wezard 1.2.12 → 1.2.18

package/dist/daemon/mirror-bridge.js

@@ -17,13 +17,14 @@ import { existsSync, readdirSync, statSync, watch, openSync, readSync, closeSync
 import { join, dirname } from "node:path";
 import { expandHome, sanitizeId } from "../shared/paths.js";
 import { activeBackends, backendForPath, projectDirFor, projectDirsFor, } from "../shared/cli-backends.js";
+import { isModalPane, parseModalOptions, pickModalAnswer } from "../shared/modal-pane.js";
 import { hasMirrorAskq, runMirrorAskqFlow, hasMirrorPlan, mootMirrorPlan, runMirrorPlanFlow } from "./approval.js";
-import { spawnTmuxClaude } from "./spawn-tmux.js";
+import { runTmux as runTmuxCmd, spawnTmuxClaude } from "./spawn-tmux.js";
 import { recordTool, recordToolResult, recordTurnStart, recordTurnItem, recordTurnUsage, recordTurnClose, recordCloseOpenTurns, buildDetailUrl, buildChatUrl } from "./detail.js";
 import { labelFor, tagOfKey, baseOfKey, withTagHeader } from "../shared/session-label.js";
 import { splitMarkdown } from "../shared/md-chunk.js";
 import { randomTip } from "./tips.js";
-import { stripAnsi, compactPane, paneIsBusy, summarizeTail, lastAssistantText, lastContextTokens, keepaliveStamps } from "./peers.js";
+import { stripAnsi, compactPane, paneIsBusy, paneIsStalled, transcriptStalled, summarizeTail, lastAssistantText, lastContextTokens, keepaliveStamps, tailTurns, renderDialog } from "./peers.js";
 // Same PATH augmentation logic as cc-bridge: launchd / systemd start the daemon
 // with a stripped PATH that often lacks nvm / homebrew, breaking spawn(claudeBin).
 const NODE_BIN_DIR = dirname(process.execPath);
@@ -763,16 +764,12 @@ export const startMirrorTail = (deps) => {
         drain,
     };
 };
-// Run a tmux subcommand, capturing stdout/stderr. Local helper to avoid
-// pulling spawn-tmux's runTmux into the bridge module graph.
-const tmuxRun = (args) => new Promise((resolve) => {
-    const p = spawn("tmux", args, { stdio: ["ignore", "pipe", "pipe"] });
-    let out = "", err = "";
-    p.stdout?.on("data", (c) => (out += c.toString("utf8")));
-    p.stderr?.on("data", (c) => (err += c.toString("utf8")));
-    p.on("error", (e) => resolve({ ok: false, stdout: "", stderr: e.message }));
-    p.on("close", (code) => resolve({ ok: code === 0, stdout: out, stderr: err }));
-});
+// Run a tmux subcommand, capturing stdout/stderr. Delegates to spawn-tmux's
+// runTmux so there is exactly ONE tmux exec path in the daemon — and therefore
+// exactly one place where the hard timeout lives. (Two hand-rolled copies used
+// to exist here; both could hang forever, which is how a wedged tmux server
+// silently killed a whole chat. See TMUX_TIMEOUT_MS.)
+const tmuxRun = (args, opts) => runTmuxCmd(args, opts);
 const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
 // Stable JSON: sort object keys recursively. Used to fingerprint a tool_use's
 // `input` so the hook-side and the jsonl-side compute the same signature even
@@ -821,12 +818,29 @@ const PB_CLASS_BY_EXT = {
     tif: "«class TIFF»",
     tiff: "«class TIFF»",
 };
+// Same no-unbounded-await rule as runTmux: this sits on the inject path (image
+// pump), and `osascript` in particular can block indefinitely if macOS decides
+// to raise an automation-permission prompt nobody is there to answer. 30s is
+// generous for a sips transcode of a large screenshot.
+const PROC_TIMEOUT_MS = 30_000;
 const runProc = (cmd, args) => new Promise((resolve) => {
     const p = spawn(cmd, args, { stdio: ["ignore", "ignore", "pipe"] });
     let err = "";
+    let settled = false;
+    const finish = (r) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(r);
+    };
+    const timer = setTimeout(() => {
+        p.kill("SIGKILL");
+        finish({ ok: false, stderr: `${cmd} timeout after ${PROC_TIMEOUT_MS}ms` });
+    }, PROC_TIMEOUT_MS);
     p.stderr?.on("data", (c) => (err += c.toString("utf8")));
-    p.on("error", (e) => resolve({ ok: false, stderr: e.message }));
-    p.on("close", (code) => resolve({ ok: code === 0, stderr: err }));
+    p.on("error", (e) => finish({ ok: false, stderr: e.message }));
+    p.on("close", (code) => finish({ ok: code === 0, stderr: err }));
 });
 const setMacClipboardImage = async (imgPath) => {
     const ext = (imgPath.split(".").pop() ?? "").toLowerCase();
@@ -951,6 +965,28 @@ const extractPaneAssistantTail = (pane) => {
     const text = out.join("\n").trim();
     return text.length >= 12 ? text : "";
 };
+// Is the pane sitting on a modal picker that would eat an injection?
+//
+// Deliberately NOT capturePaneTail: that one passes `-S -N`, which reaches
+// into the scrollback. A confirm the user already answered lives in the
+// scrollback forever, so a scrollback-inclusive capture would keep matching it
+// long after the pane went back to accepting input — wedging the mirror shut
+// permanently. Bare `-p` captures only what is currently on screen.
+//
+// Trailing blank rows are trimmed first so the 15-row window lands on the
+// bottom-most *content* (a picker's footer is its last line); 15 rows spans
+// "title → options → footer" on every confirm layout we've seen.
+const MODAL_SCAN_ROWS = 15;
+// `screen` = 实际参与判定的那一屏文本, 一并返回给调用方做选项解析 —— 再 capture
+// 一次会拿到"下一瞬间"的屏幕, 与 verdict 不同源(框可能已被本地按掉), 按键就按错了。
+const detectModalPicker = async (target) => {
+    const r = await tmuxRun(["capture-pane", "-t", target, "-p"]);
+    if (!r.ok)
+        return { modal: false, screen: "" };
+    const lines = r.stdout.replace(/\s+$/u, "").split("\n");
+    const screen = lines.slice(-MODAL_SCAN_ROWS).join("\n");
+    return { ...isModalPane(screen), screen };
+};
 // Two fingerprints, derived from different ends of `text`:
 //   headFp — first 8 non-ws chars; used for "did paste land" against a wide
 //     window because long pastes wrap and the head sits near the top of the
@@ -974,6 +1010,24 @@ const fingerprints = (text) => {
 //   4. on stuck-after-Enter, retry Enter once with extra settle.
 const injectViaTmux = async (target, text, images, log, freshSpawn, backendName) => {
     log.info({ target, len: text.length, images: images.length, freshSpawn, backendName }, "mirror inject (tmux)");
+    // Never type into a modal picker (see detectModalPicker). Checked before the
+    // image pump too — a C-v into a picker is just as destructive as a paste.
+    // 必须在按后端分流之前: 每个后端都有自己的原生确认框, 往任何一个里打字都会
+    // 替用户点掉框并吞掉这条消息。放到 codebuddy 早退之后就等于只保护了 claude。
+    // Escape hatch: WEZARD_MODAL_GUARD=0, in case a future TUI layout trips it.
+    if (process.env.WEZARD_MODAL_GUARD !== "0") {
+        const modal = await detectModalPicker(target);
+        if (modal.modal) {
+            log.warn({ target, title: modal.title, backendName }, "mirror inject: modal picker on pane, refusing to inject");
+            const what = modal.title ? `「${modal.title}」` : "原生确认框";
+            return {
+                ok: false,
+                reason: `目标会话停在 CLI ${what} 等待确认,消息未送达。`
+                    + `(强行注入会替你点掉确认框并吞掉这条消息)`
+                    + `请到 tmux 里处理该确认框,或发 /stop 取消当前操作后重发。`,
+            };
+        }
+    }
     // 图片注入策略按后端分流：
     //   claude / claude-internal —— 走 macOS 剪贴板 + Ctrl+V，TUI 收到 \x16 后
     //     直接读系统剪贴板的 PNGf flavor，附加为 image content block。
@@ -1028,21 +1082,11 @@ const injectViaTmuxText = async (target, text, log, freshSpawn) => {
     const CLEARED_TIMEOUT_MS = freshSpawn ? 4000 : 1500;
     const RETRY_SETTLE_MS = freshSpawn ? 1500 : 800;
     const loadAndPaste = async () => {
-        const loaded = await new Promise((resolve) => {
-            const loader = spawn("tmux", ["load-buffer", "-"], { stdio: ["pipe", "ignore", "pipe"] });
-            let lerr = "";
-            loader.stderr?.on("data", (c) => (lerr += c.toString("utf8")));
-            loader.on("error", (e) => resolve({ ok: false, reason: `tmux not found: ${e.message}` }));
-            loader.on("close", (code) => {
-                if (code !== 0)
-                    resolve({ ok: false, reason: `tmux load-buffer exit ${code}: ${lerr.slice(-200)}` });
-                else
-                    resolve({ ok: true });
-            });
-            loader.stdin?.end(text);
-        });
+        // stdin variant of the shared exec path — it carries the same hard timeout,
+        // which a hand-rolled spawn here did not.
