oh-my-codex 0.20.3 → 0.20.5

package/dist/team/tmux-session.js

@@ -2,6 +2,7 @@ import { spawnSync, execFile } from 'child_process';
 import { promisify } from 'util';
 import { closeSync, chmodSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'fs';
 import { homedir } from 'os';
+import { randomBytes } from 'crypto';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'path';
 import { CODEX_BYPASS_FLAG, CLAUDE_SKIP_PERMISSIONS_FLAG, MADMAX_FLAG, CONFIG_FLAG, LONG_CONFIG_FLAG, MODEL_FLAG, } from '../cli/constants.js';
 import { getAgent } from '../agents/definitions.js';
@@ -55,6 +56,16 @@ class ExactPaneProofUnavailableError extends Error {
         this.name = 'ExactPaneProofUnavailableError';
     }
 }
+class AmbiguousSplitWindowOutputError extends Error {
+    newlyObservedPaneIds;
+    reconciliationError;
+    constructor(newlyObservedPaneIds, reconciliationError = null) {
+        super('tmux_split_window_output_ambiguous');
+        this.newlyObservedPaneIds = newlyObservedPaneIds;
+        this.reconciliationError = reconciliationError;
+        this.name = 'AmbiguousSplitWindowOutputError';
+    }
+}
 const INJECTION_MARKER = '[OMX_TMUX_INJECT]';
 const MODEL_INSTRUCTIONS_FILE_KEY = 'model_instructions_file';
 const OMX_BYPASS_DEFAULT_SYSTEM_PROMPT_ENV = 'OMX_BYPASS_DEFAULT_SYSTEM_PROMPT';
@@ -101,7 +112,7 @@ const TMUX_PANE_STABILITY_POLL_MS = 60;
 const TMUX_PANE_STABILITY_POLLS_REQUIRED = 2;
 const TMUX_PANE_STABILITY_TIMEOUT_MS = 750;
 const OMX_TEAM_STATE_ROOT_ENV = 'OMX_TEAM_STATE_ROOT';
-function runTmux(args) {
+function runTmux(args, preserveStdout = false) {
     const { result } = spawnPlatformCommandSync('tmux', args, { encoding: 'utf-8' });
     if (result.error) {
         return { ok: false, stderr: result.error.message };
@@ -109,7 +120,16 @@ function runTmux(args) {
     if (result.status !== 0) {
         return { ok: false, stderr: (result.stderr || '').trim() || `tmux exited ${result.status}` };
     }
-    return { ok: true, stdout: (result.stdout || '').trim() };
+    const stdout = result.stdout || '';
+    return { ok: true, stdout: preserveStdout ? stdout : stdout.trim() };
+}
+export function parseSplitWindowPaneId(stdout, expectedReceipt) {
+    const match = expectedReceipt === undefined
+        ? /^(%\d+)(?:\r?\n)?$/.exec(stdout)
+        : /^(%\d+)\t([^\r\n\t]+)(?:\r?\n)?$/.exec(stdout);
+    if (!match || (expectedReceipt !== undefined && match[2] !== expectedReceipt))
+        return null;
+    return match[1];
 }
 /** Preserve structured tmux fields, including an empty final field. */
 /** Preserve structured tmux fields, including an empty final field. */
@@ -122,6 +142,115 @@ function runTmuxStructured(args) {
     }
     return { ok: true, stdout: (result.stdout || '').replace(/\r?\n$/, '') };
 }
+function captureSourcePaneAuthority(paneId, expectedTeamPaneOwnerId) {
+    const target = paneId.trim();
+    if (!/^%[0-9]+$/.test(target))
+        throw new Error(`invalid tmux source pane: ${paneId}`);
+    const result = runTmuxStructured([
+        'display-message', '-p', '-t', target,
+        '#{session_name}\t#{session_id}\t#{session_created}\t#{window_index}\t#{window_id}\t#{pane_id}\t#{pane_pid}',
+    ]);
+    if (!result.ok)
+        throw new Error(`failed to capture tmux source authority: ${result.stderr}`);
+    const fields = result.stdout.split('\t');
+    if (fields.length !== 7)
+        throw new Error('malformed tmux source authority');
+    const [sessionName, sessionId, sessionCreated, windowIndex, windowId, capturedPaneId, panePid] = fields;
+    if (!sessionName || !/^\$[0-9]+$/.test(sessionId) || !/^[0-9]+$/.test(sessionCreated)
+        || !/^[0-9]+$/.test(windowIndex) || !/^@[0-9]+$/.test(windowId)
+        || capturedPaneId !== target || !/^[1-9][0-9]*$/.test(panePid)) {
+        throw new Error('malformed tmux source authority');
+    }
+    const parsedPid = Number(panePid);
+    if (!Number.isSafeInteger(parsedPid) || parsedPid <= 0)
+        throw new Error('malformed tmux source authority');
+    const proof = readExactPaneProofSync(target);
+    if (proof.status === 'unavailable')
+        throw new ExactPaneProofUnavailableError(proof);
+    if (proof.status !== 'live' || proof.pid !== parsedPid)
+        throw new Error(`tmux pane identity changed: ${target}`);
+    const ownerResult = runTmuxStructured(['show-option', '-qv', '-p', '-t', target, OMX_TEAM_PANE_OWNER_OPTION]);
+    if (!ownerResult.ok)
+        throw new Error(`failed to capture tmux pane owner: ${ownerResult.stderr}`);
+    const teamPaneOwnerId = ownerResult.stdout.trim() || null;
+    if (teamPaneOwnerId && !/^[A-Za-z0-9._:-]+$/.test(teamPaneOwnerId)) {
+        throw new Error('malformed tmux pane owner');
+    }
+    if (expectedTeamPaneOwnerId !== undefined && teamPaneOwnerId !== expectedTeamPaneOwnerId) {
+        throw new Error(`tmux pane team owner changed: ${target}`);
+    }
+    return {
+        paneId: target,
+        panePid: parsedPid,
+        sessionName,
+        sessionId,
+        sessionCreated,
+        windowId,
+        windowIndex,
+        teamPaneOwnerId,
+    };
+}
+function sourceAuthorityPredicate(source) {
+    return [
+        '#{==:#{pane_dead},0}',
+        `#{==:#{pane_id},${source.paneId}}`,
+        `#{==:#{pane_pid},${source.panePid}}`,
+        `#{==:#{session_id},${source.sessionId}}`,
+        `#{==:#{session_created},${source.sessionCreated}}`,
+        `#{==:#{window_id},${source.windowId}}`,
+        ...(source.teamPaneOwnerId ? [`#{==:#{${OMX_TEAM_PANE_OWNER_OPTION}},${source.teamPaneOwnerId}}`] : []),
+    ].reduce((combined, condition) => `#{&&:${combined},${condition}}`);
+}
+function sourceTransactionReceipt() {
+    return `omx_source_${process.pid}_${Date.now()}_${randomBytes(16).toString('hex')}`;
+}
+function bindSplitReceiptToPaneCommand(command, receipt) {
+    return `${command} # ${receipt}`;
+}
+/** Queue an effect in the source pane's tmux server only when its exact pane/session/window incarnation still matches. */
+export function runSourceAuthorizedTmux(source, effect, receipt = sourceTransactionReceipt()) {
+    const result = runTmux([
+        'if-shell', '-F', '-t', source.paneId, sourceAuthorityPredicate(source),
+        `${effect} ; display-message -p ${shellQuoteSingle(receipt)}`,
+        "display-message -p ''",
+    ]);
+    if (!result.ok)
+        throw new Error(`tmux source authority transaction failed: ${result.stderr}`);
+    if (result.stdout !== receipt)
+        throw new Error('tmux source authority changed before effect');
+    return receipt;
+}
+function runSourceAuthorizedSplit(source, buildEffect) {
+    // Reconcile against the immutable window ID, not the mutable session:index
+    // target: a concurrent renumber between the guarded split and the after-read
+    // must never turn an unrelated window's pane into kill authority.
