botmux 3.9.1 → 3.10.0

package/dist/worker.js

@@ -52,6 +52,7 @@ import { deriveTerminalViewToken, deriveTerminalWriteToken, resolveTerminalAcces
 import { readPlatformBinding } from './platform/binding.js';
 import { loadDashboardSecret, loadPersistedToken } from './dashboard/auth.js';
 import { InflightInputTracker } from './core/inflight-input-tracker.js';
+import { InputTurnDeduper } from './core/input-turn-dedupe.js';
 import { shouldRunQuietRotation, evaluatePidResolverPullback, decideFingerprintSwitch, shouldHealAbsentBaseline, sessionIdFromJsonlPath, SESSION_ID_FILENAME_RE, } from './services/bridge-rotation-policy.js';
 import { CodexBridgeQueue } from './services/codex-bridge-queue.js';
 import { detectCodexComposerState } from './services/codex-composer-state.js';
@@ -59,7 +60,7 @@ import { generateCodexAppThreadTitle, readCodexAppThreadMetadata, setCodexAppThr
 import { buildBotmuxLarkNativeSessionTitle } from './core/session-title.js';
 import { drainCodexRollout, findCodexRolloutBySessionId, findCodexRolloutByPid, findCodexRolloutSetByPid, codexHistorySidIsOwned, splitCodexEventsByCutoff, extractLastCodexTurn, codexSessionIdFromRolloutPath, scanCodexThreadSettings } from './services/codex-transcript.js';
 import { CodexServiceTierTracker, resolveCodexServiceTierSnapshot } from './services/codex-service-tier.js';
-import { drainTraexRollout, findTraexRolloutBySessionId, findTraexRolloutByPid } from './services/traex-transcript.js';
+import { drainTraexRollout, findTraexRolloutBySessionId, findTraexRolloutByPid, findTraexRolloutSetByPid, traexHistorySidIsOwned } from './services/traex-transcript.js';
 import { parseTraexUserInputQuestions } from './services/traex-user-input.js';
 import { cocoEventsPathForSession, drainCocoEvents, findCocoSessionByPid } from './services/coco-transcript.js';
 import { currentHermesStateOffset, drainHermesStateDb, resolveHermesStateDbPath } from './services/hermes-transcript.js';
@@ -1027,6 +1028,11 @@ let lastSpawnEffectiveCliSessionId;
 let lastSpawnDeferInitialPrompt = false;
 let lastSpawnQueuedInitialPrompt;
 let lastSpawnQueuedInitialPromptLogicalContent;
+// True when this session runs under an outer bwrap supervisor (file sandbox OR
+// Linux credential-only bwrap) — both make getChildPid() the supervisor, not the
+// CLI leaf. credentialOnlyBwrap needs host probes so it can't be recomputed from
+// cfg at gate-check time; capture the spawn-time verdict for currentTraexObservedPid.
+let lastSpawnOuterBwrapActive = false;
 /**
  * True only when {@link shouldArmSpawnArgvInitialPromptBusy} says so: argv-
  * baked first prompt + SessionStart ready (Grok-class). First markPromptReady
@@ -1155,7 +1161,7 @@ let closeRequested = false;
 let capturedSpawnCommand = null;
 let deferredTopicOutputTail = '';
 const reportedDeferredTopicRoots = new Set();
-const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff' };
+const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff', reasonix: 'Reasonix' };
 function cliName() {
     return (lastInitConfig?.cliRuntime?.source === 'configured'
         ? (lastInitConfig.cliRuntime.displayName?.trim() || lastInitConfig.cliRuntime.id)
@@ -1166,6 +1172,10 @@ function cliName() {
 let isPromptReady = false;
 /** Mutex for async flushPending — prevents concurrent flush loops. */
 let isFlushing = false;
+/** An init prompt exists but spawn/RPC policy has not yet established whether
+ * it is argv-baked, RPC-owned, or queued. Concurrent follow-ups may enter the
+ * queue during async init, but must not flush ahead of this first turn. */
+let initialInputOwnershipPending = false;
 /** True from the moment an owned CLI restart begins until the replacement
  * backend has been synchronously installed. Async backends (notably Riff)
  * keep the old backend object alive while destroySession() awaits remote
@@ -1471,6 +1481,13 @@ async function runStartupCommands() {
 }
 const freshnessInputQueue = new CodexRunnerFreshnessInputQueue(() => codexRunnerFreshness, state => { codexRunnerFreshness = state; });
 const pendingMessages = freshnessInputQueue.normal;
+/** Ordinary Lark IM turns may be retransmitted by the daemon when the exact