+        const loaded = await tmuxRun(["load-buffer", "-"], { stdin: text });
         if (!loaded.ok)
-            return loaded;
+            return { ok: false, reason: `tmux load-buffer failed: ${loaded.stderr.slice(-200) || loaded.code}` };
         const pasted = await tmuxRun(["paste-buffer", "-p", "-d", "-t", target]);
         if (!pasted.ok)
             return { ok: false, reason: `tmux paste-buffer failed: ${pasted.stderr.slice(-200)}` };
@@ -1192,6 +1236,21 @@ const inject = (args) => {
     return injectViaTmux(target, args.text, args.images ?? [], args.log, args.freshSpawn ?? false, backendName);
 };
 const queues = new Map();
+/** Ceiling for one whole inject job (respawn + paste + submit verification).
+ *  Worst legitimate case is a cold `--resume` respawn (~8s) plus a fresh-spawn
+ *  inject with both paste re-try and both cleared-polls (~30s), so 90s is ~2.5x
+ *  headroom. Past that the job is wedged, and holding the queue is strictly
+ *  worse than dropping the turn: every later message in that chat would queue
+ *  behind it forever. Well under brief's 350s bubble ceiling so the user still
+ *  gets an error bubble rather than a silent stream timeout. */
+const INJECT_JOB_TIMEOUT_MS = 90_000;
+/** Drop a session's queue chain. A hung job can't be cancelled (it's parked in a
+ *  tmux read), but detaching the chain means the NEXT message doesn't inherit
+ *  its deadlock. Pair with an injectGen bump so the zombie can't act when it
+ *  eventually returns. */
+const abortInjectQueue = (key) => {
+    queues.delete(key);
+};
 const enqueue = (key, job) => {
     const prev = queues.get(key) ?? Promise.resolve();
     const next = prev.then(job, job).catch(() => undefined);
@@ -1359,10 +1418,10 @@ export const startMirror = (deps) => {
             try {
                 if (card) {
                     s.cardSent = true;
-                    await client.replyStreamWithCard(s.frame, s.streamId, withSessionTag(a.target, s.acc || " "), true, { templateCard: card });
+                    await client.replyStreamWithCard(s.frame, s.streamId, withLinkedTag(a, s.acc || " ", undefined, s.turnId), true, { templateCard: card });
                 }
                 else {
-                    await client.replyStream(s.frame, s.streamId, withSessionTag(a.target, s.acc || " "), true);
+                    await client.replyStream(s.frame, s.streamId, withLinkedTag(a, s.acc || " ", undefined, s.turnId), true);
                 }
                 log.info({ sessionId: a.sessionId, turnId: s.turnId, accLen: s.acc.length, tools: s.tools.length, withCard: !!card }, "stream finalize");
             }
@@ -1400,12 +1459,27 @@ export const startMirror = (deps) => {
     };
     // Standalone fallback (no live stream / stream dead). Per-attachment FIFO so
     // pushes from a single mirror stay ordered; different mirrors run in parallel.
+    // Linked tag prefix: emoji+tag becomes a chat-detail link. Falls back to
+    // plain withSessionTag when no turnId is available (no active turn to link).
+    const linkedTagPrefix = (target, turnId) => {
+        if (!turnId)
+            return "";
+        const url = buildChatUrl(cfg.daemon.detailPublicBase, cfg.daemon.host, cfg.daemon.port, turnId, stripPrincipalPrefix(target));
+        const tag = tagOfKey(target);
+        return tag ? `[${labelFor(tag)} #${tag}](${url})` : `[🧙](${url})`;
+    };
+    const withLinkedTag = (a, content, seq, turnId) => {
+        const prefix = linkedTagPrefix(a.target, turnId ?? a.briefTurnId);
+        if (prefix) {
+            const seqBit = seq ? ` ${seq}` : "";
+            return `${prefix}${seqBit} ${content}`;
+        }
+        return withSessionTag(a.target, content, seq);
+    };
     const sendStandalone = (a, content) => {
         const chatId = stripPrincipalPrefix(a.target);
-        // Tag AFTER splitting — one header per bubble, so chunk 2..N stay
-        // attributable to the session instead of arriving anonymous.
         const pieces = splitChunks(content, Math.max(200, cfg.wrc.mirror.chunkChars - TAG_HEADER_BUDGET));
-        const chunks = pieces.map((p, i) => withSessionTag(a.target, p, pieces.length > 1 ? `${i + 1}/${pieces.length}` : undefined));
+        const chunks = pieces.map((p, i) => withLinkedTag(a, p, pieces.length > 1 ? `${i + 1}/${pieces.length}` : undefined));
         a.standalonePending = a.standalonePending
             .then(async () => {
             for (const c of chunks) {
@@ -1419,6 +1493,20 @@ export const startMirror = (deps) => {
         })
             .catch(() => undefined);
     };
+    // Like sendStandalone but skips withSessionTag — content already contains the tag header (e.g. as a link).
+    const sendRaw = (a, content) => {
+        const chatId = stripPrincipalPrefix(a.target);
+        a.standalonePending = a.standalonePending
+            .then(async () => {
+            try {
+                await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content } });
+            }
+            catch (e) {
+                log.warn({ sessionId: a.sessionId, err: e.message }, "raw push failed");
+            }
+        })
+            .catch(() => undefined);
+    };
     // Pre-card preamble recovery. Called right before an approval card when the
     // gating tool_use is NOT yet in the jsonl (mirror mode: CC defers the whole
     // tool-terminated turn's flush until the tool resolves — after the card is
@@ -1553,7 +1641,7 @@ export const startMirror = (deps) => {
         flushPendingStandalone(a);
         void (async () => {
             try {
-                await client.replyStream(out.frame, out.streamId, withSessionTag(a.target, bubbleMd || " "), true);
+                await client.replyStream(out.frame, out.streamId, withLinkedTag(a, bubbleMd || " "), true);
             }
             catch (e) {
                 log.warn({ sessionId: a.sessionId, err: e.message }, "exit-deferred finalize failed; falling back to standalone");
@@ -1649,10 +1737,17 @@ export const startMirror = (deps) => {
     // 链接落到 chat 视图: 默认选中本 turn 所属的 #tag, 贴底显示整条会话。turnId 依旧
     // 是凭据 (不可枚举), 只是页面从"一个 turn"扩成"这个 chat 的全部会话"。
     // target 作为 ww_uniq 传下去, 让同 chat 的所有 turn 详情都复用一个 WeCom 窗口。
-    const briefDetailLink = (turnId, target) => `🧙 [View chat details](${buildChatUrl(cfg.daemon.detailPublicBase, cfg.daemon.host, cfg.daemon.port, turnId, stripPrincipalPrefix(target))})`;
+    const briefDetailLink = (turnId, target) => {
+        const url = buildChatUrl(cfg.daemon.detailPublicBase, cfg.daemon.host, cfg.daemon.port, turnId, stripPrincipalPrefix(target));
+        const tag = tagOfKey(target);
+        return tag
+            ? `[${labelFor(tag)} #${tag}](${url}) ← View chat details`
+            : `[🧙](${url}) ← View chat details`;
+    };
     // 收口一条 loading 气泡: finish=true 写入最终内容, 只生效一次。发送失败退回 standalone。
     // 排队中的 turn 也持有气泡, 所以气泡是显式入参而不是从 a 上取。
-    const finishBubble = async (a, b, content) => {
+    // raw=true skips withSessionTag (used when content already contains the linked tag header).
