claude-slack-channel-bots 0.8.0 → 0.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-slack-channel-bots",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Multi-session Slack-to-Claude bridge — run multiple Claude Code bots across Slack channels via Socket Mode",
   "type": "module",
   "bin": {

package/src/session-manager.ts

@@ -31,6 +31,8 @@ import {
   ErrNoSessionId,
   ErrSpawnNotFound,
   ErrSpawnNotResumable,
+  ErrTmuxSendKeys,
+  ErrTmuxSessionCreate,
 } from 'agent-director'
 import type { ListRow, SpawnParams } from 'agent-director'
 import type { WebClient } from '@slack/web-api'
@@ -179,9 +181,50 @@ export function flushSpawnFailureQueue(web: WebClient): void {
 // reconnectMcp — send `/mcp reconnect <server-name>` via library sendKeys
 // ---------------------------------------------------------------------------
 
+/**
+ * Ensure a tmux server exists on the default socket. Injectable seam so unit
+ * tests can assert the b.rmy self-heal path without spawning real processes.
+ * Default impl runs `tmux start-server` best-effort — never throws.
+ *
+ * b.rmy: after a container restart, /tmp (and thus the tmux socket) is wiped
+ * and nothing auto-starts tmux at boot, so every startup reconnect fails with
+ * `ErrTmuxSendKeys` ("no server running"). Starting the server before a retry
+ * gives the reconnect a chance to succeed instead of failing terminally.
+ */
+export type TmuxServerEnsurer = () => Promise<void>
+
+const defaultEnsureTmuxServer: TmuxServerEnsurer = async (): Promise<void> => {
+  const { spawn } = await import('child_process')
+  await new Promise<void>((resolve) => {
+    try {
+      const child = spawn('tmux', ['start-server'], { stdio: 'ignore' })
+      child.on('error', () => resolve()) // tmux missing — best-effort
+      child.on('close', () => resolve())
+    } catch {
+      resolve()
+    }
+  })
+}
+
+let _ensureTmuxServer: TmuxServerEnsurer = defaultEnsureTmuxServer
+
+/** Test-only seam: override the tmux-server ensurer. */
+export function _setTmuxServerEnsurer(fn: TmuxServerEnsurer): void {
+  _ensureTmuxServer = fn
+}
+
+/** Test-only seam: restore the default tmux-server ensurer. */
+export function _resetTmuxServerEnsurer(): void {
+  _ensureTmuxServer = defaultEnsureTmuxServer
+}
+
 /**
  * Send `/mcp reconnect <MCP_SERVER_NAME>` to the spawn's pane. Library's
  * sendKeys appends Enter automatically per its contract.
+ *
+ * b.rmy self-heal: on `ErrTmuxSendKeys` (no tmux server / session — the
+ * post-reboot field failure), ensure a tmux server exists and retry the
+ * send-keys ONCE. The retry's outcome is the returned outcome.
  */
 export async function reconnectMcp(
   channelId: string,
@@ -190,14 +233,33 @@ export async function reconnectMcp(
 ): Promise<boolean> {
   const claude_instance_id = instanceIdFor(channelId, routingConfig?.routes[channelId]?.normalizedName)
   console.error(`[slack] reconnecting MCP server "${MCP_SERVER_NAME}": channel=${channelId}`)
-  try {
-    await withOutageDetection(channelId, undefined, (client) => client.sendKeys({
+  const sendReconnect = (): Promise<unknown> =>
+    withOutageDetection(channelId, undefined, (client) => client.sendKeys({
       claude_instance_id,
       text: `/mcp reconnect ${MCP_SERVER_NAME}`,
     }))
+  try {
+    await sendReconnect()
     return true
   } catch (err) {
     if (err instanceof ErrSystemInstallDisappeared || err instanceof ErrTmuxNotAvailable) return false
+    if (err instanceof ErrTmuxSendKeys) {
+      console.error(
+        `[slack] reconnectMcp: ErrTmuxSendKeys for channel=${channelId} — ensuring tmux server exists and retrying send-keys once`,
+      )
+      await _ensureTmuxServer()
+      try {
+        await sendReconnect()
+        console.error(`[slack] reconnectMcp: retry succeeded after ErrTmuxSendKeys for channel=${channelId}`)
+        return true
+      } catch (err2) {
+        if (err2 instanceof ErrSystemInstallDisappeared || err2 instanceof ErrTmuxNotAvailable) return false
+        const e2 = err2 instanceof AgentDirectorError ? err2 : new AgentDirectorError('send-keys', 'UnknownError', String(err2))
+        console.error(`[slack] reconnectMcp: retry after ErrTmuxSendKeys failed for channel=${channelId}: ${e2.errName}`)
+        postSpawnFailureToChannel(channelId, e2, web)
+        return false
+      }
+    }
     const e = err instanceof AgentDirectorError ? err : new AgentDirectorError('send-keys', 'UnknownError', String(err))
     console.error(`[slack] reconnectMcp: send-keys failed for channel=${channelId}: ${e.errName}`)
     postSpawnFailureToChannel(channelId, e, web)
@@ -206,7 +268,7 @@ export async function reconnectMcp(
 }
 
