diff --git a/.github/workflows/windows-recovery.yml b/.github/workflows/windows-recovery.yml
index ce46dd16036..875346adf0b 100644
--- a/.github/workflows/windows-recovery.yml
+++ b/.github/workflows/windows-recovery.yml
@@ -53,14 +53,14 @@ on:
   pull_request:
     branches: [main]
     paths:
-      - 'package-lock.json'
-      - 'patches/**'
-      - 'scripts/apply-dependency-patches.mjs'
-      - 'scripts/install-electron-with-retry.mjs'
-      - 'scripts/run-electron-installer.cjs'
-      - 'scripts/clean-build.mjs'
-      - 'scripts/clean-paths.mjs'
-      - 'scripts/windows-runtime-host-local-ipc-trust.ps1'
+      - "package-lock.json"
+      - "patches/**"
+      - "scripts/apply-dependency-patches.mjs"
+      - "scripts/install-electron-with-retry.mjs"
+      - "scripts/run-electron-installer.cjs"
+      - "scripts/clean-build.mjs"
+      - "scripts/clean-paths.mjs"
+      - "scripts/windows-runtime-host-local-ipc-trust.ps1"
       # Every file in the import closure of the suites below that branches on
       # `process.platform === 'win32'`. Generated, not curated:
       # `scripts/windows-package-source-closure.test.mjs` recomputes this set
@@ -92,6 +92,7 @@ on:
       - 'packages/runtime-host/src/protocol/skill-catalog.ts'
       - 'packages/runtime-host/src/server/access-credential-store.ts'
       - 'packages/runtime-host/src/server/host-resource-probe.ts'
+      - 'packages/runtime-host/src/server/runtime-resource-coordinator.ts'
       - 'packages/runtime-host/src/server/skill-catalog-repository.ts'
       - 'packages/runtime-host/src/server/skill-catalog-transaction.ts'
       - 'packages/runtime/src/__tests__/owned-child-process.test.ts'
@@ -141,7 +142,7 @@ on:
     branches: [main]
   schedule:
     # Offset from windows-sandbox-w0 so the Windows lanes do not overlap.
-    - cron: '17 8 * * *'
+    - cron: "17 8 * * *"
   workflow_dispatch:
 
 # Pull request pushes supersede each other, keyed on the pull request number
diff --git a/apps/desktop/src/main/__tests__/runtime-host-native-capabilities.test.ts b/apps/desktop/src/main/__tests__/runtime-host-native-capabilities.test.ts
index 6af1ddbf37d..f8ba8a72515 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-native-capabilities.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-native-capabilities.test.ts
@@ -35,6 +35,7 @@ import { buildManagedArtifactPreviewTools } from '../managed-artifact-preview-to
 import { browserOriginAdmission } from '../browser/browser-origin-admission.js';
 import { buildRiveWorkflowTool } from '../rive-workflow-tool.js';
 import { createDesktopNativeCapabilityProvider } from '../runtime-host-native-capabilities.js';
+import { clearPrivateTerminalSurfaces, drainDesktopCaptures, setPrivateTerminalSurface } from '../private-terminal-surfaces.js';
 
 function jsonSchema(schema: Record<string, unknown>): {
   jsonSchema: Record<string, unknown>;
@@ -42,6 +43,33 @@ function jsonSchema(schema: Record<string, unknown>): {
   return { jsonSchema: schema };
 }
 
+test('private terminal visibility fences new computer calls and waits for in-flight capture', async () => {
+  let finish!: () => void;
+  const barrier = new Promise<void>((resolve) => { finish = resolve; });
+  let calls = 0;
+  const provider = createDesktopNativeCapabilityProvider({
+    browserTools: [], resolveBrowserUrl: () => 'https://example.com/', releaseBrowserSession() {},
+    computerUseTools: computerTools(async () => { calls++; await barrier; return { text: 'captured before private input' }; }),
+    releaseDesktopInteractionSession() {},
+  });
+  try {
+    const active = call(provider, computerFrame());
+    setPrivateTerminalSurface(5309, 'private-card', true);
+    let drained = false;
+    const drain = drainDesktopCaptures().then(() => { drained = true; });
+    await Promise.resolve();
+    assert.equal(drained, false);
+    await assert.rejects(call(provider, computerFrame()), /private terminal/);
+    finish();
+    await active;
+    await drain;
+    assert.equal(calls, 1);
+    clearPrivateTerminalSurfaces(5309);
+    await call(provider, computerFrame());
+    assert.equal(calls, 2);
+  } finally { finish(); clearPrivateTerminalSurfaces(5309); }
+});
+
 test('Artifact preview is discoverable and admitted without a pre-existing browser origin', async () => {
   let invoked = false;
   const provider = createDesktopNativeCapabilityProvider({
diff --git a/apps/desktop/src/main/__tests__/runtime-host-shell-runs-private-surface.test.ts b/apps/desktop/src/main/__tests__/runtime-host-shell-runs-private-surface.test.ts
new file mode 100644
index 00000000000..0d7f7f1b64a
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/runtime-host-shell-runs-private-surface.test.ts
@@ -0,0 +1,105 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import type { IpcHandler } from "../ipc-reconnect-policy.js";
+import {
+  clearPrivateTerminalSurfaces,
+  hasPrivateTerminalSurface,
+} from "../private-terminal-surfaces.js";
+import { registerRuntimeHostShellRunsIpc } from "../runtime-host-shell-runs-ipc-main.js";
+
+const identity = {
+  action: "ready" as const,
+  sessionId: "session-1",
+  requestId: "request-1",
+  controllerId: "controller-1",
+};
+
+function harness(controlTerminalHandoff: (input: unknown) => Promise<unknown>) {
+  const handlers = new Map<string, IpcHandler>();
+  const registration = registerRuntimeHostShellRunsIpc(
+    {
+      client: { controlTerminalHandoff } as never,
+      terminalCloses: {} as never,
+      sessionObserver: {
+        async observe() {},
+        async unobserve() {},
+      },
+    },
+    {
+      handle(channel, handler) {
+        handlers.set(channel, handler);
+      },
+    },
+  );
+  const handler = handlers.get("shell-runs:handoff");
+  assert.ok(handler);
+  const sender = {
+    id: 5309,
+    once() {},
+    on() {},
+  };
+  return {
+    invoke: (input: unknown) => handler({ sender } as never, input),
+    close: () => registration.close(),
+  };
+}
+
+test("ready rolls back the private-surface fence when Host admission fails", async () => {
+  clearPrivateTerminalSurfaces(5309);
+  const fixture = harness(async () => {
+    throw new Error("controller conflict");
+  });
+  try {
+    await assert.rejects(fixture.invoke(identity), /controller conflict/);
+    assert.equal(hasPrivateTerminalSurface(), false);
+  } finally {
+    await fixture.close();
+    clearPrivateTerminalSurfaces(5309);
+  }
+});
+
+test("ready retains the fence for human and resumed private displays", async () => {
+  clearPrivateTerminalSurfaces(5309);
+  const replies = [
+    { status: "closed", phase: "closed", nextSequence: 1, closure: "exited" },
+    { status: "ready", phase: "human", nextSequence: 1 },
+    { status: "observed", phase: "human", nextSequence: 1 },
+    { status: "ready", phase: "resumed", nextSequence: 1 },
+    { status: "observed", phase: "resumed", nextSequence: 1 },
+  ];
+  const fixture = harness(async () => replies.shift());
+  try {
+    await fixture.invoke(identity);
+    assert.equal(hasPrivateTerminalSurface(), false);
+    await fixture.invoke(identity);
+    assert.equal(hasPrivateTerminalSurface(), true);
+    await fixture.invoke({ ...identity, action: "release" });
+    assert.equal(hasPrivateTerminalSurface(), false);
+    await fixture.invoke(identity);
+    assert.equal(hasPrivateTerminalSurface(), true);
+    await fixture.invoke({ ...identity, action: "release" });
+    assert.equal(hasPrivateTerminalSurface(), false);
+  } finally {
+    await fixture.close();
+    clearPrivateTerminalSurfaces(5309);
+  }
+});
diff --git a/apps/desktop/src/main/__tests__/terminal-handoff-feedback.test.ts b/apps/desktop/src/main/__tests__/terminal-handoff-feedback.test.ts
new file mode 100644
index 00000000000..6a5964e3dfa
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/terminal-handoff-feedback.test.ts
@@ -0,0 +1,408 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { registerHooks } from 'node:module';
+import { afterEach, test } from 'node:test';
+import { act, createElement } from 'react';
+import { deferred } from '@maka/core/test-only/async-primitives';
+import type { RuntimeResourceHandoffResult } from '@maka/runtime-host/protocol';
+import { LocaleProvider } from '@maka/ui';
+import { terminalFeedback, isValidPrivateTerminalInput, TerminalHandoffPanel, loadSessionTerminalPanelForTest, createFakeWorkbarServices, WorkbarServicesProvider } from '../../renderer/features/workbar/testing.js';
+import type { SessionEvent } from '@maka/core/events';
+import { installReactRenderer, cleanupFakeDom, FakeElement } from './fake-dom.js';
+import { desktopSessionKey } from '../../shared/runtime-host-identity.js';
+
+afterEach(cleanupFakeDom);
+
+test('OpenSSH adapter recognizes a current retry but never infers success from output', () => {
+  const command = '/usr/bin/ssh -tt fixture@localhost';
+  assert.equal(terminalFeedback(command, "fixture@localhost's password: "), 'password');
+  const retry = "fixture@localhost's password: \nPermission denied, please try again.\nfixture@localhost's password: \n\n";
+  assert.equal(terminalFeedback(command, retry), 'authentication_retry');
+  assert.equal(terminalFeedback(command, `${retry}Verification code: `), undefined);
+  assert.equal(terminalFeedback(command, `${retry}AUTHENTICATED\n$ `), undefined);
+  assert.equal(terminalFeedback(command, 'The password was wrong'), undefined);
+});
+
+test('unknown programs, compound commands and unsupported prompts use raw private output', () => {
+  const retry = "Permission denied, please try again.\nfixture@localhost's password: ";
+  for (const command of ['my-ssh-wrapper host', 'sudo ssh host', 'echo ssh host', 'ssh host; other-command']) {
+    assert.equal(terminalFeedback(command, retry), undefined);
+  }
+  assert.equal(terminalFeedback('ssh host', '输入密码：'), undefined);
+  assert.equal(terminalFeedback('ssh host', 'Verification code incorrect'), undefined);
+});
+
+test('private input validation uses bytes and rejects embedded terminal controls before submission', () => {
+  assert.equal(isValidPrivateTerminalInput('密码 with spaces'), true);
+  assert.equal(isValidPrivateTerminalInput('a'.repeat(32 * 1024)), true);
+  for (const value of ['', 'a\nb', 'a\rb', 'a\tb', '\x1b[A', 'a\x7fb', '\ud800', '密'.repeat(11_000)]) {
+    assert.equal(isValidPrivateTerminalInput(value), false);
+  }
+});
+
+function descendants(element: FakeElement): FakeElement[] {
+  return [element, ...element.childNodes.flatMap((child) => child instanceof FakeElement ? descendants(child) : [])];
+}
+
+test('restoration waits for Workbar registration and authoritative phase without flashing an input card', async () => {
+  const { root, container } = installReactRenderer();
+  const surface = deferred<void>();
+  const ready = deferred<RuntimeResourceHandoffResult>();
+  const operations: string[] = [];
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal,
+    handoff: async (operation) => { operations.push(operation.action); return ready.promise; },
+  } });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true,
+      prepareHandoff: () => surface.promise,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'sh' },
+    })),
+  })));
+  const assertLoading = () => {
+    assert.equal(descendants(container).some((node) => ['HEADER', 'INPUT', 'BUTTON', 'DETAILS'].includes(node.tagName)), false);
+    assert.ok(descendants(container).some((node) => node.getAttribute('aria-busy') === 'true'));
+  };
+  assertLoading();
+  assert.deepEqual(operations, []);
+  await act(async () => surface.resolve());
+  assert.deepEqual(operations, ['ready']);
+  assertLoading();
+  await act(async () => ready.resolve({ status: 'observed', phase: 'resumed', nextSequence: 2, display: { text: 'restored-result' } }));
+  assert.match(container.textContent, /restored-result/);
+  assert.equal(descendants(container).some((node) => node.getAttribute('data-testid') === 'terminal-handoff'), false);
+  await act(async () => root.unmount());
+});
+
+test('leaving during Workbar registration never acquires a hidden terminal controller', async () => {
+  const { root } = installReactRenderer();
+  const surface = deferred<void>();
+  const operations: string[] = [];
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal,
+    handoff: async (operation) => { operations.push(operation.action); return { status: 'ready', phase: 'human', nextSequence: 1 }; },
+  } });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true,
+      prepareHandoff: () => surface.promise,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'sh' },
+    })),
+  })));
+  await act(async () => root.unmount());
+  await act(async () => surface.resolve());
+  assert.deepEqual(operations, ['release']);
+});
+
+test('failed Workbar registration offers reconnect and can recover without submitting input', async () => {
+  const { root, container } = installReactRenderer();
+  let registrations = 0;
+  const operations: string[] = [];
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal,
+    handoff: async (operation) => { operations.push(operation.action); return { status: 'ready', phase: 'human', nextSequence: 1 }; },
+  } });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true,
+      prepareHandoff: async () => { if (++registrations === 1) throw new Error('disconnected'); },
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'sh' },
+    })),
+  })));
+  assert.match(container.textContent, /Connection lost/);
+  assert.equal(operations.includes('ready'), false);
+  const reconnect = descendants(container).find((node) => node.tagName === 'BUTTON' && node.textContent === 'Reconnect to original terminal')!;
+  const key = Object.keys(reconnect).find((name) => name.startsWith('__reactProps$'))!;
+  await act(async () => (reconnect as unknown as Record<string, { onClick(event: { preventDefault(): void }): void }>)[key]!.onClick({ preventDefault() {} }));
+  assert.equal(registrations, 2);
+  assert.equal(operations.includes('ready'), true);
+  assert.equal(operations.includes('input'), false);
+  assert.doesNotMatch(container.textContent, /Connection lost/);
+  await act(async () => root.unmount());
+});
+
+test('a disconnected private card explains recovery and cannot offer an enabled Resume', async () => {
+  const { root, container } = installReactRenderer();
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal, handoff: async () => { throw new Error('transport lost'); } } });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'ssh host' },
+    })),
+  })));
+  assert.match(container.textContent, /Connection lost/);
+  assert.match(container.textContent, /Reconnect to original terminal/);
+  assert.equal(descendants(container).some((node) => node.tagName === 'BUTTON' && node.textContent === 'Done, continue task'), false);
+});
+
+test('a closed card shows the process outcome without retaining a private input or success claim', async () => {
+  const { root, container } = installReactRenderer();
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal, handoff: async () => ({ status: 'closed', phase: 'closed', closure: 'exited', nextSequence: 2 }) } });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'ssh host' },
+    })),
+  })));
+  assert.match(container.textContent, /original terminal process exited/);
+  assert.equal(descendants(container).some((node) => node.tagName === 'INPUT'), false);
+  assert.doesNotMatch(container.textContent, /Control returned to the agent/);
+});
+
+test('recovering an uncertain receipt keeps Submit and Resume disabled', async () => {
+  const { root, container } = installReactRenderer();
+  const operations: string[] = [];
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal,
+    handoff: async (operation) => {
+      operations.push(operation.action);
+      return { status: 'outcome_unknown', phase: 'human', nextSequence: 2, display: { text: "Permission denied, please try again.\nuser@host's password: " } };
+    },
+  } });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'ssh host' },
+    })),
+  })));
+  assert.match(container.textContent, /Delivery is uncertain/);
+  assert.doesNotMatch(container.textContent, /SSH rejected authentication|The agent is waiting/);
+  const buttons = descendants(container).filter((node) => node.tagName === 'BUTTON');
+  for (const label of ['Submit', 'Done, continue task']) {
+    const button = buttons.find((node) => node.textContent === label);
+    assert.ok(button, label);
+    assert.notEqual(button.getAttribute('disabled'), null, label);
+  }
+  assert.equal(operations.includes('input'), false);
+});
+
+test('losing observation while human input is open clears private display and disables input', async () => {
+  const { root, container } = installReactRenderer();
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal,
+    handoff: async (operation) => {
+      if (operation.action === 'observe') throw new Error('disconnected');
+      return { status: 'ready', phase: 'human', nextSequence: 1, display: { text: 'private-sentinel' } };
+    },
+  } });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'sh' },
+    })),
+  })));
+  assert.match(container.textContent, /Connection lost/);
+  assert.doesNotMatch(container.textContent, /private-sentinel/);
+  for (const node of descendants(container)) {
+    if (node.tagName === 'INPUT' || (node.tagName === 'BUTTON' && ['Submit', 'Done, continue task'].includes(node.textContent))) {
+      assert.notEqual(node.getAttribute('disabled'), null);
+    }
+  }
+});
+
+test('reconnection cannot clear an uncertain local submission or replay it', async () => {
+  const { root, container } = installReactRenderer();
+  let inputs = 0;
+  const base = createFakeWorkbarServices();
+  const services = createFakeWorkbarServices({ terminal: { ...base.terminal,
+    handoff: async (operation) => {
+      if (operation.action === 'input') { inputs++; throw new Error('response lost'); }
+      return { status: 'observed', phase: 'human', nextSequence: 2, display: { text: '$ ' } };
+    },
+  } });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'sh' },
+    })),
+  })));
+  const click = async (label: string) => {
+    const button = descendants(container).find((node) => node.tagName === 'BUTTON' && node.textContent === label)!;
+    assert.ok(button, label);
+    const key = Object.keys(button).find((name) => name.startsWith('__reactProps$'))!;
+    await act(async () => (button as unknown as Record<string, { onClick(event: { preventDefault(): void }): void }>)[key]!.onClick({ preventDefault() {} }));
+  };
+  const field = descendants(container).find((node) => node.tagName === 'INPUT')!;
+  const fieldKey = Object.keys(field).find((name) => name.startsWith('__reactProps$'))!;
+  await act(async () => {
+    (field as FakeElement & { value: string }).value = 'private-draft';
+    (field as unknown as Record<string, { onChange(event: { target: { value: string } }): void }>)[fieldKey]!.onChange({ target: { value: 'private-draft' } });
+  });
+  await click('Submit');
+  await click('Reconnect to original terminal');
+  assert.equal(inputs, 1);
+  assert.match(container.textContent, /Delivery is uncertain/);
+  assert.doesNotMatch(container.textContent, /Connection lost|Submitted|The agent is waiting/);
+  for (const label of ['Submit', 'Done, continue task']) {
+    const button = descendants(container).find((node) => node.tagName === 'BUTTON' && node.textContent === label)!;
+    assert.notEqual(button.getAttribute('disabled'), null, label);
+  }
+});
+
+test('one explicit completion click resumes the original handoff; prompt rendering never resumes it', async () => {
+  const { root, container } = installReactRenderer();
+  const answers: unknown[] = [];
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal,
+    handoff: async () => ({ status: 'ready', phase: 'human', nextSequence: 1, display: { text: '$ ' } }),
+    answerHandoff: async (answer) => { answers.push(answer); },
+  } });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'sh' },
+    })),
+  })));
+  const button = descendants(container).find((node) => node.tagName === 'BUTTON' && node.textContent === 'Done, continue task');
+  assert.ok(button);
+  assert.equal(button.getAttribute('disabled'), null);
+  assert.deepEqual(answers, []);
+  assert.doesNotMatch(container.textContent, /I checked the terminal/);
+  const details = descendants(container).find((node) => node.tagName === 'DETAILS');
+  assert.ok(details);
+  assert.equal(details.getAttribute('open'), null);
+  assert.match(details.textContent, /host-1/);
+  assert.match(details.textContent, /terminal-1/);
+  const header = descendants(container).find((node) => node.tagName === 'HEADER');
+  assert.ok(header);
+  assert.match(header.textContent, /sh/);
+  assert.doesNotMatch(header.textContent, /host-1|terminal-1/);
+  const propsKey = Object.keys(button).find((key) => key.startsWith('__reactProps$'));
+  assert.ok(propsKey);
+  const props = (button as unknown as Record<string, { onClick(): void }>)[propsKey]!;
+  await act(async () => props.onClick());
+  assert.equal(answers.length, 1);
+  assert.deepEqual(answers[0], {
+    sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }),
+    requestId: 'request-1', controllerId: (answers[0] as { controllerId: string }).controllerId, action: 'resume',
+  });
+});
+
+test('revealing a private draft never sends it and submission or hiding resets visibility', async () => {
+  const { root, container } = installReactRenderer();
+  const submitted: string[] = [];
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal,
+    handoff: async (operation) => {
+      if (operation.action === 'input') submitted.push(operation.input);
+      return { status: operation.action === 'input' ? 'written' : 'observed', phase: 'human', nextSequence: 1, display: { text: '$ ' } };
+    },
+  } });
+  const render = async (active: boolean) => act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'sh' },
+    })),
+  })));
+  const propsOf = (node: FakeElement) => {
+    const key = Object.keys(node).find((candidate) => candidate.startsWith('__reactProps$'));
+    assert.ok(key);
+    return (node as unknown as Record<string, { type?: string; value?: string; onClick(): void; onChange(event: { target: { value: string } }): void }>)[key]!;
+  };
+  const field = () => descendants(container).find((node) => node.tagName === 'INPUT')!;
+  const click = async (label: string) => {
+    const button = descendants(container).find((node) => node.tagName === 'BUTTON' && (node.textContent === label || node.getAttribute('aria-label') === label));
+    assert.ok(button, label);
+    await act(async () => propsOf(button).onClick());
+  };
+  const edit = async () => act(async () => {
+    (field() as FakeElement & { value: string }).value = 'private-draft';
+    propsOf(field()).onChange({ target: { value: 'private-draft' } });
+  });
+  await render(true);
+  assert.equal(propsOf(field()).type, 'password');
+  await edit();
+  const resume = descendants(container).find((node) => node.tagName === 'BUTTON' && node.textContent === 'Done, continue task')!;
+  assert.notEqual(resume.getAttribute('disabled'), null, 'a draft still blocks completion');
+  await click('Show input');
+  assert.equal(propsOf(field()).type, 'text');
+  assert.deepEqual(submitted, []);
+  assert.ok(descendants(container).some((node) => node.getAttribute('data-maka-assistant-exclude') !== null));
+  await click('Submit');
+  assert.deepEqual(submitted, ['private-draft']);
+  assert.equal(propsOf(field()).type, 'password');
+  assert.equal(propsOf(field()).value, '');
+  await edit();
+  await click('Show input');
+  await render(false);
+  await render(true);
+  assert.equal(propsOf(field()).type, 'password');
+  assert.equal(propsOf(field()).value, '');
+});
+
+test('an existing terminal tab refreshes a new handoff request from its canonical event', async () => {
+  const { root, container } = installReactRenderer();
+  // The handoff path never instantiates xterm. Stub its browser-only UMD imports
+  // while rendering the real wrapper/card and exercising their subscriptions.
+  const browserOnly = new Map([['@xterm/xterm', 'Terminal'], ['@xterm/addon-fit', 'FitAddon'], ['@xterm/addon-web-links', 'WebLinksAddon']]);
+  const hooks = registerHooks({ resolve(specifier, context, next) {
+    if (specifier === './browser-storage' && context.parentURL?.endsWith('/theme.js')) return next('./browser-storage.js', context);
+    const name = browserOnly.get(specifier);
+    return name ? { url: `data:text/javascript,export class ${name} {}`, shortCircuit: true } : next(specifier, context);
+  } });
+  let SessionTerminalPanel;
+  try { ({ SessionTerminalPanel } = await loadSessionTerminalPanelForTest()); }
+  finally { hooks.deregister(); }
+  let receive: ((event: SessionEvent) => void) | undefined;
+  let requestId = 'first-request';
+  const base = createFakeWorkbarServices();
+  const services = createFakeWorkbarServices({
+    review: { ...base.review, subscribeSessionEvents: (_id, handler) => { receive = handler; return () => { receive = undefined; }; } },
+    terminal: { ...base.terminal, handoff: async () => ({ status: 'available', phase: 'waiting', nextSequence: 1,
+      request: { requestId, ref: 'terminal-1', command: 'sh', message: requestId } }) },
+  });
+  await act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(SessionTerminalPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active: true, terminalRef: 'terminal-1',
+    })),
+  })));
+  assert.match(container.textContent, /first-request/);
+  requestId = 'second-request';
+  assert.ok(receive);
+  await act(async () => receive?.({ type: 'terminal_handoff_request', id: 'event-2', turnId: 'turn-1', ts: 2,
+    requestId, toolUseId: 'tool-2', ref: 'terminal-1', message: requestId }));
+  assert.match(container.textContent, /second-request/);
+  assert.doesNotMatch(container.textContent, /first-request/);
+});
+
+test('completion leaves only the private terminal display and restores it on return', async () => {
+  const { root, container } = installReactRenderer();
+  const operations: string[] = [];
+  const services = createFakeWorkbarServices({ terminal: { ...createFakeWorkbarServices().terminal,
+    handoff: async (operation) => {
+      operations.push(operation.action);
+      return { status: 'observed', phase: 'resumed', nextSequence: 2,
+        ...(operation.action === 'observe' ? { display: { text: 'private-result' } } : {}) };
+    },
+  } });
+  const render = async (active: boolean) => act(async () => root.render(createElement(LocaleProvider, { locale: 'en', children:
+    createElement(WorkbarServicesProvider, { services }, createElement(TerminalHandoffPanel, {
+      sessionId: desktopSessionKey({ hostId: 'host-1', sessionId: 'session-1' }), active,
+      request: { requestId: 'request-1', ref: 'terminal-1', message: 'Authenticate', command: 'sh' },
+    })),
+  })));
+  await render(true);
+  assert.match(container.textContent, /private-result/);
+  assert.equal(descendants(container).some((node) => node.getAttribute('data-testid') === 'terminal-handoff'), false);
+  assert.equal(descendants(container).some((node) => node.getAttribute('data-testid') === 'private-terminal'), true);
+  assert.equal(descendants(container).some((node) => ['INPUT', 'HEADER', 'DETAILS'].includes(node.tagName)), false);
+  await render(false);
+  assert.doesNotMatch(container.textContent, /private-result/);
+  await render(true);
+  assert.match(container.textContent, /private-result/);
+  assert.doesNotMatch(container.textContent, /share|select.*text/i);
+  assert.equal(descendants(container).some((node) => node.tagName === 'BUTTON'), false);
+  assert.deepEqual(operations, ['ready', 'observe', 'release', 'ready', 'observe']);
+});
diff --git a/apps/desktop/src/main/__tests__/workbar-controller.test.ts b/apps/desktop/src/main/__tests__/workbar-controller.test.ts
index 6656247033c..82f11159e3d 100644
--- a/apps/desktop/src/main/__tests__/workbar-controller.test.ts
+++ b/apps/desktop/src/main/__tests__/workbar-controller.test.ts
@@ -92,11 +92,14 @@ let controllerRenderSnapshots: Array<{
   terminalOwnerIds: Array<string | undefined>;
 }> = [];
 