+    const windowTarget = source.windowId;
+    const beforeTopology = listPanesResult(windowTarget);
+    if (beforeTopology.error) {
+        throw new Error(`failed to read tmux pane topology before split: ${beforeTopology.error}`);
+    }
+    const beforePaneIds = new Set(beforeTopology.panes.map((pane) => pane.paneId));
+    const receipt = sourceTransactionReceipt();
+    const effect = buildEffect(receipt);
+    const result = runTmux([
+        'if-shell', '-F', '-t', source.paneId, sourceAuthorityPredicate(source),
+        effect.replace("-F '#{pane_id}'", `-F '#{pane_id}\\t${receipt}'`),
+        "display-message -p ''",
+    ], true);
+    if (!result.ok)
+        throw new Error(`tmux source authority transaction failed: ${result.stderr}`);
+    const paneId = parseSplitWindowPaneId(result.stdout, receipt);
+    if (!paneId) {
+        const afterTopology = listPanesResult(windowTarget);
+        const newlyObservedPaneIds = afterTopology.error
+            ? []
+            : afterTopology.panes
+                .filter((pane) => !beforePaneIds.has(pane.paneId) && pane.startCommand.includes(receipt))
+                .map((pane) => pane.paneId);
+        throw new AmbiguousSplitWindowOutputError(newlyObservedPaneIds, afterTopology.error);
+    }
+    return paneId;
+}
 function restoredHudCleanupDebtPath(cwd, stateRoot) {
     const canonicalStateRoot = resolveCanonicalTeamStateRoot(resolve(cwd));
     if (typeof stateRoot !== 'string' || !stateRoot.trim()) {
@@ -338,17 +467,6 @@ function sanitizeTmuxStyleOption(sessionTarget, optionName, beforeEffect) {
     const result = runTmux(['set-option', '-t', sessionTarget, optionName, sanitized]);
     return result.ok;
 }
-function tagPaneInstance(paneTarget, instanceId, expectedPanePid) {
-    const target = paneTarget.trim();
-    const sanitized = instanceId.trim();
-    if (!target || !sanitized)
-        return;
-    const provenTarget = requireLiveExactPaneSync(target, expectedPanePid);
-    const result = runTmux(['set-option', '-p', '-t', provenTarget, OMX_PANE_INSTANCE_OPTION, sanitized]);
-    if (!result.ok) {
-        throw new Error(`failed to tag tmux pane ${provenTarget}: ${result.stderr}`);
-    }
-}
 export function tagPaneTeamOwner(paneTarget, teamOwnerId, expectedPanePid) {
     const target = paneTarget.trim();
     const sanitized = teamOwnerId.trim();
@@ -471,6 +589,13 @@ function requireLiveTeamOwnedPaneSync(paneId, expectedPanePid, expectedTeamOwner
     }
     return requireLiveExactPaneSync(target, expectedPanePid);
 }
+function frozenWindowTopologyError(teamTarget, expectedPaneIds, actualPaneIds) {
+    const expected = [...expectedPaneIds].sort();
+    const actual = [...actualPaneIds].sort();
+    const unexpected = actual.filter((paneId) => !expectedPaneIds.has(paneId));
+    const missing = expected.filter((paneId) => !actualPaneIds.has(paneId));
+    return new Error(`tmux window topology changed before layout mutation: target=${teamTarget}; expected=[${expected.join(',')}]; actual=[${actual.join(',')}]; unexpected=[${unexpected.join(',')}]; missing=[${missing.join(',')}]. Team requires an isolated tmux window with no host-owned foreign panes`);
+}
 function requireFrozenWindowTopologySync(teamTarget, expectedPanePids, expectedPaneOwners) {
     const topology = listPanesResult(teamTarget);
     if (topology.error)
@@ -478,7 +603,7 @@ function requireFrozenWindowTopologySync(teamTarget, expectedPanePids, expectedP
     const actualPaneIds = new Set(topology.panes.map((pane) => pane.paneId));
     if (actualPaneIds.size !== expectedPanePids.size
         || [...expectedPanePids.keys()].some((paneId) => !actualPaneIds.has(paneId))) {
-        throw new Error('tmux window topology changed before layout mutation');
+        throw frozenWindowTopologyError(teamTarget, new Set(expectedPanePids.keys()), actualPaneIds);
     }
     for (const [paneId, expectedPanePid] of expectedPanePids) {
         const expectedOwner = expectedPaneOwners?.get(paneId);
@@ -511,7 +636,7 @@ function requireFrozenWindowTopologySync(teamTarget, expectedPanePids, expectedP
     const finalPaneIds = new Set(finalTopology.panes.map((pane) => pane.paneId));
     if (finalPaneIds.size !== expectedPanePids.size
         || [...expectedPanePids.keys()].some((paneId) => !finalPaneIds.has(paneId))) {
-        throw new Error('tmux window topology changed before layout mutation');
+        throw frozenWindowTopologyError(teamTarget, new Set(expectedPanePids.keys()), finalPaneIds);
     }
 }
 export function listPaneIds(target) {
@@ -636,6 +761,59 @@ async function runTmuxAsync(args) {
 function hasExplicitWorkerPaneId(workerPaneId) {
     return typeof workerPaneId === 'string' && workerPaneId.trim().length > 0;
 }
+function readExactWorkerPaneLivenessProofSync(paneId) {
+    if (!/^%[0-9]+$/.test(paneId))
+        return { status: 'unavailable', paneId, reason: 'invalid_pane_id' };
+    const result = runTmuxStructured([
+        'display-message', '-p', '-t', paneId,
+        `#{pane_id}\t#{pane_dead}\t#{pane_pid}\t#{${OMX_TEAM_PANE_OWNER_OPTION}}`,
+    ]);
+    if (!result.ok) {
+        if (/can't find pane|no such pane|unknown pane/i.test(result.stderr)) {
+            return { status: 'gone', paneId, reason: 'absent' };
+        }
+        return { status: 'unavailable', paneId, reason: `query_failed:${result.stderr || 'unknown'}` };
+    }
+    const lines = result.stdout.replace(/\r\n/g, '\n').split('\n').filter((line) => line.length > 0);
+    if (lines.length !== 1)
+        return { status: 'unavailable', paneId, reason: 'malformed_exact_pane_result' };
+    const fields = lines[0].split('\t');
+    if (fields.length !== 4)
+        return { status: 'unavailable', paneId, reason: 'malformed_exact_pane_result' };
+    const [actualPaneId, paneDead, rawPid, ownerId] = fields;
+    if (actualPaneId !== paneId) {
+        return { status: 'unavailable', paneId, reason: `pane_id_changed:expected=${paneId}:actual=${actualPaneId}` };
+    }
+    if (paneDead !== '0' && paneDead !== '1')
+        return { status: 'unavailable', paneId, reason: 'malformed_exact_pane_result' };
+    if (!/^[0-9]+$/.test(rawPid))
+        return { status: 'unavailable', paneId, reason: 'malformed_exact_pane_result' };
+    const pid = Number(rawPid);
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return { status: 'unavailable', paneId, reason: 'malformed_exact_pane_result' };
+    if (paneDead === '1')
+        return { status: 'gone', paneId, reason: 'dead' };
+    return { status: 'live', paneId, pid, ownerId };
+}
+function requireExactWorkerPaneLivenessIdentity(paneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
+    if (hudPaneId?.trim() && paneId === hudPaneId.trim()) {
+        throw new Error(`tmux worker pane is HUD target: ${paneId}`);
+    }
+    const proof = readExactWorkerPaneLivenessProofSync(paneId);
+    if (proof.status === 'unavailable' && proof.reason.startsWith('pane_id_changed:')) {
+        throw new Error(`tmux worker pane identity changed: ${paneId}: ${proof.reason}`);
+    }
+    if (proof.status !== 'live')
+        return proof;
+    if (typeof expectedPanePid === 'number' && proof.pid !== expectedPanePid) {
+        throw new Error(`tmux worker pane PID changed: ${paneId}: expected ${expectedPanePid}, got ${proof.pid}`);
+    }
+    const expectedOwner = typeof expectedTeamOwnerId === 'string' ? expectedTeamOwnerId.trim() : '';
+    if (expectedOwner && proof.ownerId !== expectedOwner) {