 // ---------------------------------------------------------------------------
-// approveDevChannelsDialog — auto-approve the dev-channels warning on spawn
+// approvePreSessionDialogs — auto-approve pre-SessionStart dialogs on spawn
 // ---------------------------------------------------------------------------
 
 /**
@@ -216,19 +278,19 @@ export async function reconnectMcp(
  */
 export const DEV_CHANNELS_DIALOG_NEEDLE = 'I am using this for local development'
 
-/** Default poll interval while watching for the dev-channels dialog. */
-export const DIALOG_POLL_INTERVAL_MS = 500
-
-/** Default deadline for both the appearance poll and the still-visible poll. */
-export const DIALOG_POLL_TIMEOUT_MS = 30_000
+/**
+ * Verified against Claude Code 2.1.120 (2026-06-02). If this stops matching,
+ * the folder-trust dialog has drifted — see b.k54 / b.uhv. Match the option
+ * label (semantic, stable) rather than the header (cosmetic, drifts).
+ */
+export const TRUST_DIALOG_NEEDLE = 'Yes, I trust this folder'
 
-/** Number of consecutive "needle absent" reads required to confirm approval. */
-export const DIALOG_GONE_CONFIRMS_REQUIRED = 2
+/** Default poll interval while watching for pre-session dialogs. */
+export const DIALOG_POLL_INTERVAL_MS = 500
 
 let _dialogPollIntervalMs = DIALOG_POLL_INTERVAL_MS
-let _dialogPollTimeoutMs = DIALOG_POLL_TIMEOUT_MS
 
-/** Test-only seam: override the dev-channels poll interval. */
+/** Test-only seam: override the dialog poll interval. */
 export function _setDialogPollIntervalMs(ms: number): void {
   _dialogPollIntervalMs = ms
 }
@@ -238,182 +300,256 @@ export function _resetDialogPollIntervalMs(): void {
   _dialogPollIntervalMs = DIALOG_POLL_INTERVAL_MS
 }
 
-/** Test-only seam: override the dev-channels poll timeout. */
-export function _setDialogPollTimeoutMs(ms: number): void {
-  _dialogPollTimeoutMs = ms
+/** Hard cap: how long to wait for a fresh spawn to leave `pending` (reach a
+ *  live SessionStart state) while auto-dismissing pre-session dialogs. */
+export const DIALOG_READY_TIMEOUT_MS = 5 * 60_000
+
+let _dialogReadyTimeoutMs = DIALOG_READY_TIMEOUT_MS
+
+/** Test-only seam: override the ready cap. */
+export function _setDialogReadyTimeoutMs(ms: number): void {
+  _dialogReadyTimeoutMs = ms
 }
 
-/** Test-only seam: restore the default poll timeout. */
-export function _resetDialogPollTimeoutMs(): void {
-  _dialogPollTimeoutMs = DIALOG_POLL_TIMEOUT_MS
+/** Test-only seam: restore the default ready cap. */
+export function _resetDialogReadyTimeoutMs(): void {
+  _dialogReadyTimeoutMs = DIALOG_READY_TIMEOUT_MS
 }
 
+// ---------------------------------------------------------------------------
+// Raw-tmux dialog fallback (b.vub) — bypass agent-director when the row is in
+// a non-interactive state (missing/ended) but the pane still shows the dialog.
+// ---------------------------------------------------------------------------
+
 /**
- * Poll the freshly-spawned bot's tmux pane until the dev-channels approval
- * dialog appears, send Enter to accept the pre-selected
- * "I am using this for local development" option, then confirm the dialog
- * has cleared. All errors caught locally — never throws to the caller.
+ * b.vub — the critical mechanism the ticket's manual mitigation used.
  *
- * readPane/sendKeys use `allow_pending: true` because the bot is still in
- * `pending` AD state when this runs (b.98w — formerly caused ErrSpawnNotInteractive).
+ * On the RESUME lap, `client.resume` re-creates the tmux session but the AD row
+ * stays `missing`/`ended` until SessionStart re-fires — and SessionStart can't
+ * fire because the dev-channels dialog blocks it. Crucially, agent-director's
+ * `read-pane` / `send-keys` REFUSE to touch a `missing`/`ended` row
+ * (`ErrSpawnNotInteractive`, even with allow_pending), so the approver cannot
+ * clear the dialog through AD. A raw `tmux capture-pane` + `tmux send-keys …
+ * Enter` DOES clear it (verified against real AD/tmux; this is exactly the
+ * `tmux send-keys -t <session> Enter` the operator ran by hand in the ticket),
+ * after which AD flips to `waiting`.
  *
- * Two distinct failure modes are recorded via `recordStartupError` so a
- * future Claude Code release that changes the dialog cannot silently break
- * fresh-spawn approval:
- *   - `dev-channels-approve-no-dialog`   — needle never observed
- *   - `dev-channels-approve-still-visible` — needle persists after Enter
+ * These two seams shell out to tmux directly, keyed on the deterministic
+ * per-channel session name. Injectable so unit tests stay hermetic.
  */
-export async function approveDevChannelsDialog(
-  channelId: string,
-  web: WebClient | undefined,
-  isStartup: boolean,
-  normalizedName?: string,
-): Promise<void> {
-  void web
-  const claude_instance_id = instanceIdFor(channelId, normalizedName)
-  const deadline = Date.now() + _dialogPollTimeoutMs
+export type TmuxPaneReader = (sessionName: string) => Promise<string>
+export type TmuxEnterSender = (sessionName: string) => Promise<void>
 