+ * receipt ACK times out. Fence those retries before any renderer / adapter side
+ * effects so one Lark message can enter the CLI input queue at most once per
+ * worker generation. Durable receiver attempts already have their own lease
+ * protocol and adopt writes have an ambiguity journal, so this gate stays on
+ * non-adopt `om_` turns without dispatchAttempt. */
+const ordinaryImTurnDedupe = new InputTurnDeduper(256);
 /** Correlation ids that this worker actually wrote into the owned Codex App
  * runner. Runner lifecycle/final markers may route only to ids in this bounded
  * local set; model/user display bytes cannot add entries. */
@@ -3515,18 +3532,21 @@ function codexBridgeStartTimer() {
                     cwd: lastInitConfig?.workingDir,
                     pid: codexAdoptPendingPid,
                 });
-                // Codex defense-in-depth: resolveFileBridgePath resolves sessionId-first,
-                // so a pending sid that is actually a shared-CODEX_HOME sibling's would
-                // resolve to that foreign rollout. Only attach when the resolved rollout's
-                // sid is one the observed pid actually holds open. This poller re-runs
-                // every 1s, so a lazily-opened owned fd is picked up on a later tick.
-                // Skip the gate only when we have no pid to prove ownership with (keeps
-                // the sid/pid resolution working for non-adopt / pid-less flows).
-                const attachOk = !(structuredBridgeIsCodex() && lastInitConfig?.adoptMode && path && currentCodexObservedPid())
-                    || (() => {
-                        const sid = codexSessionIdFromRolloutPath(path);
-                        return !!sid && codexHistorySidOwnedByCurrentPid(sid);
-                    })();
+                // Codex/TRAE defense-in-depth: resolveFileBridgePath resolves
+                // sessionId-first, so a pending sid that is actually a shared-home
+                // sibling's (CODEX_HOME / TRAE_HOME) would resolve to that foreign
+                // rollout. Only attach when the resolved rollout's sid is one the
+                // observed pid actually holds open. This poller re-runs every 1s, so a
+                // lazily-opened owned fd is picked up on a later tick. Skip the gate
+                // only when we have no pid to prove ownership with (keeps the sid/pid
+                // resolution working for non-adopt / pid-less flows).
+                const codexAttachGated = structuredBridgeIsCodex() && lastInitConfig?.adoptMode && path && currentCodexObservedPid();
+                const traexAttachGated = structuredBridgeIsTraex() && lastInitConfig?.adoptMode && path && currentTraexObservedPid();
+                const attachOk = codexAttachGated
+                    ? (() => { const sid = codexSessionIdFromRolloutPath(path); return !!sid && codexHistorySidOwnedByCurrentPid(sid); })()
+                    : traexAttachGated
+                        ? (() => { const sid = codexSessionIdFromRolloutPath(path); return !!sid && traexHistorySidOwnedByCurrentPid(sid); })()
+                        : true;
                 if (path && attachOk) {
                     if (codexAdoptPendingPid && (lastInitConfig?.cliId === 'codex' || lastInitConfig?.cliId === 'traex')) {
                         const discoveredSessionId = codexSessionIdFromRolloutPath(path);
@@ -3804,6 +3824,54 @@ function codexHistorySidOwnedByCurrentPid(cliSessionId) {
     }
     return owned;
 }
+/** Resolve the pid that actually holds a TRAE rollout open, given a candidate
+ *  that may be a bwrap supervisor. Under the file sandbox, botmux launches
+ *  `bwrap --unshare-pid -- traex`, so the tmux pane leaf / getChildPid() is the
+ *  bwrap process — its /proc/<pid>/fd holds no rollout, and the ownership gate
+ *  would always fail. The real traex leaf is host-visible across the pid ns
+ *  (ps -A ppid links), so a comm-based BFS descends to it. Outside the sandbox
+ *  (or if traex hasn't been forked yet) the candidate already is the leaf, so
+ *  we return it unchanged — fail closed to the launcher pid rather than guess. */
