wezard 2.7.7 → 2.8.0

package/dist/daemon/mirror-bridge.js

@@ -1,7 +1,7 @@
 import { finalId, receiptCoverage, receiptQuiet } from "./message-events.js";
 import { parseEnvelope, renderTail } from "../shared/reminder.js";
 import { codexSessions, codexSessionForPane, recordCodexPaneSession } from "../shared/codex.js";
-import { codexHookLaunchArgs, codexHookCommand } from "../shared/codex-hooks.js";
+import { codexHookLaunchArgs, codexHookCommand, inspectCodexHooks, trustCodexHookSet } from "../shared/codex-hooks.js";
 import { fileURLToPath } from "node:url";
 // Mirror-mode bridge.
 //
@@ -30,7 +30,7 @@ import { withImageClipboard, pasteVerifiedImage } from "./image-input.js";
 import { createKeyedScheduler } from "../shared/keyed-scheduler.js";
 import { withPaneInput } from "./pane-input.js";
 import { activeBackends, resolveCliBackend, backendForPath, projectDirFor, projectDirsFor, } from "../shared/cli-backends.js";
-import { isModalPane, isAskqSubmitPage, parseModalOptions, pickModalAnswer, pickAutoAllowAnswer, parseConfirmContext, modalFingerprint, looksLikePicker } from "../shared/modal-pane.js";
+import { isModalPane, isCodexHookReviewPane, isAskqSubmitPage, parseModalOptions, pickModalAnswer, pickAutoAllowAnswer, parseConfirmContext, modalFingerprint, looksLikePicker } from "../shared/modal-pane.js";
 import { hasMirrorAskq, runMirrorAskqFlow, hasMirrorPlan, mootMirrorPlan, runMirrorPlanFlow, hasMirrorPicker, mootMirrorPicker, runMirrorPickerFlow } from "./approval.js";
 import { isAutoWindowActive } from "./session-cache.js";
 import { noticeSuffixFor } from "./notices.js";
@@ -2046,8 +2046,11 @@ const injectViaTmuxText = async (target, text, log, freshSpawn, witness = NO_WIT
     }
     // 补到头仍没证据: 可能只是渲染/落盘迟到, 也可能根本没提交。
     // 保留 uncertain 阻止重贴, 但不能让只看 ok 的调用方把它当成已送达。
+    // 冷 TUI 的框布局未知时也可能已经提交；同样等原生事件见证，期间不再输入。
+    if (requireEventEvidence && await lateEvidence(LATE_LAND_MS))
+        return { ok: true };
     log.warn({ target, tailFp, freshSpawn, boxTrusted, witness: witness.status }, "mirror inject: submission unconfirmed, stopping input");
-    return { ok: false, uncertain: true, reason: "目标会话未确认收下消息，停止输入以避免误提交或重复投递" };
+    return { ok: false, uncertain: true, reason: "暂时无法确认目标会话是否收到消息，已停止继续输入；为避免重复执行，不会自动重发" };
 };
 const injectViaSpawn = async (args) => {
     const { text, images = [], cfg, log, sessionId, jsonlPath } = args;
@@ -2503,7 +2506,7 @@ export const startMirror = (deps) => {
             return;
         s.flushTimer = setTimeout(() => void flushStream(s), FLUSH_MS);
     };
-    const finalizeStream = async (a, s, timedOut = false) => {
+    const finalizeStream = async (a, s, timedOut = false, stillWanted) => {
         if (s.closed)
             return;
         s.closed = true;
@@ -2534,14 +2537,16 @@ export const startMirror = (deps) => {
                 await s.pending?.catch(() => undefined);
                 if (!eventOwned(s.eventId))
                     return;
-                if (card) {
-                    s.cardSent = true;
-                    await client.replyStreamWithCard(s.frame, s.streamId, withLinkedTag(a, body, undefined, s.turnId), true, { templateCard: card });
-                }
-                else {
-                    await client.replyStream(s.frame, s.streamId, withLinkedTag(a, body, undefined, s.turnId), true);
+                if (stillWanted?.() !== false) {
+                    if (card) {
+                        s.cardSent = true;
+                        await client.replyStreamWithCard(s.frame, s.streamId, withLinkedTag(a, body, undefined, s.turnId), true, { templateCard: card });
+                    }
+                    else {
+                        await client.replyStream(s.frame, s.streamId, withLinkedTag(a, body, undefined, s.turnId), true);
+                    }