+        throw new Error(`tmux worker pane incarnation changed: ${paneId}: expected ${expectedOwner}, got ${proof.ownerId || 'missing'}`);
+    }
+    return proof;
+}
 function resolveWorkerPaneTargetSync(sessionName, workerIndex, workerPaneId) {
     if (!hasExplicitWorkerPaneId(workerPaneId))
         return paneTarget(sessionName, workerIndex);
@@ -883,7 +1061,7 @@ function buildBestEffortShellCommand(command) {
 }
 function buildAuthoritativeHudResizeShellCommand(hudPaneId, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES, expectedPanePid, expectedPaneOwnerId, effectCommand = buildNestedTmuxShellCommand(buildHudResizeCommand(buildHudPaneTarget(hudPaneId), heightLines))) {
     const target = buildHudPaneTarget(hudPaneId);
-    const snapshot = buildNestedTmuxShellCommand("list-panes -a -F '#{pane_id}\\t#{pane_dead}\\t#{pane_pid}'");
+    const snapshot = buildNestedTmuxShellCommand("list-panes -a -F '#{pane_id}\t#{pane_dead}\t#{pane_pid}'");
     const expectedPid = typeof expectedPanePid === 'number' && Number.isSafeInteger(expectedPanePid) && expectedPanePid > 0
         ? ` && $3 == "${expectedPanePid}"`
         : '';
@@ -949,12 +1127,11 @@ export function buildScheduleDelayedHudResizeArgs(hudPaneId, delaySeconds = HUD_
 export function buildReconcileHudResizeArgs(hudPaneId, heightLines = HUD_TMUX_TEAM_HEIGHT_LINES, expectedPanePid, expectedPaneOwnerId) {
     return ['run-shell', buildBestEffortShellCommand(buildAuthoritativeHudResizeShellCommand(hudPaneId, heightLines, expectedPanePid, expectedPaneOwnerId))];
 }
-function redrawLeaderPaneAfterTeamLayout(leaderPaneId, expectedPanePid, expectedTeamOwnerId) {
-    const target = leaderPaneId.trim();
-    if (!target.startsWith('%'))
-        return;
-    const provenTarget = requireLiveTeamOwnedPaneSync(target, expectedPanePid, expectedTeamOwnerId);
-    runTmux(['send-keys', '-t', provenTarget, 'C-l']);
+function redrawLeaderPaneAfterTeamLayout(source, expectedTeamOwnerId) {
+    const provenTarget = requireLiveTeamOwnedPaneSync(source.paneId, source.panePid, expectedTeamOwnerId);
+    if (provenTarget !== source.paneId)
+        throw new Error(`tmux pane identity changed: ${source.paneId}`);
+    runSourceAuthorizedTmux(source, `send-keys -t ${source.paneId} C-l`);
 }
 const ZSH_CANDIDATE_PATHS = ['/bin/zsh', '/usr/bin/zsh', '/usr/local/bin/zsh', '/opt/local/bin/zsh', '/opt/homebrew/bin/zsh'];
 const BASH_CANDIDATE_PATHS = ['/bin/bash', '/usr/bin/bash'];
@@ -1311,6 +1488,23 @@ function appendTeamWorkerMcpDisableOverrides(args, env) {
         args.splice(endOfOptionsIndex < 0 ? args.length : endOfOptionsIndex, 0, CONFIG_FLAG, `${key}=false`);
     }
 }
+const CODEX_BYPASS_MDM_INCOMPATIBLE_REASON = 'codex_bypass_mdm_incompatible';
+const CODEX_BYPASS_MDM_REJECTED_MARKER = 'MDM_POLICY_REJECTED: approval_policy=never forbids --dangerously-bypass-approvals-and-sandbox';
+export function classifyCodexBypassMdmIncompatibility(captured, workerCli, finalArgs) {
+    if (workerCli !== 'codex' || !finalArgs || !parseTeamWorkerLaunchArgs([...finalArgs], 'final tmux worker arguments', { directPolicyMode: 'ignore' }).wantsBypass)
+        return null;
+    const normalizedLines = captured.replace(/\r\n?/g, '\n').split('\n');
+    return normalizedLines.includes(CODEX_BYPASS_MDM_REJECTED_MARKER)
+        ? CODEX_BYPASS_MDM_INCOMPATIBLE_REASON
+        : null;
+}
+function buildAttachedTmuxWorkerStartupPlan(teamName, workerIndex, launchArgs, cwd, extraEnv, workerCliOverride, initialPrompt, workerRole) {
+    const processSpec = buildWorkerStartupProcessLaunchSpec(teamName, workerIndex, launchArgs, cwd, extraEnv, workerCliOverride, initialPrompt, workerRole);
+    const startupArgs = [...processSpec.args];
+    if (processSpec.workerCli === 'codex')
+        appendTeamWorkerMcpDisableOverrides(startupArgs, { ...process.env, ...extraEnv });
+    return Object.freeze({ processSpec, startupArgs: Object.freeze(startupArgs) });
+}
 function insertArgsBeforeEndOfOptions(args, insertedArgs) {
     const endOfOptionsIndex = args.indexOf('--');
     if (endOfOptionsIndex < 0)
@@ -1434,24 +1628,17 @@ function buildWorkerStartupScriptContent(processSpec, startupEnv, startupArgs, c
         '',
     ].filter((line) => line !== '').join('\n');
 }
-export function writeWorkerStartupScriptCommand(teamName, workerIndex, launchArgs = [], cwd = process.cwd(), extraEnv = {}, workerCliOverride, initialPrompt, workerRole) {
+export function writeWorkerStartupScriptCommand(teamName, workerIndex, launchArgs = [], cwd = process.cwd(), extraEnv = {}, workerCliOverride, initialPrompt, workerRole, attachedPlan) {
     if (process.platform === 'win32' && !isMsysOrGitBash())
         return null;
     const stateRoot = extraEnv[OMX_TEAM_STATE_ROOT_ENV]?.trim();
     if (!stateRoot)
         return null;
-    const processSpec = buildWorkerStartupProcessLaunchSpec(teamName, workerIndex, launchArgs, cwd, extraEnv, workerCliOverride, initialPrompt, workerRole);
-    const startupEnv = {
-        ...readTmuxWorkerAmbientEnv(process.env),
-        ...processSpec.env,
-    };
-    const startupArgs = [...processSpec.args];
-    if (processSpec.workerCli === 'codex') {
-        appendTeamWorkerMcpDisableOverrides(startupArgs, { ...process.env, ...extraEnv });
-    }
+    const startupPlan = attachedPlan ?? buildAttachedTmuxWorkerStartupPlan(teamName, workerIndex, launchArgs, cwd, extraEnv, workerCliOverride, initialPrompt, workerRole);
+    const startupEnv = { ...readTmuxWorkerAmbientEnv(process.env), ...startupPlan.processSpec.env };
     const scriptPath = join(stateRoot, 'team', teamName, 'runtime', `worker-${workerIndex}-startup.sh`);
     mkdirSync(dirname(scriptPath), { recursive: true });
-    writeFileSync(scriptPath, buildWorkerStartupScriptContent(processSpec, startupEnv, startupArgs, cwd, extraEnv), 'utf-8');
+    writeFileSync(scriptPath, buildWorkerStartupScriptContent(startupPlan.processSpec, startupEnv, [...startupPlan.startupArgs], cwd, extraEnv), 'utf-8');
     chmodSync(scriptPath, 0o700);
     return `exec /bin/sh ${shellQuoteSingle(translatePathForMsys(scriptPath))}`;
 }
@@ -1616,6 +1803,7 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
     const partialWorkerPaneIds = [];
     const partialWorkerPaneIdsByIndex = Array.from({ length: workerCount }, () => null);
     const partialWorkerPanePidsByIndex = Array.from({ length: workerCount }, () => null);
+    const partialStartupCleanupPanePids = new Map();
     let partialHudPaneId = null;
     let partialHudPanePid = null;
     try {
@@ -1647,7 +1835,11 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             throw new ExactPaneProofUnavailableError(leaderProof);
         if (leaderProof.status === 'gone')
             throw new Error(`tmux pane is not proven live: ${leaderPaneId}`);
-        const leaderPanePid = leaderProof.pid;
+        let leaderSource = captureSourcePaneAuthority(leaderPaneId);
+        if (leaderSource.sessionName !== sessionName || leaderSource.windowIndex !== windowIndex || leaderSource.panePid !== leaderProof.pid) {
+            throw new Error('tmux source authority changed during team startup');
+        }
+        const leaderPanePid = leaderSource.panePid;
         partialLeaderPaneId = leaderPaneId;
         partialLeaderPanePid = leaderPanePid;
         const initialHudPaneIds = findHudWatchPaneIds(paneListResult.panes, leaderPaneId, { leaderPaneId });
@@ -1669,13 +1861,36 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
         // instead of making it disappear on team startup failures or broken installs.