+function resolveTraexOwnershipPid(candidatePid, sandbox) {
+    if (!sandbox || !candidatePid)
+        return candidatePid;
+    return findLaunchedCliPid(candidatePid, 'traex') ?? candidatePid;
+}
+/** TRAE counterpart of currentCodexObservedPid: the pid of the TRAE process
+ *  this worker observes (spawned child or adopted pane). Same resolution order
+ *  — the wired backend.cliPid first, then the live pane child pid, then the
+ *  adopt-pending pid (which is populated for TRAE too, see the codex/traex
+ *  branch around line 3674). backend.cliPid is already sandbox-resolved at wire
+ *  time; the getChildPid() fallback is not, so descend it here too (no-op
+ *  outside the sandbox / when already a leaf). */
+function currentTraexObservedPid() {
+    const wired = backend?.cliPid;
+    if (wired)
+        return wired;
+    const child = backend?.getChildPid?.();
+    if (child)
+        return resolveTraexOwnershipPid(child, lastSpawnOuterBwrapActive);
+    return codexAdoptPendingPid;
+}
+/** Ownership gate for binding a TRAE session id that came from the GLOBAL
+ *  history.jsonl (shared by every TRAE pane under one TRAE_HOME). A concurrent
+ *  sibling pane submitting identical text — e.g. a bare "继续" in adopt mode,
+ *  which carries no unique <session_id> — can make writeInput's history match
+ *  surface a FOREIGN session id. Before persisting it (resume target) or
+ *  (re-)attaching the transcript bridge, require the id to be one THIS pid
+ *  actually holds open. FAIL CLOSED: unavailable fd enumeration (undefined set)
+ *  or a non-member id → false, so the caller keeps its current binding. Mirrors
+ *  codexHistorySidOwnedByCurrentPid; the pure decision lives in
+ *  traexHistorySidIsOwned for unit testing without a live pid. */
+function traexHistorySidOwnedByCurrentPid(cliSessionId) {
+    const pid = currentTraexObservedPid();
+    const ownedRollouts = pid ? findTraexRolloutSetByPid(pid) : undefined;
+    const owned = traexHistorySidIsOwned(cliSessionId, ownedRollouts);
+    if (!owned) {
+        log(`TRAE session id ${cliSessionId} not owned by pid ${pid ?? '?'} (open rollouts: ${ownedRollouts ? [...ownedRollouts].join(',') || 'none' : 'unknown'})`);
+    }
+    return owned;
+}
 /** Called from flushPending after writeInput first returns a cliSessionId.
  *  Tries to locate the rollout file immediately; if it's not on disk yet,
  *  remembers the sid so the 1s poller can keep retrying. */
@@ -3863,6 +3931,15 @@ function codexBridgeNotifyCliSessionId(cliSessionId) {
             const currentSid = codexSessionIdFromRolloutPath(codexBridgeRolloutPath);
             if (currentSid && currentSid.toLowerCase() === cliSessionId.toLowerCase())
                 return;
+            // Ownership gate: the reported id came from the GLOBAL history.jsonl, so a
+            // sibling pane's identical text (e.g. a bare adopt-mode reply with no
+            // unique <session_id>) could surface a foreign id. Only rotate the bridge
+            // to a rollout THIS pid holds open; otherwise keep the current binding
+            // (fail closed on unknown/unowned). Mirrors the codex branch above.
+            if (!traexHistorySidOwnedByCurrentPid(cliSessionId)) {
+                log(`Keeping current TRAE bridge ${currentSid ?? '?'} — refusing history-only re-attach to ${cliSessionId}`);
+                return;
+            }
             const next = resolveFileBridgePath('traex', { sessionId: cliSessionId });
             // Close any terminal already committed to the retired rollout before
             // switching. A durable turn is a worker HOL barrier, so a legitimate
@@ -3982,6 +4059,19 @@ function codexBridgeNotifyCliSessionId(cliSessionId) {
             return;
         }
     }
+    // TRAE INITIAL attach: same shared-history.jsonl hazard as codex above. The
+    // TRAE adapter only returns an owned sid, but keep a defense-in-depth gate so
+    // a foreign sid from any other path can't first-attach the bridge in adopt
+    // mode. Fail closed identically: keep the poller armed on the adopt pid rather
+    // than pinning an unverified sid (which would wedge the bridge).