+                    log.info({ sessionId: a.sessionId, turnId: s.turnId, accLen: s.acc.length, tools: s.tools.length, withCard: !!card, timedOut }, "stream finalize");
                 }
-                log.info({ sessionId: a.sessionId, turnId: s.turnId, accLen: s.acc.length, tools: s.tools.length, withCard: !!card, timedOut }, "stream finalize");
             }
             catch (e) {
                 log.warn({ sessionId: a.sessionId, turnId: s.turnId, err: e.message }, "stream finalize failed");
@@ -2601,7 +2606,7 @@ export const startMirror = (deps) => {
     // 推到本轮的频道 (人从别的群叫它 → 回那个群)。私聊轮的正文 brief 下在上游
     // turnSilent 已被拦下; 非 brief 的逐条推送在这里兜一道 —— 只放 `[mirror]` /
     // `[wezard]` 系统提示 (它们回 home)。
-    const sendStandalone = (a, content) => {
+    const sendStandalone = (a, content, stillWanted) => {
         const eventId = a.activeEventId;
         if (!hasVisibleBody(content) || !eventOwned(eventId))
             return;
@@ -2614,7 +2619,7 @@ export const startMirror = (deps) => {
         a.standalonePending = a.standalonePending
             .then(async () => {
             for (const c of chunks) {
-                if (!eventOwned(eventId))
+                if (!eventOwned(eventId) || stillWanted?.() === false)
                     return;
                 try {
                     const ack = await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content: c } });
@@ -5999,8 +6004,339 @@ export const startMirror = (deps) => {
     // One pool for the picker sentinel's pane probes: slow panes do not stall
     // other panes, and scans on the same pane never overlap.
     const maintenance = createKeyedScheduler(4);
+    let hookReviewStopping = false;
+    const hookReviews = new Map();
+    const hookReviewBySession = new Map();
+    const hookCardFailures = new Map();
+    const hookDetails = (hooks) => {
+        const allEnabled = hooks.every((hook) => hook.enabled);
+        const items = hooks.map((hook, index) => [
+            `${index + 1}. Codex hook`,
+            `source: ${hook.sourcePath}`,
+            `event: ${hook.eventName}`,
+            `matcher: ${hook.matcher}`,
+            `key: ${hook.key}`,
+            `enabled: ${hook.enabled}`,
+            `trust: ${hook.trustStatus}`,
+            `hash: ${hook.currentHash}`,
+            `command: ${hook.command}`,
+        ].join("\n")).join("\n\n");
+        return `Codex 待审 hooks 清单（${allEnabled ? "以下 hooks 均已启用" : "逐项审查"}）：\n\n${items}`;
+    };
+    const renderHookReviewCard = (id, hooks, status = "选择操作") => ({
+        card_type: "vote_interaction",
+        source: { desc: "Codex hook 信任审查" },
+        main_title: { title: `${hooks.length} 个 Codex hooks 需要审查` },
+        task_id: id,
+        checkbox: { question_key: "action", mode: 0, option_list: [
+                { id: "review", text: "查看 hooks" },
+                { id: "trust", text: "精确授信并继续" },
+                { id: "skip", text: "不授信并继续" },
+            ] },
+        submit_button: { text: status, key: `codex-hook-review:${id}:submit` },
+    });
+    const renderHookReviewProgress = (id, status) => ({
+        card_type: "vote_interaction", source: { desc: "Codex hook 信任审查" },
+        main_title: { title: status }, task_id: id,
+        checkbox: { question_key: "status", mode: 0, option_list: [{ id: "pending", text: "请稍候" }] },
+        submit_button: { text: "处理中…", key: `codex-hook-review:${id}:pending` },
+    });
+    const sendHookDetails = async (review) => {
+        const content = hookDetails(review.hooks);
+        const chatId = replyChatId(review.a);
+        const chunks = splitMarkdown(withLinkedTag(review.a, content), Math.max(200, cfg.wrc.mirror.chunkBytes - TAG_HEADER_BUDGET));
+        for (const chunk of chunks) {
+            if (!review.valid())
+                return;
+            await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content: chunk } });
+        }
+    };
+    const sendHookResult = async (review, text) => {