-  let approved = false
-  while (Date.now() < deadline) {
-    try {
-      const { pane } = await withOutageDetection(channelId, undefined, (client) => client.readPane({ claude_instance_id, n_lines: 40, allow_pending: true }))
-      if (pane.includes(DEV_CHANNELS_DIALOG_NEEDLE)) {
-        await withOutageDetection(channelId, undefined, (client) => client.sendKeys({ claude_instance_id, text: '', allow_pending: true }))
-        approved = true
-        break
+function defaultTmuxCapturePane(sessionName: string): Promise<string> {
+  return (async () => {
+    const { spawn } = await import('child_process')
+    return await new Promise<string>((resolve) => {
+      try {
+        const child = spawn('tmux', ['capture-pane', '-p', '-t', sessionName])
+        let out = ''
+        child.stdout?.on('data', (d: Buffer) => { out += d.toString('utf8') })
+        child.on('error', () => resolve(''))
+        child.on('close', () => resolve(out))
+      } catch {
+        resolve('')
       }
-    } catch (err) {
-      if (err instanceof ErrSystemInstallDisappeared || err instanceof ErrTmuxNotAvailable) {
-        // Outage flag raised; continue polling
-      } else {
-        console.error(`[slack] approveDevChannelsDialog: readPane error channel=${channelId}: ${String(err)}`)
+    })
+  })()
+}
+
+function defaultTmuxSendEnter(sessionName: string): Promise<void> {
+  return (async () => {
+    const { spawn } = await import('child_process')
+    await new Promise<void>((resolve) => {
+      try {
+        const child = spawn('tmux', ['send-keys', '-t', sessionName, 'Enter'], { stdio: 'ignore' })
+        child.on('error', () => resolve())
+        child.on('close', () => resolve())
+      } catch {
+        resolve()
       }
-    }
-    await new Promise((r) => setTimeout(r, _dialogPollIntervalMs))
-  }
+    })
+  })()
+}
 
-  if (!approved) {
-    const msg = `dev-channels dialog never appeared for channel=${channelId} within ${_dialogPollTimeoutMs}ms (dialog text may have drifted — see b.yy6)`
-    console.error(`[slack] approveDevChannelsDialog: ${msg}`)
-    if (isStartup) recordStartupError('dev-channels-approve-no-dialog', msg)
-    return
-  }
+let _tmuxCapturePane: TmuxPaneReader = defaultTmuxCapturePane
+let _tmuxSendEnter: TmuxEnterSender = defaultTmuxSendEnter
 
-  let misses = 0
-  while (Date.now() < deadline && misses < DIALOG_GONE_CONFIRMS_REQUIRED) {
-    await new Promise((r) => setTimeout(r, _dialogPollIntervalMs))
-    try {
-      const { pane } = await withOutageDetection(channelId, undefined, (client) => client.readPane({ claude_instance_id, n_lines: 40, allow_pending: true }))
-      misses = pane.includes(DEV_CHANNELS_DIALOG_NEEDLE) ? 0 : misses + 1
-    } catch {
-      /* tolerate transient readPane failure */
-    }
-  }
-  if (misses < DIALOG_GONE_CONFIRMS_REQUIRED) {
-    const msg = `dev-channels dialog still visible after Enter for channel=${channelId} (sendKeys may not have reached pane)`
-    console.error(`[slack] approveDevChannelsDialog: ${msg}`)
-    if (isStartup) recordStartupError('dev-channels-approve-still-visible', msg)
-  }
+/** Test-only seam: override the raw tmux pane reader. */
+export function _setTmuxCapturePane(fn: TmuxPaneReader): void {
+  _tmuxCapturePane = fn
+}
+/** Test-only seam: override the raw tmux Enter sender. */
+export function _setTmuxSendEnter(fn: TmuxEnterSender): void {
+  _tmuxSendEnter = fn
+}
+/** Test-only seam: restore the default raw tmux helpers. */
+export function _resetTmuxDialogHelpers(): void {
+  _tmuxCapturePane = defaultTmuxCapturePane
+  _tmuxSendEnter = defaultTmuxSendEnter
 }
 
-// ---------------------------------------------------------------------------
-// approveTrustFolderDialog — auto-approve the folder-trust dialog on spawn
-// ---------------------------------------------------------------------------
+/** Live (post-SessionStart) states: the dialog is gone, the session is ready. */
+const DIALOG_READY_STATES = new Set(['waiting', 'working', 'ask_user', 'check_permission'])
+/** Terminal states: the spawn died before becoming ready. */
+const DIALOG_DEAD_STATES = new Set(['ended', 'missing'])
+/** Every pre-SessionStart dialog we can auto-approve (option 1 pre-selected; Enter accepts). */
+const PRE_SESSION_DIALOG_NEEDLES = [TRUST_DIALOG_NEEDLE, DEV_CHANNELS_DIALOG_NEEDLE]
 