+    if (structuredBridgeIsTraex() && lastInitConfig?.adoptMode && currentTraexObservedPid()) {
+        if (!traexHistorySidOwnedByCurrentPid(cliSessionId)) {
+            log(`TRAE initial-attach refused for unverified session ${cliSessionId}; keeping poller armed on pid ${currentTraexObservedPid()}`);
+            codexBridgePendingSessionId = undefined;
+            codexBridgeStartTimer();
+            return;
+        }
+    }
     const path = resolveFileBridgePath(lastInitConfig?.cliId, {
         sessionId: cliSessionId,
         cwd: lastInitConfig?.workingDir,
@@ -6441,6 +6531,8 @@ async function flushPending() {
     // backend's idle/task-done callback) write across that restart boundary.
     if (cliRestartInProgress)
         return;
+    if (initialInputOwnershipPending)
+        return;
     if (shouldHoldCodexRunnerInput(codexRunnerFreshness))
         return;
     if (isFlushing)
@@ -6845,8 +6937,6 @@ async function flushPending() {
     }
 }
 function sendToPty(content, turnId, opts = {}) {
-    if (!cliAdapter)
-        return false;
     const next = {
         content,
         turnId,
@@ -6865,6 +6955,8 @@ function sendToPty(content, turnId, opts = {}) {
         log(`Queued message while CLI backend is restarting (${pendingMessages.length} pending)`);
         return true;
     }
+    if (!cliAdapter)
+        return false;
     const supportsTypeAhead = pendingInputAllowsTypeAhead(cliAdapter.supportsTypeAhead === true, durableTurnInFlight, next);
     const shouldMergeQueued = opts.dispatchAttempt === undefined && !durableTurnInFlight
         && !isFlushing && !shouldWriteNow({
@@ -7194,8 +7286,18 @@ function setupAdoptInputAdapter(cfg) {
         cliAdapter = createCliAdapterSync(cfg.cliId, cfg.cliPathOverride);
     }
 }
+function wireIdleDetectorBusyTransition(detector, label) {
+    detector.onBusy(() => {
+        if (!isPromptReady)
+            return;
+        isPromptReady = false;
+        log(`Explicit busy marker detected — ${label}`);
+        publishScreenStatus('working', { force: true });
+    });
+}
 function setupAdoptIdleDetection(cfg, label) {
     idleDetector = new IdleDetector(adoptIdleAdapter(cfg));
+    wireIdleDetectorBusyTransition(idleDetector, `${label} adopt mode`);
     idleDetector.onIdle(() => {
         if (backend && deferPromptReadyWhileBusy(`${label} adopt-idle`, backend))
             return;
@@ -9360,17 +9462,63 @@ async function spawnCli(cfg, opts = {}) {
         startWrapperRealPidResolve(cliPid);
     if (cliPid)
         observeCursorCliSessionId(cliPid);
+    // File sandbox / Linux credential-only bwrap launches `bwrap --unshare-pid --
+    // traex`, so the pane leaf (getChildPid) is the bwrap SUPERVISOR — its
+    // /proc/<pid>/fd holds no rollout and the TRAE ownership gate can never admit
+    // a session id (fresh sandbox TRAE then never captures its SID, the bridge
+    // never attaches, and because reliableTurnTerminal disables screen-idle the
+    // durable turn can wedge — it does NOT self-heal). The real traex leaf is
+    // host-visible across the pid ns (ps -A ppid links), so BFS-descend to it and
+    // rewire backend.cliPid. Bounded retry (not one-shot): bwrap may not have
+    // forked traex yet at spawn. Reuses scheduleWrapperRealCliPid's stale-backend
+    // guard so a mid-retry worker restart can't rewire the new session. Gated on
+    // outerBwrapActive — sandboxRequested OR the Linux credential-only bwrap path,
+    // both of which produce an outer supervisor pid. */
+    const outerBwrapActive = sandboxRequested || credentialOnlyBwrap;
+    lastSpawnOuterBwrapActive = outerBwrapActive;
+    const startTraexSandboxPidResolve = (launcherPid) => {
+        if (cfg.cliId !== 'traex' || !outerBwrapActive)
+            return;
+        scheduleWrapperRealCliPid(launcherPid, {
+            findRealPid: (lp) => findLaunchedCliPid(lp, 'traex'),