+        for (let attempt = 0; attempt <= 5; attempt++) {
+            if (!review.canNotify())
+                return false;
+            try {
+                await client.sendMessage(replyChatId(review.a), { msgtype: "markdown", markdown: { content: withLinkedTag(review.a, text) } });
+                return true;
+            }
+            catch (error) {
+                log.warn({ err: errText(error), id: review.id, attempt }, "Codex hook result delivery failed; retrying");
+                if (attempt < 5)
+                    await sleep(Math.min(60_000, 2_000 * 2 ** attempt));
+            }
+        }
+        if (review.canNotify() && review.frame) {
+            try {
+                await client.updateTemplateCard(review.frame, renderHookReviewProgress(review.id, "结果消息发送失败，请查看本机 CLI"));
+            }
+            catch (fallbackError) {
+                log.error({ err: errText(fallbackError), id: review.id }, "Codex hook result and fallback card delivery failed");
+            }
+        }
+        return false;
+    };
+    const codexPid = async (pane) => {
+        const root = await panePidOf(pane);
+        const ps = await psSnap();
+        const pids = new Set([...ps.commands].filter(([, command]) => basename(command) === "codex").map(([pid]) => pid));
+        return root ? registeredPidUnder(root, pids, ps.kids) : undefined;
+    };
+    const chooseCodexHookOption = async (review, v, index, live) => {
+        if (!isCodexHookReviewPane(v.screen) || modalFingerprint(v.screen) !== review.fingerprint)
+            return false;
+        const options = parseModalOptions(v.screen);
+        const target = options.find((option) => option.index === index);
+        if ((index === 2 && target?.label !== "Trust all and continue")
+            || (index === 3 && !/^Continue without trusting\b/u.test(target?.label ?? "")))
+            return false;
+        let selected = options.find((option) => option.selected)?.index;
+        if (!target || selected === undefined)
+            return false;
+        for (let n = 0; selected !== index && n < options.length; n++) {
+            if (!(await live()))
+                return false;
+            await runTmux(["send-keys", "-t", review.pane, selected < index ? "Down" : "Up"]);
+            await sleep(MODAL_ARROW_SETTLE_MS);
+            const next = await detectModalPicker(review.pane);
+            if (!(await live()) || !isCodexHookReviewPane(next.screen) || modalFingerprint(next.screen) !== review.fingerprint)
+                return false;
+            selected = parseModalOptions(next.screen).find((option) => option.selected)?.index;
+            if (selected === undefined)
+                return false;
+        }
+        const current = await detectModalPicker(review.pane);
+        if (!(await live()) || !isCodexHookReviewPane(current.screen) || modalFingerprint(current.screen) !== review.fingerprint
+            || parseModalOptions(current.screen).find((option) => option.selected)?.index !== index)
+            return false;
+        if (!(await runTmux(["send-keys", "-t", review.pane, "Enter"])).ok)
+            return false;
+        for (let end = Date.now() + 3000; Date.now() < end; await sleep(100)) {
+            const after = await detectModalPicker(review.pane);
+            if (!(await live()))
+                return false;
+            if (!isCodexHookReviewPane(after.screen))
+                return Boolean(after.screen.trim());
+        }
+        return false;
+    };
+    client.on("event.template_card_event", async (frame) => {
+        const ev = frame.body?.event;
+        const key = ev?.template_card_event?.event_key ?? ev?.event_key ?? "";
+        const match = /^codex-hook-review:([^:]+):submit$/u.exec(key);
+        const review = match ? hookReviews.get(match[1]) : undefined;
+        if (!review || !review.valid())
+            return;