+    const finishBubble = async (a, b, content, raw = false) => {
         if (!b || b.done)
             return;
         b.done = true;
@@ -1664,15 +1759,15 @@ export const startMirror = (deps) => {
         if (a.briefBubble === b)
             a.briefBubble = undefined;
         try {
-            await client.replyStream(b.frame, b.streamId, withSessionTag(a.target, content || " "), true);
+            await client.replyStream(b.frame, b.streamId, raw ? (content || " ") : withLinkedTag(a, content || " "), true);
         }
         catch (e) {
             log.warn({ sessionId: a.sessionId, err: e.message }, "brief: bubble finish failed; standalone fallback");
             if (content.trim())
-                sendStandalone(a, content);
+                raw ? sendRaw(a, content) : sendStandalone(a, content);
         }
     };
-    const finishBriefBubble = (a, content) => finishBubble(a, a.briefBubble, content);
+    const finishBriefBubble = (a, content, raw = false) => finishBubble(a, a.briefBubble, content, raw);
     // 让一个已建好记录的 turn 成为活跃 turn。turn 级状态在这里统一归零 —— 唯一入口。
     const openBriefTurn = (a, q) => {
         a.briefTurnId = q.turnId;
@@ -1692,9 +1787,18 @@ export const startMirror = (deps) => {
         a.ctxCut = undefined;
         return cut;
     };
+    // graph 归因同样一次性: 一次注入只解释它开出的那一轮。超过 ORIGIN_TTL_MS 还没被
+    // 认领 = 那次注入没能开出 turn, 印章作废 —— 宁可少标一轮, 也不能把人打的字冒认成
+    // graph 派的 (归因错了比没有更糟)。
+    const ORIGIN_TTL_MS = 5 * 60_000;
+    const consumeOrigin = (a) => {
+        const p = a.pendingOrigin;
+        a.pendingOrigin = undefined;
+        return p && Date.now() - p.at <= ORIGIN_TTL_MS ? p.origin : undefined;
+    };
     const startBriefTurn = async (a, frame, streamId, isSlash = false, userQuery = "") => {
         const turnId = newTurnId();
-        recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, userQuery: userQuery.trim() || undefined, cut: consumeCut(a) });
+        recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, cwd: a.runningCwd || undefined, userQuery: userQuery.trim() || undefined, cut: consumeCut(a), origin: consumeOrigin(a) });
         // hardTimer 兜底: turn 若无终句 / turn_end 收口 (卡死/漏收), 到点仍收气泡。
         const bubble = { frame, streamId, hardTimer: undefined, done: false };
         const q = { turnId, bubble, isSlash };
@@ -1706,7 +1810,7 @@ export const startMirror = (deps) => {
                 log.warn({ sessionId: a.sessionId, turnId }, "brief: queued turn timed out — force-closing the stuck one");
                 closeBriefTurn(a);
             }
-            void finishBubble(a, bubble, briefDetailLink(turnId, a.target));
+            void finishBubble(a, bubble, briefDetailLink(turnId, a.target), true);
         }, HARD_TIMEOUT_MS);
         // earlyTimer: 3s 无 CLI 产出 → 先把 loading 气泡收成详情链接, 用户可即时点入。
         // 首条 item 到达时清除 (handleBriefItem 路径)。用显式 bubble ref 而非 a.briefBubble,
@@ -1714,7 +1818,7 @@ export const startMirror = (deps) => {
         bubble.earlyTimer = setTimeout(() => {
             if (bubble.done)
                 return;
-            void finishBubble(a, bubble, briefDetailLink(turnId, a.target));
+            void finishBubble(a, bubble, briefDetailLink(turnId, a.target), true);
         }, EARLY_LINK_MS);
         if (a.briefTurnId) {
             (a.briefQueue ??= []).push(q);
@@ -1740,14 +1844,14 @@ export const startMirror = (deps) => {
         const turnId = newTurnId();
         const query = a.pendingBriefQuery?.replace(/^> ?/gm, "").trim();
         a.pendingBriefQuery = undefined;
-        recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, userQuery: query || undefined, cut: consumeCut(a) });
+        recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, userQuery: query || undefined, cut: consumeCut(a), origin: consumeOrigin(a) });
         a.briefTurnId = turnId;
         a.briefBubble = undefined;
         a.briefIsSlash = false;
         a.briefHadTool = false;
         a.briefConcluded = false;
         a.briefLastText = undefined;
-        enqueueStandalone(a, briefDetailLink(turnId, a.target));
+        sendRaw(a, briefDetailLink(turnId, a.target));
         log.info({ sessionId: a.sessionId, turnId }, "brief: turn started (CLI-side, no bubble)");
     };
     // 本轮一旦出现工具调用 / tool_result / 非 final 文本, 就说明这不是"一句话答完"的
@@ -1758,7 +1862,7 @@ export const startMirror = (deps) => {
         if (!a.briefTurnId || !a.briefBubble || a.briefBubble.done)
             return;
         a.briefHadTool = true;
-        void finishBriefBubble(a, briefDetailLink(a.briefTurnId, a.target));
+        void finishBriefBubble(a, briefDetailLink(a.briefTurnId, a.target), true);
     };
     // 本轮结论落地, 只生效一次:
     //   • 无工具 → 结论 + 详情链接一并写进 loading 气泡 (仍是一条消息);
@@ -1787,7 +1891,7 @@ export const startMirror = (deps) => {
         // 气泡还开着 (有工具的 turn: 结论只发了 standalone, 气泡留到这里收链接; 或空 turn
         // 没有结论) —— 收口: 统一写详情链接, 保证每个 turn 都有可点入口。
         if (a.briefBubble && !a.briefBubble.done) {
-            void finishBriefBubble(a, briefDetailLink(a.briefTurnId, a.target));
+            void finishBriefBubble(a, briefDetailLink(a.briefTurnId, a.target), true);
         }
         recordTurnClose(a.briefTurnId);
         log.info({ sessionId: a.sessionId, turnId: a.briefTurnId }, "brief: turn closed");
@@ -1802,6 +1906,78 @@ export const startMirror = (deps) => {
         if (next)
             openBriefTurn(a, next);
     };
+    // 强制收口一个 attachment 的全部出站通道, 并返回收掉的气泡/流条数。
+    //
+    // 关键约束: **一个 tmux 调用都不许有**。它的两个调用方 (`/stop` 和 inject
+    // watchdog) 恰恰是在 tmux 已经卡死时才最需要生效 —— 历史故障里 tmux 无响应
+    // 导致 dispatch 静默挂死, 用户在手机上看到一条永不结束的 "…" 气泡, 发 /stop
+    // 也没用 (旧 /stop 第一件事就是 tmuxPaneAlive, 一起卡死)。所以这里只做纯内存
+    // 状态的清算, Esc 之类要碰 pane 的动作留给调用方在这之后自己尽力去做。
+    const teardownOutbound = (a, note) => {
+        let closed = 0;
+        // 排队中的 turn 先清空再动当前 turn —— 反序会让 closeBriefTurn 顺手 shift
+        // 一个僵尸 turn 上来当活跃 turn, 白收一遍。
+        for (const q of a.briefQueue ?? []) {
+            closed++;
+            void finishBubble(a, q.bubble, briefDetailLink(q.turnId, a.target));
+            recordTurnClose(q.turnId);
+        }
+        a.briefQueue = [];
+        if (a.briefTurnId) {
+            closed++;
+            closeBriefTurn(a);
+        }
+        if (a.softEnd) {
+            clearTimeout(a.softEnd);
+            a.softEnd = undefined;
+        }
+        if (a.outbound) {
+            if (a.outbound.kind === "deferred")
+                clearTimeout(a.outbound.timer);
+            a.outbound = undefined;
+        }
+        if (a.standaloneBuf) {
+            clearTimeout(a.standaloneBuf.timer);
+            flushStandalone(a);
+        }
+        if (a.liveStream && !a.liveStream.closed) {
+            closed++;
+            void finalizeStream(a, a.liveStream);
+        }
+        if (note)
+            sendStandalone(a, note);
+        return closed;
+    };
+    // Watchdog around one inject job. The failure this exists for: every await in
+    // the job chain used to be unbounded, so a wedged tmux server parked the job
+    // forever — no log line, no error bubble, and the per-session queue stayed
+    // locked behind it, muting that chat until the daemon restarted. Now the queue
+    // is released on a deadline and the user gets told.