+            getBackend: () => backend,
+            getChildPid: () => backend?.getChildPid?.(),
+            applyRealPid: (realPid) => {
+                log(`TRAE sandbox: resolved real traex leaf pid ${realPid} under bwrap supervisor ${launcherPid}; rewiring ownership pid`);
+                backend.cliPid = realPid;
+                backend.cliCwd = cfg.workingDir;
+                publishLocalProcessAttestation(realPid);
+            },
+            schedule: (fn, ms) => { setTimeout(fn, ms); },
+        });
+    };
     // Wire pid + cwd so adapters' writeInput can bind submits to this process:
     //   - claude-code: ~/.claude/sessions/<pid>.json
     //   - grok: findGrokSessionByPid → preferSessionId against shared
     //     prompt_history (concurrent same-cwd workers must not cross-claim)
+    //   - traex: findTraexRolloutSetByPid → ownership gate for the shared global
+    //     history.jsonl (concurrent same-TRAE_HOME panes must not cross-claim a
+    //     sibling's session id from an identical-text submit). getChildPid() is
+    //     normally the traex process itself, EXCEPT under the file sandbox: bwrap
+    //     runs `--unshare-pid -- traex`, so the pane leaf is the bwrap supervisor
+    //     and /proc/<bwrap>/fd holds no rollout. resolveTraexOwnershipPid() BFS-
+    //     descends to the real traex leaf (host-visible across the pid ns via
+    //     `ps -A` ppid links) so the ownership gate can actually admit the id;
+    //     it fails closed to the launcher pid when no leaf is found yet (the async
+    //     retry below re-resolves once bwrap has forked traex).
+    //   - reasonix: identify the lease owned by this process tree
     // Claude's sessionId is set ONCE at process start (2.1.123); a `--resume`
     // lookup will surface here, but in-pane `/clear` won't. The pinned
     // claudeJsonlPath above is still the initial guess; the resolver corrects
     // it on first write when Claude was started with `--resume`.
-    if (cliPid && (claudeDataDir || cfg.cliId === 'grok')) {
-        backend.cliPid = cliPid;
+    if (cliPid && (claudeDataDir || cfg.cliId === 'grok' || cfg.cliId === 'traex' || cfg.cliId === 'reasonix')) {
+        // TRAE under outer bwrap: best-effort immediate resolve (leaf may already be
+        // forked), then a bounded retry below covers the not-yet-forked case.
+        const wiredPid = cfg.cliId === 'traex' ? resolveTraexOwnershipPid(cliPid, outerBwrapActive) : cliPid;
+        backend.cliPid = wiredPid;
         backend.cliCwd = cfg.workingDir;
+        if (cfg.cliId === 'traex' && outerBwrapActive)
+            startTraexSandboxPidResolve(cliPid);
     }
     // Async pid fallback: tmux/pty resolve the CLI pid synchronously above, but
     // zellij's CLI subprocess starts AFTER spawn() returns (the zellij server
@@ -9399,9 +9547,12 @@ async function spawnCli(cfg, opts = {}) {
                         log(`Failed to write CLI PID marker (async): ${err.message}`);
                     }
                 }
-                if (claudeDataDir || cfg.cliId === 'grok') {
-                    backend.cliPid = pid;
+                if (claudeDataDir || cfg.cliId === 'grok' || cfg.cliId === 'traex' || cfg.cliId === 'reasonix') {
+                    const wiredPid = cfg.cliId === 'traex' ? resolveTraexOwnershipPid(pid, outerBwrapActive) : pid;
+                    backend.cliPid = wiredPid;
                     backend.cliCwd = cfg.workingDir;
+                    if (cfg.cliId === 'traex' && outerBwrapActive)
+                        startTraexSandboxPidResolve(pid);
                 }
                 // wrapperCli under a late-pid backend (zellij): `pid` here is still the
                 // LAUNCHER. Kick the descendant resolver so the bridge gets the real CLI
@@ -9628,6 +9779,7 @@ async function spawnCli(cfg, opts = {}) {
     // quiescence, repeatedly triggering markPromptReady() and duplicate cards.