+        const selected = ev?.template_card_event?.selected_items;
+        const first = Array.isArray(selected) ? selected[0] : selected?.selected_item?.[0];
+        const optionIds = first?.option_ids;
+        const action = (Array.isArray(optionIds) ? optionIds : optionIds?.option_id ?? [])[0];
+        if (action === "review") {
+            try {
+                await client.updateTemplateCard(frame, renderHookReviewCard(review.id, review.hooks));
+            }
+            catch (error) {
+                log.warn({ err: errText(error), id: review.id }, "Codex hook review card reset failed");
+            }
+            try {
+                await sendHookDetails(review);
+            }
+            catch (error) {
+                log.warn({ err: errText(error), pane: review.pane }, "Codex hook detail delivery failed");
+                await sendHookResult(review, "完整 hook 清单发送失败；请稍后重试查看，未执行任何授权。");
+            }
+            return;
+        }
+        if (action !== "trust" && action !== "skip")
+            return;
+        if (review.busy)
+            return;
+        review.busy = true;
+        review.frame = frame;
+        try {
+            await client.updateTemplateCard(frame, renderHookReviewProgress(review.id, "正在处理 Codex hooks"));
+        }
+        catch (error) {
+            log.warn({ err: errText(error), id: review.id }, "Codex hook processing card update failed");
+        }
+        if (!review.valid()) {
+            review.busy = false;
+            return;
+        }
+        let status = "授权未完成；确认卡已失效";
+        let terminal = false;
+        try {
+            const result = await withPaneInput(review.pane, async (live) => {
+                const valid = async () => {
+                    if (!review.valid() || !live() || await panePidOf(review.pane) !== review.rootPid)
+                        return false;
+                    const currentSession = codexSessionForPane(review.pane, cfg.daemon.stateDir)?.sessionId;
+                    if (currentSession && currentSession !== review.sid)
+                        return false;
+                    return await codexPid(review.pane) === review.pid;
+                };
+                if (!(await valid()))
+                    return "pane 身份已变化，未执行操作";
+                let before = await detectModalPicker(review.pane);
+                if (!isCodexHookReviewPane(before.screen) || modalFingerprint(before.screen) !== review.fingerprint)
+                    return "弹窗已变化或已由本地处理，未执行操作";
+                const backend = backendForPath(review.a.jsonlPath);
+                const homeDir = expandHome(backend.homeDir);
+                const current = await inspectCodexHooks(backend.bin, review.a.runningCwd, [], homeDir);
+                if (!(await valid()))
+                    return "daemon 已停止或 pane 身份改变；未执行操作";
+                const currentByKey = new Map(current.map((hook) => [hook.key, hook]));
+                if (review.hooks.some((hook) => {
+                    const now = currentByKey.get(hook.key);
+                    return !now || !now.enabled || now.sourcePath !== hook.sourcePath || now.currentHash !== hook.currentHash
+                        || now.eventName !== hook.eventName || now.command !== hook.command || now.matcher !== hook.matcher;
+                }))
+                    return "Codex hooks changed since review; 卡片已失效，未继续";
+                const pending = current.filter((hook) => hook.enabled && hook.trustStatus !== "trusted");
+                const reviewedKeys = new Set(review.hooks.map((hook) => hook.key));
+                if (pending.some((hook) => !reviewedKeys.has(hook.key)))
+                    return "出现未展示的待审 hook；卡片已失效，未继续";
+                // “Trust all” can authorize hooks outside this card. Exact hashes have
+                // been persisted and verified above; continue via the native skip path.