         requireFrozenWindowTopologySync(teamTarget, initialWindowPanePids);
         if (ownerSessionId) {
-            const tagResult = runTmux(['set-option', '-t', sessionName, OMX_INSTANCE_OPTION, ownerSessionId]);
-            if (!tagResult.ok) {
-                throw new Error(`failed to tag tmux session ${sessionName}: ${tagResult.stderr}`);
-            }
+            runSourceAuthorizedTmux(leaderSource, `set-option -t ${leaderSource.sessionId} ${OMX_INSTANCE_OPTION} ${shellQuoteSingle(ownerSessionId)}`);
         }
-        tagPaneInstance(leaderPaneId, ownerSessionId, leaderPanePid);
-        tagPaneTeamOwner(leaderPaneId, teamPaneOwnerId, leaderPanePid);
+        if (ownerSessionId) {
+            runSourceAuthorizedTmux(leaderSource, `set-option -p -t ${leaderPaneId} ${OMX_PANE_INSTANCE_OPTION} ${shellQuoteSingle(ownerSessionId)}`);
+        }
+        runSourceAuthorizedTmux(leaderSource, `set-option -p -t ${leaderPaneId} ${OMX_TEAM_PANE_OWNER_OPTION} ${shellQuoteSingle(teamPaneOwnerId)}`);
+        // All subsequent Team mutations must bind the frozen leader owner in the
+        // same tmux-server transaction as their effect. The initial tag itself is
+        // deliberately the sole bootstrap mutation before an owner exists.
+        leaderSource = captureSourcePaneAuthority(leaderPaneId, teamPaneOwnerId);
+        const exactProveAndTagReconciledPane = (paneId) => {
+            const proof = readExactPaneProofSync(paneId);
+            if (proof.status === 'unavailable')
+                throw new ExactPaneProofUnavailableError(proof);
+            if (proof.status === 'gone')
+                return null;
+            const paneSource = captureSourcePaneAuthority(paneId);
+            if (paneSource.panePid !== proof.pid)
+                throw new Error(`tmux pane identity changed: ${paneId}`);
+            if (paneSource.teamPaneOwnerId && paneSource.teamPaneOwnerId !== teamPaneOwnerId) {
+                throw new Error(`tmux pane team owner changed: ${paneId}`);
+            }
+            if (ownerSessionId) {
+                runSourceAuthorizedTmux(paneSource, `set-option -p -t ${paneId} ${OMX_PANE_INSTANCE_OPTION} ${shellQuoteSingle(ownerSessionId)}`);
+            }
+            rollbackTaggedPaneOwnerIds.set(paneId, teamPaneOwnerId);
+            runSourceAuthorizedTmux(paneSource, `set-option -p -t ${paneId} ${OMX_TEAM_PANE_OWNER_OPTION} ${shellQuoteSingle(teamPaneOwnerId)}`);
+            rollbackPanes.set(paneId, proof.pid);
+            return proof.pid;
+        };
         if (canRecreateTeamHud) {
             for (const [hudPaneId, hudPanePid] of initialWindowPanePids) {
                 if (hudPaneId !== leaderPaneId)
@@ -1683,6 +1898,7 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             }
         }
         const workerPaneIds = [];
+        const workerStartupArgs = Array.from({ length: workerCount }, () => Object.freeze([]));
         const workerPanePidsByIndex = Array.from({ length: workerCount }, () => null);
         let rightStackRootPaneId = null;
         let rightStackRootPanePid = null;
@@ -1694,30 +1910,49 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             const tmuxWorkerCwd = translatePathForMsys(workerCwd);
             const workerEnv = startup.env || {};
             const launchArgsForWorker = [...(workerLaunchPolicyPlan[i - 1] ?? workerLaunchArgs)];
+            const attachedStartupPlan = buildAttachedTmuxWorkerStartupPlan(safeTeamName, i, launchArgsForWorker, workerCwd, workerEnv, workerCliPlan[i - 1], startup.initialPrompt, startup.workerRole);
+            workerStartupArgs[i - 1] = attachedStartupPlan.startupArgs;
             trustWorkerMiseConfigIfAvailable(workerCwd);
-            const cmd = writeWorkerStartupScriptCommand(safeTeamName, i, launchArgsForWorker, workerCwd, workerEnv, workerCliPlan[i - 1], startup.initialPrompt, startup.workerRole) ?? buildWorkerStartupCommand(safeTeamName, i, launchArgsForWorker, workerCwd, workerEnv, workerCliPlan[i - 1], startup.initialPrompt, startup.workerRole);
+            const cmd = writeWorkerStartupScriptCommand(safeTeamName, i, launchArgsForWorker, workerCwd, workerEnv, workerCliPlan[i - 1], startup.initialPrompt, startup.workerRole, attachedStartupPlan) ?? buildWorkerStartupCommand(safeTeamName, i, launchArgsForWorker, workerCwd, workerEnv, workerCliPlan[i - 1], startup.initialPrompt, startup.workerRole);
             // First split creates the right side from leader. Remaining splits stack on the right.