-type ControllerProbeInput = UseWorkbarControllerInput & { openOnActivation?: boolean };
+type ControllerProbeInput = UseWorkbarControllerInput & { openOnActivation?: boolean; prepareHandoffOnMount?: boolean };
 
 function ControllerProbe(props: ControllerProbeInput) {
   const workbar = useWorkbarController(props);
   latestController = workbar;
+  useLayoutEffect(() => {
+    if (props.prepareHandoffOnMount) void workbar.host.prepareTerminalHandoff?.().catch(() => {});
+  }, [props.prepareHandoffOnMount, workbar.host.prepareTerminalHandoff]);
   const visiblePanels = projectWorkbarPanelsForSession(
     workbar.host.panelsState, workbar.host.activeId,
     new Set(workbar.host.quotes?.map((quote) => `side-chat:${quote.id}`)),
@@ -334,6 +337,41 @@ function renderWorkBoardComposition(
 const installedRailLayoutPort = shellRailLayoutPort.current;
 
 describe('useWorkbarController', () => {
+  it('owns one terminal surface registration across early cards, reconnect and Session changes', async () => {
+    const { root } = installReactRenderer();
+    const gate = deferred<void>();
+    const operations: Array<{ sessionId: string; available: boolean }> = [];
+    const listeners = new Set<(event: { sessionId: string }) => void>();
+    const base = createFakeWorkbarServices();
+    const services = createFakeWorkbarServices({ terminal: { ...base.terminal,
+      subscribeResync: (handler) => { listeners.add(handler); return () => { listeners.delete(handler); }; },
+      handoff: async (operation) => {
+        assert.equal(operation.action, 'surface');
+        if (operation.action !== 'surface') throw new Error('unexpected operation');
+        operations.push(operation);
+        if (operation.available) await gate.promise;
+        return { status: 'available', phase: 'waiting', nextSequence: 1 };
+      },
+    } });
+    await act(async () => renderController(root, services, { ...input(session('a')), prepareHandoffOnMount: true }));
+    const first = controller().host.prepareTerminalHandoff!();
+    assert.equal(controller().host.prepareTerminalHandoff!(), first);
+    assert.equal(operations.length, 1);
+    await act(async () => gate.resolve());
+    await first;
+    await controller().host.prepareTerminalHandoff!();
+    assert.equal(operations.length, 1);
+    await act(async () => listeners.forEach((handler) => handler({ sessionId: 'a' })));
+    await controller().host.prepareTerminalHandoff!();
+    assert.equal(operations.length, 2);
+    await act(async () => renderController(root, services, input(session('b'))));
+    await act(async () => root.unmount());
+    assert.deepEqual(operations.map(({ sessionId, available }) => [sessionId, available]), [
+      ['a', true], ['a', true], ['a', false], ['b', true], ['b', false],
+    ]);
+    assert.equal(listeners.size, 0);
+  });
+
   afterEach(() => {
     shellRailLayoutPort.current = installedRailLayoutPort;
     latestController = undefined;
diff --git a/apps/desktop/src/main/__tests__/workbar-services-adapter.test.ts b/apps/desktop/src/main/__tests__/workbar-services-adapter.test.ts
index c95887a5f76..e9c050b823c 100644
--- a/apps/desktop/src/main/__tests__/workbar-services-adapter.test.ts
+++ b/apps/desktop/src/main/__tests__/workbar-services-adapter.test.ts
@@ -83,7 +83,7 @@ function createBridgeRecorder(answerOverrides: Record<string, unknown> = {}): {
 }
 
 describe('createDesktopWorkbarServices', () => {
-  it('recovers only live local desktop PTYs from the Host inventory and updates', async () => {
+  it('restores live handoffs before manual PTYs regardless of enumeration order, excluding inherited resources', async () => {
     const { bridge } = createBridgeRecorder();
     const manual = {
       sessionId: 's', ownership: { kind: 'local' },
@@ -92,23 +92,32 @@ describe('createDesktopWorkbarServices', () => {
     } as ShellRunUpdate;
     const updates = [
       manual,
-      { ...manual, sourceTurnId: 'agent-turn' },
+      { ...manual, sourceTurnId: 'agent-turn', result: { ...manual.result, ref: 'agent' } },
       { ...manual, result: { ...manual.result, mode: 'pipes' } },
       { ...manual, result: { ...manual.result, status: 'completed' } },
       { ...manual, ownership: { kind: 'source_unavailable', sourceSessionId: 'source' } },
+      { ...manual, sourceTurnId: 'agent-turn', result: { ...manual.result, ref: 'agent-handoff' } },
     ] as ShellRunUpdate[];
     let listener: ((update: ShellRunUpdate) => void) | undefined;
+    let phase: 'human' | 'resumed' = 'human';
     bridge.shellRuns = {
       ...bridge.shellRuns,
       recover: async () => ({ resources: updates, closes: [] }),
+      handoff: async (input) => ({ status: 'available', nextSequence: 1, phase,
+        ...(input.action === 'lookup' && input.ref === 'agent-handoff' ? { request: { requestId: 'request', ref: input.ref, message: 'Authenticate', command: 'ssh fixture' } } : {}) }),
       subscribeUpdates: (handler) => { listener = handler; return () => { listener = undefined; }; },
     };
     const services = createDesktopWorkbarServices(bridge);
-    assert.deepEqual(await services.terminal.recover('s'), { resources: [manual], closes: [] });
+    const expected = { resources: [updates[5], manual], closes: [] };
+    assert.deepEqual(await services.terminal.recover('s'), expected);
+    phase = 'resumed';
+    assert.deepEqual(await services.terminal.recover('s'), expected);
+    bridge.shellRuns.recover = async () => ({ resources: [...updates].reverse(), closes: [] });
+    assert.deepEqual(await services.terminal.recover('s'), expected);
     const received: ShellRunUpdate[] = [];
     const dispose = services.terminal.subscribeUpdates((update) => received.push(update));
     for (const update of updates) listener?.(update);
-    assert.deepEqual(received, [manual, updates[3]]);
+    assert.deepEqual(received, [manual, updates[1], updates[3], updates[5]]);
     dispose();
     assert.equal(listener, undefined);
   });
diff --git a/apps/desktop/src/main/private-terminal-surfaces.ts b/apps/desktop/src/main/private-terminal-surfaces.ts
new file mode 100644
index 00000000000..d8523c7145a
--- /dev/null
+++ b/apps/desktop/src/main/private-terminal-surfaces.ts
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+// Contains identities only. Never retain terminal text or human input here.
+const surfaces = new Map<number, Set<string>>();
+const captures = new Set<Promise<unknown>>();
+
+/** Register before yielding so mounting a private surface fences in-flight capture too. */
+export function trackDesktopCapture<T>(task: Promise<T>): Promise<T> {
+  captures.add(task);
+  void task.then(() => captures.delete(task), () => captures.delete(task));
+  return task;
+}
+
+export async function drainDesktopCaptures(): Promise<void> {
+  await Promise.allSettled([...captures]);
+}
+
+export function setPrivateTerminalSurface(windowId: number, controllerId: string, visible: boolean): void {
+  const controllers = surfaces.get(windowId) ?? new Set<string>();
+  if (visible) controllers.add(controllerId);
+  else controllers.delete(controllerId);
+  if (controllers.size) surfaces.set(windowId, controllers);
+  else surfaces.delete(windowId);
+}
+
+export function clearPrivateTerminalSurfaces(windowId: number): void {
+  surfaces.delete(windowId);
+}
+
+export function hasPrivateTerminalSurface(): boolean {
+  return surfaces.size > 0;
+}
diff --git a/apps/desktop/src/main/runtime-host-client.ts b/apps/desktop/src/main/runtime-host-client.ts
index f7471d228d3..12a3c2d7e7a 100644
--- a/apps/desktop/src/main/runtime-host-client.ts
+++ b/apps/desktop/src/main/runtime-host-client.ts
@@ -1662,6 +1662,10 @@ export class DesktopRuntimeHostClient {
     return this.request("runtime.resource.controller.control", input);
   }
 