+    const withInjectWatchdog = async (a, gen, job) => {
+        let timer;
+        const timedOut = new Promise((resolve) => {
+            timer = setTimeout(() => resolve("timeout"), INJECT_JOB_TIMEOUT_MS);
+        });
+        const outcome = await Promise.race([
+            job().then(() => "done", (e) => {
+                log.error({ target: a.target, sessionId: a.sessionId, err: e?.message }, "inject job threw");
+                return "done";
+            }),
+            timedOut,
+        ]);
+        if (timer)
+            clearTimeout(timer);
+        if (outcome !== "timeout")
+            return;
+        // Racing already released the queue for the next message. The zombie is
+        // still parked in tmux, so bump the generation to disarm its paste, and
+        // detach the queue chain it thinks it owns.
+        if ((a.injectGen ?? 0) === gen)
+            a.injectGen = gen + 1;
+        abortInjectQueue(a.sessionId);
+        log.error({ target: a.target, sessionId: a.sessionId, gen: a.injectGen, timeoutMs: INJECT_JOB_TIMEOUT_MS }, "inject job watchdog fired — queue released, turn abandoned");
+        teardownOutbound(a, `[mirror] ✗ 注入超时 ${Math.round(INJECT_JOB_TIMEOUT_MS / 1000)}s — tmux 无响应, 本轮已放弃。再发一条消息即可重试, 或 \`/new\` 换个 pane。`);
+    };
     // Route one RenderItem into the turn store. final text 会额外作为 standalone 发群。
     const handleBriefItem = (a, item) => {
         const turnId = a.briefTurnId;
@@ -1940,6 +2116,29 @@ export const startMirror = (deps) => {
         clearTimeout(a.keepaliveQuiet);
         a.keepaliveQuiet = undefined;
     };
+    // A reply is still a heartbeat while its letters remain a prefix of "pong"
+    // (covers streamed partials "p"/"po"/"pon" and trailing punctuation). Anything
+    // else means the model ignored the ping and resumed real work.
+    const pongPrefix = (s) => "pong".startsWith(s.replace(/[^a-zA-Z]/g, "").toLowerCase());
+    // Stop swallowing the in-flight ping turn: close its heartbeat detail turn,
+    // lift the quiet window, and re-anchor the clocks to "real activity now" so the
+    // resumed work resets the round budget. The caller then falls through to the
+    // normal onItem path, letting this and the rest of the turn reach chat.
+    const releaseKeepalive = (a) => {
+        if (a.keepaliveTurnId) {
+            recordTurnClose(a.keepaliveTurnId);
+            a.keepaliveTurnId = undefined;
+        }
+        endKeepaliveQuiet(a);
+        a.keepalivePongBuf = undefined;
+        if (a.keepalive) {
+            a.keepalive.round = 0;
+            a.keepalive.pinging = false;
+            a.keepalive.settledAt = 0;
+            a.keepalive.lastRealMs = Date.now();
+        }
+        log.info({ target: a.target, sessionId: a.sessionId }, "keepalive: reply diverged from pong — un-swallowing resumed turn");
+    };
     const onItem = (a, item) => {
         // 新 spawn 的 pane 在首次 inject 落地前吞掉所有初始输出 (greeting/system)。
         if (a.muteUntilInject)
@@ -1951,30 +2150,39 @@ export const startMirror = (deps) => {
         // cache-read) — so the detail page shows the genuine heartbeat, not a
         // synthetic summary. Closed on the terminal signal (hard or soft turn_end).
         if (a.keepaliveQuiet) {
-            const id = a.keepaliveTurnId;
-            if (id) {
-                const now = Date.now();
-                if (item.kind === "text") {
-                    recordTurnItem(id, { t: "text", body: item.body, ts: now, final: item.final === true });
-                }
-                else if (item.kind === "tool_use") {
-                    for (const c of item.calls)
-                        recordTurnItem(id, { t: "tool_use", toolUseId: c.toolUseId, toolName: c.name, toolInput: c.input, ts: now });
-                }
-                else if (item.kind === "tool_result") {
-                    recordTurnItem(id, { t: "tool_result", toolUseId: item.toolUseId, body: item.full, ts: now });
-                }
-                else if (item.kind === "turn_usage") {
-                    recordTurnUsage(id, { model: item.model, messageId: item.messageId, usage: item.usage });
+            // Swallow only while the reply is consistent with a bare "pong". A text
+            // whose accumulated letters leave the "pong" prefix, or ANY tool_use (a
+            // heartbeat never calls tools), means the model resumed real work → release
+            // and fall through so the turn reaches chat instead of being hidden.
+            const nextBuf = item.kind === "text" ? (a.keepalivePongBuf ?? "") + item.body : (a.keepalivePongBuf ?? "");
+            const divergent = item.kind === "tool_use" || (item.kind === "text" && !pongPrefix(nextBuf));
+            if (!divergent) {
+                if (item.kind === "text")
+                    a.keepalivePongBuf = nextBuf;
+                const id = a.keepaliveTurnId;
+                if (id) {
+                    const now = Date.now();
+                    if (item.kind === "text") {
+                        recordTurnItem(id, { t: "text", body: item.body, ts: now, final: item.final === true });
+                    }
+                    else if (item.kind === "tool_result") {
+                        recordTurnItem(id, { t: "tool_result", toolUseId: item.toolUseId, body: item.full, ts: now });
+                    }
+                    else if (item.kind === "turn_usage") {
+                        recordTurnUsage(id, { model: item.model, messageId: item.messageId, usage: item.usage });
+                    }
+                    else if (item.kind === "turn_end") {
+                        recordTurnClose(id);
+                        a.keepaliveTurnId = undefined;
+                    }
                 }
-                else if (item.kind === "turn_end") {
-                    recordTurnClose(id);
-                    a.keepaliveTurnId = undefined;
+                if (item.kind === "turn_end") {
+                    endKeepaliveQuiet(a);
+                    a.keepalivePongBuf = undefined;
                 }
+                return;
             }
-            if (item.kind === "turn_end")
-                endKeepaliveQuiet(a);
-            return;
+            releaseKeepalive(a); // fall through to normal handling for this item
         }
         // 任何新 item 到达 = 上一条"消息写完了"并不代表这一轮结束 → 撤销待确认的软收口。
         // 硬信号 (end_turn / turn_duration) 的后端永远不会走到这里。
@@ -2214,6 +2422,7 @@ export const startMirror = (deps) => {
             a.migrationWatcher.cancel();
             a.migrationWatcher = undefined;
         }
+        a.clearRebind = undefined;
         if (a.outbound?.kind === "deferred")
             clearTimeout(a.outbound.timer);
         a.outbound = undefined;
@@ -2254,7 +2463,14 @@ export const startMirror = (deps) => {
         // Replace any existing attach with the same sessionId or same target. The
         // sessionId clash is the "/wrc again from same window" case; the target
         // clash is "different window steals my WeCom chat" — both end the previous.
+        // Guard: if a DIFFERENT principal already owns this sessionId, refuse rather
+        // than detaching it — prevents cross-wire when concurrent restoreFromStore
+        // calls race or heal logic picks the same newest jsonl.
         const prevBySid = bySessionId.get(sessionId);
+        if (prevBySid && prevBySid.target !== target) {
+            log.warn({ sessionId, existingTarget: prevBySid.target, incomingTarget: target }, "mirror attach: sessionId already bound to another principal, refusing");
+            return { ok: false, reason: `sessionId ${sessionId} already bound to ${prevBySid.target}` };
+        }
         if (prevBySid)
             detach(prevBySid, "sessionId reattach");
         const prevByTarget = byTarget.get(target);
@@ -2318,16 +2534,9 @@ export const startMirror = (deps) => {
         return { ok: true, sessionId, jsonlPath, target };
     };
     // ── Persistence: restore-from-store (lazy + boot) ────────────────────
-    const tmuxRun = (args) => new Promise((resolve) => {
-        const p = spawn("tmux", args, {
-            env: { ...process.env, PATH: augmentedPath(process.env.PATH) },
-            stdio: ["ignore", "pipe", "ignore"],
-        });
-        let out = "";
-        p.stdout?.on("data", (c) => (out += c.toString("utf8")));
-        p.on("error", () => resolve({ code: null, stdout: "" }));
-        p.on("close", (code) => resolve({ code, stdout: out }));
-    });
+    // NOTE: this used to be a second hand-rolled `spawn("tmux", …)` that shadowed
+    // the module-level helper — and had no timeout, so `/stop` itself could hang
+    // on a wedged server. It now resolves to the same single exec path.
     // Verify a paneId still exists. `display-message -t <paneId>` succeeds iff
     // the pane is alive — and tmux pane ids monotonically increment within a
     // server lifetime, so a freed id will not be silently reused. We don't need
@@ -2549,6 +2758,26 @@ export const startMirror = (deps) => {
             return new Set();
         }
     };
+    // Every `/clear` the daemon injects, keyed by the project dir it rotates in.