 /**
- * Verified against Claude Code 2.1.120 (2026-06-02). If this stops matching,
- * the folder-trust dialog has drifted — see b.k54 / b.uhv. Match the option
- * label (semantic, stable) rather than the header (cosmetic, drifts).
+ * b.vub: consecutive dead-state-with-no-needle polls required before treating a
+ * spawn as genuinely dead. A freshly resumed (or freshly spawned) row is
+ * legitimately `missing`/`ended` for a brief window: after `client.resume`, the
+ * tmux pane needs a moment to render the dev-channels dialog, and AD keeps
+ * reporting the prior terminal state until SessionStart re-fires. Bailing on the
+ * FIRST such poll (as the pre-b.vub code did) races the dialog and re-hangs the
+ * resume. Requiring a short grace streak lets the dialog appear (needle → Enter,
+ * which resets the streak) while still fast-failing a truly dead spawn without
+ * waiting the full 5-minute cap. Reset to 0 on any live state or needle sighting.
  */
-export const TRUST_DIALOG_NEEDLE = 'Yes, I trust this folder'
+export const DIALOG_DEAD_GRACE_POLLS = 20
 
-let _trustDialogPollIntervalMs = DIALOG_POLL_INTERVAL_MS
-let _trustDialogPollTimeoutMs = DIALOG_POLL_TIMEOUT_MS
-
-/** Test-only seam: override the trust-folder poll interval. */
-export function _setTrustDialogPollIntervalMs(ms: number): void {
-  _trustDialogPollIntervalMs = ms
-}
+let _dialogDeadGracePolls = DIALOG_DEAD_GRACE_POLLS
 
-/** Test-only seam: restore the default trust-folder poll interval. */
-export function _resetTrustDialogPollIntervalMs(): void {
-  _trustDialogPollIntervalMs = DIALOG_POLL_INTERVAL_MS
+/** Test-only seam: override the dead-state grace streak. */
+export function _setDialogDeadGracePolls(n: number): void {
+  _dialogDeadGracePolls = n
 }
 
-/** Test-only seam: override the trust-folder poll timeout. */
-export function _setTrustDialogPollTimeoutMs(ms: number): void {
-  _trustDialogPollTimeoutMs = ms
-}
-
-/** Test-only seam: restore the default trust-folder poll timeout. */
-export function _resetTrustDialogPollTimeoutMs(): void {
-  _trustDialogPollTimeoutMs = DIALOG_POLL_TIMEOUT_MS
+/** Test-only seam: restore the default dead-state grace streak. */
+export function _resetDialogDeadGracePolls(): void {
+  _dialogDeadGracePolls = DIALOG_DEAD_GRACE_POLLS
 }
 
 /**
- * Poll the freshly-spawned bot's tmux pane until the folder-trust dialog
- * appears, send Enter to accept the pre-selected "Yes, I trust this folder"
- * option, then confirm the dialog has cleared. All errors caught locally —
- * never throws to the caller.
+ * Drive a freshly-spawned bot past its pre-SessionStart dialogs (folder-trust
+ * and/or dev-channels) by watching agent-director's state machine: while the
+ * spawn is `pending` (SessionStart not yet fired — a dialog may be blocking),
+ * poll the pane and press Enter whenever a known dialog needle is on screen.
+ * Exit the instant AD reports a live state (the dialog is gone). 5-minute hard
+ * cap; failure to reach ready is surfaced loudly — never a silent early quit.
+ *
+ * status/readPane/sendKeys are wrapped in withOutageDetection so AD-outage
+ * flags keep working (b.en2). readPane/sendKeys use allow_pending:true because
+ * the bot is `pending` here (b.98w). The needle-gate guarantees Enter is sent
+ * ONLY when a dialog is actually displayed, so we never inject a stray Enter
+ * into a live prompt. Uses the composed instance id (b.ben).
  *
- * readPane/sendKeys use `allow_pending: true` because the bot is still in
- * `pending` AD state when this runs (b.98w).
+ * Replaces the former two-function pair (trust-folder + dev-channels approvers):
+ * one loop from spawn+0 (no wasted 30s trust window) that self-heals a missed
+ * Enter (state stays pending, needle reappears, next iteration presses again)
+ * and never gives up silently at 30s.
  *
- * Divergence from `approveDevChannelsDialog`: if the needle never appears
- * within the timeout, return silently (expected happy path once Fix A is in
- * place — no `recordStartupError`). Only record an error when the needle
- * persists after Enter:
- *   - `trust-folder-approve-still-visible` — needle persists after Enter
+ * b.vub: pane-first / state-tolerant, with a RAW-TMUX fallback for dead rows.
+ * A *resumed* bot faces the same `--dangerously-load-development-channels`
+ * dialog, but its AD row is `missing`/`ended` from the prior life while it sits
+ * blocked at the dialog (SessionStart never re-fires). Two compounding facts the
+ * pre-b.vub code missed: (1) it early-returned on DIALOG_DEAD_STATES before ever
+ * reading the pane; (2) even if it had tried, agent-director's read-pane/
+ * send-keys REFUSE a `missing`/`ended` row (ErrSpawnNotInteractive), so the
+ * dialog can only be cleared by talking to tmux directly. Fix: within the
+ * pre-SessionStart window, for a dead row read+Enter via raw tmux (keyed on the
+ * deterministic session name), for a pending row via AD; press Enter whenever a
+ * needle is visible regardless of AD state; treat missing/ended as terminal only
+ * after a short no-needle grace streak (DIALOG_DEAD_GRACE_POLLS), tolerating the
+ * brief post-resume window before the dialog renders. Still needle-gated (no
+ * stray Enter into a live session) and bounded by the hard cap.
  */
-export async function approveTrustFolderDialog(
+export async function approvePreSessionDialogs(
   channelId: string,
   web: WebClient | undefined,
   isStartup: boolean,
   normalizedName?: string,
 ): Promise<void> {
-  void web
   const claude_instance_id = instanceIdFor(channelId, normalizedName)
-  const deadline = Date.now() + _trustDialogPollTimeoutMs
+  const deadline = Date.now() + _dialogReadyTimeoutMs
+  let deadStreak = 0
 