             const splitDirection = i === 1 ? '-h' : '-v';
             const splitTarget = requireLiveTeamOwnedPaneSync(i === 1 ? leaderPaneId : (rightStackRootPaneId ?? leaderPaneId), i === 1 ? leaderPanePid : (rightStackRootPanePid ?? leaderPanePid), teamPaneOwnerId);
-            const split = runTmux([
-                'split-window',
-                splitDirection,
-                '-t',
-                splitTarget,
-                '-d',
-                '-P',
-                '-F',
-                '#{pane_id}',
-                '-c',
-                tmuxWorkerCwd,
-                cmd,
-            ]);
-            if (!split.ok) {
-                throw new Error(`failed to create worker pane ${i}: ${split.stderr}`);
+            const splitSource = captureSourcePaneAuthority(splitTarget, teamPaneOwnerId);
+            let paneId;
+            try {
+                paneId = runSourceAuthorizedSplit(splitSource, (receipt) => `split-window ${splitDirection} -t ${splitTarget} -d -P -F '#{pane_id}' -c ${shellQuoteSingle(tmuxWorkerCwd)} ${shellQuoteSingle(bindSplitReceiptToPaneCommand(cmd, receipt))}`);
             }
-            const paneId = split.stdout.split('\n')[0]?.trim();
-            if (!paneId || !paneId.startsWith('%')) {
-                throw new Error(`failed to capture worker pane id for worker ${i}`);
+            catch (error) {
+                if (error instanceof AmbiguousSplitWindowOutputError) {
+                    const isUnassignedAmbiguity = error.newlyObservedPaneIds.length > 1;
+                    for (const candidatePaneId of error.newlyObservedPaneIds) {
+                        rollbackPanes.set(candidatePaneId, null);
+                        partialWorkerPaneIds.push(candidatePaneId);
+                        if (isUnassignedAmbiguity)
+                            partialStartupCleanupPanePids.set(candidatePaneId, null);
+                    }
+                    if (error.newlyObservedPaneIds.length === 1) {
+                        partialWorkerPaneIdsByIndex[i - 1] = error.newlyObservedPaneIds[0];
+                    }
+                    for (const candidatePaneId of error.newlyObservedPaneIds) {
+                        const reconciledPid = exactProveAndTagReconciledPane(candidatePaneId);
+                        if (reconciledPid === null) {
+                            rollbackPanes.delete(candidatePaneId);
+                            partialWorkerPaneIds.splice(partialWorkerPaneIds.lastIndexOf(candidatePaneId), 1);
+                            partialStartupCleanupPanePids.delete(candidatePaneId);
+                            if (partialWorkerPaneIdsByIndex[i - 1] === candidatePaneId) {
+                                partialWorkerPaneIdsByIndex[i - 1] = null;
+                            }
+                        }
+                        else if (isUnassignedAmbiguity) {
+                            partialStartupCleanupPanePids.set(candidatePaneId, reconciledPid);
+                        }
+                        else {
+                            partialWorkerPanePidsByIndex[i - 1] = reconciledPid;
+                        }
+                    }
+                }
+                throw error;
             }
             // The pane exists once split-window returns its concrete ID. Persist it in
             // rollback/partial state before its first proof: a malformed or unavailable
@@ -1738,9 +1973,14 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             if (isNativeWindows() && !waitForPaneToRemainPresent(teamTarget, paneId)) {
                 throw new Error(`worker pane ${i} did not remain present after tmux split-window returned ${paneId}`);
             }
-            tagPaneInstance(paneId, ownerSessionId, panePid);
+            const paneSource = captureSourcePaneAuthority(paneId);
+            if (paneSource.panePid !== panePid)
+                throw new Error(`tmux pane identity changed: ${paneId}`);
+            if (ownerSessionId) {
+                runSourceAuthorizedTmux(paneSource, `set-option -p -t ${paneId} ${OMX_PANE_INSTANCE_OPTION} ${shellQuoteSingle(ownerSessionId)}`);
+            }
             rollbackTaggedPaneOwnerIds.set(paneId, teamPaneOwnerId);
-            tagPaneTeamOwner(paneId, teamPaneOwnerId, panePid);
+            runSourceAuthorizedTmux(paneSource, `set-option -p -t ${paneId} ${OMX_TEAM_PANE_OWNER_OPTION} ${shellQuoteSingle(teamPaneOwnerId)}`);
             frozenWindowPaneOwners.set(paneId, teamPaneOwnerId);
             workerPaneIds.push(paneId);
             if (i === 1) {
@@ -1750,7 +1990,7 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
         }
         // Keep leader as full left/main pane; workers stay stacked on the right.
         requireFrozenWindowTopologySync(teamTarget, frozenWindowPanePids, frozenWindowPaneOwners);
-        runTmux(['select-layout', '-t', teamTarget, 'main-vertical']);
+        runSourceAuthorizedTmux(leaderSource, `select-layout -t ${leaderSource.windowId} main-vertical`);
         // Force leader pane to use half the window width.
         const windowWidthResult = runTmux(['display-message', '-p', '-t', teamTarget, '#{window_width}']);
         if (windowWidthResult.ok) {
@@ -1758,9 +1998,9 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             if (Number.isFinite(width) && width >= 40) {
                 const half = String(Math.floor(width / 2));
                 requireFrozenWindowTopologySync(teamTarget, frozenWindowPanePids, frozenWindowPaneOwners);
-                runTmux(['set-window-option', '-t', teamTarget, 'main-pane-width', half]);
+                runSourceAuthorizedTmux(leaderSource, `set-window-option -t ${leaderSource.windowId} main-pane-width ${half}`);
                 requireFrozenWindowTopologySync(teamTarget, frozenWindowPanePids, frozenWindowPaneOwners);
-                runTmux(['select-layout', '-t', teamTarget, 'main-vertical']);
+                runSourceAuthorizedTmux(leaderSource, `select-layout -t ${leaderSource.windowId} main-vertical`);
             }
         }
         // Re-create a single team HUD as a full-width bottom strip spanning both
@@ -1775,97 +2015,134 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             const hudCwd = translatePathForMsys(cwd);
             requireFrozenWindowTopologySync(teamTarget, frozenWindowPanePids, frozenWindowPaneOwners);
             const hudSplitTarget = leaderPaneId;
-            const hudResult = runTmux([
-                'split-window', '-v', '-f', '-l', String(HUD_TMUX_TEAM_HEIGHT_LINES), '-t', hudSplitTarget, '-d', '-P', '-F', '#{pane_id}', '-c', hudCwd, hudCmd,
-            ]);
-            if (hudResult.ok) {
-                const id = hudResult.stdout.split('\n')[0]?.trim() ?? '';
-                if (id.startsWith('%')) {
-                    // split-window has created a concrete pane even though no proof has
-                    // authorized an effect yet. Retain PID-less cleanup debt first.
-                    rollbackPanes.set(id, null);
-                    partialHudPaneId = id;
-                    partialHudPanePid = null;
-                    const hudProof = readExactPaneProofSync(id);
-                    if (hudProof.status === 'unavailable')
-                        throw new ExactPaneProofUnavailableError(hudProof);
-                    if (hudProof.status === 'gone')
-                        throw new Error(`tmux pane is not proven live: ${id}`);
-                    const hudPanePid = hudProof.pid;
-                    frozenWindowPanePids.set(id, hudPanePid);
-                    rollbackPanes.set(id, hudPanePid);
-                    partialHudPanePid = hudPanePid;
-                    if (isNativeWindows() && !waitForPaneToRemainPresent(teamTarget, id)) {
-                        throw new Error(`HUD pane did not remain present after tmux split-window returned ${id}`);
+            const hudSource = captureSourcePaneAuthority(hudSplitTarget, teamPaneOwnerId);
+            let id;
+            try {
+                id = runSourceAuthorizedSplit(hudSource, (receipt) => `split-window -v -f -l ${HUD_TMUX_TEAM_HEIGHT_LINES} -t ${hudSplitTarget} -d -P -F '#{pane_id}' -c ${shellQuoteSingle(hudCwd)} ${shellQuoteSingle(bindSplitReceiptToPaneCommand(hudCmd, receipt))}`);
+            }
+            catch (error) {
+                if (error instanceof AmbiguousSplitWindowOutputError) {
+                    const isUnassignedAmbiguity = error.newlyObservedPaneIds.length > 1;
+                    for (const candidatePaneId of error.newlyObservedPaneIds) {
+                        rollbackPanes.set(candidatePaneId, null);
+                        if (isUnassignedAmbiguity)
+                            partialStartupCleanupPanePids.set(candidatePaneId, null);
                     }
-                    tagPaneInstance(id, ownerSessionId, hudPanePid);