+    // Two chats mirroring panes in the SAME dir (the norm — one repo, many chats)
+    // both produce an indistinguishable post-clear transcript; whichever watcher
+    // ticks first would otherwise claim whichever file landed first and the two
+    // chats stay cross-wired forever (persisted to the store). Recorded BEFORE
+    // the inject so a sibling armed earlier still sees the overlap.
+    const CLEAR_WINDOW_MS = 5 * 60_000; // == migration watcher TIMEOUT_MS
+    const clearInjects = [];
+    const noteClearInject = (a) => {
+        const cut = Date.now() - CLEAR_WINDOW_MS;
+        for (let i = clearInjects.length - 1; i >= 0; i--)
+            if (clearInjects[i].at < cut)
+                clearInjects.splice(i, 1);
+        clearInjects.push({ dir: dirname(a.jsonlPath), target: a.target, at: Date.now() });
+    };
+    const siblingClearedSameDir = (a) => {
+        const cut = Date.now() - CLEAR_WINDOW_MS;
+        const dir = dirname(a.jsonlPath);
+        return clearInjects.some((r) => r.at >= cut && r.dir === dir && r.target !== a.target);
+    };
     // Post-/clear identification: claude rotates the session IMMEDIATELY on
     // /clear (not on next user input as the original design assumed) and writes
     // the `/clear` command itself as the first non-meta user line of the brand-
@@ -2620,6 +2849,14 @@ export const startMirror = (deps) => {
     // migration omits it (→ tail from EOF) because the fork file is seeded with
     // the FULL prior transcript and replaying from 0 would re-dump it to WeCom.
     const migrateAttachment = (a, newSessionId, newJsonlPath, startOffset) => {
+        // Guard: if newSessionId is already bound to a DIFFERENT principal, abort —
+        // prevents silent cross-wire (path B: /clear rotation or drift landing on
+        // a sibling's live session).
+        const incumbent = bySessionId.get(newSessionId);
+        if (incumbent && incumbent.target !== a.target) {
+            log.warn({ target: a.target, newSessionId, incumbentTarget: incumbent.target }, "migrateAttachment: target sid owned by another principal, aborting migration");
+            return;
+        }
         const oldSessionId = a.sessionId;
         const oldJsonlPath = a.jsonlPath;
         // 迁移是所有会话轮换的唯一漏斗 (注入的 /clear、TUI 里手打的 /clear、resume fork、
@@ -2678,7 +2915,9 @@ export const startMirror = (deps) => {
     // (predicate = first user line is /clear; replay from 0) and dead-pane resume
     // (predicate = file has real user content; tail from EOF — the fork is seeded
     // with full history). `startOffset` flows through to migrateAttachment.
-    const startMigrationWatcher = (a, baseline, isChild, startOffset) => {
+    // `exclusive` (the /clear flavor) refuses to claim on ambiguous evidence —
+    // see claimIsAttributable.
+    const startMigrationWatcher = (a, baseline, isChild, startOffset, exclusive) => {
         if (a.migrationWatcher)
             a.migrationWatcher.cancel(); // re-armed (e.g. /clear twice, or respawn during a pending watch)
         const projectDir = dirname(a.jsonlPath);
@@ -2720,16 +2959,28 @@ export const startMirror = (deps) => {
                     return 0;
                 } })() }))
                 .sort((x, y) => y.mtime - x.mtime);
-            for (const c of ranked) {
-                const p = join(projectDir, c.n);
-                if (isChild(p)) {
-                    stopped = true;
-                    a.migrationWatcher = undefined;
-                    const newSid = c.n.replace(/\.jsonl$/, "");
-                    if (newSid !== a.sessionId)
-                        migrateAttachment(a, newSid, p, startOffset);
-                    return;
-                }
+            const matches = ranked.filter((c) => isChild(join(projectDir, c.n)));
+            // A `/clear` rotation is identified only by "first user line is /clear",
+            // which every chat's /clear produces — the file carries nothing tying it
+            // to a pane. So claim only on unambiguous evidence: exactly one match,
+            // and no sibling attachment in this dir cleared inside the same window.
+            // Otherwise stand down and let the next inject's text fingerprint decide
+            // (see armSilentForkRebind + a.clearRebind) — a wrong pick here would
+            // permanently wire this chat onto another chat's pane.
+            if (exclusive && matches.length > 0 && (matches.length > 1 || siblingClearedSameDir(a))) {
+                log.warn({ target: a.target, candidates: matches.map((c) => c.n) }, "mirror migration: ambiguous /clear rotation, deferring to inject fingerprint");
+                timer = setTimeout(tick, POLL_MS);
+                return;
+            }
+            const hit = matches[0];
+            if (hit) {
+                stopped = true;
+                a.migrationWatcher = undefined;
+                a.clearRebind = undefined;
+                const newSid = hit.n.replace(/\.jsonl$/, "");
+                if (newSid !== a.sessionId)
+                    migrateAttachment(a, newSid, join(projectDir, hit.n), startOffset);
+                return;
             }
             timer = setTimeout(tick, POLL_MS);
         };
@@ -2760,13 +3011,26 @@ export const startMirror = (deps) => {
     //      not our fork. A genuine TUI fork is a brand-new, unowned session.
     // The fingerprint itself is lengthened (and its min-length raised) so short /
     // common messages can't collide onto a stranger's transcript in the first place.
+    //
+    // It doubles as the resolver for a `/clear` rotation the dir-scan watcher
+    // refused to attribute (a.clearRebind): same mechanism, but the candidate set
+    // narrows to transcripts born after the clear, which makes a short
+    // fingerprint safe enough to accept.
     const armSilentForkRebind = (a, text) => {
-        if (a.migrationWatcher)
+        const pendingClear = a.clearRebind;
+        if (pendingClear) {
+            // Hand over: the fingerprint is pane-certain, the dir-scan is not.
+            a.migrationWatcher?.cancel();
+            a.migrationWatcher = undefined;
+            a.clearRebind = undefined; // one-shot — this inject is the evidence
+        }
+        else if (a.migrationWatcher) {
             return; // don't race an in-flight watcher
+        }
         if (!a.tmuxPane)
             return; // spawn-mode: no pane to fork under
         const stripped = text.replace(/\s+/gu, "");
-        if (stripped.length < 16)
+        if (stripped.length < (pendingClear ? 4 : 16))
             return; // too short to fingerprint safely
         const fp = stripped.slice(0, 120); // long contiguous run → collision-resistant
         const dir = dirname(a.jsonlPath);
@@ -2821,6 +3085,9 @@ export const startMirror = (deps) => {
             const boundName = boundPath.slice(dir.length + 1);
             const ranked = names
                 .filter((n) => n !== boundName)
+                // Post-/clear: only transcripts that didn't exist before the rotation
+                // can be ours, which is what licenses the shorter fingerprint above.
+                .filter((n) => !pendingClear || !pendingClear.baseline.has(n))
                 .map((n) => ({ n, m: (() => { try {
                     return statSync(join(dir, n)).mtimeMs;
                 }
@@ -2918,6 +3185,9 @@ export const startMirror = (deps) => {
     // from the running cwd). Decoupling means /pwd can show truth even after
     // the AI sets a new path but the user hasn't /new'd yet.
     const expandedDefaultCwd = expandHome(cfg.wrc.cwd);
+    // Long absolute paths wrap in the WeCom bubble — show only the trailing
+    // three segments, which is enough to identify the project.
+    const shortCwd = (p) => p.split("/").filter(Boolean).slice(-3).join("/");
     const renderProjectInfo = (target) => {
         const a = byTarget.get(target);
         const rec = a ? undefined : deps.store.get(target);
@@ -2926,17 +3196,20 @@ export const startMirror = (deps) => {
         // in this chat, so read it from the shared base slot rather than the
         // caller's own (now-empty) attachment record.
         const pending = chatCwdFallback(target).pending;
-        const lines = [`📂 当前项目: \`${running}\``];
+        const lines = [`📂 cwd: \`${shortCwd(running)}\``];
         if (pending && pending !== running) {
-            lines.push(`下次切换: \`${pending}\` (使用 /new 或 /clear 生效)`);
+            lines.push(`下次切换: \`${shortCwd(pending)}\` (使用 /new 或 /clear 生效)`);
         }
         // Session-boundary footer — `/new` and `/clear` are the only two callers,
         // so the tip lands exactly once per fresh context, never mid-conversation.
         lines.push(randomTip());
         return lines.join("\n");
     };
-    const pushProjectInfo = (target) => {
-        const md = renderProjectInfo(target);
+    // `header` folds the caller's ack ("created") into this same bubble — /new
+    // must land as exactly ONE WeCom message, not card + separate reply.