+  controlTerminalHandoff(input: OperationInput<'runtime.resource.handoff'>): Promise<OperationOutput<'runtime.resource.handoff'>> {
+    return this.request('runtime.resource.handoff', input);
+  }
+
   releaseRuntimeResourceController(
     input: OperationInput<"runtime.resource.controller.release">,
   ): Promise<OperationOutput<"runtime.resource.controller.release">> {
diff --git a/apps/desktop/src/main/runtime-host-native-capabilities.ts b/apps/desktop/src/main/runtime-host-native-capabilities.ts
index a68909f3d50..39debd5963f 100644
--- a/apps/desktop/src/main/runtime-host-native-capabilities.ts
+++ b/apps/desktop/src/main/runtime-host-native-capabilities.ts
@@ -48,6 +48,7 @@ import { clientCapabilityEntityId } from "@maka/runtime-host/client-capability-e
 import { toJSONSchema, z } from "zod";
 import { withBrowserOriginAdmission } from './browser/browser-origin-admission.js';
 import type { DesktopTargetScope } from '../shared/runtime-host-identity.js';
+import { hasPrivateTerminalSurface, trackDesktopCapture } from './private-terminal-surfaces.js';
 
 const CAPABILITY_VERSION = "0";
 const BROWSER_OFFER_ID = "desktop_browser";
@@ -220,6 +221,10 @@ export function createDesktopNativeCapabilityProvider(
       }
       const binding = bindings.get(bindingKey(frame));
       if (!binding) throw new Error("Desktop native capability is not offered");
+      const capturesDesktop = frame.offerId === COMPUTER_USE_OFFER_ID || binding.tool.categoryHint === 'computer_use';
+      if (hasPrivateTerminalSurface() && capturesDesktop) {
+        throw new Error('Desktop capture and computer use are unavailable while a private terminal is visible. Hide the private terminal before continuing.');
+      }
 
       const invocation = new AbortController();
       const task = invokeNativeTool(
@@ -240,7 +245,7 @@ export function createDesktopNativeCapabilityProvider(
         settled,
       });
       void settled.finally(() => activeInvocations.delete(invocation));
-      return task;
+      return capturesDesktop ? trackDesktopCapture(task) : task;
     },
     callService: (frame, options) => {
       if (closed)
diff --git a/apps/desktop/src/main/runtime-host-session-observer.ts b/apps/desktop/src/main/runtime-host-session-observer.ts
index faee216c80e..7aa5203aeb4 100644
--- a/apps/desktop/src/main/runtime-host-session-observer.ts
+++ b/apps/desktop/src/main/runtime-host-session-observer.ts
@@ -649,6 +649,8 @@ export class RuntimeHostSessionObserver {
         type: "user_question_answer_ack",
         ...base,
       });
+    } else if (answered.outcome.kind === 'terminal_handoff_answer') {
+      this.#broadcast(answered.sessionId, { type: 'terminal_handoff_answer_ack', ...base });
     } else if (answered.outcome.kind === "form_answer") {
       this.#broadcast(answered.sessionId, {
         type: "form_answer_ack",
diff --git a/apps/desktop/src/main/runtime-host-shell-runs-ipc-main.ts b/apps/desktop/src/main/runtime-host-shell-runs-ipc-main.ts
index d3dfe318baf..ff2e5aeb2cc 100644
--- a/apps/desktop/src/main/runtime-host-shell-runs-ipc-main.ts
+++ b/apps/desktop/src/main/runtime-host-shell-runs-ipc-main.ts
@@ -17,33 +17,47 @@
  * under the License.
  */
 
-import { randomUUID } from 'node:crypto';
-import { DESKTOP_TERMINAL_LAUNCH_PREFIX } from '@maka/core/shell-run';
-import type { ShellRunUpdate } from '@maka/core/events';
-import type { ShellRunPtySnapshot } from '@maka/runtime/shell-run-contract';
-import type { SessionDomainChange } from '@maka/runtime-host/protocol';
-import { RuntimeHostOperationError } from '@maka/runtime-host/client';
+import { randomUUID } from "node:crypto";
+import { DESKTOP_TERMINAL_LAUNCH_PREFIX } from "@maka/core/shell-run";
+import type { ShellRunUpdate } from "@maka/core/events";
+import type { ShellRunPtySnapshot } from "@maka/runtime/shell-run-contract";
+import {
+  decodeRuntimeResourceHandoffInput,
+  type SessionDomainChange,
+} from "@maka/runtime-host/protocol";
+import {
+  setPrivateTerminalSurface,
+  clearPrivateTerminalSurfaces,
+  drainDesktopCaptures,
+} from "./private-terminal-surfaces.js";
+import { RuntimeHostOperationError } from "@maka/runtime-host/client";
 import {
   handleReconnectableRead,
   type ReconnectableReadIpcMain,
-} from './ipc-reconnect-policy.js';
-import type { DesktopRuntimeHostClient } from './runtime-host-client.js';
-import type { RuntimeHostSessionObserverTarget } from './runtime-host-session-observer.js';
-import type { TerminalCloseIntents } from './terminal-close-intents.js';
+} from "./ipc-reconnect-policy.js";
+import type { DesktopRuntimeHostClient } from "./runtime-host-client.js";
+import type { RuntimeHostSessionObserverTarget } from "./runtime-host-session-observer.js";
+import type { TerminalCloseIntents } from "./terminal-close-intents.js";
 
 export type RuntimeHostShellRunsClient = Pick<
   DesktopRuntimeHostClient,
-  | 'acquireRuntimeResourceController'
-  | 'controlRuntimeResource'
-  | 'listRuntimeResources'
-  | 'releaseRuntimeResourceController'
-  | 'startRuntimeResource'
-  | 'stopRuntimeResource'
->;
+  | "acquireRuntimeResourceController"
+  | "controlRuntimeResource"
+  | "listRuntimeResources"
+  | "releaseRuntimeResourceController"
+  | "startRuntimeResource"
+  | "stopRuntimeResource"
+> &
+  Partial<
+    Pick<
+      DesktopRuntimeHostClient,
+      "controlTerminalHandoff" | "answerInteraction"
+    >
+  >;
 
 export type RuntimeHostShellRunQueriesClient = Pick<
   DesktopRuntimeHostClient,
-  'getRuntimeResource' | 'listRuntimeResources'
+  "getRuntimeResource" | "listRuntimeResources"
 >;
 
 export interface RuntimeHostShellRunQueriesIpcHandle {
@@ -59,16 +73,19 @@ export function registerRuntimeHostShellRunQueriesIpc(
   },
   ipcMain: ReconnectableReadIpcMain,
 ): RuntimeHostShellRunQueriesIpcHandle {
-  handleReconnectableRead(ipcMain, 'shell-runs:list', (_event, sessionId: unknown) =>
-    deps.client.listRuntimeResources(requiredId(sessionId, 'Session')),
+  handleReconnectableRead(
+    ipcMain,
+    "shell-runs:list",
+    (_event, sessionId: unknown) =>
+      deps.client.listRuntimeResources(requiredId(sessionId, "Session")),
   );
   return {
     sessionDomainChanged(change) {
-      if (change.domain !== 'runtime_resource') return;
+      if (change.domain !== "runtime_resource") return;
       void refreshRuntimeResources(deps, change.sessionId, change.resources);
     },
     sessionSubscriptionRecovered(sessionId) {
-      deps.sendToRenderer?.('shell-runs:resync', { sessionId });
+      deps.sendToRenderer?.("shell-runs:resync", { sessionId });
     },
   };
 }
@@ -98,8 +115,71 @@ export function registerRuntimeHostShellRunsIpc(
     newId,
     deps.sessionObserver,
   );
-  ipcMain.handle('shell-runs:start', async (_event, sessionId: unknown) => {
-    const normalizedSessionId = requiredId(sessionId, 'Session');
+  // Private controls deliberately bypass reconnectable reads and command journals.
+  // A transport failure must never replay a user's input.
+  const privateWindows = new Set<number>();
+  ipcMain.handle("shell-runs:handoff", async (event, value: unknown) => {
+    if (!deps.client.controlTerminalHandoff)
+      throw new Error("Terminal handoff is unavailable");
+    const input = decodeRuntimeResourceHandoffInput(value);
+    const sender = event.sender as import("electron").WebContents;
+    if (input.action === "ready") {
+      setPrivateTerminalSurface(sender.id, input.controllerId, true);
+      if (!privateWindows.has(sender.id)) {
+        privateWindows.add(sender.id);
+        sender.once("destroyed", () => {
+          privateWindows.delete(sender.id);
+          clearPrivateTerminalSurfaces(sender.id);
+        });
+        // Clear after navigation commits, when the old private document is gone.
+        // Starting navigation (or a renderer crash) can leave its pixels visible.
+        sender.on("did-navigate", () =>
+          clearPrivateTerminalSurfaces(sender.id),
+        );
+      }
+      await drainDesktopCaptures();
+    }
+    if (input.action === "release")
+      setPrivateTerminalSurface(sender.id, input.controllerId, false);
+    try {
+      const result = await deps.client.controlTerminalHandoff(input);
+      if (input.action === "ready" && result.phase !== "human" && result.phase !== "resumed") {
+        setPrivateTerminalSurface(sender.id, input.controllerId, false);
+      }
+      return result;
+    } catch (error) {
+      if (input.action === "ready") {
+        setPrivateTerminalSurface(sender.id, input.controllerId, false);
+      }
+      throw error;
+    }
+  });
+  ipcMain.handle(
+    "shell-runs:handoff-answer",
+    async (_event, value: unknown) => {
+      if (!deps.client.answerInteraction || !value || typeof value !== "object")
+        throw new Error("Terminal handoff is unavailable");
+      const input = value as {
+        sessionId?: unknown;
+        requestId?: unknown;
+        controllerId?: unknown;
+        action?: unknown;
+      };
+      if (input.action !== "resume" && input.action !== "cancel")
+        throw new Error("Invalid terminal handoff decision");
+      await deps.client.answerInteraction({
+        sessionId: requiredId(input.sessionId, "Session"),
+        interactionId: requiredId(input.requestId, "Request"),
+        answer: {
+          kind: "terminal_handoff",
+          action: input.action,
+          controllerId: requiredId(input.controllerId, "Controller"),
+        },
+      });
+    },
+  );
+  ipcMain.handle("shell-runs:start", async (_event, sessionId: unknown) => {
+    const normalizedSessionId = requiredId(sessionId, "Session");
     const launchId = `${DESKTOP_TERMINAL_LAUNCH_PREFIX}${newId()}`;
     const started = await deps.client.startRuntimeResource({
       sessionId: normalizedSessionId,
@@ -107,40 +187,49 @@ export function registerRuntimeHostShellRunsIpc(
     });
     const update: ShellRunUpdate = {
       sessionId: normalizedSessionId,
-      ownership: { kind: 'local' },
+      ownership: { kind: "local" },
       sourceTurnId: launchId,
       sourceToolCallId: launchId,
       result: started.resource,
     };
     return update;
   });
-  ipcMain.handle('shell-runs:attach', (event, value: unknown) =>
+  ipcMain.handle("shell-runs:attach", (event, value: unknown) =>
     controllers.attach(
-      runtimeResourceIdentity(value, 'attach'),
+      runtimeResourceIdentity(value, "attach"),
       event.sender as RuntimeHostSessionObserverTarget,
     ),
   );
-  ipcMain.handle('shell-runs:detach', (_event, value: unknown) =>
-    controllers.detach(runtimeResourceIdentity(value, 'detach')),
+  ipcMain.handle("shell-runs:detach", (_event, value: unknown) =>
+    controllers.detach(runtimeResourceIdentity(value, "detach")),
   );
-  ipcMain.handle('shell-runs:write', (_event, value: unknown) =>
+  ipcMain.handle("shell-runs:write", (_event, value: unknown) =>
     controllers.control(runtimeResourceControl(value)),
   );
-  handleReconnectableRead(ipcMain, 'shell-runs:recover', (_event, sessionId: unknown) => {
-    const id = requiredId(sessionId, 'Session');
-    return closes.recover(id, () => deps.client.listRuntimeResources(id));
-  });
-  ipcMain.handle('shell-runs:stop', (_event, value: unknown) => {
-    const input = runtimeResourceIdentity(value, 'stop');
+  handleReconnectableRead(
+    ipcMain,
+    "shell-runs:recover",
+    (_event, sessionId: unknown) => {
+      const id = requiredId(sessionId, "Session");
+      return closes.recover(id, () => deps.client.listRuntimeResources(id));
+    },
+  );
+  ipcMain.handle("shell-runs:stop", (_event, value: unknown) => {
+    const input = runtimeResourceIdentity(value, "stop");
     return closes.stop(input, () => controllers.stop(input));
   });
 
-  return { close: () => controllers.close() };
+  return {
+    close: async () => {
+      for (const id of privateWindows) clearPrivateTerminalSurfaces(id);
+      await controllers.close();
+    },
+  };
 }
 
 async function refreshRuntimeResources(
   deps: {
-    client: Pick<DesktopRuntimeHostClient, 'getRuntimeResource'>;
+    client: Pick<DesktopRuntimeHostClient, "getRuntimeResource">;
     sendToRenderer?(channel: string, payload: unknown): void;
     onError?(error: unknown): void;
   },
@@ -149,8 +238,11 @@ async function refreshRuntimeResources(
 ): Promise<void> {
   for (const resource of resources) {
     try {
-      const update = await deps.client.getRuntimeResource(sessionId, resource.ref);
-      if (update) deps.sendToRenderer?.('shell-runs:update', update);
+      const update = await deps.client.getRuntimeResource(
+        sessionId,
+        resource.ref,
+      );
+      if (update) deps.sendToRenderer?.("shell-runs:update", update);
     } catch (error) {
       deps.onError?.(error);
     }
@@ -214,7 +306,13 @@ class RuntimeResourceControllers {
   ): Promise<ShellRunPtySnapshot> {
     return this.#run(input, async () => {
       const state = this.#state(input);
-      await this.#sessionObserver.observe(input.sessionId, state.observerId, target, false, input.ref);
+      await this.#sessionObserver.observe(
+        input.sessionId,
+        state.observerId,
+        target,
+        false,
+        input.ref,
+      );
       return this.#acquire(input, state);
     });
   }
@@ -226,7 +324,8 @@ class RuntimeResourceControllers {
         state = this.#state(input);
         await this.#acquire(input, state);
       }
-      if (!state) throw new Error('Runtime Resource controller was not acquired');
+      if (!state)
+        throw new Error("Runtime Resource controller was not acquired");
       const sequence = state.nextSequence;
       await this.#client.controlRuntimeResource({
         sessionId: input.sessionId,
@@ -278,12 +377,15 @@ class RuntimeResourceControllers {
       }),
     );
     const failed = results.find(
-      (result): result is PromiseRejectedResult => result.status === 'rejected',
+      (result): result is PromiseRejectedResult => result.status === "rejected",
     );
     if (failed) throw failed.reason;
   }
 
