            if (hasMountedSandboxOverlay(overlayPaths))
-                continue;
-            let ageOk = false;
-            try {
-                ageOk = now - statSync(sessionRoot).mtimeMs > ACTIVE_DEAD_GRACE_MS;
-            }
-            catch {
-                ageOk = false;
-            }
-            if (!ageOk)
-                continue; // too fresh — could be a worker mid-spawn
+            continue; // a running process holds this tree
+        if (activeSessionIds.has(sid))
+            continue; // active (possibly suspended) session
+        const sessionRoot = join(root, sid);
+        let ageOk = false;
+        try {
+            ageOk = now - statSync(sessionRoot).mtimeMs > GRACE_MS;
         }
-        reclaimSandbox(sandboxDataDir, sid);
+        catch {
+            ageOk = false;
+        }
+        if (!ageOk)
+            continue;
+        // Reclaim empty deny-mask mountpoints recorded in this tree's manifest
+        // BEFORE removing the tree (which holds the manifest). Only runs once we've
+        // confirmed no live bwrap references the sid (liveSandboxSids above).
+        reclaimMaskMounts(sessionRoot);
+        try {
+            rmSync(sessionRoot, { recursive: true, force: true });
+        }
+        catch { /* */ }
     }
 }
 // Presentation-only flags the sandbox may pass through. Path-bearing flags