+                const option = 3;
+                if (action === "trust") {
+                    if (pending.length) {
+                        await trustCodexHookSet(backend.bin, review.a.runningCwd, homeDir, pending.map(({ key, currentHash, sourcePath }) => ({ key, currentHash, sourcePath })), valid);
+                    }
+                    if (!(await valid()))
+                        return "hash 已写入，但 pane 身份改变；请在 CLI 核对继续状态";
+                    const verified = await inspectCodexHooks(backend.bin, review.a.runningCwd, [], homeDir);
+                    if (!(await valid()))
+                        return "daemon 已停止或 pane 身份改变；未继续操作";
+                    if (review.hooks.some((hook) => {
+                        const now = verified.find((item) => item.key === hook.key);
+                        return !now || !now.enabled || now.sourcePath !== hook.sourcePath || now.currentHash !== hook.currentHash
+                            || now.eventName !== hook.eventName || now.command !== hook.command || now.matcher !== hook.matcher;
+                    }) || verified.some((hook) => hook.enabled && hook.trustStatus !== "trusted"
+                        && !review.hooks.some((item) => item.key === hook.key))) {
+                        return "hash 验证后 hook 集发生变化；弹窗已失效，未继续";
+                    }
+                    const afterTrust = await detectModalPicker(review.pane);
+                    if (!afterTrust.modal)
+                        return "审查清单中的 hook 已精确授信；弹窗已消失，未代为继续";
+                    if (!isCodexHookReviewPane(afterTrust.screen) || modalFingerprint(afterTrust.screen) !== review.fingerprint) {
+                        return "hash 已验证，但弹窗已变化；请在 CLI 核对继续状态";
+                    }
+                    before = afterTrust;
+                }
+                const liveGuard = valid;
+                const pressed = await chooseCodexHookOption(review, before, option, liveGuard);
+                if (!pressed)
+                    return action === "trust"
+                        ? "hash 已按审查清单写入并验证；CLI 确认未完成，请在本地继续"
+                        : "未信任任何 hook；CLI 确认未完成，请在本地继续";
+                return action === "trust"
+                    ? "审查清单中的 hook 已精确授信；本次启动选择了不信任继续，hooks 本次不会运行"
+                    : "未信任 hook，Codex 已继续；hooks 本次不会运行";
+            }, { guard: review.valid });
+            status = result;
+            terminal = /Codex 已继续|本次启动选择了不信任继续/u.test(result);
+        }
+        catch (error) {
+            status = `授权未完成：${errText(error)}`;
+            log.warn({ err: errText(error), pane: review.pane }, "Codex hook trust action failed");
+        }
+        review.resultPending = true;
+        await sendHookResult(review, status);
+        review.resultPending = false;
+        review.busy = false;
+        if (terminal || /弹窗已变化|pane 身份已变化|卡片已失效|未展示的待审 hook|hook 集发生变化/u.test(status)) {
+            review.active = false;
+            hookReviews.delete(review.id);
+            hookReviewBySession.delete(review.sid);
+            review.valid = () => false;
+        }
+    });
     const maintenanceValid = (a, pane, sid, gen, signal) => !signal.aborted && byTarget.get(a.target) === a && a.tmuxPane === pane && a.sessionId === sid
         && (a.injectGen ?? 0) === gen && !a.migrationWatcher;
+    const codexHookReviewOne = async (a, pane, sid, gen, signal) => {
+        const v = await detectModalPicker(pane);
+        if (!isCodexHookReviewPane(v.screen)) {
+            const stale = hookReviewBySession.get(sid);
+            if (stale) {
+                const previous = hookReviews.get(stale);
+                if (previous?.busy || previous?.resultPending)
+                    return;
+                if (previous)
+                    previous.active = false;
+                hookReviewBySession.delete(sid);
+                hookReviews.delete(stale);
+            }
+            a.pickerSentinelFp = undefined;
+            return;
+        }
+        if (hookReviewBySession.has(sid))
+            return;
+        const fingerprint = modalFingerprint(v.screen);
+        const failure = hookCardFailures.get(sid);
+        if (failure?.fingerprint === fingerprint && Date.now() < failure.retryAt)
+            return;
+        if (failure && failure.fingerprint !== fingerprint)
+            hookCardFailures.delete(sid);
+        const rootPid = await panePidOf(pane);
+        const pid = await codexPid(pane);
+        const currentSession = codexSessionForPane(pane, cfg.daemon.stateDir)?.sessionId;
+        if (!rootPid || !pid || (currentSession && currentSession !== sid)
+            || byTarget.get(a.target) !== a || a.tmuxPane !== pane || a.sessionId !== sid || (a.injectGen ?? 0) !== gen)