-  async #run<T>(input: RuntimeResourceIdentity, operation: () => Promise<T>): Promise<T> {
+  async #run<T>(
+    input: RuntimeResourceIdentity,
+    operation: () => Promise<T>,
+  ): Promise<T> {
     const key = resourceIdentity(input);
     const previous = this.#tails.get(key) ?? Promise.resolve();
     let release!: () => void;
@@ -321,7 +423,7 @@ class RuntimeResourceControllers {
   ): Promise<ShellRunPtySnapshot> {
     const key = resourceIdentity(input);
     let acquired: Awaited<
-      ReturnType<RuntimeHostShellRunsClient['acquireRuntimeResourceController']>
+      ReturnType<RuntimeHostShellRunsClient["acquireRuntimeResourceController"]>
     >;
     try {
       acquired = await this.#client.acquireRuntimeResourceController({
@@ -330,7 +432,10 @@ class RuntimeResourceControllers {
         controllerId: state.controllerId,
       });
     } catch (error) {
-      if (error instanceof RuntimeHostOperationError && this.#states.get(key) === state) {
+      if (
+        error instanceof RuntimeHostOperationError &&
+        this.#states.get(key) === state
+      ) {
         this.#states.delete(key);
         await this.#releaseObservation(state).catch(() => undefined);
       }
@@ -340,63 +445,78 @@ class RuntimeResourceControllers {
     return acquired.pty;
   }
 
-  async #releaseObservation(state: RuntimeResourceControllerState): Promise<void> {
+  async #releaseObservation(
+    state: RuntimeResourceControllerState,
+  ): Promise<void> {
     await this.#sessionObserver.unobserve(state.observerId);
   }
 }
 
 function protocolControl(input: RuntimeResourceControl) {
   if (input.input !== undefined && input.size !== undefined) {
-    return { kind: 'input_and_resize' as const, input: input.input, ...input.size };
+    return {
+      kind: "input_and_resize" as const,
+      input: input.input,
+      ...input.size,
+    };
   }
-  if (input.input !== undefined) return { kind: 'input' as const, input: input.input };
-  if (input.size !== undefined) return { kind: 'resize' as const, ...input.size };
-  throw new Error('Terminal control is empty');
+  if (input.input !== undefined)
+    return { kind: "input" as const, input: input.input };
+  if (input.size !== undefined)
+    return { kind: "resize" as const, ...input.size };
+  throw new Error("Terminal control is empty");
 }
 
-function runtimeResourceIdentity(value: unknown, action: string): RuntimeResourceIdentity {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+function runtimeResourceIdentity(
+  value: unknown,
+  action: string,
+): RuntimeResourceIdentity {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new TypeError(`Invalid terminal ${action} input`);
   }
   const record = value as Record<string, unknown>;
-  if (Object.keys(record).some((key) => key !== 'sessionId' && key !== 'ref')) {
+  if (Object.keys(record).some((key) => key !== "sessionId" && key !== "ref")) {
     throw new TypeError(`Invalid terminal ${action} input`);
   }
   return {
-    sessionId: requiredId(record.sessionId, 'Session'),
-    ref: requiredId(record.ref, 'terminal ref'),
+    sessionId: requiredId(record.sessionId, "Session"),
+    ref: requiredId(record.ref, "terminal ref"),
   };
 }
 
 function runtimeResourceControl(value: unknown): RuntimeResourceControl {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new TypeError('Invalid terminal control input');
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError("Invalid terminal control input");
   }
   const record = value as Record<string, unknown>;
   if (
     Object.keys(record).some(
-      (key) => key !== 'sessionId' && key !== 'ref' && key !== 'input' && key !== 'size',
+      (key) =>
+        key !== "sessionId" &&
+        key !== "ref" &&
+        key !== "input" &&
+        key !== "size",
     )
   ) {
-    throw new TypeError('Invalid terminal control input');
+    throw new TypeError("Invalid terminal control input");
   }
   const input = record.input;
   const size = record.size;
-  if (input !== undefined && typeof input !== 'string') {
-    throw new TypeError('Invalid terminal input');
+  if (input !== undefined && typeof input !== "string") {
+    throw new TypeError("Invalid terminal input");
   }
   let normalizedSize: { cols: number; rows: number } | undefined;
   if (size !== undefined) {
-    if (!size || typeof size !== 'object' || Array.isArray(size)) {
-      throw new TypeError('Invalid terminal size');
+    if (!size || typeof size !== "object" || Array.isArray(size)) {
+      throw new TypeError("Invalid terminal size");
     }
     const dimensions = size as Record<string, unknown>;
     if (
-      Object.keys(dimensions).some((key) => key !== 'cols' && key !== 'rows')
-      || !Number.isInteger(dimensions.cols)
-      || !Number.isInteger(dimensions.rows)
+      Object.keys(dimensions).some((key) => key !== "cols" && key !== "rows") ||
+      !Number.isInteger(dimensions.cols) ||
+      !Number.isInteger(dimensions.rows)
     ) {
-      throw new TypeError('Invalid terminal size');
+      throw new TypeError("Invalid terminal size");
     }
     normalizedSize = {
       cols: dimensions.cols as number,
@@ -404,12 +524,12 @@ function runtimeResourceControl(value: unknown): RuntimeResourceControl {
     };
   }
   if (input === undefined && normalizedSize === undefined) {
-    throw new TypeError('Terminal control is empty');
+    throw new TypeError("Terminal control is empty");
   }
   return {
     ...runtimeResourceIdentity(
       { sessionId: record.sessionId, ref: record.ref },
-      'control',
+      "control",
     ),
     ...(input === undefined ? {} : { input }),
     ...(normalizedSize === undefined ? {} : { size: normalizedSize }),
@@ -420,19 +540,22 @@ function resourceIdentity(input: RuntimeResourceIdentity): string {
   return `${input.sessionId}\0${input.ref}`;
 }
 
-function parseResourceIdentity(identity: string): [sessionId: string, ref: string] {
-  const separator = identity.indexOf('\0');
-  if (separator < 0) throw new Error('Invalid Runtime Resource controller identity');
+function parseResourceIdentity(
+  identity: string,
+): [sessionId: string, ref: string] {
+  const separator = identity.indexOf("\0");
+  if (separator < 0)
+    throw new Error("Invalid Runtime Resource controller identity");
   return [identity.slice(0, separator), identity.slice(separator + 1)];
 }
 
 function requiredId(value: unknown, name: string, maxLength = 512): string {
   if (
-    typeof value !== 'string'
-    || value.length === 0
-    || value.length > maxLength
-    || value.trim() !== value
-    || /[\u0000-\u001f\u007f]/.test(value)
+    typeof value !== "string" ||
+    value.length === 0 ||
+    value.length > maxLength ||
+    value.trim() !== value ||
+    /[\u0000-\u001f\u007f]/.test(value)
   ) {
     throw new TypeError(`Invalid ${name} id`);
   }
diff --git a/apps/desktop/src/preload/bridge-contract.d.ts b/apps/desktop/src/preload/bridge-contract.d.ts
index 5287b9e34f0..468e401e1a2 100644
--- a/apps/desktop/src/preload/bridge-contract.d.ts
+++ b/apps/desktop/src/preload/bridge-contract.d.ts
@@ -1552,6 +1552,8 @@ export interface MakaBridge {
     restore(projectId: string, host?: DesktopRuntimeHostRef): Promise<ProjectRecord>;
   };
   shellRuns: {
+    handoff(input: import('@maka/runtime-host/protocol').RuntimeResourceHandoffInput): Promise<import('@maka/runtime-host/protocol').RuntimeResourceHandoffResult>;
+    answerHandoff(input: { sessionId: string; requestId: string; controllerId: string; action: 'resume' | 'cancel' }): Promise<void>;
     recover(sessionId: string): Promise<import('../shared/runtime-host-identity.js').TerminalRecovery>;
     subscribeCloseChanges(handler: (change: import('../shared/runtime-host-identity.js').TerminalCloseChange) => void): () => void;
     list(sessionId: string): Promise<ShellRunUpdate[]>;
diff --git a/apps/desktop/src/preload/preload.ts b/apps/desktop/src/preload/preload.ts
index aba743dc2cd..384411b75f8 100644
--- a/apps/desktop/src/preload/preload.ts
+++ b/apps/desktop/src/preload/preload.ts
@@ -3109,6 +3109,12 @@ const makaBridge = {
     },
   },
   shellRuns: {
+    handoff(input: import('@maka/runtime-host/protocol').RuntimeResourceHandoffInput): Promise<import('@maka/runtime-host/protocol').RuntimeResourceHandoffResult> {
+      return invokeSessionInput('shell-runs:handoff', input);
+    },
+    answerHandoff(input: { sessionId: string; requestId: string; action: 'resume' | 'cancel' }): Promise<void> {
+      return invokeSessionInput('shell-runs:handoff-answer', input);
+    },
     async recover(sessionId: string) {
       const session = await runtimeHostSessionRef(sessionId);
       const result = await invokeWhenReady('shell-runs:recover', session.scope, session.sessionId) as
diff --git a/apps/desktop/src/renderer/chat-composer-region.tsx b/apps/desktop/src/renderer/chat-composer-region.tsx
index 6e5c2dfe9c1..3c14c9f3e77 100644
--- a/apps/desktop/src/renderer/chat-composer-region.tsx
+++ b/apps/desktop/src/renderer/chat-composer-region.tsx
@@ -196,6 +196,7 @@ export function ChatComposerRegion({
     activeInteraction?.type === 'client_capability_request' ? activeInteraction : undefined;
   const activeQuestion = activeInteraction?.type === 'user_question_request' ? activeInteraction : undefined;
   const activeForm = activeInteraction?.type === 'form_request' ? activeInteraction : undefined;
+  const activeTerminalHandoff = activeInteraction?.type === 'terminal_handoff_request' ? activeInteraction : undefined;
   const activeModelChoice = composerRest.activeModel
     ? composerRest.modelChoices?.find(
         (choice) =>
@@ -391,6 +392,7 @@ export function ChatComposerRegion({
             onRespond={respondToUserForm}
           />
         )}
+        {activeTerminalHandoff && <Banner status="info" role="status" title={activeTerminalHandoff.message} />}
       </div>
       {LiveContextUsageProbe ? (
         <LiveContextUsageProbe
diff --git a/apps/desktop/src/renderer/features/conversation/model/session-events.ts b/apps/desktop/src/renderer/features/conversation/model/session-events.ts
index bd7ec3b9199..23a1ec936e9 100644
--- a/apps/desktop/src/renderer/features/conversation/model/session-events.ts
+++ b/apps/desktop/src/renderer/features/conversation/model/session-events.ts
@@ -209,7 +209,7 @@ export function createAppShellSessionEventHandlers(options: {
     });
   }
 
-  async function settleAssistantStreaming(sessionId: string, messageId?: string): Promise<void> {
+  function settleAssistantStreaming(sessionId: string, messageId?: string) {
     return handoffAssistantStreaming(sessionId, messageId, true);
   }
 
@@ -327,6 +327,7 @@ export function createAppShellSessionEventHandlers(options: {
       case 'client_capability_request':
       case 'user_question_request':
       case 'form_request':
+      case 'terminal_handoff_request':
         onInteractionChanged?.(sessionId);
         break;
       // The runtime drops its owner on this ack, not on the tool result that
@@ -335,6 +336,7 @@ export function createAppShellSessionEventHandlers(options: {
       case 'user_question_answer_ack':
       case 'client_capability_decision_ack':
       case 'form_answer_ack':
+      case 'terminal_handoff_answer_ack':
         onInteractionChanged?.(sessionId);
         break;
       case 'sandbox_boundary_decision_ack':
diff --git a/apps/desktop/src/renderer/features/workbar/controller/use-workbar-controller.ts b/apps/desktop/src/renderer/features/workbar/controller/use-workbar-controller.ts
index d693ccdf097..b74487768b6 100644
--- a/apps/desktop/src/renderer/features/workbar/controller/use-workbar-controller.ts
+++ b/apps/desktop/src/renderer/features/workbar/controller/use-workbar-controller.ts
@@ -197,7 +197,7 @@ export function useWorkbarController(
     viteEnv?.VITE_MAKA_WORK_BOARD_START_TASK === '1' &&
     Boolean(input.openNewTaskSurface && input.resolveWorkBoardTarget && input.prepareWorkBoardDraft);
   const terminalCopy = getDesktopConversationCopy(locale).terminalPanel;
-  const { browser, sideChat, terminal, workBoard } = useWorkbarServices();
+  const { browser, sideChat, terminal, workBoard, review } = useWorkbarServices();
   const compact = useMediaQuery(SHELL_WORKBAR_COMPACT_QUERY);
   const layout = useWorkbarLayoutState(input.layoutSessionId, input.authoritativeSessionIds, compact);
   const sideConversations = useSideConversationWorkspace();
@@ -532,6 +532,48 @@ export function useWorkbarController(
     [concealRailIfNoWorkbarRoom, layout.setBottomPanelOpen, layout.setWorkbarCollapsed],
   );
 
+  // One registration owner. Cards await this same promise, including when a
+  // restored child mounts before the controller's passive effect has run.
+  const handoffSurface = useMemo(() => {
+    let pending: Promise<void> | undefined;
+    return {
+      prepare: () => {
+        if (!pending) {
+          const attempt = terminal.handoff!({ action: 'surface', sessionId: activeSessionId!, available: true }).then(() => {});
+          pending = attempt;
+          void attempt.catch(() => { if (pending === attempt) pending = undefined; });
+        }
+        return pending;
+      },
+      reset: () => { pending = undefined; },
+    };
+  }, [activeSessionId, terminal]);
+
+  useEffect(() => {
+    if (!activeSessionId || !terminal.handoff || workspace !== 'session') return;
+    let disposed = false;
+    const advertise = () => {
+      if (!disposed) void handoffSurface.prepare().catch(() => {});
+    };
+    advertise();
+    const unsubscribeResync = terminal.subscribeResync((event) => {
+      if (event.sessionId === activeSessionId) { handoffSurface.reset(); advertise(); }
+    });
+    const unsubscribe = review.subscribeSessionEvents(activeSessionId, (event) => {
+      if (event.type !== 'terminal_handoff_request') return;
+      layout.openDynamicWorkbarTab({ id: terminalSessionWorkbarTabId(event.ref), kind: 'terminal',
+        resourceRef: event.ref, ownerSessionId: activeSessionId, ordinal: reserveOrdinal('terminal') }, 'right');
+      revealPlacement('right');
+    });
+    return () => {
+      disposed = true;
+      unsubscribe();
+      unsubscribeResync();
+      handoffSurface.reset();
+      void terminal.handoff!({ action: 'surface', sessionId: activeSessionId, available: false }).catch(() => {});
+    };
+  }, [activeSessionId, workspace, terminal, review, layout.openDynamicWorkbarTab, reserveOrdinal, revealPlacement, handoffSurface]);
+
   const openNewSideConversation = useCallback(
     (placement: SessionWorkbarPlacement, initialPrompt?: string) => {
       const sourceSessionId = activeSessionIdRef.current;
@@ -1023,6 +1065,7 @@ export function useWorkbarController(
     host: {
       workspace: workspace,
       activeId: input.available ? activeSessionId : undefined,
+      prepareTerminalHandoff: terminal.handoff && workspace === 'session' ? handoffSurface.prepare : undefined,
       projectId: input.projectId,
       projectAliases: input.projectAliases,
       rightCollapsed: layout.workbarCollapsed,
diff --git a/apps/desktop/src/renderer/features/workbar/ports.ts b/apps/desktop/src/renderer/features/workbar/ports.ts
index f74b022e461..17f3877237f 100644
--- a/apps/desktop/src/renderer/features/workbar/ports.ts
+++ b/apps/desktop/src/renderer/features/workbar/ports.ts
@@ -89,6 +89,8 @@ export interface WorkbarReviewService {
 }
 