+    const pushProjectInfo = (target, header) => {
+        const info = renderProjectInfo(target);
+        const md = header ? `${header}\n\n${info}` : info;
         const a = byTarget.get(target);
         if (a) {
             sendStandalone(a, md);
@@ -3066,7 +3339,7 @@ export const startMirror = (deps) => {
             }
         }
         if (!opts?.silent)
-            pushProjectInfo(target);
+            pushProjectInfo(target, "created");
         return { ok: true, sessionId: r.sessionId, cwd: r.cwd };
     };
     const getCwd = (target) => {
@@ -3180,7 +3453,7 @@ export const startMirror = (deps) => {
             return {
                 target: t,
                 tag,
-                label: tag ? labelFor(tag) : "▫️",
+                label: tag ? labelFor(tag) : "🧙",
                 sessionId: a?.sessionId || rec?.sessionId || "",
                 jsonlPath,
                 cwd: a?.runningCwd || rec?.cwd || expandedDefaultCwd,
@@ -3207,6 +3480,17 @@ export const startMirror = (deps) => {
         const raw = await capturePaneTail(pane, Math.max(8, rows) + 12);
         return { ok: true, pane: compactPane(raw, rows), busy: paneIsBusy(raw) };
     };
+    // Reading a peer's conversation is a transcript job, not a terminal job: the
+    // jsonl holds whole role-tagged messages, while a pane capture is ANSI-laden
+    // and clipped at the viewport edge. Only `busy` still comes from the pane.
+    const peekTurns = async (target, n = 6) => {
+        const jsonl = jsonlOf(target);
+        const busy = await isBusy(target);
+        if (!jsonl || !existsSync(jsonl))
+            return { ok: false, reason: "no transcript bound for target", busy };
+        const dialog = renderDialog(tailTurns(jsonl, n));
+        return dialog ? { ok: true, dialog, busy } : { ok: false, reason: "transcript has no turns yet", busy };
+    };
     // ── Prompt-cache keepalive ──────────────────────────────────────────
     // Anthropic's prompt cache expires ~5min after the last request. A pane that
     // goes idle (agent parked on a peer, background task running) lets the whole
@@ -3216,7 +3500,6 @@ export const startMirror = (deps) => {
     // anchored to the last REAL (non-ping) activity, NOT to our own pings — so a
     // dead session is never kept warm forever, and once real work is older than
     // `maxIdleSec` we stop and let the cache die.
-    const fmtTokens = (n) => n >= 1000 ? `${(n / 1000).toFixed(n >= 10_000 ? 0 : 1)}k` : String(n);
     // After `/stop`, ignore pane-busy as a resume signal for this long — long
     // enough for an in-flight ping (interrupted by the same /stop's Esc) to settle,
     // so it can't self-resume the pause. A genuine new turn after this window does.
@@ -3226,25 +3509,31 @@ export const startMirror = (deps) => {
     // bump mtime without being a model turn, which would fake a long-dead session
     // back to "just active" and pin it in an endless ping loop. lastRealMs stays
     // anchored on genuine work, so the tick's realIdle guard can finally let it die.
-    const initKeepalive = (jsonlPath, mtime, pingSig) => {
+    const initKeepalive = (jsonlPath, mtime, pingSigs) => {
         let lastMs = 0;
         let lastRealMs = 0;
         try {
-            const s = keepaliveStamps(jsonlPath, pingSig);
+            const s = keepaliveStamps(jsonlPath, pingSigs);
             lastMs = s.lastMs;
             lastRealMs = s.lastRealMs;
         }
         catch { /* unreadable tail */ }
-        return { lastMs, lastRealMs, seenMtime: mtime, pinging: false, pingMtime: 0, round: 0 };
+        return { lastMs, lastRealMs, seenMtime: mtime, pinging: false, pingMtime: 0, round: 0, settledAt: 0 };
     };
-    const fireKeepalive = async (a) => {
+    const fireKeepalive = async (a, stalled) => {
         const kc = cfg.wrc.mirror.keepalive;
-        // Only the streak's FIRST ping carries the full instruction; consecutive
-        // pings shrink to a bare "ping" — the instruction is already in context,
-        // and the smaller delta means a smaller cache-write and less pane clutter.
-        // keepaliveStamps matches both forms, so the bare one never reads as real
-        // activity. (round is incremented below, after the inject lands.)
-        const text = (a.keepalive?.round ?? 0) > 0 ? "ping" : kc.ping;
+        // Stalled (error/limit banner + idle pane): send the full resume instruction
+        // — inviting the model to finish genuinely-unfinished work, or to reply
+        // "pong" if it was legitimately parked. Otherwise the plain warmer, the SAME
+        // full instruction every round: a bare "ping" used to be sent from round 2 on
+        // (the instruction was already in context), but the model reads a bare "ping"
+        // as an open turn and answers it however it likes — anything other than
+        // "pong" un-swallows the heartbeat into chat and re-anchors the clocks as
+        // real activity. Restating the instruction is a few tokens of cache-write and
+        // buys a deterministic reply. keepaliveStamps matches every form, so none
+        // reads as real activity. (round is incremented below, after the inject lands.)
+        const text = stalled ? kc.resumePing : kc.ping;
+        a.keepalivePongBuf = ""; // fresh reply accumulator for the swallow/release gate
         // Suppress the pane→WeCom echo of the ping user line, then swallow the whole
         // ping turn (reply included). The 60s fail-safe clears the quiet window if
         // the turn somehow never emits turn_end, so a later real turn is never muted;
@@ -3270,10 +3559,8 @@ export const startMirror = (deps) => {
             return;
         }
         const tokens = lastContextTokens(a.jsonlPath);
-        const size = tokens > 0 ? `~${fmtTokens(tokens)} tokens` : "未知";
-        const totalRounds = Math.max(1, kc.rounds);
         const round = a.keepalive ? (a.keepalive.round += 1) : 1;
-        log.info({ target: a.target, tokens, round, totalRounds }, "keepalive: ping injected");
+        log.info({ target: a.target, tokens, round, totalRounds: Math.max(1, kc.rounds) }, "keepalive: ping injected");
         // Open a chat-detail turn for the real heartbeat exchange: userQuery is the
         // actual ping we injected; the assistant reply (expected: just "pong"), any
         // tool calls, and usage are grafted on from the swallowed items in onItem;
@@ -3281,8 +3568,6 @@ export const startMirror = (deps) => {
         const turnId = newTurnId();
         a.keepaliveTurnId = turnId;
         recordTurnStart({ id: turnId, target: a.target, sessionId: a.sessionId, userQuery: text });
-        if (kc.notify)
-            sendStandalone(a, `KeepAlive ${round}/${totalRounds} · ${size}`);
     };
     let keepaliveTicking = false;
     const keepaliveTick = async () => {
@@ -3293,7 +3578,7 @@ export const startMirror = (deps) => {
         try {
             const idleTriggerMs = Math.max(30, kc.ttlSec - kc.marginSec) * 1000;
             const ttlMs = kc.ttlSec * 1000;
-            const pingSig = normAssistant(kc.ping).slice(0, 40);
+            const pingSigs = [normAssistant(kc.ping).slice(0, 40), normAssistant(kc.resumePing).slice(0, 40)].filter((s) => s.length > 0);
             const now = Date.now();
             for (const a of byTarget.values()) {
                 if (!a.tmuxPane)
@@ -3313,14 +3598,14 @@ export const startMirror = (deps) => {
                 }
                 if (!mtime)
                     continue;
-                const k = (a.keepalive ??= initKeepalive(a.jsonlPath, mtime, pingSig));
+                const k = (a.keepalive ??= initKeepalive(a.jsonlPath, mtime, pingSigs));
                 // File mtime is only a cheap "did anything change → re-read the tail" gate.