-                    rollbackTaggedPaneOwnerIds.set(id, teamPaneOwnerId);
-                    tagPaneTeamOwner(id, teamPaneOwnerId, hudPanePid);
-                    frozenWindowPaneOwners.set(id, teamPaneOwnerId);
-                    hudPaneId = id;
-                    if (isNativeWindows()) {
-                        const provenHudPaneId = requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
-                        const reconcile = runTmux(buildHudResizeArgs(provenHudPaneId));
-                        if (!reconcile.ok) {
-                            throw new Error(`failed to reconcile HUD resize: ${reconcile.stderr}`);
-                        }
+                    if (error.newlyObservedPaneIds.length === 1) {
+                        partialHudPaneId = error.newlyObservedPaneIds[0];
+                        partialHudPanePid = null;
                     }
-                    else {
-                        const hookTarget = buildResizeHookTarget(sessionName, windowIndex);
-                        const hookName = buildResizeHookName(safeTeamName, sessionName, windowIndex, hudPaneId);
-                        requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
-                        const registerHook = runTmux(buildRegisterResizeHookArgs(hookTarget, hookName, hudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
-                        const clientAttachedHookName = buildClientAttachedReconcileHookName(safeTeamName, sessionName, windowIndex, hudPaneId);
-                        if (registerHook.ok) {
-                            resizeHookTarget = hookTarget;
-                            resizeHookName = hookName;
-                            registeredResizeHook = {
-                                name: resizeHookName,
-                                target: resizeHookTarget,
-                                leaderPaneId,
-                                leaderPanePid,
-                                hudPaneId,
-                                hudPanePid,
-                                teamPaneOwnerId,
-                            };
+                    for (const candidatePaneId of error.newlyObservedPaneIds) {
+                        const reconciledPid = exactProveAndTagReconciledPane(candidatePaneId);
+                        if (reconciledPid === null) {
+                            rollbackPanes.delete(candidatePaneId);
+                            partialStartupCleanupPanePids.delete(candidatePaneId);
+                            if (partialHudPaneId === candidatePaneId)
+                                partialHudPaneId = null;
                         }
-                        else {
-                            console.warn(`[omx] tmux resize hook unavailable for ${hookTarget} (${hookName}): ${registerHook.stderr}; `
-                                + 'continuing with best-effort HUD resize fallback.');
-                        }
-                        requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
-                        const registerClientAttachedHook = runTmux(buildRegisterClientAttachedReconcileArgs(hookTarget, clientAttachedHookName, hudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
-                        if (registerClientAttachedHook.ok) {
-                            registeredClientAttachedHook = {
-                                name: clientAttachedHookName,
-                                target: hookTarget,
-                                leaderPaneId,
-                                leaderPanePid,
-                                hudPaneId,
-                                hudPanePid,
-                                teamPaneOwnerId,
-                            };
+                        else if (isUnassignedAmbiguity) {
+                            partialStartupCleanupPanePids.set(candidatePaneId, reconciledPid);
                         }
                         else {
-                            console.warn(`[omx] tmux client-attached resize fallback unavailable for ${hookTarget} `
-                                + `(${clientAttachedHookName}): ${registerClientAttachedHook.stderr}; continuing with delayed HUD resize fallback.`);
-                        }
-                        requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
-                        const delayed = runTmux(buildScheduleDelayedHudResizeArgs(hudPaneId, HUD_RESIZE_RECONCILE_DELAY_SECONDS, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
-                        if (!delayed.ok) {
-                            console.warn(`[omx] tmux delayed HUD resize unavailable for ${hudPaneId}: ${delayed.stderr}; continuing.`);
-                        }
-                        requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
-                        const reconcile = runTmux(buildReconcileHudResizeArgs(hudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
-                        if (!reconcile.ok) {
-                            console.warn(`[omx] tmux HUD resize reconcile unavailable for ${hudPaneId}: ${reconcile.stderr}; continuing.`);
+                            partialHudPanePid = reconciledPid;
                         }
                     }
                 }
+                throw error;
+            }
+            {
+                // split-window has created a concrete pane even though no proof has
+                // authorized an effect yet. Retain PID-less cleanup debt first.
+                rollbackPanes.set(id, null);
+                partialHudPaneId = id;
+                partialHudPanePid = null;
+                const hudProof = readExactPaneProofSync(id);
+                if (hudProof.status === 'unavailable')
+                    throw new ExactPaneProofUnavailableError(hudProof);
+                if (hudProof.status === 'gone')
+                    throw new Error(`tmux pane is not proven live: ${id}`);
+                const hudPanePid = hudProof.pid;
+                frozenWindowPanePids.set(id, hudPanePid);
+                rollbackPanes.set(id, hudPanePid);
+                partialHudPanePid = hudPanePid;
+                if (isNativeWindows() && !waitForPaneToRemainPresent(teamTarget, id)) {
+                    throw new Error(`HUD pane did not remain present after tmux split-window returned ${id}`);
+                }
+                const hudSource = captureSourcePaneAuthority(id);
+                if (hudSource.panePid !== hudPanePid)
+                    throw new Error(`tmux pane identity changed: ${id}`);
+                if (ownerSessionId) {
+                    runSourceAuthorizedTmux(hudSource, `set-option -p -t ${id} ${OMX_PANE_INSTANCE_OPTION} ${shellQuoteSingle(ownerSessionId)}`);
+                }
+                rollbackTaggedPaneOwnerIds.set(id, teamPaneOwnerId);
+                runSourceAuthorizedTmux(hudSource, `set-option -p -t ${id} ${OMX_TEAM_PANE_OWNER_OPTION} ${shellQuoteSingle(teamPaneOwnerId)}`);
+                frozenWindowPaneOwners.set(id, teamPaneOwnerId);
+                hudPaneId = id;
+                if (isNativeWindows()) {
+                    const provenHudPaneId = requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                    const reconcile = runTmux(buildHudResizeArgs(provenHudPaneId));
+                    if (!reconcile.ok) {
+                        throw new Error(`failed to reconcile HUD resize: ${reconcile.stderr}`);
+                    }
+                }
+                else {
+                    const hookTarget = buildResizeHookTarget(sessionName, windowIndex);
+                    const hookName = buildResizeHookName(safeTeamName, sessionName, windowIndex, hudPaneId);
+                    requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                    const registerHook = runTmux(buildRegisterResizeHookArgs(hookTarget, hookName, hudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
+                    const clientAttachedHookName = buildClientAttachedReconcileHookName(safeTeamName, sessionName, windowIndex, hudPaneId);
+                    if (registerHook.ok) {
+                        resizeHookTarget = hookTarget;
+                        resizeHookName = hookName;
+                        registeredResizeHook = {
+                            name: resizeHookName,
+                            target: resizeHookTarget,
+                            leaderPaneId,
+                            leaderPanePid,
+                            hudPaneId,
+                            hudPanePid,
+                            teamPaneOwnerId,
+                        };
+                    }
+                    else {
+                        console.warn(`[omx] tmux resize hook unavailable for ${hookTarget} (${hookName}): ${registerHook.stderr}; `