+            return;
+        const backend = backendForPath(a.jsonlPath);
+        let hooks;
+        try {
+            hooks = await inspectCodexHooks(backend.bin, a.runningCwd, [], expandHome(backend.homeDir));
+        }
+        catch (error) {
+            log.warn({ err: errText(error), target: a.target }, "Codex hook review enumeration failed");
+            return;
+        }
+        const pending = hooks.filter((hook) => hook.enabled && hook.trustStatus !== "trusted");
+        const summary = /(?:^|\n)\s*(\d+)\s+hooks?\s+(?:is|are)\s+new or changed\./iu.exec(v.screen);
+        if (!summary || Number(summary[1]) !== pending.length || !pending.length || pending.some((hook) => !hook.key || !hook.eventName || !hook.sourcePath
+            || !hook.currentHash || !/^sha256:[0-9a-f]{64}$/iu.test(hook.currentHash) || !hook.command)) {
+            log.info({ target: a.target, screenCount: summary?.[1], count: pending.length }, "Codex hook review not forwarded: incomplete or empty review set");
+            return;
+        }
+        const id = randomUUID();
+        const review = {
+            id, a, pane, sid, gen, pid, rootPid, fingerprint, screen: v.screen,
+            hooks: pending, busy: false, active: true, signal,
+            valid: () => review.active && !hookReviewStopping && !maintenance.signal.aborted && !signal.aborted
+                && byTarget.get(a.target) === a && a.tmuxPane === pane && a.sessionId === sid
+                && (a.injectGen ?? 0) === gen && !a.migrationWatcher,
+            canNotify: () => !hookReviewStopping && !maintenance.signal.aborted && !signal.aborted,
+        };
+        try {
+            const chatId = replyChatId(a);
+            const chunks = splitMarkdown(withLinkedTag(a, hookDetails(pending)), Math.max(200, cfg.wrc.mirror.chunkBytes - TAG_HEADER_BUDGET));
+            for (const content of chunks) {
+                if (!review.valid())
+                    return;
+                await client.sendMessage(chatId, { msgtype: "markdown", markdown: { content } });
+            }
+            if (!review.valid())
+                return;
+            hookReviews.set(id, review);
+            hookReviewBySession.set(sid, id);
+            await client.sendMessage(chatId, { msgtype: "template_card", template_card: renderHookReviewCard(id, pending) });
+            hookCardFailures.delete(sid);
+            a.pickerSentinelFp = v.screen;
+            log.info({ target: a.target, sessionId: sid, id, count: pending.length }, "Codex hook review card sent");
+        }
+        catch (error) {
+            review.active = false;
+            hookReviews.delete(id);
+            hookReviewBySession.delete(sid);
+            const previous = hookCardFailures.get(sid);
+            const attempts = previous?.fingerprint === fingerprint ? previous.attempts + 1 : 1;
+            const retryMs = Math.min(5 * 60_000, 5_000 * 2 ** (attempts - 1));
+            hookCardFailures.set(sid, { fingerprint, attempts, retryAt: Date.now() + retryMs });
+            a.pickerSentinelFp = v.screen;
+            log.warn({ err: errText(error), target: a.target, attempts, retryMs }, "Codex hook review card send failed; retry backed off");
+        }
+    };
     // ── 原生权限 picker 哨兵 ──────────────────────────────────────────────
     // CodeBuddy 对一部分调用先弹自家权限 picker、PreToolUse hook 在人点掉之后才
     // 触发 / 根本不触发 (与 AskUserQuestion 的「本地面板先行」同源; 实测命中: 子代理
@@ -6013,7 +6349,7 @@ export const startMirror = (deps) => {
     //     对应选项; 本地先按掉则 moot 作废卡。代按/发卡都发 chat 回执留痕。
     // WEZARD_PICKER_SENTINEL=0 整体关闭。
     const pickerOne = async (a, pane, sid, gen, signal) => {
-        const guard = () => maintenanceValid(a, pane, sid, gen, signal) && cfg.approval.enabled
+        const guard = () => maintenanceValid(a, pane, sid, gen, signal) && (cliOf(a) === "codex" || cfg.approval.enabled)
             && process.env.WEZARD_PICKER_SENTINEL !== "0";
         if (!guard())
             return;
@@ -6021,12 +6357,14 @@ export const startMirror = (deps) => {
             const valid = () => guard() && live();
             if (!a.tmuxPane || a.migrationWatcher)
                 return;
-            // Codex PermissionRequest has its own independent native gate. Screen
-            // options, tool windows and skipAll never authorize its sandbox.
-            if (cliOf(a) === "codex")
-                return;
             if (!(await tmuxPaneAlive(pane)) || !valid())
                 return;
+            // Hook trust is a distinct startup gate: enumerate and display its exact
+            // hash set; ordinary tool approval rules have no authority over it.