-  let approved = false
   while (Date.now() < deadline) {
+    // 1) Readiness oracle.
+    let state: string
     try {
-      const { pane } = await withOutageDetection(channelId, undefined, (client) => client.readPane({ claude_instance_id, n_lines: 40, allow_pending: true }))
-      if (pane.includes(TRUST_DIALOG_NEEDLE)) {
-        await withOutageDetection(channelId, undefined, (client) => client.sendKeys({ claude_instance_id, text: '', allow_pending: true }))
-        approved = true
-        break
-      }
+      const r = await withOutageDetection(channelId, undefined, (client) => client.status({ claude_instance_id }))
+      state = r.state
     } catch (err) {
-      if (err instanceof ErrSystemInstallDisappeared || err instanceof ErrTmuxNotAvailable) {
-        // Outage flag raised; continue polling
-      } else {
-        console.error(`[slack] approveTrustFolderDialog: readPane error channel=${channelId}: ${String(err)}`)
+      if (err instanceof ErrSpawnNotFound) {
+        console.error(`[slack] approvePreSessionDialogs: spawn not found for channel=${channelId} — aborting`)
+        return
+      }
+      // Transient (incl. AD-outage errors already flagged by withOutageDetection) — keep polling.
+      console.error(`[slack] approvePreSessionDialogs: status error channel=${channelId}: ${String(err)}`)
+      await new Promise((r) => setTimeout(r, _dialogPollIntervalMs))
+      continue
+    }
+    if (DIALOG_READY_STATES.has(state)) return // dialog cleared, session live
+
+    // 2) Pane-first (b.vub): read the pane and dismiss any visible pre-session
+    // dialog BEFORE deciding whether a dead state is terminal.
+    //
+    // Two paths, because agent-director's read-pane/send-keys REFUSE a
+    // `missing`/`ended` row (ErrSpawnNotInteractive) even with allow_pending:
+    //   - Fresh spawn (state=pending): drive via AD read-pane/send-keys.
+    //   - Resumed row (state=missing/ended): AD won't touch the pane, but the
+    //     dialog IS on screen and blocking SessionStart. Fall back to RAW tmux
+    //     (capture-pane + send-keys Enter) keyed on the deterministic session
+    //     name — exactly the `tmux send-keys -t <session> Enter` the operator
+    //     ran by hand in the ticket. Once Enter lands, SessionStart fires and
+    //     AD flips to a live state on the next poll.
+    let needleVisible = false
+    if (DIALOG_DEAD_STATES.has(state)) {
+      // Raw-tmux fallback (agent-director cannot interact with a dead row).
+      const sessionName = tmuxSessionNameFor(channelId, normalizedName)
+      try {
+        const pane = await _tmuxCapturePane(sessionName)
+        needleVisible = PRE_SESSION_DIALOG_NEEDLES.some((n) => pane.includes(n))
+        if (needleVisible) {
+          await _tmuxSendEnter(sessionName)
+        }
+      } catch (err) {
+        console.error(`[slack] approvePreSessionDialogs: raw-tmux fallback error channel=${channelId}: ${String(err)}`)
+      }
+    } else {
+      // Interactive (pending) — drive via agent-director.
+      try {
+        const { pane } = await withOutageDetection(channelId, undefined, (client) => client.readPane({ claude_instance_id, n_lines: 40, allow_pending: true }))
+        needleVisible = PRE_SESSION_DIALOG_NEEDLES.some((n) => pane.includes(n))
+        if (needleVisible) {
+          await withOutageDetection(channelId, undefined, (client) => client.sendKeys({ claude_instance_id, text: '', allow_pending: true })) // Enter
+        }
+      } catch (err) {
+        console.error(`[slack] approvePreSessionDialogs: readPane/sendKeys error channel=${channelId}: ${String(err)}`)
       }
     }
-    await new Promise((r) => setTimeout(r, _trustDialogPollIntervalMs))
-  }
 