+                            + 'continuing with best-effort HUD resize fallback.');
+                    }
+                    requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                    const registerClientAttachedHook = runTmux(buildRegisterClientAttachedReconcileArgs(hookTarget, clientAttachedHookName, hudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
+                    if (registerClientAttachedHook.ok) {
+                        registeredClientAttachedHook = {
+                            name: clientAttachedHookName,
+                            target: hookTarget,
+                            leaderPaneId,
+                            leaderPanePid,
+                            hudPaneId,
+                            hudPanePid,
+                            teamPaneOwnerId,
+                        };
+                    }
+                    else {
+                        console.warn(`[omx] tmux client-attached resize fallback unavailable for ${hookTarget} `
+                            + `(${clientAttachedHookName}): ${registerClientAttachedHook.stderr}; continuing with delayed HUD resize fallback.`);
+                    }
+                    requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                    const delayed = runTmux(buildScheduleDelayedHudResizeArgs(hudPaneId, HUD_RESIZE_RECONCILE_DELAY_SECONDS, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
+                    if (!delayed.ok) {
+                        console.warn(`[omx] tmux delayed HUD resize unavailable for ${hudPaneId}: ${delayed.stderr}; continuing.`);
+                    }
+                    requireLiveTeamOwnedPaneSync(hudPaneId, hudPanePid, teamPaneOwnerId);
+                    const reconcile = runTmux(buildReconcileHudResizeArgs(hudPaneId, HUD_TMUX_TEAM_HEIGHT_LINES, hudPanePid, teamPaneOwnerId));
+                    if (!reconcile.ok) {
+                        console.warn(`[omx] tmux HUD resize reconcile unavailable for ${hudPaneId}: ${reconcile.stderr}; continuing.`);
+                    }
+                }
             }
         }
-        runTmux(['select-pane', '-t', requireLiveTeamOwnedPaneSync(leaderPaneId, leaderPanePid, teamPaneOwnerId)]);
-        redrawLeaderPaneAfterTeamLayout(leaderPaneId, leaderPanePid, teamPaneOwnerId);
+        const focusedLeader = requireLiveTeamOwnedPaneSync(leaderPaneId, leaderPanePid, teamPaneOwnerId);
+        if (focusedLeader !== leaderSource.paneId)
+            throw new Error(`tmux pane identity changed: ${leaderPaneId}`);
+        runSourceAuthorizedTmux(leaderSource, `select-pane -t ${leaderPaneId}`);
+        redrawLeaderPaneAfterTeamLayout(leaderSource, teamPaneOwnerId);
         sleepSeconds(0.5);
         // Enable mouse scrolling so agent output panes can be scrolled with the
         // mouse wheel without conflicting with keyboard up/down arrow-key input
@@ -1874,20 +2151,20 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
         if (process.env.OMX_TEAM_MOUSE !== '0') {
             enableMouseScrolling(sessionName, () => { requireLiveTeamOwnedPaneSync(leaderPaneId, leaderPanePid, teamPaneOwnerId); });
         }
-        const sessionIncarnation = teamTarget.includes(':') ? null : queryDetachedTeamSession(sessionName);
-        if (sessionIncarnation && sessionIncarnation.status !== 'exact') {
-            throw new Error(`tmux_session_incarnation_unavailable:${sessionName}`);
-        }
         return {
             name: teamTarget,
-            tmuxSessionId: sessionIncarnation?.incarnation.sessionId,
-            tmuxSessionCreated: sessionIncarnation?.incarnation.sessionCreated,
+            tmuxSessionId: leaderSource.sessionId,
+            tmuxSessionCreated: leaderSource.sessionCreated,
             workerCount,
             cwd,
             workerPaneIds,
             workerPaneIdsByIndex: [...workerPaneIds],
             workerPanePidsByIndex,
             leaderPanePid,
+            workerStartupArgs: Object.freeze(workerStartupArgs),
+            leaderSessionId: leaderSource.sessionId,
+            leaderSessionCreated: leaderSource.sessionCreated,
+            leaderWindowId: leaderSource.windowId,
             hudPanePid: partialHudPanePid,
             leaderPaneId,
             hudPaneId,
@@ -1898,6 +2175,9 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
     }
     catch (error) {
         const cleanupErrors = [];
+        if (error instanceof AmbiguousSplitWindowOutputError && error.reconciliationError) {
+            cleanupErrors.push('failed to reconcile tmux pane topology after ambiguous split output');
+        }
         const unregisterAuthorizedHook = (hook, unregister, label) => {
             try {
                 requireLiveTeamOwnedPaneSync(hook.leaderPaneId, hook.leaderPanePid, hook.teamPaneOwnerId);
@@ -1949,6 +2229,9 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             .map((paneId) => paneId && unresolvedPaneIds.has(paneId) ? paneId : null);
         const unresolvedWorkerPanePidsByIndex = partialWorkerPanePidsByIndex
             .map((panePid, index) => partialWorkerPaneIdsByIndex[index] && unresolvedPaneIds.has(partialWorkerPaneIdsByIndex[index]) ? panePid : null);
+        const unresolvedStartupCleanupPanes = [...partialStartupCleanupPanePids.entries()]
+            .filter(([paneId]) => unresolvedPaneIds.has(paneId))
+            .map(([paneId, panePid]) => ({ paneId, panePid }));
         const unresolvedHudPaneId = partialHudPaneId && (unresolvedPaneIds.has(partialHudPaneId)
             || registeredResizeHook !== null
             || registeredClientAttachedHook !== null)
@@ -1956,7 +2239,8 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
             : null;
         const hasRecoverablePartialArtifact = unresolvedPaneIds.size > 0
             || registeredResizeHook !== null
-            || registeredClientAttachedHook !== null;
+            || registeredClientAttachedHook !== null
+            || (error instanceof AmbiguousSplitWindowOutputError && error.reconciliationError !== null);
         if (hasRecoverablePartialArtifact && partialTeamTarget && partialLeaderPaneId) {
             throw new CreateTeamSessionPartialError({
                 name: partialTeamTarget,
@@ -1965,6 +2249,7 @@ export function createTeamSession(teamName, workerCount, cwd, workerLaunchArgs =
                 workerPaneIds: unresolvedWorkerPaneIds,
                 workerPaneIdsByIndex: unresolvedWorkerPaneIdsByIndex,
                 workerPanePidsByIndex: unresolvedWorkerPanePidsByIndex,
+                startupCleanupPanes: unresolvedStartupCleanupPanes,
                 leaderPanePid: partialLeaderPanePid,
                 hudPanePid: unresolvedHudPaneId ? partialHudPanePid : null,
                 leaderPaneId: partialLeaderPaneId,
@@ -2038,7 +2323,9 @@ export function restoreStandaloneHudPane(leaderPaneId, cwd, options = {}) {
         runTmux(['select-pane', '-t', requireAuthorizedLeaderPane()]);
         return existingHudPaneId;
     }
-    const hudCmd = `exec env ${formatHudEnvAssignments(process.env, { sessionId: options.sessionId, leaderPaneId: normalizedLeaderPaneId })} ${shellQuoteSingle(translatePathForMsys(resolveLeaderNodePath()))} ${shellQuoteSingle(translatePathForMsys(omxEntry))} hud --watch`;
+    const beforeSplitPaneIds = new Set(paneListResult.panes.map((pane) => pane.paneId));
+    const splitReceipt = sourceTransactionReceipt();
+    const hudCmd = bindSplitReceiptToPaneCommand(`exec env ${formatHudEnvAssignments(process.env, { sessionId: options.sessionId, leaderPaneId: normalizedLeaderPaneId })} ${shellQuoteSingle(translatePathForMsys(resolveLeaderNodePath()))} ${shellQuoteSingle(translatePathForMsys(omxEntry))} hud --watch`, splitReceipt);
     let hudResult = null;
     for (const restoreCwd of resolveStandaloneHudRestoreCwdCandidates(normalizedLeaderPaneId, cwd, options.cwd, requireAuthorizedLeaderPane)) {
         const candidateResult = runTmux([
@@ -2055,7 +2342,7 @@ export function restoreStandaloneHudPane(leaderPaneId, cwd, options = {}) {
             '-c',
             translatePathForMsys(restoreCwd.rawPath),
             hudCmd,
-        ]);
+        ], true);
         if (candidateResult.ok) {
             hudResult = candidateResult;
             break;
@@ -2063,9 +2350,45 @@ export function restoreStandaloneHudPane(leaderPaneId, cwd, options = {}) {
     }
     if (!hudResult?.ok)
         return null;
-    const paneId = hudResult.stdout.split('\n')[0]?.trim() ?? '';
-    if (!paneId.startsWith('%'))
-        return null;
+    const paneId = parseSplitWindowPaneId(hudResult.stdout);
+    if (!paneId) {
+        const afterTopology = listPanesResult(normalizedLeaderPaneId);
+        if (afterTopology.error) {
+            throw new Error('restored_hud_split_topology_reconciliation_failed');
+        }