+            if (cliOf(a) === "codex") {
+                await codexHookReviewOne(a, pane, sid, gen, signal);
+                return;
+            }
             const v = await detectModalPicker(pane);
             if (!valid())
                 return;
@@ -6123,10 +6461,10 @@ export const startMirror = (deps) => {
         }, { guard });
     };
     const pickerTick = () => {
-        if (!cfg.approval.enabled || process.env.WEZARD_PICKER_SENTINEL === "0")
+        if (process.env.WEZARD_PICKER_SENTINEL === "0")
             return;
         for (const a of byTarget.values()) {
-            if (!a.tmuxPane || cliOf(a) === "codex")
+            if (!a.tmuxPane || (cliOf(a) !== "codex" && !cfg.approval.enabled))
                 continue;
             const pane = a.tmuxPane, sid = a.sessionId, gen = a.injectGen ?? 0;
             void maintenance.schedule(`picker:${a.target}`, pane, (signal) => pickerOne(a, pane, sid, gen, signal))
@@ -6635,7 +6973,7 @@ export const startMirror = (deps) => {
                 const resumeBaseline = listJsonls(dirname(a.jsonlPath));
                 const r = await spawnTmuxClaude({ cfg, log: log.child({ sub: "respawn-init", sessionId: sid }), resumeSessionId: sid, windowName: displayName(target) || target, cwdOverride: a.runningCwd, cli: backendForPath(a.jsonlPath).name, ...respawnSpec(a), systemPrompt: charterFor(target, { cwd: a.runningCwd, cli: backendForPath(a.jsonlPath).name }) });
                 if (!r.ok || !r.tmuxPane)
-                    return { ok: false, retryable: true, reason: `respawn failed: ${r.reason ?? "unknown"}` };
+                    return { ok: false, retryable: r.retryable !== false, reason: `respawn failed: ${r.reason ?? "unknown"}` };
                 if (!permitted() || a.tmuxPane !== probedPane) {
                     // This pane was born for an unsubmitted injection. Never kill the old
                     // executor or bind the withdrawn birth. A failed cleanup is explicitly
@@ -6702,6 +7040,8 @@ export const startMirror = (deps) => {
         interruptPane: async (target, opts) => {
             if (opts?.guard && !opts.guard())
                 return { ok: false, reason: "interrupt authority changed" };
+            if (opts?.teardown)
+                deps.events?.cancel((e) => e.target === target);
             const a = byTarget.get(target);
             if (!a)
                 return { ok: false, reason: "no mirror attached for target" };
@@ -7020,9 +7360,15 @@ export const startMirror = (deps) => {
         onSpawn,
         onContextCut,
         shutdown: () => {
+            hookReviewStopping = true;
             clearInterval(paneDriftTimer);
             clearInterval(pickerTimer);
             maintenance.stop();
+            for (const review of hookReviews.values())
+                review.active = false;
+            hookReviews.clear();
+            hookReviewBySession.clear();
+            hookCardFailures.clear();
             for (const a of bySessionId.values()) {
                 if (a.outbound?.kind === "deferred")
                     clearTimeout(a.outbound.timer);
@@ -7243,6 +7589,13 @@ export const startMirror = (deps) => {
                     // Respawn in the binding's runningCwd (pendingCwd doesn't apply to a
                     // mid-turn reincarnation — only /new and /clear-with-pending swap cwd).
                     const r = await spawnTmuxClaude({ cfg, log: log.child({ sub: "respawn", sessionId: sid }), resumeSessionId: sid, windowName: displayName(a.target) || a.target, cwdOverride: a.runningCwd, cli: backendForPath(a.jsonlPath).name, ...respawnSpec(a), systemPrompt: charterFor(a.target, { cwd: a.runningCwd, cli: backendForPath(a.jsonlPath).name }) });
+                    if (byTarget.get(a.target) !== a || a.sessionId !== sid || (a.injectGen ?? 0) !== myGen || (guard && !guard())) {
+                        // A stop or replacement during startup revokes this birth before binding.