 export interface WorkbarTerminalService {
+  handoff?(input: import('@maka/runtime-host/protocol').RuntimeResourceHandoffInput): Promise<import('@maka/runtime-host/protocol').RuntimeResourceHandoffResult>;
+  answerHandoff?(input: { sessionId: string; requestId: string; controllerId: string; action: 'resume' | 'cancel' }): Promise<void>;
   /** Live, locally owned manual terminals; excludes model tools and inherited resources. */
   recover(sessionId: string): Promise<import('../../../shared/runtime-host-identity.js').TerminalRecovery>;
   subscribeCloseChanges(handler: (change: import('../../../shared/runtime-host-identity.js').TerminalCloseChange) => void): WorkbarUnsubscribe;
diff --git a/apps/desktop/src/renderer/features/workbar/testing.ts b/apps/desktop/src/renderer/features/workbar/testing.ts
index a6fe3f775a4..0cc01daa3d7 100644
--- a/apps/desktop/src/renderer/features/workbar/testing.ts
+++ b/apps/desktop/src/renderer/features/workbar/testing.ts
@@ -56,6 +56,9 @@ export * from './tools/terminal/terminal-interaction-policy.js';
 export * from './tools/terminal/session-terminal-hydration.js';
 export * from './tools/terminal/session-terminal-query.js';
 export * from './tools/terminal/session-terminal-frame.js';
+export * from './tools/terminal/terminal-handoff-feedback.js';
+export { TerminalHandoffPanel } from './tools/terminal/terminal-handoff-panel.js';
+export const loadSessionTerminalPanelForTest = () => import('./tools/terminal/session-terminal-panel.js');
 export * from '../../application/contracts/session-inspector/use-session-trace.js';
 export { useWorkbarController } from './controller/use-workbar-controller.js';
 export type {
diff --git a/apps/desktop/src/renderer/features/workbar/tools/terminal/session-terminal-panel.tsx b/apps/desktop/src/renderer/features/workbar/tools/terminal/session-terminal-panel.tsx
index e3d066148c3..dc44c9ecb0b 100644
--- a/apps/desktop/src/renderer/features/workbar/tools/terminal/session-terminal-panel.tsx
+++ b/apps/desktop/src/renderer/features/workbar/tools/terminal/session-terminal-panel.tsx
@@ -26,13 +26,15 @@ import { useUiLocale } from '@maka/ui';
 import { ICON_SIZE, Terminal as TerminalIcon } from '@maka/ui/icons';
 import { FitAddon } from '@xterm/addon-fit';
 import { Terminal } from '@xterm/xterm';
-import { getDesktopConversationCopy } from '../../../../application/contracts/conversation-copy';
-import { SessionTerminalHydration, SessionTerminalRenderQueue } from './session-terminal-hydration';
-import { suppressTerminalQueryReplies } from './session-terminal-query';
-import { scheduleTerminalFrame } from './session-terminal-frame';
-import { loadTerminalWebLinks } from './terminal-web-links';
+import { getDesktopConversationCopy } from '../../../../application/contracts/conversation-copy.js';
+import { SessionTerminalHydration, SessionTerminalRenderQueue } from './session-terminal-hydration.js';
+import { suppressTerminalQueryReplies } from './session-terminal-query.js';
+import { scheduleTerminalFrame } from './session-terminal-frame.js';
+import { loadTerminalWebLinks } from './terminal-web-links.js';
 import { useWorkbarServices } from '../../services-context.js';
-import { getTerminalFontSize, subscribeTerminalFontSize } from '../../../../theme';
+import { getTerminalFontSize, subscribeTerminalFontSize } from '../../../../theme.js';
+import { TerminalHandoffPanel } from './terminal-handoff-panel.js';
+import type { RuntimeResourceHandoffResult } from '@maka/runtime-host/protocol';
 
 function terminalTheme(element: HTMLElement) {
   const styles = getComputedStyle(element);
@@ -48,6 +50,45 @@ function terminalTheme(element: HTMLElement) {
 }
 
 export function SessionTerminalPanel(props: {
+  sessionId: string;
+  prepareHandoff?: () => Promise<void>;
+  terminalRef: string | null;
+  active: boolean;
+}) {
+  const { terminal, review } = useWorkbarServices();
+  const [handoff, setHandoff] = useState<RuntimeResourceHandoffResult['request']>();
+  const [checked, setChecked] = useState(!terminal.handoff);
+  useEffect(() => {
+    if (!terminal.handoff || !props.terminalRef) { setChecked(true); return; }
+    let disposed = false;
+    setChecked(false);
+    setHandoff(undefined);
+    const refresh = async () => {
+      try {
+        const result = await terminal.handoff!({ action: 'lookup', sessionId: props.sessionId, ref: props.terminalRef! });
+        if (!disposed) { setHandoff(result.request); setChecked(true); }
+      } catch { if (!disposed) setChecked(true); }
+    };
+    void refresh();
+    const unsubscribe = terminal.subscribeUpdates((update) => {
+      if (update.sessionId === props.sessionId && update.result.ref === props.terminalRef) void refresh();
+    });
+    const unsubscribeResync = terminal.subscribeResync(({ sessionId }) => {
+      if (sessionId === props.sessionId) void refresh();
+    });
+    // A second handoff on the same PTY changes the request, not the tab/ref.
+    // Refresh from its canonical event even if the resource projection is unchanged.
+    const unsubscribeHandoff = review.subscribeSessionEvents(props.sessionId, (event) => {
+      if (event.type === 'terminal_handoff_request' && event.ref === props.terminalRef) void refresh();
+    });
+    return () => { disposed = true; unsubscribe(); unsubscribeResync(); unsubscribeHandoff(); };
+  }, [terminal, review, props.sessionId, props.terminalRef]);
+  if (handoff) return <TerminalHandoffPanel key={handoff.requestId} sessionId={props.sessionId} request={handoff} active={props.active} prepareHandoff={props.prepareHandoff} />;
+  if (!checked) return <div className="maka-session-terminal-panel" aria-busy="true" />;
+  return <StandardSessionTerminalPanel {...props} />;
+}
+
+function StandardSessionTerminalPanel(props: {
   sessionId: string;
   terminalRef: string | null;
   active: boolean;
diff --git a/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-handoff-feedback.ts b/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-handoff-feedback.ts
new file mode 100644
index 00000000000..3085dac1b2e
--- /dev/null
+++ b/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-handoff-feedback.ts
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { isWellFormedTerminalInput } from '@maka/core/terminal-input';
+
+/** Renderer-only hints. Never return raw output, publish it, or infer success. */
+type TerminalHint = 'password' | 'authentication_retry';
+export function terminalFeedback(command: string, text: string): TerminalHint | undefined {
+  // The only verified program today is OpenSSH. Unsupported commands/locales
+  // keep their raw response; add tested recognizers when another program needs one.
+  if (!/^(?:\/usr\/bin\/)?ssh\s/.test(command.trim()) || /[;&|`\n]/.test(command)) return;
+  const lines = text.trimEnd().split('\n');
+  if (!/^[^\r\n]*'s password:\s*$/.test(lines.at(-1) ?? '')) return;
+  return lines.at(-2)?.trim() === 'Permission denied, please try again.'
+    ? 'authentication_retry' : 'password';
+}
+
+export function isValidPrivateTerminalInput(value: string): boolean {
+  return Boolean(value) && isWellFormedTerminalInput(value) && !/[\x00-\x1f\x7f]/.test(value) &&
+    new TextEncoder().encode(value).length <= 32 * 1024;
+}
diff --git a/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-handoff-panel.tsx b/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-handoff-panel.tsx
new file mode 100644
index 00000000000..b6bf2796bc6
--- /dev/null
+++ b/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-handoff-panel.tsx
@@ -0,0 +1,218 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useEffect, useRef, useState } from 'react';
+import { Button, IconButton, InputGroup, InputGroupText, useUiLocale } from '@maka/ui';
+import { Eye, EyeOff, ICON_SIZE } from '@maka/ui/icons';
+import type { UiCatalog } from '@maka/core/ui-locale';
+import { Banner, ChatComposer, TextInput, isImeKeyEvent } from '@astryxdesign/core';
+import type { RuntimeResourceHandoffResult } from '@maka/runtime-host/protocol';
+import { useWorkbarServices } from '../../services-context.js';
+import { parseDesktopSessionKey } from '../../../../../shared/runtime-host-identity.js';
+import { isValidPrivateTerminalInput, terminalFeedback } from './terminal-handoff-feedback.js';
+
+const COPY = {
+  en: {
+    waiting: 'The agent is waiting for your private input.', details: 'Connection details',
+    input: 'Private terminal input', submit: 'Submit', resume: 'Done, continue task', cancel: 'Cancel and stop',
+    show: 'Show input', hide: 'Hide input',
+    sent: 'Submitted. Check the terminal response.',
+    unknown: 'Delivery is uncertain. Stop this terminal to avoid duplicate input.',
+    disconnected: 'Connection lost. Reconnect to the original terminal; input will not be resent.',
+    reconnect: 'Reconnect to original terminal', invalid: 'Not sent. Enter one line without control characters, up to 32 KB.',
+    target: 'Execution host',
+    password: 'Enter the SSH password below.', authentication_retry: 'SSH rejected authentication. Check the password and try again.',
+    exited: 'The original terminal process exited.',
+    cancelled: 'Terminal stopped.', unavailable: 'The original terminal is unavailable.',
+  },
+  'zh-CN': {
+    waiting: 'Agent 正在等待你的私密输入。', details: '连接详情',
+    input: '私密终端输入', submit: '提交', resume: '已完成，继续任务', cancel: '取消并停止',
+    show: '显示输入', hide: '隐藏输入',
+    sent: '已提交，请查看终端回应。',
+    unknown: '无法确认是否送达，请停止此终端，避免重复输入。',
+    disconnected: '连接已中断，请重新连接原终端。输入不会重发。',
+    reconnect: '重新连接原终端', invalid: '尚未发送。请输入不含控制字符的单行内容，最多 32 KB。',
+    target: '执行主机',
+    password: '请在下方输入 SSH 密码。', authentication_retry: 'SSH 验证未通过，请核对密码后重试。',
+    exited: '原终端进程已退出。', cancelled: '已停止终端。', unavailable: '原终端已不可用。',
+  },
+  'zh-TW': {
+    waiting: 'Agent 正在等待你的私密輸入。', details: '連線詳情',
+    input: '私密終端輸入', submit: '提交', resume: '已完成，繼續任務', cancel: '取消並停止',
+    show: '顯示輸入', hide: '隱藏輸入',
+    sent: '已提交，請查看終端回應。',
+    unknown: '無法確認是否送達，請停止此終端，避免重複輸入。',
+    disconnected: '連線已中斷，請重新連線原終端。輸入不會重送。',
+    reconnect: '重新連線原終端', invalid: '尚未傳送。請輸入不含控制字元的單行內容，最多 32 KB。',
+    target: '執行主機',
+    password: '請在下方輸入 SSH 密碼。', authentication_retry: 'SSH 驗證未通過，請核對密碼後重試。',
+    exited: '原終端行程已結束。', cancelled: '已停止終端。', unavailable: '原終端已無法使用。',
+  },
+} satisfies UiCatalog<Record<string, string>>;
+type Notice = '' | 'sent' | 'unknown' | 'invalid';
+
+export function TerminalHandoffPanel(props: {
+  sessionId: string;
+  request: NonNullable<RuntimeResourceHandoffResult['request']>;
+  active: boolean;
+  prepareHandoff?: () => Promise<void>;
+}) {
+  const { terminal } = useWorkbarServices();
+  const locale = useUiLocale();
+  const copy = COPY[locale];
+  const [controllerId] = useState(() => crypto.randomUUID());
+  const [state, setState] = useState<RuntimeResourceHandoffResult>();
+  const [notice, setNotice] = useState<Notice>('');
+  const [busy, setBusy] = useState(false);
+  const [connection, setConnection] = useState<'connecting' | 'connected' | 'disconnected'>('connecting');
+  const [revision, setRevision] = useState(0);
+  // Component-local only: never reuse chat drafts or generic form responses.
+  const [privateInput, setPrivateInput] = useState('');
+  const [visible, setVisible] = useState(false);
+  const input = useRef<HTMLInputElement>(null);
+  const sending = useRef(false);
+  const displayEpoch = useRef(0);
+  const identity = { sessionId: props.sessionId, requestId: props.request.requestId, controllerId };
+  const connected = connection === 'connected';
+  const disconnected = connection === 'disconnected';
+  // An ambiguous local send stays latched even if a later poll looks healthy.
+  const uncertain = notice === 'unknown' || state?.status === 'outcome_unknown';
+  const human = state?.phase === 'human';
+  const hint = human && connected && state?.display ? terminalFeedback(props.request.command, state.display.text) : undefined;
+  const canInput = human && connected && !busy && !uncertain;
+  const canResume = canInput && !privateInput && !hint && Boolean(state?.display);
+
+  function accept(result: RuntimeResourceHandoffResult) {
+    setState(result);
+    if (result.status === 'outcome_unknown') setNotice('unknown');
+    if (result.status === 'closed') { setNotice(''); setVisible(false); }
+    if (result.rejection === 'controller_expired') { setConnection('disconnected'); setVisible(false); }
+    if (result.rejection === 'invalid_input') setNotice((previous) => previous === 'unknown' ? previous : 'invalid');
+  }
+
+  useEffect(() => {
+    if (!terminal.handoff || !props.active) return;
+    let disposed = false;
+    let timer: ReturnType<typeof setTimeout>;
+    const failed = () => {
+      if (disposed) return;
+      setConnection('disconnected'); setVisible(false);
+      if (input.current) input.current.value = '';
+      setPrivateInput(''); setState((previous) => previous ? { ...previous, display: undefined } : previous);
+    };
+    const poll = async () => {
+      const epoch = displayEpoch.current;
+      try {
+        const result = await terminal.handoff!({ ...identity, action: 'observe' });
+        if (!disposed && epoch === displayEpoch.current) accept(result);
+        if (!disposed && result.phase !== 'closed' && result.rejection !== 'controller_expired') timer = setTimeout(poll, 300);
+      } catch { failed(); }
+    };
+    // Reclaim only the original resource. Input is never replayed on recovery.
+    void (props.prepareHandoff?.() ?? Promise.resolve())
+      .then(async () => {
+        if (disposed) return;
+        const result = await terminal.handoff!({ ...identity, action: 'ready' });
+        if (disposed) { void terminal.handoff!({ ...identity, action: 'release' }).catch(() => {}); return; }
+        setConnection('connected'); accept(result);
+        if (result.phase !== 'closed') void poll();
+      }).catch(failed);
+    return () => {
+      disposed = true; displayEpoch.current++; clearTimeout(timer);
+      if (input.current) input.current.value = '';
+      setPrivateInput(''); setVisible(false); setState((previous) => previous ? { ...previous, display: undefined } : previous); setConnection('connecting');
+      void terminal.handoff!({ ...identity, action: 'release' }).catch(() => {});
+    };
+  }, [terminal, props.sessionId, props.request.requestId, props.active, props.prepareHandoff, controllerId, revision]);
+
+  async function submit() {
+    const value = input.current?.value ?? '';
+    if (sending.current || !canInput || !state) return;
+    if (!isValidPrivateTerminalInput(value)) { setNotice('invalid'); return; }
+    sending.current = true; setBusy(true);
+    input.current!.value = ''; setPrivateInput(''); setVisible(false);
+    const epoch = ++displayEpoch.current;
+    try {
+      const result = await terminal.handoff!({ ...identity, action: 'input', sequence: state.nextSequence, input: value });
+      if (epoch !== displayEpoch.current) return;
+      accept(result);
+      if (result.status === 'written') setNotice((previous) => previous === 'unknown' ? previous : 'sent');
+    } catch {
+      if (epoch !== displayEpoch.current) return;
+      setNotice('unknown'); setConnection('disconnected');
+    } finally { sending.current = false; setBusy(false); }
+  }
+
+  async function answer(action: 'resume' | 'cancel') {
+    if (sending.current || (action === 'resume' && !canResume)) return;
+    sending.current = true; setBusy(true);
+    if (input.current) input.current.value = '';
+    setPrivateInput(''); setVisible(false);
+    const epoch = ++displayEpoch.current;
+    setState((previous) => previous ? { ...previous, display: undefined } : previous);
+    try {
+      await terminal.answerHandoff!({ ...identity, action });
+      const result = await terminal.handoff!({ ...identity, action: 'observe' });
+      if (epoch !== displayEpoch.current) return;
+      displayEpoch.current++; accept(result); setNotice('');
+    } catch {
+      if (epoch === displayEpoch.current) setConnection('disconnected');
+    } finally { sending.current = false; setBusy(false); }
+  }
+
+  const closed = state?.phase === 'closed';
+  const host = parseDesktopSessionKey(props.sessionId)?.hostId ?? props.sessionId;
+  const problem = uncertain ? 'unknown' : disconnected ? 'disconnected' : notice === 'invalid' ? 'invalid' : hint === 'authentication_retry' ? hint : undefined;
+  const response = <pre className="maka-terminal-handoff-screen" aria-hidden="true" data-private-terminal="true">{props.active ? state?.display?.text : ''}</pre>;
+  const reconnect = disconnected && !closed && <Button label={copy.reconnect} variant="secondary" size="sm" onClick={() => setRevision((value) => value + 1)} isDisabled={busy} />;
+  if (!state && !disconnected) return <section className="maka-session-terminal-panel" aria-busy="true" />;
+  // Keep the private transport/capture fence, but the completed input UI has no
+  // reason to occupy the terminal. A later handoff mounts a fresh input card.
+  if (state?.phase === 'resumed' || closed) return <section className="maka-session-terminal-panel" data-testid="private-terminal">
+    {closed ? <Banner status={state.closure === 'cancelled' ? 'info' : 'warning'} title={copy[state.closure ?? 'unavailable']} /> :
+      problem && <Banner status="warning" title={copy[problem]} />}
+    {response}
+    {reconnect}
+  </section>;
+  return <section className="maka-terminal-handoff" data-testid="terminal-handoff">
+    <header><strong>{copy.input}</strong><code>{props.request.command}</code></header>
+    <details><summary>{copy.details}</summary><p>{props.request.message}</p><small>{copy.target}: {host}</small><code>{props.request.ref}</code></details>
+    {response}
+    {problem ? <Banner status={problem === 'disconnected' ? 'warning' : 'error'} title={copy[problem]} /> :
+      human && <p role="status">{hint ? copy[hint] : notice === 'sent' ? copy.sent : copy.waiting}</p>}
+    {human && <ChatComposer className="maka-composer-astryx" onSubmit={() => {}}
+      input={<InputGroup label={copy.input} data-maka-assistant-exclude isDisabled={!canInput}>
+        <TextInput ref={input} label={copy.input} isLabelHidden type={visible ? 'text' : 'password'} autoComplete="off"
+          value={privateInput} onChange={(value) => { setPrivateInput(value); if (!value) setVisible(false); if (notice === 'invalid') setNotice(''); }} isDisabled={!canInput} width="100%"
+          onKeyDown={(event) => { if (event.key === 'Enter') { event.preventDefault(); if (!isImeKeyEvent(event.nativeEvent)) void submit(); } }} />
+        <InputGroupText><IconButton label={visible ? copy.hide : copy.show} variant="ghost" size="sm" aria-pressed={visible}
+          icon={visible ? <EyeOff size={ICON_SIZE.chrome} aria-hidden="true" /> : <Eye size={ICON_SIZE.chrome} aria-hidden="true" />}
+          isDisabled={!canInput} onClick={() => setVisible((value) => !value)} /></InputGroupText>
+      </InputGroup>}
+      footerActions={<Button label={copy.cancel} variant="ghost" size="sm" onClick={() => void answer('cancel')} isDisabled={busy} />}
+      sendButton={<Button label={copy.submit} size="sm" onClick={() => void submit()} isDisabled={!canInput || !privateInput} />}
+    />}
+    <footer>
+      {!human && <Button label={copy.cancel} variant="secondary" size="sm" onClick={() => void answer('cancel')} isDisabled={busy} />}
+      {reconnect}
+      {human && <Button label={copy.resume} size="sm" onClick={() => void answer('resume')} isDisabled={!canResume} />}
+    </footer>
+  </section>;
+}
diff --git a/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-web-links.ts b/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-web-links.ts
index 2e1ac9b0c95..6b5d0379872 100644
--- a/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-web-links.ts
+++ b/apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-web-links.ts
@@ -20,7 +20,7 @@
 import { WebLinksAddon } from '@xterm/addon-web-links';
 import type { Terminal } from '@xterm/xterm';
 