-  if (!approved) {
-    // Needle never appeared — silent return (expected happy path with Fix A)
-    return
-  }
-
-  let misses = 0
-  while (Date.now() < deadline && misses < DIALOG_GONE_CONFIRMS_REQUIRED) {
-    await new Promise((r) => setTimeout(r, _trustDialogPollIntervalMs))
-    try {
-      const { pane } = await withOutageDetection(channelId, undefined, (client) => client.readPane({ claude_instance_id, n_lines: 40, allow_pending: true }))
-      misses = pane.includes(TRUST_DIALOG_NEEDLE) ? 0 : misses + 1
-    } catch {
-      /* tolerate transient readPane failure */
+    // 3) Dead-state handling (b.vub). A needle means "dialog-blocked, not dead":
+    // reset the streak and keep pressing Enter. Only treat missing/ended as
+    // terminal after it persists with NO needle for DIALOG_DEAD_GRACE_POLLS
+    // consecutive polls — this tolerates the brief post-spawn/post-resume window
+    // where the row is still terminal and the pane hasn't rendered the dialog
+    // yet, without racing the dialog and re-hanging the resume.
+    if (needleVisible) {
+      deadStreak = 0
+    } else if (DIALOG_DEAD_STATES.has(state)) {
+      deadStreak += 1
+      if (deadStreak >= _dialogDeadGracePolls) {
+        const msg = `spawn reached ${state} before clearing dev-channels dialog for channel=${channelId} (no needle for ${deadStreak} polls)`
+        console.error(`[slack] approvePreSessionDialogs: ${msg}`)
+        if (isStartup) recordStartupError('dev-channels-approve-spawn-died', msg)
+        return
+      }
+    } else {
+      // pending (or any other non-dead, non-ready state) — reset the streak.
+      deadStreak = 0
     }
+
+    await new Promise((r) => setTimeout(r, _dialogPollIntervalMs))
   }
-  if (misses < DIALOG_GONE_CONFIRMS_REQUIRED) {
-    const msg = `trust-folder dialog still visible after Enter for channel=${channelId} (sendKeys may not have reached pane)`
-    console.error(`[slack] approveTrustFolderDialog: ${msg}`)
-    if (isStartup) recordStartupError('trust-folder-approve-still-visible', msg)
-  }
+
+  // 3) Hard cap hit — genuine failure, surfaced loudly (no silent give-up).
+  const msg = `spawn never reached a live state within ${_dialogReadyTimeoutMs}ms for channel=${channelId} — dialog unrecognized or session hung (dev-needle='${DEV_CHANNELS_DIALOG_NEEDLE}')`
+  console.error(`[slack] approvePreSessionDialogs: ${msg}`)
+  if (isStartup) recordStartupError('dev-channels-approve-not-ready', msg)
+  postSpawnFailureToChannel(channelId, new AgentDirectorError('status', 'DialogApprovalTimeout', msg), web, isStartup)
 }
 
 // ---------------------------------------------------------------------------
@@ -530,6 +666,78 @@ async function tryKill(channelId: string, normalizedName: string | undefined): P
   }
 }
 