     if (effectiveBackendType !== 'riff') {
         idleDetector = new IdleDetector(cliAdapter);
+        wireIdleDetectorBusyTransition(idleDetector, `${cliName()} PTY`);
         idleDetector.onIdle(async (evidenceSource) => {
             log('Prompt detected (idle)');
             // Snapshot-only backends (ZMX) must complete one authoritative refresh
@@ -11401,8 +11553,23 @@ function send(msg) {
     process.send?.(payload);
 }
 function acknowledgeTurnInputCommitted(turnId) {
+    if (!turnId)
+        return;
+    ordinaryImTurnDedupe.commit(turnId);
+    send({ type: 'turn_input_committed', turnId });
+}
+function acknowledgeTurnInputReceived(turnId) {
     if (turnId)
-        send({ type: 'turn_input_committed', turnId });
+        send({ type: 'turn_input_received', turnId });
+}
+function receiveOrdinaryImTurn(turnId) {
+    const state = ordinaryImTurnDedupe.begin(turnId);
+    acknowledgeTurnInputReceived(turnId);
+    return state;
+}
+function rejectOrdinaryImTurn(turnId, reason) {
+    ordinaryImTurnDedupe.release(turnId);
+    send({ type: 'turn_input_rejected', turnId, reason });
 }
 function publishLocalProcessAttestation(cliPid) {
     const cliProcStart = cliPid ? readProcessStartIdentity(cliPid) : undefined;
@@ -11492,9 +11659,44 @@ process.on('message', async (raw) => {
     switch (msg.type) {
         case 'init': {
             const initStartedAtMs = Date.now();
-            if (lastInitConfig)
-                return; // already initialized
+            const ordinaryImTurnId = !msg.adoptMode
+                && msg.dispatchAttempt === undefined
+                && !!msg.prompt
+                && msg.turnId?.startsWith('om_')
+                ? msg.turnId
+                : undefined;
+            if (lastInitConfig) {
+                // Only an exact retry of this generation's init may be acknowledged.
+                // A different init is still rejected as an invalid re-initialization.
+                if (ordinaryImTurnId && lastInitConfig.turnId === ordinaryImTurnId) {
+                    const duplicateState = receiveOrdinaryImTurn(ordinaryImTurnId);
+                    if (duplicateState === 'committed') {
+                        log(`Re-ACKing committed duplicate init turn ${ordinaryImTurnId.substring(0, 16)}`);
+                        acknowledgeTurnInputCommitted(ordinaryImTurnId);
+                    }
+                    else {
+                        log(`Re-ACKing received duplicate init turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    }
+                }
+                return;
+            }
+            if (ordinaryImTurnId) {
+                const duplicateState = receiveOrdinaryImTurn(ordinaryImTurnId);
+                // Receipt is the daemon ↔ worker transport boundary. Publish it before
+                // startup work can await a slow backend, plugin gateway, or Codex
+                // metadata read. The later committed ACK keeps its existing meaning.
+                if (duplicateState === 'committed') {
+                    log(`Re-ACKing committed duplicate init turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    acknowledgeTurnInputCommitted(ordinaryImTurnId);
+                    break;
+                }
+                if (duplicateState === 'inflight') {
+                    log(`Re-ACKing received duplicate init turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    break;
+                }
+            }
             lastInitConfig = msg;
+            initialInputOwnershipPending = !!msg.prompt;
             activeRestartAttemptId = msg.restartAttemptId;
             sessionId = msg.sessionId;
             refreshTerminalViewToken();
@@ -11649,7 +11851,10 @@ process.on('message', async (raw) => {
                     passesInitialPromptViaArgs: cliAdapter?.passesInitialPromptViaArgs === true,
                     deferInitialPrompt,
                 })) {
-                    pendingMessages.push({
+                    // Follow-up IPC handlers can run while this async init is awaiting
+                    // backend startup. They queue safely behind !backend above, but the
+                    // original init prompt must remain first in logical turn order.