-import { terminalWebUrl } from './terminal-interaction-policy';
+import { terminalWebUrl } from './terminal-interaction-policy.js';
 
 /**
  * Wires clickable HTTP(S) links into an xterm instance. Renderer-side URL
diff --git a/apps/desktop/src/renderer/features/workbar/ui/workbar-host.tsx b/apps/desktop/src/renderer/features/workbar/ui/workbar-host.tsx
index ebe6cc83562..f9abc6fb08d 100644
--- a/apps/desktop/src/renderer/features/workbar/ui/workbar-host.tsx
+++ b/apps/desktop/src/renderer/features/workbar/ui/workbar-host.tsx
@@ -92,6 +92,7 @@ function SessionWorkbarFallback(props: {
 export interface WorkbarHostModel {
   workspace?: 'session' | 'workhub';
   activeId?: string;
+  prepareTerminalHandoff?: () => Promise<void>;
   projectId?: string | null;
   projectAliases?: readonly string[];
   rightCollapsed: boolean;
@@ -222,6 +223,7 @@ export function WorkbarHostView({ model: props, togglePosition = 'titlebar' }: {
               togglePosition={togglePosition}
               workspace={props.workspace}
               sessionId={props.activeId}
+              prepareTerminalHandoff={props.prepareTerminalHandoff}
               projectId={props.projectId}
               projectAliases={props.projectAliases}
               hidden={props.hidden || !props.activeId}
diff --git a/apps/desktop/src/renderer/features/workbar/ui/workbar-surface.tsx b/apps/desktop/src/renderer/features/workbar/ui/workbar-surface.tsx
index b68f3f3703e..dc7ad2d6235 100644
--- a/apps/desktop/src/renderer/features/workbar/ui/workbar-surface.tsx
+++ b/apps/desktop/src/renderer/features/workbar/ui/workbar-surface.tsx
@@ -387,6 +387,7 @@ export function WorkbarSurface(props: {
   togglePosition?: WorkbarTogglePosition;
   workspace?: 'session' | 'workhub';
   sessionId?: string;
+  prepareTerminalHandoff?: () => Promise<void>;
   projectId?: string | null;
   projectAliases?: readonly string[];
   hidden: boolean;
@@ -542,6 +543,7 @@ export function WorkbarSurface(props: {
               <SessionTerminalPanel
                 sessionId={tab.ownerSessionId ?? props.sessionId!}
                 terminalRef={terminalRef}
+                prepareHandoff={props.prepareTerminalHandoff}
                 active={!props.hidden && active}
               />
             </Suspense>
diff --git a/apps/desktop/src/renderer/platform/desktop/create-workbar-services.ts b/apps/desktop/src/renderer/platform/desktop/create-workbar-services.ts
index 84580caacda..3f8e06f0f2f 100644
--- a/apps/desktop/src/renderer/platform/desktop/create-workbar-services.ts
+++ b/apps/desktop/src/renderer/platform/desktop/create-workbar-services.ts
@@ -121,6 +121,8 @@ export function createDesktopWorkbarServices(
         bridge.sessions.subscribeChanges(handler),
     },
     terminal: {
+      handoff: (input) => bridge.shellRuns.handoff(input),
+      answerHandoff: (input) => bridge.shellRuns.answerHandoff(input),
       start: (sessionId) => bridge.shellRuns.start(sessionId),
       stop: (input) => bridge.shellRuns.stop(input),
       attach: (input) => bridge.shellRuns.attach(input),
@@ -130,13 +132,23 @@ export function createDesktopWorkbarServices(
       subscribeResync: (handler) => bridge.shellRuns.subscribeResync(handler),
       recover: async (sessionId) => {
         const recovery = await bridge.shellRuns.recover(sessionId);
-        return { ...recovery, resources: recovery.resources.filter((update) =>
-          isDesktopTerminal(update) && !isTerminalShellRunStatus(update.result.status)),
-        };
+        const retained = await Promise.all(recovery.resources.map(async (update) => {
+          if (isTerminalShellRunStatus(update.result.status)) return null;
+          if (isDesktopTerminal(update)) return update;
+          if (update.ownership.kind !== 'local' || update.result.mode !== 'pty') return null;
+          const handoff = await bridge.shellRuns.handoff({ action: 'lookup', sessionId, ref: update.result.ref }).catch(() => undefined);
+          return handoff?.request ? update : null;
+        }));
+        // Recovered resource tabs are not persisted locally. Restore the task's
+        // private interaction before manual terminals so it remains the default
+        // surface after reload, independent of Host resource enumeration order.
+        const resources = retained.filter((value): value is NonNullable<typeof value> => value !== null)
+          .sort((a, b) => Number(isDesktopTerminal(a)) - Number(isDesktopTerminal(b)));
+        return { ...recovery, resources };
       },
       subscribeCloseChanges: (handler) => bridge.shellRuns.subscribeCloseChanges(handler),
       subscribeUpdates: (handler) => bridge.shellRuns.subscribeUpdates((update) => {
-        if (isDesktopTerminal(update)) handler(update);
+        if (update.ownership.kind === 'local' && update.result.mode === 'pty') handler(update);
       }),
     },
     browser: {
diff --git a/apps/desktop/src/renderer/styles/workbar/terminal.css b/apps/desktop/src/renderer/styles/workbar/terminal.css
index 125d2d45abd..bfd2581040d 100644
--- a/apps/desktop/src/renderer/styles/workbar/terminal.css
+++ b/apps/desktop/src/renderer/styles/workbar/terminal.css
@@ -28,6 +28,30 @@
   background: var(--agents-content-area-bg);
 }
 
+.maka-terminal-handoff {
+  display: flex;
+  flex-direction: column;
+  height: 100%;
+  min-height: 0;
+  gap: var(--space-3);
+  padding: var(--space-3);
+  color: var(--foreground);
+}
+
+.maka-terminal-handoff header {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-2);
+}
+
+.maka-terminal-handoff code { overflow-wrap: anywhere; }
+.maka-terminal-handoff details { font-size: var(--font-size-sm, 12px); color: var(--muted-foreground); }
+.maka-terminal-handoff details summary { cursor: pointer; }
+.maka-terminal-handoff details small, .maka-terminal-handoff details code { display: block; }
+.maka-terminal-handoff p { margin: 0; font-size: var(--font-size-sm, 12px); }
+.maka-terminal-handoff footer { display: flex; gap: var(--space-2); flex-wrap: wrap; }
+.maka-terminal-handoff-screen { flex: 1; min-height: 80px; overflow: auto; white-space: pre-wrap; overflow-wrap: anywhere; margin: 0; padding: var(--space-2); background: var(--agents-content-area-bg); font-family: ui-monospace, monospace; font-size: 12px; }
+
 .maka-session-terminal-panel > .astryx-banner {
   flex: none;
   margin: var(--space-2);
diff --git a/docs/astryx-surface-file-inventory.md b/docs/astryx-surface-file-inventory.md
index 592f4e7b079..2e0b42fa454 100644
--- a/docs/astryx-surface-file-inventory.md
+++ b/docs/astryx-surface-file-inventory.md
@@ -6,7 +6,7 @@ Generated against `@astryxdesign/core@0.6.3` (195 component exports).
 
 Wiki bar: Design Conventions · API Use-the-System · Theming · Container Padding.
 
-**Totals:** 334 files — blocker 0, reimplementation 0, polish 4, aligned 330.
+**Totals:** 335 files — blocker 0, reimplementation 0, polish 4, aligned 331.
 