                 // The clocks themselves come from message turns, so metadata churn (which
                 // bumps mtime but is not a turn) can never move them. `grewSinceLast` now
                 // means a NEW message turn appeared — not that the file grew.
                 const prevRealMs = k.lastRealMs;
                 if (mtime > k.seenMtime + 1000) {
-                    const s = keepaliveStamps(a.jsonlPath, pingSig);
+                    const s = keepaliveStamps(a.jsonlPath, pingSigs);
                     if (s.stamped) {
                         k.lastMs = s.lastMs;
                         k.lastRealMs = s.lastRealMs;
@@ -3335,13 +3620,15 @@ export const startMirror = (deps) => {
                 // keepalive ping+pong advances lastMs but NOT lastRealMs, so the heartbeat
                 // no longer reads as activity to itself (which was pinning round at 1/N).
                 const grewSinceLast = k.lastRealMs > prevRealMs + 1000;
-                const busy = paneIsBusy(await capturePaneTail(a.tmuxPane, 12));
+                const paneTail = await capturePaneTail(a.tmuxPane, 16);
+                const busy = paneIsBusy(paneTail);
                 if (k.pinging) {
                     // Waiting for our own ping to land and settle: until a NEWER message turn
                     // (the ping's own user line) appears and the pane goes idle, keep waiting.
                     if (busy || k.lastMs <= k.pingMtime)
                         continue;
                     k.pinging = false;
+                    k.settledAt = now;
                     continue;
                 }
                 // A new real message turn (or a busy pane) re-anchors: reset the round
@@ -3349,8 +3636,12 @@ export const startMirror = (deps) => {
                 // message-based now, so `/stop`'s Esc settling writes (metadata, no new
                 // turn) can no longer self-resume the pause — only a busy pane past grace,
                 // or a WeCom inbound in dispatch, does.
-                if (busy || grewSinceLast) {
-                    k.round = 0; // real work resets the round counter — pings start from 1/N again
+                // Suppress the grewSinceLast reset for 30s after pinging settles — the
+                // pong's tail flush can lag a tick and would otherwise fake real activity.
+                const justSettled = k.settledAt > 0 && now - k.settledAt < 30_000;
+                if (busy || (grewSinceLast && !justSettled)) {
+                    k.round = 0;
+                    k.settledAt = 0;
                     if (a.keepaliveOff && busy && now - (a.keepaliveOffAt ?? 0) > RESUME_GRACE_MS) {
                         a.keepaliveOff = false;
                         persistPause(a);
@@ -3367,9 +3658,14 @@ export const startMirror = (deps) => {
                     continue; // cache already cold — a ping would cold-rewrite for nothing
                 if (k.round >= kc.rounds)
                     continue; // budget spent — let it go cold
+                // Stall recovery, decided by RULE only (no model self-judgment): the last
+                // transcript turn is a synthetic API-error/limit line, or the idle pane
+                // still shows an error banner ⇒ a turn died mid-work. Send the resume
+                // instruction instead of the plain warmer.
+                const stalled = kc.resumeOnStall && (transcriptStalled(a.jsonlPath) || paneIsStalled(paneTail));
                 k.pinging = true;
                 k.pingMtime = k.lastMs; // settles when a newer turn (the ping's own) appears
-                await fireKeepalive(a);
+                await fireKeepalive(a, stalled);
             }
         }
         catch (e) {
@@ -3384,6 +3680,7 @@ export const startMirror = (deps) => {
         attach,
         peers,
         peekPane,
+        peekTurns,
         isBusy,
         lastText,
         status: () => {
@@ -3543,7 +3840,7 @@ export const startMirror = (deps) => {
                 // 队列内单条失败已在 sendStandalone 里 warn 过, 这里吞掉, 不阻塞发卡。
             }
         },
-        injectText: async (target, text) => {
+        injectText: async (target, text, origin) => {
             // Lazy restore, same as dispatch: a peer session that hasn't been talked
             // to in this process lifetime (or any session after a reload) has an empty
             // in-memory slot but a perfectly good persisted binding. Without this, an
@@ -3557,6 +3854,10 @@ export const startMirror = (deps) => {
             // recentInjects dedupe (otherwise the user sees their own demo prompt
             // echoed back as a quoted bubble).
             rememberInject(text);
+            // 印章要早于 inject 落地 —— tail 是独立轮询的, 它可能在 inject 的 promise
+            // resolve 之前就看到 user 行并开出 turn, 那时归因必须已经在位。
+            if (origin)
+                a.pendingOrigin = { origin, at: Date.now() };
             const sid = a.sessionId;
             const paneAlive = a.tmuxPane ? await tmuxPaneAlive(a.tmuxPane) : false;
             if (!paneAlive) {
@@ -3576,23 +3877,40 @@ export const startMirror = (deps) => {
             }
             // freshSpawn: true — the pane was just minted by /mirror/spawn, the TUI
             // is still warming up so the verifier in injectViaTmux needs the slack.
-            return await inject({
+            const r = await inject({
                 text, images: [], cfg, log: log.child({ principal: target, sessionId: sid, sub: "init-demo" }),
                 sessionId: sid, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane, freshSpawn: true,
             });
+            // 与 dispatch 同一约定: 首条 inject 落地 = 解除新 pane 的初始输出静默。
+            // 漏掉这一步的后果不只是少几条气泡 —— onItem 在 mute 分支整体早退, 连
+            // recordTurnStart 都不会跑, 于是 graph/send_peer 拉起来的节点在 chat 列表
+            // 和 chat 详情里彻底不存在(它从来没被 WeCom 侧 dispatch 过, 没有第二次机会)。
+            if (r.ok) {
+                a.muteUntilInject = false;
+                a.justSpawned = false;
+            }
+            return r;
         },
-        interruptPane: async (target) => {
+        interruptPane: async (target, opts) => {
             const a = byTarget.get(target);
             if (!a)
                 return { ok: false, reason: "no mirror attached for target" };
-            if (!a.tmuxPane)
+            // `/stop` (teardown: true) must work when tmux itself is the problem, so
+            // the order is: local state first, pane second. The old implementation
+            // probed the pane FIRST and returned early on failure — meaning a wedged
+            // tmux server left the user with a "…" bubble that /stop could not close
+            // and an inject queue no message could get past. Callers that only want
+            // an Esc (the `.claude/**` guard's cancel) pass no opts and keep the old
+            // pane-only behavior, bubbles untouched.
+            let torndown = 0;
+            if (opts?.teardown) {
+                a.injectGen = (a.injectGen ?? 0) + 1; // disarm a zombie inject's paste
+                abortInjectQueue(a.sessionId); // unblock the next message
+                torndown = teardownOutbound(a); // close every hanging bubble/stream
+            }
+            else if (!a.tmuxPane) {
                 return { ok: false, reason: "no live tmux pane (spawn-mode attachment)" };
-            const alive = await tmuxPaneAlive(a.tmuxPane);
-            if (!alive)
-                return { ok: false, reason: "tmux pane no longer alive" };
-            const r = await tmuxRun(["send-keys", "-t", a.tmuxPane, "Escape"]);
-            if (r.code !== 0)
-                return { ok: false, reason: `send-keys Escape failed: ${r.stdout.slice(-200) || r.code}` };
+            }
             // /stop also pauses keepalive: the user is deliberately quieting this
             // session, so stop poking it too. A real turn (WeCom inbound, or the pane
             // going busy AFTER the resume grace) lifts the pause and re-earns the
@@ -3602,9 +3920,56 @@ export const startMirror = (deps) => {
             a.keepaliveOffAt = Date.now();
             a.keepalive = undefined; // re-anchors cleanly on resume
             persistPause(a); // survive a reload — don't resurrect a quieted session
+            // Best-effort Esc. Every failure mode here is reported, never fatal: the
+            // teardown above already gave the user their chat back.
+            let escOk = false;
+            let escReason = "";
+            if (!a.tmuxPane) {
+                escReason = "spawn-mode attachment (no live tmux pane)";
+            }
+            else if (!(await tmuxPaneAlive(a.tmuxPane))) {
+                escReason = "tmux pane no longer alive";
+            }
+            else {
+                const r = await tmuxRun(["send-keys", "-t", a.tmuxPane, "Escape"]);
+                escOk = r.ok;
+                if (!r.ok)
+                    escReason = `send-keys Escape failed: ${(r.stderr || r.stdout).slice(-200) || r.code}`;
+            }
             // Any in-flight ping's quiet window + detail turn are left to close on their
             // own turn_end (or the 60s fail-safe), so the interrupted pong stays out of chat.
-            log.info({ target, sessionId: a.sessionId, pane: a.tmuxPane }, "mirror /stop — Esc sent to pane, keepalive paused");
+            log.info({ target, sessionId: a.sessionId, pane: a.tmuxPane, torndown, escOk, escReason, gen: a.injectGen }, "mirror /stop — teardown + Esc");
+            // Esc failure is not an overall failure when we tore down: the user asked
+            // for quiet and got it. Without teardown there's nothing else to report,
+            // so keep the old strict contract.