+// ---------------------------------------------------------------------------
+// Orphan-tmux self-heal (b.vub)
+// ---------------------------------------------------------------------------
+
+/**
+ * Kill a tmux session by its exact name. Injectable seam so unit tests can
+ * assert the self-heal path without spawning real processes. Default impl
+ * runs `tmux kill-session -t <name>` best-effort.
+ *
+ * b.vub: the field failure is an orphan tmux session that survives the AD row
+ * going `missing` — the AD `client.kill` verb does NOT reap it (observed across
+ * dozens of restart cycles). Killing the session directly by its deterministic,
+ * per-channel name (`tmuxSessionNameFor`) is the only reliable reap, and the
+ * name can only ever belong to this channel's spawn, so it is safe.
+ */
+export type TmuxSessionKiller = (sessionName: string) => Promise<void>
+
+let _killTmuxSession: TmuxSessionKiller = async (sessionName: string): Promise<void> => {
+  const { spawn } = await import('child_process')
+  await new Promise<void>((resolve) => {
+    try {
+      const child = spawn('tmux', ['kill-session', '-t', sessionName], { stdio: 'ignore' })
+      child.on('error', () => resolve()) // tmux missing / session absent — best-effort
+      child.on('close', () => resolve())
+    } catch {
+      resolve()
+    }
+  })
+}
+
+/** Test-only seam: override the tmux-session killer. */
+export function _setTmuxSessionKiller(fn: TmuxSessionKiller): void {
+  _killTmuxSession = fn
+}
+
+/** Test-only seam: restore the default tmux-session killer. */
+export function _resetTmuxSessionKiller(): void {
+  _killTmuxSession = async (sessionName: string): Promise<void> => {
+    const { spawn } = await import('child_process')
+    await new Promise<void>((resolve) => {
+      try {
+        const child = spawn('tmux', ['kill-session', '-t', sessionName], { stdio: 'ignore' })
+        child.on('error', () => resolve())
+        child.on('close', () => resolve())
+      } catch {
+        resolve()
+      }
+    })
+  }
+}
+
+/**
+ * Self-heal an `ErrTmuxSessionCreate` collision (b.vub): the deterministic tmux
+ * session name is still held by an orphaned session while the AD row is
+ * terminal/gone, so a fresh spawn/resume cannot create the session. Kill the
+ * orphan by name, then retry `client.spawn` ONCE. Returns the spawn result on
+ * success, or rethrows the retry's error (caller surfaces it).
+ */
+async function selfHealTmuxCollisionAndRespawn(
+  channelId: string,
+  route: { cwd: string },
+  params: SpawnParams,
+  normalizedName: string | undefined,
+): Promise<{ claude_instance_id: string }> {
+  const sessionName = tmuxSessionNameFor(channelId, normalizedName)
+  console.error(
+    `[slack] spawnForRoute: ErrTmuxSessionCreate for channel=${channelId} — killing orphan tmux session "${sessionName}" and retrying spawn once`,
+  )
+  await _killTmuxSession(sessionName)
+  return withSpawnDetection(channelId, route.cwd, (client) => client.spawn(params))
+}
+
 /** Delete the spawn row; surface failures. Returns whether the delete succeeded. */
 async function tryDelete(
   channelId: string,
@@ -585,13 +793,36 @@ export async function spawnForRoute(
   try {
     const r = await withSpawnDetection(channelId, route.cwd, (client) => client.spawn(params))
     console.error(`[slack] spawnForRoute: spawned channel=${channelId} instanceId=${r.claude_instance_id}`)
-    await approveTrustFolderDialog(channelId, web, isStartup, normalizedName)
-    await approveDevChannelsDialog(channelId, web, isStartup, normalizedName)
+    await approvePreSessionDialogs(channelId, web, isStartup, normalizedName)
     return { channelId, action: 'spawned' }
   } catch (err) {
     if (err instanceof ErrInstanceIdCollision) {
       // Collision → fall through to get-then-act
       console.error(`[slack] spawnForRoute: ErrInstanceIdCollision for channel=${channelId} — fetching current state`)
+    } else if (err instanceof ErrTmuxSessionCreate) {
+      // b.vub: fresh spawn collided on the deterministic tmux session name held
+      // by an orphan session (no instance-id collision → no AD row to resolve).
+      // Self-heal: kill the orphan by name, retry spawn once.
+      try {
+        const r = await selfHealTmuxCollisionAndRespawn(channelId, route, params, normalizedName)
+        console.error(`[slack] spawnForRoute: self-heal spawn succeeded after ErrTmuxSessionCreate for channel=${channelId} instanceId=${r.claude_instance_id}`)
+        await approvePreSessionDialogs(channelId, web, isStartup, normalizedName)
+        return { channelId, action: 'spawned' }
+      } catch (err2) {
+        if (
+          err2 instanceof ErrSystemInstallDisappeared ||
+          err2 instanceof ErrTmuxNotAvailable ||
+          err2 instanceof ErrCwdNotFound ||
+          err2 instanceof ErrCwdNotADirectory
+        ) {
+          return { channelId, action: 'failed' }
+        }
+        const e = err2 instanceof AgentDirectorError ? err2 : new AgentDirectorError('spawn', 'UnknownError', String(err2))
+        console.error(`[slack] spawnForRoute: self-heal spawn after ErrTmuxSessionCreate failed for channel=${channelId}: ${e.errName}`)
+        if (isStartup) recordStartupError('spawn-failed', `self-heal spawn after ErrTmuxSessionCreate failed for channel=${channelId}: ${e.errName}`, e)
+        postSpawnFailureToChannel(channelId, e, web, isStartup)
+        return { channelId, action: 'failed' }
+      }
     } else if (
       err instanceof ErrSystemInstallDisappeared ||
       err instanceof ErrTmuxNotAvailable ||
@@ -620,8 +851,7 @@ export async function spawnForRoute(
       try {
         const r = await withSpawnDetection(channelId, route.cwd, (client) => client.spawn(params))
         console.error(`[slack] spawnForRoute: retry-spawn succeeded for channel=${channelId} instanceId=${r.claude_instance_id}`)
-        await approveTrustFolderDialog(channelId, web, isStartup, normalizedName)
-        await approveDevChannelsDialog(channelId, web, isStartup, normalizedName)
+        await approvePreSessionDialogs(channelId, web, isStartup, normalizedName)
         return { channelId, action: 'spawned' }
       } catch (err2) {
         if (
@@ -658,8 +888,7 @@ export async function spawnForRoute(
       try {
         await withSpawnDetection(channelId, route.cwd, (client) => client.spawn(params))
         console.error(`[slack] spawnForRoute: fresh-spawned (after kill+delete) for channel=${channelId}`)
-        await approveTrustFolderDialog(channelId, web, isStartup, normalizedName)
-        await approveDevChannelsDialog(channelId, web, isStartup, normalizedName)
+        await approvePreSessionDialogs(channelId, web, isStartup, normalizedName)
         return { channelId, action: 'spawned' }
       } catch (err) {
         if (
@@ -683,16 +912,45 @@ export async function spawnForRoute(
     try {
       await withSpawnDetection(channelId, route.cwd, (client) => client.resume({ claude_instance_id: instanceIdFor(channelId, normalizedName) }))
       console.error(`[slack] spawnForRoute: resumed channel=${channelId}`)
+      // b.vub: a resumed bot faces the same --dangerously-load-development-channels
+      // dialog. Its AD row is still `missing`/`ended` while blocked at the dialog
+      // (SessionStart hasn't re-fired), so the pane-first approver drives it past.
+      await approvePreSessionDialogs(channelId, web, isStartup, normalizedName)
       return { channelId, action: 'resumed' }
     } catch (err) {
+      if (err instanceof ErrTmuxSessionCreate) {
+        // b.vub: the deterministic tmux session name is still held by an orphan
+        // session while the AD row is terminal — resume cannot re-create it.
+        // This is the observed field failure (resume throws ErrTmuxSessionCreate
+        // every ~2 min). Self-heal: kill the orphan by name, retry spawn once.
+        try {
+          const r = await selfHealTmuxCollisionAndRespawn(channelId, route, params, normalizedName)
+          console.error(`[slack] spawnForRoute: self-heal spawn succeeded after ErrTmuxSessionCreate for channel=${channelId} instanceId=${r.claude_instance_id}`)
+          await approvePreSessionDialogs(channelId, web, isStartup, normalizedName)
+          return { channelId, action: 'spawned' }
+        } catch (err2) {
+          if (
+            err2 instanceof ErrSystemInstallDisappeared ||
+            err2 instanceof ErrTmuxNotAvailable ||
+            err2 instanceof ErrCwdNotFound ||
+            err2 instanceof ErrCwdNotADirectory
+          ) {
+            return { channelId, action: 'failed' }
+          }
+          const e = err2 instanceof AgentDirectorError ? err2 : new AgentDirectorError('spawn', 'UnknownError', String(err2))
+          console.error(`[slack] spawnForRoute: self-heal spawn after ErrTmuxSessionCreate failed for channel=${channelId}: ${e.errName}`)
+          if (isStartup) recordStartupError('spawn-failed', `self-heal spawn after ErrTmuxSessionCreate failed for channel=${channelId}: ${e.errName}`, e)
+          postSpawnFailureToChannel(channelId, e, web, isStartup)
+          return { channelId, action: 'failed' }
+        }
+      }
       if (err instanceof ErrNoSessionId || err instanceof ErrJsonlMissing) {
         console.error(`[slack] spawnForRoute: ${err.errName} on resume for channel=${channelId} — delete+fresh`)
         if (!(await tryDelete(channelId, normalizedName, web, isStartup))) return { channelId, action: 'failed' }
         try {
           await withSpawnDetection(channelId, route.cwd, (client) => client.spawn(params))
           console.error(`[slack] spawnForRoute: fresh-spawned (after delete) for channel=${channelId}`)
-          await approveTrustFolderDialog(channelId, web, isStartup, normalizedName)
-          await approveDevChannelsDialog(channelId, web, isStartup, normalizedName)
+          await approvePreSessionDialogs(channelId, web, isStartup, normalizedName)
           return { channelId, action: 'spawned' }
         } catch (err2) {
           if (
@@ -717,8 +975,7 @@ export async function spawnForRoute(
         if (!(await tryDelete(channelId, normalizedName, web, isStartup))) return { channelId, action: 'failed' }
         try {
           await withSpawnDetection(channelId, route.cwd, (client) => client.spawn(params))
-          await approveTrustFolderDialog(channelId, web, isStartup, normalizedName)
-          await approveDevChannelsDialog(channelId, web, isStartup, normalizedName)
+          await approvePreSessionDialogs(channelId, web, isStartup, normalizedName)
           return { channelId, action: 'spawned' }
         } catch (err2) {
           if (
@@ -751,12 +1008,27 @@ export async function spawnForRoute(
   }
 