 ## Exclusions (explicit)
 
@@ -148,6 +148,7 @@ Wiki bar: Design Conventions · API Use-the-System · Theming · Container Paddi
 | `apps/desktop/src/renderer/features/workbar/tools/review/session-review-panel.tsx` | shell-chrome-or-panel | Banner, Button, Collapsible, CollapsibleGroup, EmptyState, HStack, Section, Skeleton, Text, VStack | aligned — uses Astryx (Banner, Button, Collapsible, CollapsibleGroup, EmptyState, HStack, Section, Skeleton) | aligned |
 | `apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx` | shell-chrome-or-panel | Banner | aligned — uses Astryx (Banner) | aligned |
 | `apps/desktop/src/renderer/features/workbar/tools/terminal/session-terminal-panel.tsx` | shell-chrome-or-panel | Banner, EmptyState | aligned — uses Astryx (Banner, EmptyState) | aligned |
+| `apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-handoff-panel.tsx` | shell-chrome-or-panel | Banner, Button, ChatComposer, IconButton, InputGroup, InputGroupText, TextInput | aligned — uses Astryx (Banner, Button, ChatComposer, IconButton, InputGroup, InputGroupText, TextInput) | aligned |
 | `apps/desktop/src/renderer/features/workbar/ui/recent-turn-overlay.tsx` | shell-chrome-or-panel | Button | aligned — uses Astryx (Button) | aligned |
 | `apps/desktop/src/renderer/features/workbar/ui/side-chat-close-confirmation.tsx` | shell-chrome-or-panel | Button, CheckboxInput, Dialog, DialogHeader, HStack, Layout, LayoutContent, LayoutFooter, Text, VStack | aligned — uses Astryx (Button, CheckboxInput, Dialog, DialogHeader, HStack, Layout, LayoutContent, LayoutFooter) | aligned |
 | `apps/desktop/src/renderer/features/workbar/ui/workbar-host.tsx` | shell-chrome-or-panel | Card, IconButton, ResizeHandle, Spinner | aligned — uses Astryx (Card, IconButton, ResizeHandle, Spinner) | aligned |
diff --git a/docs/astryx-surface-file-inventory.paths b/docs/astryx-surface-file-inventory.paths
index 6fab66f4bd7..8a064bc786b 100644
--- a/docs/astryx-surface-file-inventory.paths
+++ b/docs/astryx-surface-file-inventory.paths
@@ -118,6 +118,7 @@ apps/desktop/src/renderer/features/workbar/tools/review/session-review-base-bran
 apps/desktop/src/renderer/features/workbar/tools/review/session-review-panel.tsx
 apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
 apps/desktop/src/renderer/features/workbar/tools/terminal/session-terminal-panel.tsx
+apps/desktop/src/renderer/features/workbar/tools/terminal/terminal-handoff-panel.tsx
 apps/desktop/src/renderer/features/workbar/ui/recent-turn-overlay.tsx
 apps/desktop/src/renderer/features/workbar/ui/side-chat-close-confirmation.tsx
 apps/desktop/src/renderer/features/workbar/ui/workbar-host.tsx
diff --git a/docs/images/pr/terminal-handoff/01-normal.png b/docs/images/pr/terminal-handoff/01-normal.png
new file mode 100644
index 00000000000..4be504bbc0d
Binary files /dev/null and b/docs/images/pr/terminal-handoff/01-normal.png differ
diff --git a/docs/images/pr/terminal-handoff/02-waiting.png b/docs/images/pr/terminal-handoff/02-waiting.png
new file mode 100644
index 00000000000..aff3bee3082
Binary files /dev/null and b/docs/images/pr/terminal-handoff/02-waiting.png differ
diff --git a/docs/images/pr/terminal-handoff/03-resumed.png b/docs/images/pr/terminal-handoff/03-resumed.png
new file mode 100644
index 00000000000..3ba6121f789
Binary files /dev/null and b/docs/images/pr/terminal-handoff/03-resumed.png differ
diff --git a/docs/images/pr/terminal-handoff/04-retry.png b/docs/images/pr/terminal-handoff/04-retry.png
new file mode 100644
index 00000000000..aa6483b3df5
Binary files /dev/null and b/docs/images/pr/terminal-handoff/04-retry.png differ
diff --git a/docs/images/pr/terminal-handoff/05-exited.png b/docs/images/pr/terminal-handoff/05-exited.png
new file mode 100644
index 00000000000..406fb24b67d
Binary files /dev/null and b/docs/images/pr/terminal-handoff/05-exited.png differ
diff --git a/docs/images/pr/terminal-handoff/authentication-complete.png b/docs/images/pr/terminal-handoff/authentication-complete.png
new file mode 100644
index 00000000000..7bac580bee3
Binary files /dev/null and b/docs/images/pr/terminal-handoff/authentication-complete.png differ
diff --git a/docs/images/pr/terminal-handoff/connection-details.png b/docs/images/pr/terminal-handoff/connection-details.png
new file mode 100644
index 00000000000..43f68058920
Binary files /dev/null and b/docs/images/pr/terminal-handoff/connection-details.png differ
diff --git a/docs/images/pr/terminal-handoff/followup-3.png b/docs/images/pr/terminal-handoff/followup-3.png
new file mode 100644
index 00000000000..e348c2d3dd0
Binary files /dev/null and b/docs/images/pr/terminal-handoff/followup-3.png differ
diff --git a/docs/images/pr/terminal-handoff/visible-draft.png b/docs/images/pr/terminal-handoff/visible-draft.png
new file mode 100644
index 00000000000..beec22c4577
Binary files /dev/null and b/docs/images/pr/terminal-handoff/visible-draft.png differ
diff --git a/docs/terminal-handoff.md b/docs/terminal-handoff.md
new file mode 100644
index 00000000000..06212c9717a
--- /dev/null
+++ b/docs/terminal-handoff.md
@@ -0,0 +1,276 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+
+# Private terminal handoff
+
+For [#5309](https://github.com/apache/maka/issues/5309), an agent can request
+human input in its existing background PTY. Desktop shows the original command,
+execution-host identity and terminal ref, and uses the same `ChatComposer`,
+`TextInput` and buttons as existing user interactions. Submitting one private
+line and returning control are separate actions. Resume records the user's
+decision, not a claim that authentication succeeded.
+
+**Open acceptance gap:** the manual sharing mechanism has been removed. The
+agent can resume writes in the original terminal, but cannot yet observe its
+post-handoff results. Output remains private until a replacement boundary has
+been validated. This is not a complete implementation of issue #5309's result
+observation requirement.
+
+The agent decides when to request this capability through a structured tool
+call. Neither chat keywords nor a password prompt automatically opens the card.
+Supported sessions advertise discovery from the existing Bash description:
+starting a PTY alone does not reveal the private input surface. The discovered
+WriteStdin description teaches the action; the UI responds only to the
+validated `terminal_handoff_request` event.
+
+## Feedback and recovery
+
+The transport reports submission, definite rejection, uncertain delivery and
+process closure independently of authentication. Invalid single-line input is
+rejected before sending and can be corrected. A lost connection clears the
+private display/draft and disables Submit and Resume. Reconnect reclaims the
+original resource without replaying input; an uncertain receipt remains fenced.
+Process exit, cancellation and an unavailable original process have distinct
+closed-card messages and do not retain private output.
+
+The explicit **Done, continue task** action confirms completion and resumes the
+original terminal in one click. There is no second confirmation checkbox.
+Unsubmitted input, uncertain delivery, disconnection and a recognized pending
+password prompt block Resume. Clicking the action is a user attestation, not
+automatic proof of login success; receiving output never resumes automatically.
+An eye button lets users inspect their own draft. It defaults to masked and
+returns to masked on submission, clearing, hiding, disconnection or completion.
+Reveal does not send the draft or make it available to assistant observations.
+
+Completion removes the input card, its header, details and action buttons. The
+terminal remains a private, read-only display using the same capture fence and
+original process. Reloading or switching tabs restores that display without
+reopening the input flow. Another handoff request creates a new input card.
+While the initial phase is unknown, only the terminal loading container is
+shown. A registration failure exposes reconnect instead of leaving a spinner.
+
+During input, one message describes the current actionable state: uncertain
+delivery takes precedence over a disconnected surface, invalid input and a
+recognized authentication rejection. Ordinary submission/prompt feedback is a
+short status line. The original command stays visible so the user can check its
+destination; the agent's explanation, full Host identity and resource ref live
+in collapsed connection details.
+
+Renderer-only program adapters may translate known prompts into fixed friendly
+hints. The first adapter covers the standard English OpenSSH password prompt and
+`Permission denied, please try again.` followed by a new password prompt. It
+also blocks Resume while that prompt remains visible. It never classifies an
+arbitrary output as successful authentication, changes transport state, publishes
+output or sends input. Unsupported programs, compound commands, prompts and
+locales retain the original private response. Additional verified programs can
+extend the pure renderer function; there is no registry for the single current
+recognizer, and no SSH logic belongs in the Host.
+
+## Owners and extension points
+
+- `ShellRunProcessManager` remains the sole process/PTY owner. The
+  `PtyHandoffController` interface exposes prepare, private input, private
+  observation and resume. There is no private-output publication operation.
+- `HostRuntimeResourceCoordinator` owns resource serialization and a volatile
+  controller identity/sequence. The existing Interaction coordinator owns the
+  pending request, durable decision, Run cancellation and Session projection.
+- Workbar owns Desktop surface registration. Restored cards await its shared
+  registration promise before claiming a controller; cards never advertise a
+  second surface. Host resync invalidates that promise, and a failed registration
+  can be retried. The display carries text only: `phase` controls the UI, while
+  Runtime retains its internal input fence.
+- `WriteStdin({ref, handoff: {message}})` waits on that Interaction. It is offered
+  only when an interactive Desktop surface is registered for the Session and
+  the platform provides an input fence. No new task, shell or terminal process
+  is created. Ordinary actions and handoff are mutually exclusive.
+- `runtime.resource.handoff` is a bounded, nonjournalled `control` operation.
+  Its private payload never becomes a model tool argument or generic form
+  answer. The canonical answer contains only resume/cancel; the live answer
+  also carries the controller identity for stale-card fencing.
+
+This boundary can support other terminal workflows without recognizing SSH,
+sudo or password-prompt strings. The current UI submits one line at a time;
+arbitrary human TUI keys/mouse input and additional authentication adapters can
+extend the private control path without changing process ownership or using
+chat drafts.
+
+## Input and lifecycle guarantees
+
+Admission changes the resource's input epoch. Previously queued agent writes
+cannot cross this boundary. The Unix driver owns a bounded nonblocking write
+queue and drains earlier accepted bytes to the OS before the human can write.
+This is not a claim that the child already consumed those bytes.
+Each actual write uses the pinned node-pty patch's synchronous writer and its
+own write-stream/socket close fence. Runtime never retains a raw fd for writes:
+Linux PTY masters can share the same `fstat` identity even after fd reuse.
+Expected input closure drops pending bytes without reporting an integrity fault.
+The first write that discovers closure fails synchronously instead of returning a
+queued receipt, including when an earlier backpressured write has a retry pending;
+later writes and protocol replies preserve that classification.
+Resize uses the same owned socket/write-stream close fence, so a reused PTY fd
+cannot receive a resize from the retired terminal.
+
+Each private submission has a monotonically increasing sequence and an identity
+scoped to the original live request and authenticated connection. Duplicate
+delivery returns the recorded receipt without rewriting bytes. A delivery
+failure returns `outcome_unknown`, never retries, and prevents additional input
+or Resume; stopping the terminal remains available. Ordinary terminal controls
+cannot bypass the handoff path.
+
+Disconnect releases the controller, not the input fence. Reattaching or
+refreshing claims a new card identity on the original PTY; old identities lose
+write/Resume authority. A missing renderer has a bounded readiness deadline;
+human input itself has no handoff deadline (the original process timeout still
+applies). Cancel, Turn stop, resource exit and Host shutdown close the pending
+Interaction. A restarted Host does not recreate a lost authenticated process.
+
+The authenticated PTY belongs to the task, not the conversation turn. Later
+turns can write to the same resource without another password while it remains
+alive. Its configured process timeout still applies; another message does not
+renew it. Losing only the Desktop surface does not imply that SSH disconnected.
+
+Hiding a resumed card releases only its controller. Returning, including after
+reload, can still display the same private output to the user. Only closed
+tombstones have a 128-entry retention cap; live resumed terminals remain tied to
+their resource lifetime. The resource queue now covers Resume's readiness check,
+durable decision and transfer together. Earlier uncertain input or controller
+release is refused before persistence; a release/disconnect after admission
+cannot invalidate the committed transfer. A failed terminal side effect rejects
+that handoff without poisoning the Host's Interaction authority for other tasks.
+An already-open terminal tab refreshes its request from the canonical handoff
+event if the same process needs human input again.
+
+The authenticated owner/grant is the authorization boundary, not a particular
+Desktop device. While a card owns a handoff, other connections cannot reclaim
+it. After release/disconnection, another authorized client of the same owner
+may register a private surface and claim it; the old controller then expires.
+
+## Output privacy and the unresolved result boundary
+
+Before the first human write, PTY output switches to a separate volatile parser.
+The normal parser, raw replay buffer, Session projections, tool results and
+storage receive no subsequent private bytes. **This remains true after Resume**:
+an arbitrary terminal can echo credentials late, and changing visibility based
+on timing, an echo flag or password matching would not provide this guarantee.
+
+Resume discards the authentication display and returns agent write authority.
+New output remains private. Selection, sharing UI, the Host protocol action and
+the Runtime publication method have all been removed. An old client cannot
+publish text through that removed protocol action. Resume does not publish any
+terminal text. The agent can continue writing commands, but must report its
+inability to observe the result rather than claim success or ask the user to
+copy private output into the conversation.
+Terminal device/status queries are answered by the private parser directly to
+the PTY, so interactive programs still work after Resume; replies and screen
+contents are not published to the model. Historical replay is admitted with
+protocol replies disabled, and it cannot coalesce with fresh output. This keeps
+old cursor/status queries from injecting a second reply into the current private
+prompt while allowing newly arriving queries to be answered. Queries already queued
+in the public parser before handoff still receive their original reply: that
+parser never receives private bytes, so a handoff cannot strand a startup probe.
+
+Private buffers stay in the live process and visible renderer. Drafts clear on
+submit, hide, refresh and completion. Desktop computer-use calls are fenced
+while a private surface is visible, and mounting waits for in-flight capture to
+settle before allowing private display/input. This is an application boundary,
+not protection against an external screen recorder or a malicious local process.
+
+## Supported scope and acceptance
+
+The first implementation supports Unix PTYs on macOS/Linux. Windows and
+headless clients do not advertise the handoff action until they implement the
+same input-fence and private-surface contract. Remote transport continues to use
+the existing authenticated Runtime Host connection; a remote-host acceptance
+run and Windows ConPTY support are follow-up work. No permission mode changes
+occur during handoff or Resume.
+
+The opt-in [real-model harness](../scripts/terminal-handoff/README.md) was run on
+macOS with `gpt-5.6-terra`, a real local OpenAI-compatible endpoint, actual SSH
+password authentication (including rejection and retry) and a second terminal
+challenge. The follow-up natural-language journey names no tools or handoff
+parameters: the model discovers the capability itself. The original shell's
+unexported marker and `/tmp` working directory survived in the private display.
+The current harness checks that this result is not silently published after
+sharing removal. Its report marks `fullIssueAcceptance: false` and
+`automaticResultObservation: false`; passing the scoped input/continuation tests
+does not mean the original issue is complete. Reload clears the unsubmitted
+password and recovers the same handoff. The resumed private display also survives
+collapse/expand, changing terminal tabs, and reloading. In the latest run, two
+additional conversation turns reused that same connection without another input
+card. Fourteen provider requests, 19 workspace files and 69 live-profile files
+contained neither test credential. The App remained open, so the profile scan
+was performed before shutdown.
+
+The latest simplification is validated without screenshots. Earlier review
+images remain historical evidence and do not represent the current layout.
+
+The normal terminal wrapper uses lifecycle/resync events instead of permanent
+lookup polling. Private text is polled only by the mounted active card, avoiding
+a second retained output subscription or replay store. No credential store,
+generic secret form, Session clone or automatic output-unprotect abstraction was
+introduced.
+
+Two process-local ablations validated the boundaries: removing private-output
+isolation made the real PTY test detect a secret in a public projection; removing
+the input-epoch check allowed a queued pre-handoff agent write through and failed
+the coordinator regression. Both protections were retained. The mutations were
+applied only through a test-process module loader, never to the running app or
+the committed implementation.
+
+The UX ablation removed the checkbox and tested the actual product contract:
+rendering a ready-looking prompt never resumes; one deliberate completion click
+resumes the original request; uncertain delivery, disconnect, a pending password
+and an unsubmitted draft remain fenced. All five checks passed, so the redundant
+checkbox/state was removed. The earlier checkbox-specific regression merely
+pinned that UI choice and did not establish its necessity.
+
+The next simplification merged duplicate connection flags and removed the
+single-program adapter registry. Existing feedback/recovery checks still pass.
+Removing the uncertain-delivery latch in a process-local ablation made a later
+healthy observation re-enable completion after a lost submission receipt, and
+the recovery regression failed. That necessary memory remains in the existing
+notice state; no separate uncertainty boolean is required.
+
+The surface-ownership ablation removed the card's second advertisement and the
+unused `display.inputOpen` field; restoration, retry and Runtime privacy checks
+still pass. Removing the shared-registration wait instead caused a restored
+card to claim control before its surface was available. Removing the initial
+loading branch brought back the old input card while the authoritative phase
+was pending. These two guards remain; they require no additional UI state.
+
+Two further real-PTY ablations exposed the output-policy problem. Removing
+publication leaves the model unable to read the requested command's result.
+Making new output public after Resume leaks the fixture's delayed credential
+echo. Sharing has now been removed as requested; the remaining result-observation
+gap is explicit rather than hidden behind a replacement confirmation.
+
+An isolated parser experiment also rejected automatic matching of submitted
+values as a substitute for that boundary. It hid complete echoes, pending
+prefixes, SGR-separated text and line wrapping, but a cursor edit deleting an
+already-masked prefix revealed the remaining credential fragment. An encoded
+credential also escaped exact matching. No such experimental filter is used by
+the product. Adapters remain renderer-local functions rather than introducing
+a plugin registry or another lifecycle owner.
+
+The review follow-up replaced the Driver's fd fingerprint with node-pty's own
+close fence. A Linux two-PTY ablation removed that fence while retaining all
+other code: the old terminal's queued test password reached the replacement PTY
+and the regression failed. The restored fence passes on Linux; macOS also
+passes the read-stream-close variant. The fingerprint abstraction was removed
+from the Driver because it cannot prove PTY ownership.
diff --git a/docs/windows-test-inventory.md b/docs/windows-test-inventory.md
index 7e7ff70fade..911f0fad987 100644
--- a/docs/windows-test-inventory.md
+++ b/docs/windows-test-inventory.md
@@ -16,10 +16,10 @@ Locations intentionally omit line numbers so unrelated edits do not invalidate t
 | Classification | Count |
 |---|---:|
 | windows-backend-gap | 27 |
-| portable-candidate | 57 |
+| portable-candidate | 62 |
 | platform-contract | 48 |
 
-Total Windows-excluded declarations: **132**
+Total Windows-excluded declarations: **137**
 