+                    pendingMessages.unshift({
                         content: lastSpawnQueuedInitialPrompt ?? msg.prompt,
                         ...(lastSpawnQueuedInitialPromptLogicalContent
                             ? { logicalContent: lastSpawnQueuedInitialPromptLogicalContent }
@@ -11666,6 +11871,10 @@ process.on('message', async (raw) => {
                     // it into argv or the RPC engine already accepted it.
                     initialInputCommitted = true;
                 }
+                // The first turn is now either at queue head or already owned by the
+                // argv/RPC startup path. Only now may an early idle edge drain
+                // follow-ups that arrived while init was awaiting slow startup work.
+                initialInputOwnershipPending = false;
                 if (initialInputCommitted)
                     acknowledgeTurnInputCommitted(msg.turnId);
                 // A backend may become prompt-ready before spawnCli() returns. The
@@ -11692,6 +11901,7 @@ process.on('message', async (raw) => {
                 });
             }
             catch (err) {
+                initialInputOwnershipPending = false;
                 await sendFatalWorkerErrorAndExit(err);
                 return;
             }
@@ -11699,6 +11909,25 @@ process.on('message', async (raw) => {
         }
         case 'message': {
             const messageAdoptMode = lastInitConfig?.adoptMode === true;
+            const ordinaryImTurnId = !messageAdoptMode
+                && msg.dispatchAttempt === undefined
+                && msg.turnId?.startsWith('om_')
+                ? msg.turnId
+                : undefined;
+            if (ordinaryImTurnId) {
+                const duplicateState = receiveOrdinaryImTurn(ordinaryImTurnId);
+                // ACK process ownership synchronously, before crash recovery or any
+                // other awaited work. Actual queue ownership remains committed below.
+                if (duplicateState === 'committed') {
+                    log(`Re-ACKing committed duplicate IM turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    acknowledgeTurnInputCommitted(ordinaryImTurnId);
+                    break;
+                }
+                if (duplicateState === 'inflight') {
+                    log(`Re-ACKing received duplicate IM turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    break;
+                }
+            }
             // Adopt IPC handlers can overlap. Delay their turn baseline until the
             // submission mutex is held so a queued message cannot steal attribution
             // from the write/verification already in flight.
@@ -11746,6 +11975,8 @@ process.on('message', async (raw) => {
                     await prepareCodexNativeTitleGeneration(restartCfg, codexRpcEngine);
                 }
                 catch (err) {
+                    if (ordinaryImTurnId)
+                        ordinaryImTurnDedupe.release(ordinaryImTurnId);
                     // Pass the message's own attempt (not the stale currentBotmux* from a
                     // prior IM turn) so a durable delivery relaunch failure carries the
                     // right attribution for the daemon's receipt/lease gate.
@@ -11936,6 +12167,8 @@ process.on('message', async (raw) => {
                 });
                 if (inputCommitted)
                     acknowledgeTurnInputCommitted(msg.turnId);
+                else if (ordinaryImTurnId)
+                    rejectOrdinaryImTurn(ordinaryImTurnId, 'cli_input_unavailable');
             }
             break;
         }
@@ -12383,6 +12616,13 @@ process.on('message', async (raw) => {
             killCli({ preserveSandbox: true });
             cleanup();
             await flushTransferDetachAck(msg.requestId);
+            // NOTE: process.exit(0) can wedge in node-pty's native teardown when a
+            // web-terminal client PTY was attached (the reader-thread join blocks and
+            // the JS event loop is already stopped, so this process cannot self-kill
+            // via a timer). killCli() above already detached the observer and the ACK
+            // just flushed, so the daemon force-kills this now-disposable process
+            // shortly after the ACK (see detachWorkerForTransfer's post-ACK kill).
+            // We still request a clean exit; the daemon SIGKILL is the hard backstop.
             process.exit(0);
         }
         case 'suspend': {