   if (state === 'waiting') {
-    await reconnectMcp(channelId, web, routingConfig)
+    // b.rmy: propagate the reconnect outcome — a failed reconnect must count
+    // as `failed` so startupSessionManager's ok/failed totals reflect reality
+    // (previously this reported 'reconnected' unconditionally, masking a
+    // total post-reboot outage as "0 failed").
+    if (!(await reconnectMcp(channelId, web, routingConfig))) {
+      console.error(`[slack] spawnForRoute: reconnect failed for channel=${channelId}`)
+      if (isStartup) recordStartupError('spawn-failed', `reconnect failed for channel=${channelId} (state=waiting)`)
+      return { channelId, action: 'failed' }
+    }
     return { channelId, action: 'reconnected' }
   }
 
   if (state === 'working') {
-    await waitForWaitingAndReconnect(channelId, routingConfig, web)
+    // b.rmy: same outcome propagation as the `waiting` branch. Note
+    // waitForWaitingAndReconnect returns true on timeout/terminal transitions
+    // by design (long turns aren't errors) — only real failures reach here.
+    if (!(await waitForWaitingAndReconnect(channelId, routingConfig, web))) {
+      console.error(`[slack] spawnForRoute: reconnect failed for channel=${channelId}`)
+      if (isStartup) recordStartupError('spawn-failed', `reconnect failed for channel=${channelId} (state=working)`)
+      return { channelId, action: 'failed' }
+    }
     return { channelId, action: 'reconnected' }
   }