+                        if (r.tmuxPane)
+                            await runTmux(["kill-pane", "-t", r.tmuxPane]);
+                        onSubmitted?.({ ok: false, retryable: false, reason: "respawn permission withdrawn; binding withheld" });
+                        return;
+                    }
                     if (r.ok && r.tmuxPane && r.tmuxSession) {
                         a.tmuxPane = r.tmuxPane;
                         a.tmuxSession = r.tmuxSession;
@@ -7275,7 +7628,7 @@ export const startMirror = (deps) => {
                         // store still reflects "user wanted tmux" — next turn retries.
                         log.error({ reason: r.reason }, "mirror: tmux respawn failed");
                         if (eventId) {
-                            onSubmitted?.({ ok: false, retryable: true, reason: `respawn failed: ${r.reason ?? "unknown"}` });
+                            onSubmitted?.({ ok: false, retryable: r.retryable !== false, reason: `respawn failed: ${r.reason ?? "unknown"}` });
                             if (s)
                                 await finalizeStream(a, s);
                             if (a.outbound?.kind === "deferred")
@@ -7318,12 +7671,23 @@ export const startMirror = (deps) => {
                 // 不许退化成 spawn-mode (`--resume -p`) 的无窗口注入。忙闲交给 CLI 自己的输入队列:
                 // 贴进运行中的一轮会被记成 queued 轮, 等它在 transcript 露面再接上这条 event。
                 // slash 命令要等闲, 那一道在上面 (dispatch 开头) 已经拦过了。
-                const r = await inject({
+                let r = await inject({
                     text: effText, images: effImages, cfg, log: log.child({ principal, sessionId: sid }),
                     sessionId: sid, eventId, jsonlPath: a.jsonlPath, tmuxTarget: a.tmuxPane, freshSpawn,
                     requireIdle: eventId ? () => true : undefined,
                     guard: (phase, identity) => byTarget.get(a.target) === a && a.tmuxPane === injectPane && (a.injectGen ?? 0) === myGen && (!guard || guard(phase, identity)),
                 });
+                // 注入失败可以迟于转录消费；只认这一笔在原绑定转录里的标记，不用别轮产出猜 ACK。
+                const submissionConfirmed = () => {
+                    const event = eventId ? deps.events?.get(eventId) : undefined;
+                    return !!event && !event.canceled
+                        && (event.exposure === "consumed" || event.execution === "complete"
+                            || !!event.transcript && submittedEventSince([{ path: event.transcript, offset: 0 }], event.id, event.at));
+                };
+                if (!r.ok && r.uncertain && submissionConfirmed()) {
+                    log.info({ target: a.target, eventId, reason: r.reason }, "mirror inject: late failure superseded by event submission evidence");
+                    r = { ok: true };
+                }
                 onSubmitted?.(r);
                 if (!r.ok) {
                     // retryable = 一个字都没进输入框, 消息事件层会稍后重投 —— 不是失败, 别报 ✗
@@ -7336,10 +7700,14 @@ export const startMirror = (deps) => {
                         a.outbound = undefined;
                         return;
                     }
-                    const note = `[mirror] ✗ ${r.reason ?? "failed"}`;
+                    const note = r.uncertain
+                        ? "[mirror] ⚠ 暂时无法确认目标会话是否收到消息，已停止继续输入；为避免重复执行，不会自动重发"
+                        : `[mirror] ✗ ${r.reason ?? "failed"}`;
+                    // 提示也会排发送队列；真正发出前再认一次同事件证据，撤销过期告警。
+                    const stillWanted = () => !r.uncertain || !submissionConfirmed();
                     if (s) {
                         s.acc = s.acc ? `${s.acc}\n\n${note}` : note;
-                        await finalizeStream(a, s);
+                        await finalizeStream(a, s, false, stillWanted);
                     }
                     else if (armMigration) {
                         // /clear path has no live stream — surface failure as a one-shot
@@ -7356,7 +7724,7 @@ export const startMirror = (deps) => {
                         if (a.outbound?.kind === "deferred")
                             clearTimeout(a.outbound.timer);
                         a.outbound = undefined;
-                        sendStandalone(a, note);
+                        sendStandalone(a, note, stillWanted);
                     }
                     return;
                 }