+        const newlyObservedPaneIds = afterTopology.panes
+            .filter((pane) => !beforeSplitPaneIds.has(pane.paneId) && pane.startCommand.includes(splitReceipt))
+            .map((pane) => pane.paneId);
+        if (newlyObservedPaneIds.length === 1) {
+            const reconciledPaneId = newlyObservedPaneIds[0];
+            persistRestoredHudCleanupDebtSync(cwd, {
+                schema_version: 1,
+                operation: 'restored_hud_cleanup',
+                pane_id: reconciledPaneId,
+                pane_pid: null,
+                leader_pane_id: normalizedLeaderPaneId,
+                leader_pane_pid: options.expectedLeaderPanePid ?? leaderPanePid,
+                leader_pane_owner_id: options.expectedLeaderPaneOwnerId?.trim() || null,
+                hud_owner_leader_pane_id: normalizedLeaderPaneId,
+            }, options.stateRoot);
+            const reconciledProof = readExactPaneProofSync(reconciledPaneId);
+            if (reconciledProof.status === 'unavailable')
+                throw new ExactPaneProofUnavailableError(reconciledProof);
+            if (reconciledProof.status === 'gone')
+                throw new Error(`tmux pane is not proven live: ${reconciledPaneId}`);
+            persistRestoredHudCleanupDebtSync(cwd, {
+                schema_version: 1,
+                operation: 'restored_hud_cleanup',
+                pane_id: reconciledPaneId,
+                pane_pid: reconciledProof.pid,
+                leader_pane_id: normalizedLeaderPaneId,
+                leader_pane_pid: options.expectedLeaderPanePid ?? leaderPanePid,
+                leader_pane_owner_id: options.expectedLeaderPaneOwnerId?.trim() || null,
+                hud_owner_leader_pane_id: normalizedLeaderPaneId,
+            }, options.stateRoot);
+        }
+        throw new Error('restored_hud_split_output_ambiguous');
+    }
     persistRestoredHudCleanupDebtSync(cwd, {
         schema_version: 1,
         operation: 'restored_hud_cleanup',
@@ -2163,7 +2486,10 @@ function paneHasClaudeBypassPermissionsPrompt(captured) {
         && tail.some((line) => /Enter\s*to\s*confirm/i.test(line));
     return hasWarning && hasChoices;
 }
-export function evaluateStartupDirectTriggerSafetyCapture(captured, workerCli) {
+export function evaluateStartupDirectTriggerSafetyCapture(captured, workerCli, finalArgs) {
+    const incompatibleReason = classifyCodexBypassMdmIncompatibility(captured, workerCli, finalArgs);
+    if (incompatibleReason)
+        return { safe: false, reason: incompatibleReason };
     if (paneHasTrustPrompt(captured))
         return { safe: false, reason: 'trust_prompt' };
     if (paneHasClaudeBypassPermissionsPrompt(captured))
@@ -2176,7 +2502,7 @@ export function evaluateStartupDirectTriggerSafetyCapture(captured, workerCli) {
         return { safe: true, reason: 'codex_viewport' };
     return { safe: false, reason: 'not_agent_viewport' };
 }
-export async function evaluateStartupDirectTriggerSafety(sessionName, workerIndex, workerPaneId, workerCli) {
+export async function evaluateStartupDirectTriggerSafety(sessionName, workerIndex, workerPaneId, workerCli, finalArgs) {
     if (!isTmuxAvailable())
         return { safe: false, reason: 'tmux_unavailable' };
     const target = await resolveWorkerPaneTargetAsync(sessionName, workerIndex, workerPaneId);
@@ -2185,7 +2511,7 @@ export async function evaluateStartupDirectTriggerSafety(sessionName, workerInde
     const result = await runTmuxAsync(sharedBuildVisibleCapturePaneArgv(target));
     if (!result.ok)
         return { safe: false, reason: 'capture_failed' };
-    return evaluateStartupDirectTriggerSafetyCapture(result.stdout, workerCli);
+    return evaluateStartupDirectTriggerSafetyCapture(result.stdout, workerCli, finalArgs);
 }
 function acceptClaudeBypassPermissionsPrompt(resolveTarget) {
     const literalTarget = resolveTarget();
@@ -2455,12 +2781,13 @@ export function waitForWorkerReady(sessionName, workerIndex, timeoutMs = 30_000,
 // Async twin of waitForWorkerReady for team startup fan-out. Keep the readiness
 // semantics mirrored with the synchronous helper above, but yield between polls
 // so one slow worker pane cannot block later workers' startup attempts.
-export async function waitForWorkerReadyAsync(sessionName, workerIndex, timeoutMs = 30_000, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
+export async function waitForWorkerReadyDetailedAsync(sessionName, workerIndex, timeoutMs = 30_000, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId, incompatibility) {
     const initialBackoffMs = 150;
     const maxBackoffMs = 8000;
     const startedAt = Date.now();
     let blockedByTrustPrompt = false;
     let promptDismissed = false;
+    let startupIncompatible = false;
     const resolveTarget = createPinnedWorkerPaneTargetResolver(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
     const sendRobustEnter = async () => {
         // Trust + follow-up splash can require two submits in Codex TUI.
@@ -2482,6 +2809,12 @@ export async function waitForWorkerReadyAsync(sessionName, workerIndex, timeoutM
         const result = await runTmuxAsync(sharedBuildVisibleCapturePaneArgv(target));
         if (!result.ok)
             return false;
+        const incompatibleReason = classifyCodexBypassMdmIncompatibility(result.stdout, incompatibility?.workerCli, incompatibility?.finalArgs);
+        if (incompatibleReason) {
+            startupIncompatible = true;
+            incompatibility?.onIncompatible(incompatibleReason);
+            return false;
+        }
         if (await dismissClaudeBypassPermissionsPromptIfPresentAsync(resolveTarget, result.stdout)) {
             promptDismissed = true;
             return false;
@@ -2519,6 +2852,8 @@ export async function waitForWorkerReadyAsync(sessionName, workerIndex, timeoutM
     while (Date.now() - startedAt < timeoutMs) {
         if (await check())
             return true;
+        if (startupIncompatible)
+            return false;
         if (blockedByTrustPrompt)
             return false;
         // After dismissing a trust prompt, reset backoff so we re-check quickly
@@ -2535,6 +2870,9 @@ export async function waitForWorkerReadyAsync(sessionName, workerIndex, timeoutM
     }
     return false;
 }
+export async function waitForWorkerReadyAsync(sessionName, workerIndex, timeoutMs = 30_000, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
+    return waitForWorkerReadyDetailedAsync(sessionName, workerIndex, timeoutMs, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
+}
 /**
  * Detect and auto-dismiss a Codex "Trust this directory?" prompt in a worker pane.
  * Returns true if a trust prompt was found and dismissed, false otherwise.
@@ -2692,8 +3030,8 @@ export function notifyLeaderStatus(sessionName, message) {
 // Get PID of the shell process in a worker's tmux pane
 export function getWorkerPanePid(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
     if (hasExplicitWorkerPaneId(workerPaneId)) {
-        const target = createPinnedWorkerPaneTargetResolverSync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId)();
-        return target ? expectedPanePid ?? null : null;
+        const proof = requireExactWorkerPaneLivenessIdentity(workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
+        return proof.status === 'live' ? proof.pid : null;
     }
     const result = runTmux(['list-panes', '-t', paneTarget(sessionName, workerIndex), '-F', '#{pane_pid}']);
     if (!result.ok)
@@ -2709,10 +3047,19 @@ export function getWorkerPanePid(sessionName, workerIndex, workerPaneId, expecte
 // Check if worker's tmux pane has a running process
 export function isWorkerAlive(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
     if (hasExplicitWorkerPaneId(workerPaneId)) {
-        const target = createPinnedWorkerPaneTargetResolverSync(sessionName, workerIndex, workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId)();
-        if (!target || typeof expectedPanePid !== 'number')
+        if (hudPaneId?.trim() && workerPaneId === hudPaneId.trim()) {
+            throw new Error(`tmux worker pane is HUD target: ${workerPaneId}`);
+        }
+        const proof = requireExactWorkerPaneLivenessIdentity(workerPaneId, expectedPanePid, expectedTeamOwnerId, hudPaneId);
+        if (proof.status === 'unavailable')
+            return true;
+        if (proof.status === 'gone')
             return false;
-        return probeProcessLiveness(expectedPanePid) !== 'gone';
+        if (typeof expectedPanePid !== 'number' || !Number.isSafeInteger(expectedPanePid) || expectedPanePid <= 0)
+            return true;
+        if (typeof expectedTeamOwnerId !== 'string' || expectedTeamOwnerId.trim() === '')
+            return true;
+        return probeProcessLiveness(proof.pid) !== 'gone';
     }
     const result = runTmux([
         'list-panes',