+            if (!opts?.teardown && !escOk)
+                return { ok: false, reason: escReason };
+            return { ok: true, torndown, escOk, escReason: escReason || undefined };
+        },
+        killPane: async (target) => {
+            // paneOf (not byTarget.get) so a binding surviving only in the persisted
+            // store — e.g. after a reload that couldn't re-attach — is still killable.
+            const a = byTarget.get(target);
+            const pane = a?.tmuxPane || paneOf(target);
+            if (!a && !pane)
+                return { ok: false, reason: "no session bound to target" };
+            if (pane && (await tmuxPaneAlive(pane))) {
+                // Esc first, like /stop: a mid-generation CLI gets a beat to unwind and
+                // flush its transcript before the TTY is yanked out from under it.
+                await tmuxRun(["send-keys", "-t", pane, "Escape"]);
+                await sleepMs(250);
+                const r = await tmuxRun(["kill-pane", "-t", pane]);
+                if (r.code !== 0)
+                    return { ok: false, reason: `kill-pane failed: ${r.stdout.slice(-200) || r.code}` };
+            }
+            if (a)
+                detach(a, "/kill");
+            // Drop the persisted record too — keeping it would let the next inbound
+            // resurrect this very session via the dead-pane `--resume` self-heal,
+            // which is the opposite of what /kill means. The chat then auto-spawns a
+            // fresh session on its next message.
+            deps.store.drop(target);
+            log.info({ target, sessionId: a?.sessionId, pane }, "mirror /kill — pane killed, binding dropped");
             return { ok: true };
         },
         submitPane: async (target) => {
@@ -3651,6 +4016,50 @@ export const startMirror = (deps) => {
             log.info({ target, pane, client: best }, "mirror /reveal — tmux client switched");
             return { ok: true };
         },
+        hasLivePane: (sessionId) => Boolean(bySessionId.get(sessionId)?.tmuxPane),
+        answerNativeModal: async (sessionId, opts) => {
+            const a = bySessionId.get(sessionId);
+            if (!a?.tmuxPane)
+                return { status: "no_pane", reason: "no live tmux pane for session" };
+            if (!(await tmuxPaneAlive(a.tmuxPane)))
+                return { status: "no_pane", reason: "tmux pane no longer alive" };
+            const pane = a.tmuxPane;
+            const lg = log.child({ sessionId, pane, sub: "native-modal" });
+            // CC 在 hook 返回**之后**才渲染这个框, 所以进来时它通常还没出现 —— 轮询等它。
+            const POLL_MS = 200;
+            const deadline = Date.now() + Math.max(0, opts.waitMs);
+            let v = await detectModalPicker(pane);
+            while (!v.modal && Date.now() < deadline) {
+                await sleepMs(POLL_MS);
+                v = await detectModalPicker(pane);
+            }
+            // 没等到: 这次 CC 没弹框(会话内已授权过 / 命中盲点判断失误)。无事可做。
+            if (!v.modal)
+                return { status: "no_modal" };
+            const pick = pickModalAnswer(parseModalOptions(v.screen), v.title);
+            if (!pick) {
+                lg.warn({ title: v.title }, "native modal: no trustworthy one-shot option, not pressing");
+                return { status: "unparsable", title: v.title, screen: v.screen };
+            }
+            // 数字键在 CC 的 picker 里即选即确认。按完等一拍回读: 框还在且**标题没变**才
+            // 补一个 Enter(个别布局要显式确认); 标题变了说明弹的已是另一个框 —— 绝不盲按,
+            // 交给兜底路径, 免得替用户确认了他没看过的东西。
+            const SETTLE_MS = 400;
+            await tmuxRun(["send-keys", "-t", pane, String(pick.index)]);
+            await sleepMs(SETTLE_MS);
+            let after = await detectModalPicker(pane);
+            if (after.modal && after.title === v.title) {
+                await tmuxRun(["send-keys", "-t", pane, "Enter"]);
+                await sleepMs(SETTLE_MS);
+                after = await detectModalPicker(pane);
+            }
+            if (after.modal) {
+                lg.warn({ title: after.title, pressed: pick.index }, "native modal: still on pane after answer");
+                return { status: "still_modal", title: after.title, index: pick.index, label: pick.label };
+            }
+            lg.info({ title: v.title, pressed: `${pick.index}. ${pick.label}` }, "native modal answered");
+            return { status: "answered", title: v.title, index: pick.index, label: pick.label };
+        },
         getCwd,
         setPendingCwd,
         newSession,
@@ -3742,6 +4151,11 @@ export const startMirror = (deps) => {
             // immediately — capturing baseline post-inject would already include it,
             // and the watcher would never see a "new" candidate (the bug this fixes).
             const preClearBaseline = armMigration ? listJsonls(dirname(a.jsonlPath)) : undefined;
+            // Registered here, not after the inject: the inject's paste verification
+            // can take ~10s, and a sibling chat's watcher armed earlier must already
+            // see this clear as an overlap by the time it evaluates a candidate.
+            if (armMigration)
+                noteClearInject(a);
             // 记下断点, 由下一轮 (第一轮读不到上文的轮次) 领走。/clear 自己不建 turn,
             // 否则这次清空在 chat 详情里毫无痕迹, 前后两轮看着还是连续的。
             if (armMigration)
@@ -3794,7 +4208,8 @@ export const startMirror = (deps) => {
                 enterDeferred(a, frame, streamId);
             }
             const sid = a.sessionId;
-            await enqueue(sid, async () => {
+            const myGen = a.injectGen ?? 0;
+            await enqueue(sid, () => withInjectWatchdog(a, myGen, async () => {
                 if (s && s.closed)
                     return; // (eager path) superseded by a newer dispatch
                 // Always reincarnate when no live pane: covers (a) pane closed between
@@ -3804,6 +4219,9 @@ export const startMirror = (deps) => {
                 // If respawn fails, fall through to spawn-mode inject for THIS turn
                 // but DON'T erase tmuxSession from store — next inbound will retry,
                 // making the system self-healing instead of one-failure-permanent.
+                // First step of the job and the historical hang point — log BEFORE the
+                // probe so a stall is attributable to it next time, not invisible.
+                log.info({ target: a.target, sessionId: sid, pane: a.tmuxPane, gen: myGen }, "inject job start");
                 const paneAlive = a.tmuxPane ? await tmuxPaneAlive(a.tmuxPane) : false;
                 let freshSpawn = a.justSpawned === true;
                 a.justSpawned = false;
@@ -3855,6 +4273,18 @@ export const startMirror = (deps) => {
                 // surfaces the user's text, and without a pre-recorded entry the
                 // dedupe filter wouldn't suppress it — user's chat msg gets echoed
                 // back as a quoted bubble. Recording up front fixes that.
+                // Last checkpoint before we touch the pane: a `/stop` (or a watchdog
+                // fire) during the respawn above means this text is no longer wanted.
+                // Without this, a tmux server that unwedges after the user gave up would
+                // paste a minutes-old message into a session that has moved on.
+                if ((a.injectGen ?? 0) !== myGen) {
+                    // Lift the spawn mute here too: this inject will never land, so the
+                    // pane's output (including whatever /stop interrupted) would otherwise
+                    // stay swallowed by onItem until some later message injects cleanly.
+                    a.muteUntilInject = false;
+                    log.warn({ target: a.target, sessionId: sid, myGen, gen: a.injectGen }, "inject aborted — superseded by /stop or watchdog");
+                    return;
+                }
                 rememberInject(text);
                 const r = await inject({
                     text, images, cfg, log: log.child({ principal, sessionId: sid }),
@@ -3926,13 +4356,14 @@ export const startMirror = (deps) => {
                 // feedback (the skip-stream path otherwise leaves WeCom silent).
                 if (armMigration) {
                     sendStandalone(a, `cleared\n\n${renderProjectInfo(a.target)}`);
-                    startMigrationWatcher(a, preClearBaseline, jsonlIsPostClearChild, 0);
+                    a.clearRebind = { baseline: preClearBaseline };
+                    startMigrationWatcher(a, preClearBaseline, jsonlIsPostClearChild, 0, true);
                 }
                 // Don't await the stream's lifetime — it stays open until next inbound
                 // or hard timeout. Releasing the inject queue here lets the next
                 // dispatch start its inject promptly while tail content keeps flowing
                 // into the (still-open) stream until superseded.
-            });
+            }));
         },
     };
 };