 ## Inventory
 
@@ -92,10 +92,15 @@ Total Windows-excluded declarations: **132**
 | platform-contract | `packages/runtime/src/__tests__/owned-child-process.test.ts` supervisor mirrors a command that dies from ${signal} | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
 | platform-contract | `packages/runtime/src/__tests__/owned-child-process.test.ts` group-wide signals from the command do not end its supervisor | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
 | platform-contract | `packages/runtime/src/__tests__/owned-child-process.test.ts` unexpected POSIX supervisor death terminates its command and cannot report success | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
+| portable-candidate | `packages/runtime/src/__tests__/pty-process-driver-write-lifecycle.test.ts` closed PTY input cannot reach a replacement PTY (same fd on Linux) before child exit | `process.platform === 'win32' ? 'Unix PTY file-descriptor lifecycle only' : false` |
+| portable-candidate | `packages/runtime/src/__tests__/pty-process-driver.test.ts` a real PTY input fence drains backpressure before the next owner writes | `process.platform === 'win32'` |
 | portable-candidate | `packages/runtime/src/__tests__/shell-exec.test.ts` writes a legacy WSL Bash command through stdin | `process.platform === 'win32' ? 'uses /bin/sh as a portable stdin probe' : false` |
 | platform-contract | `packages/runtime/src/__tests__/shell-exec.test.ts` bounds output drain after the root exits while a detached descendant retains stdout | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
 | platform-contract | `packages/runtime/src/__tests__/shell-owner-death.test.ts` ${mode} (stop already requested: ${beginStop}): owner SIGKILL terminates an admitted command before its delayed write | `beginStop && process.platform === 'win32' ? 'POSIX graceful SIGTERM window required' : false` |
 | platform-contract | `packages/runtime/src/__tests__/shell-owner-death.test.ts` owner SIGKILL also terminates a descendant that left the command group with setsid | `process.platform === 'win32' ? 'POSIX detached process-group semantics required' : false` |
+| portable-candidate | `packages/runtime/src/__tests__/shell-run-manager.test.ts` handoff answers a query still queued in the public parser exactly once | `process.platform === 'win32'` |
+| portable-candidate | `packages/runtime/src/__tests__/shell-run-manager.test.ts` handoff replay does not inject an old DSR response into a private prompt | `process.platform === 'win32'` |
+| portable-candidate | `packages/runtime/src/__tests__/shell-run-manager.test.ts` private handoff preserves a real shell and excludes immediate and delayed echoes from durable projections | `process.platform === 'win32'` |
 | platform-contract | `packages/runtime/src/__tests__/shell-run-manager.test.ts` latches timeout when the root exits during POSIX process discovery | `process.platform === 'win32' ? 'POSIX process discovery only' : false` |
 | platform-contract | `packages/runtime/src/__tests__/shell-run-manager.test.ts` preserves cancellation when timeout fires during POSIX process discovery | `process.platform === 'win32' ? 'POSIX process discovery only' : false` |
 | platform-contract | `packages/runtime/src/__tests__/shell-run-manager.test.ts` ignores a Stop abort that occurs after another admitted Stop commits termination | `process.platform === 'win32' ? 'Windows termination has no asynchronous POSIX snapshot window' : false` |
diff --git a/packages/cli/src/__tests__/acp-session-interactions.test.ts b/packages/cli/src/__tests__/acp-session-interactions.test.ts
index 7edc3682d0f..79f58b45ed0 100644
--- a/packages/cli/src/__tests__/acp-session-interactions.test.ts
+++ b/packages/cli/src/__tests__/acp-session-interactions.test.ts
@@ -901,6 +901,11 @@ function answered(
   const base = { ...pending, revision: 2 as const, status: 'answered' as const };
   const committedAt = 10;
   switch (answer.kind) {
+    case 'terminal_handoff':
+      return {
+        ...base,
+        outcome: { kind: 'terminal_handoff_answer', action: answer.action, committedAt },
+      };
     case 'question':
       return {
         ...base,
diff --git a/packages/core/src/backend-types.ts b/packages/core/src/backend-types.ts
index 1c757cb530e..66dcad189f1 100644
--- a/packages/core/src/backend-types.ts
+++ b/packages/core/src/backend-types.ts
@@ -233,6 +233,8 @@ export type BackendSessionEvent = Exclude<
         | 'queue_update'
         | 'message_admission'
         | 'client_capability_request'
+        | 'terminal_handoff_request'
+        | 'terminal_handoff_answer_ack'
         | 'client_capability_decision_ack'
         | 'context_compaction_started'
         | 'permission_request'
diff --git a/packages/core/src/events.ts b/packages/core/src/events.ts
index f0f5645a21d..ed1619f9409 100644
--- a/packages/core/src/events.ts
+++ b/packages/core/src/events.ts
@@ -676,6 +676,8 @@ export type SessionEvent =
   | UserQuestionAnswerAckEvent
   | FormRequestEvent
   | FormAnswerAckEvent
+  | TerminalHandoffRequestEvent
+  | TerminalHandoffAnswerAckEvent
   | PlanSubmittedEvent
   | TokenUsageEvent
   | SteeringMessageEvent
@@ -1156,6 +1158,20 @@ export interface FormRequestEvent extends BaseEvent {
   fields: readonly InteractionFormField[];
 }
 
+export interface TerminalHandoffRequestEvent extends BaseEvent {
+  type: 'terminal_handoff_request';
+  requestId: string;
+  toolUseId: string;
+  ref: string;
+  message: string;
+}
+
+export interface TerminalHandoffAnswerAckEvent extends BaseEvent {
+  type: 'terminal_handoff_answer_ack';
+  requestId: string;
+  toolUseId: string;
+}
+
 export interface SandboxBoundaryRequestEvent extends BaseEvent {
   type: 'sandbox_boundary_request';
   requestId: string;
@@ -1178,6 +1194,7 @@ export interface ClientCapabilityRequestEvent extends BaseEvent {
  * live event can rehydrate the prompt instead of stranding the run.
  */
 export type ActiveInteractionRequestEvent =
+  | TerminalHandoffRequestEvent
   | SandboxBoundaryRequestEvent
   | UserQuestionRequestEvent
   | FormRequestEvent
diff --git a/packages/core/src/interaction.ts b/packages/core/src/interaction.ts
index 3fe755391b0..e77649f7c15 100644
--- a/packages/core/src/interaction.ts
+++ b/packages/core/src/interaction.ts
@@ -173,6 +173,26 @@ export interface InteractionFormRequest {
   readonly fields: readonly InteractionFormField[];
 }
 
+/** Input bytes travel over the private resource control channel, never an answer. */
+export interface InteractionTerminalHandoffRequest {
+  readonly kind: 'terminal_handoff';
+  readonly toolUseId: string;
+  readonly ref: string;
+  readonly message: string;
+}
+
+export interface InteractionTerminalHandoffAnswer {
+  readonly kind: 'terminal_handoff';
+  readonly action: 'resume' | 'cancel';
+  readonly controllerId: string;
+}
+
+export interface InteractionCanonicalTerminalHandoffOutcome {
+  readonly kind: 'terminal_handoff_answer';
+  readonly action: 'resume' | 'cancel';
+  readonly committedAt: number;
+}
+
 export interface InteractionSandboxBoundaryRequest {
   readonly kind: 'sandbox_boundary';
   readonly expansion: SandboxBoundaryExpansion;
@@ -186,6 +206,7 @@ export interface InteractionClientCapabilityRequest {
 }
 
 export type InteractionRequest =
+  | InteractionTerminalHandoffRequest
   | InteractionPermissionRequest
   | InteractionQuestionRequest
   | InteractionFormRequest
@@ -229,6 +250,7 @@ export interface InteractionClientCapabilityAnswer {
 }
 
 export type InteractionAnswer =
+  | InteractionTerminalHandoffAnswer
   | InteractionPermissionAnswer
   | InteractionQuestionAnswer
   | InteractionFormAnswer
@@ -282,6 +304,7 @@ export interface InteractionCanonicalClosureOutcome {
 }
 
 export type InteractionCanonicalOutcome =
+  | InteractionCanonicalTerminalHandoffOutcome
   | InteractionCanonicalPermissionOutcome
   | InteractionCanonicalQuestionOutcome
   | InteractionCanonicalFormOutcome
@@ -312,6 +335,19 @@ const FORM_REQUEST_SHAPE = defineObjectShape<InteractionFormRequest>()(
   ['kind', 'toolUseId', 'message', 'requester', 'fields'],
   [],
 );
+const TERMINAL_HANDOFF_REQUEST_SHAPE = defineObjectShape<InteractionTerminalHandoffRequest>()(
+  ['kind', 'toolUseId', 'ref', 'message'],
+  [],
+);
+const TERMINAL_HANDOFF_ANSWER_SHAPE = defineObjectShape<InteractionTerminalHandoffAnswer>()(
+  ['kind', 'action', 'controllerId'],
+  [],
+);
+const TERMINAL_HANDOFF_OUTCOME_SHAPE =
+  defineObjectShape<InteractionCanonicalTerminalHandoffOutcome>()(
+    ['kind', 'action', 'committedAt'],
+    [],
+  );
 const SANDBOX_BOUNDARY_REQUEST_SHAPE = defineObjectShape<InteractionSandboxBoundaryRequest>()(
   ['kind', 'expansion', 'justification'],
   [],
@@ -430,6 +466,14 @@ export function decodeInteractionRequest(value: unknown): InteractionRequest {
         INTERACTION_MAX_QUESTIONS,
       ).map(decodeQuestion),
     };
+  } else if (record.kind === 'terminal_handoff') {
+    exact(record, TERMINAL_HANDOFF_REQUEST_SHAPE, 'terminal handoff request');
+    request = {
+      kind: 'terminal_handoff',
+      toolUseId: boundedString(record.toolUseId, 'toolUseId', INTERACTION_ID_MAX_BYTES),
+      ref: boundedString(record.ref, 'terminal ref', INTERACTION_ID_MAX_BYTES),
+      message: boundedString(record.message, 'handoff message', INTERACTION_FORM_MESSAGE_MAX_BYTES),
+    };
   } else if (record.kind === 'form') {
     exact(record, FORM_REQUEST_SHAPE, 'form request');
     const fields = plainArray(record.fields, 'form fields', 0, INTERACTION_FORM_MAX_FIELDS).map(
@@ -488,6 +532,13 @@ export function decodeInteractionAnswer(value: unknown): InteractionAnswer {
       decision === 'deny'
         ? { kind: 'permission', decision, rememberForTurn: false }
         : { kind: 'permission', decision, rememberForTurn };
+  } else if (record.kind === 'terminal_handoff') {
+    exact(record, TERMINAL_HANDOFF_ANSWER_SHAPE, 'terminal handoff answer');
+    answer = {
+      kind: 'terminal_handoff',
+      action: oneOf(record.action, ['resume', 'cancel'] as const, 'action'),
+      controllerId: boundedString(record.controllerId, 'controllerId', 256),
+    };
   } else if (record.kind === 'question') {
     exact(record, QUESTION_ANSWER_SHAPE, 'question answer');
     answer = { kind: 'question', answers: decodeAnswers(record.answers) };
@@ -578,6 +629,13 @@ export function decodeInteractionCanonicalOutcome(value: unknown): InteractionCa
       decision === 'deny'
         ? { ...common, decision, rememberForTurn: false }
         : { ...common, decision, rememberForTurn };
+  } else if (record.kind === 'terminal_handoff_answer') {
+    exact(record, TERMINAL_HANDOFF_OUTCOME_SHAPE, 'terminal handoff outcome');
+    outcome = {
+      kind: 'terminal_handoff_answer',
+      action: oneOf(record.action, ['resume', 'cancel'] as const, 'action'),
+      committedAt: safeInteger(record.committedAt, 'committedAt', false),
+    };
   } else if (record.kind === 'question_answer') {
     exact(record, QUESTION_OUTCOME_SHAPE, 'question outcome');
     outcome = {
@@ -815,11 +873,13 @@ export function interactionOutcomeMatchesRequestKind(
       ? outcome.kind === 'permission_answer'
       : request.kind === 'question'
         ? outcome.kind === 'question_answer'
-        : request.kind === 'form'
-          ? outcome.kind === 'form_answer'
-          : request.kind === 'sandbox_boundary'
-            ? outcome.kind === 'sandbox_boundary_decision'
-            : outcome.kind === 'client_capability_decision')
+        : request.kind === 'terminal_handoff'
+          ? outcome.kind === 'terminal_handoff_answer'
+          : request.kind === 'form'
+            ? outcome.kind === 'form_answer'
+            : request.kind === 'sandbox_boundary'
+              ? outcome.kind === 'sandbox_boundary_decision'
+              : outcome.kind === 'client_capability_decision')
   );
 }
 
@@ -848,6 +908,7 @@ export function isInteractionAnswerValidForRequest(
   answer: InteractionAnswer,
 ): boolean {
   if (!interactionAnswerMatchesRequestKind(request, answer)) return false;
+  if (answer.kind === 'terminal_handoff') return request.kind === 'terminal_handoff';
   if (answer.kind === 'question') {
     return (
       request.kind === 'question' &&
@@ -867,6 +928,7 @@ export function isInteractionCanonicalOutcomeValidForRequest(
   outcome: InteractionCanonicalOutcome,
 ): boolean {
   if (!interactionOutcomeMatchesRequestKind(request, outcome)) return false;
+  if (outcome.kind === 'terminal_handoff_answer') return request.kind === 'terminal_handoff';
   if (outcome.kind === 'closure')
     return (
       request.kind === 'permission' ||
@@ -904,6 +966,9 @@ export function interactionCanonicalOutcomesEquivalent(
   right: InteractionCanonicalOutcome,
 ): boolean {
   if (left.kind !== right.kind) return false;
+  if (left.kind === 'terminal_handoff_answer' && right.kind === 'terminal_handoff_answer') {
+    return left.action === right.action;
+  }
   if (left.kind === 'permission_answer' && right.kind === 'permission_answer')
     return left.decision === right.decision && left.rememberForTurn === right.rememberForTurn;
   if (left.kind === 'question_answer' && right.kind === 'question_answer')
diff --git a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
index 97f85589b5a..23a73ce0b3d 100644
--- a/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-model-composition.test.ts
@@ -168,7 +168,7 @@ const MAX_IMPLEMENTATION_CHILD_REQUESTS =
 const HEADLESS_CODING_V1_PROMPT_HASH =
   'sha256:e490f6055478bf8cdcef1aa85217de623f0954120a692358dbba2065ba6710fc';
 const HEADLESS_CODING_V1_TOOLS_HASH =
-  'sha256:b4fd61c4eeec3ed41f22d36b61c800331e6c18a9704f5b7806acafea919945b0';
+  'sha256:a2e72527c20fe6bfec9c01a89252204b466cd11c070029591657edac6b1f2664';
 const execFileAsync = promisify(execFile);
 test('backend creation resolves a bound Session by immutable Connection identity', async () => {
   let observedRef: unknown;
diff --git a/packages/runtime-host/src/__tests__/interaction-coordinator.test.ts b/packages/runtime-host/src/__tests__/interaction-coordinator.test.ts
index 3946604d5e6..e9dad9682db 100644
--- a/packages/runtime-host/src/__tests__/interaction-coordinator.test.ts
+++ b/packages/runtime-host/src/__tests__/interaction-coordinator.test.ts
@@ -79,6 +79,159 @@ const RUN = Object.freeze({
 });
 
 describe('HostInteractionCoordinator', () => {
+  test('terminal handoff persists decisions only, rejects premature Resume and applies one decision', async () => {
+    await withStore(async ({ store }) => {
+      const published = deferred();
+      const coordinator = createCoordinator(store, {
+        refreshCanonicalContinuity: async () => {
+          published.resolve();
+        },
+      });
+      const owner = coordinator.bindRun(RUN);
+      let ready = false;
+      const applied: string[] = [];
+      let admissionActive = false;
+      const pending = coordinator.requestTerminalHandoff({
+        ...RUN,
+        requestId: 'private-terminal',
+        request: {
+          kind: 'terminal_handoff',
+          toolUseId: 'write-terminal',
+          ref: 'maka://runtime/background-tasks/shell-1',
+          message: 'Enter credentials in the original terminal',
+        },
+        withAnswerAdmission: async (answer) => {
+          admissionActive = true;
+          try {
+            return await answer();
+          } finally {
+            admissionActive = false;
+          }
+        },
+        canAnswer: (action, id) => {
+          assert.equal(admissionActive, true, 'readiness is checked inside resource admission');
+          return action === 'cancel' || (ready && id === 'connection_1');
+        },
+        apply: async (action) => {
+          assert.equal(admissionActive, true, 'admission spans persistence and apply');
+          assert.equal(
+            (await store.listPending(RUN)).length,
+            0,
+            'apply follows the durable decision',
+          );
+          applied.push(action);
+        },
+      });
+      await published.promise;
+      const answer = {
+        sessionId: RUN.sessionId,
+        interactionId: 'private-terminal',
+        answer: {
+          kind: 'terminal_handoff' as const,
+          action: 'resume' as const,
+          controllerId: 'card-1',
+        },
+      };
+      assert.equal(
+        (await coordinator.handlers['interaction.answer'](answer, connection())).ok,
+        false,
+      );
+      assert.equal((await store.listPending(RUN)).length, 1);
+      ready = true;
+      assert.equal(
+        (await coordinator.handlers['interaction.answer'](answer, connection())).ok,
+        true,
+      );
+      assert.equal((await pending).kind, 'terminal_handoff_answer');
+      assert.equal(
+        (await coordinator.handlers['interaction.answer'](answer, connection())).ok,
+        true,
+      );
+      assert.deepEqual(applied, ['resume']);
+      assert.deepEqual(await store.listPending(RUN), []);
+      await owner.close('turn_terminal');
+      owner.release();
+      await coordinator.close();
+    });
+  });
+
+  test('terminal apply failure rejects that request without poisoning other interactions', async () => {
+    await withStore(async ({ store }) => {
+      const published = deferred();
+      const coordinator = createCoordinator(store, {
+        refreshCanonicalContinuity: async () => {
+          published.resolve();
+        },
+      });
+      const owner = coordinator.bindRun(RUN);
+      const pending = coordinator.requestTerminalHandoff({
+        ...RUN,
+        requestId: 'failing-terminal',
+        request: {
+          kind: 'terminal_handoff',
+          toolUseId: 'write-terminal',
+          ref: 'maka://runtime/background-tasks/shell-1',
+          message: 'Private input',
+        },
+        canAnswer: () => true,
+        apply: async () => {
+          throw new Error('terminal stop failed');
+        },
+      });
+      const rejected = assert.rejects(pending, /terminal stop failed/);
+      await published.promise;
+      const result = await coordinator.handlers['interaction.answer'](
+        {
+          sessionId: RUN.sessionId,
+          interactionId: 'failing-terminal',
+          answer: { kind: 'terminal_handoff', action: 'cancel', controllerId: 'card' },
+        },
+        connection(),
+      );
+      assert.equal(result.ok, true, 'the durable answer was committed');
+      await rejected;
+      assert.equal(coordinator.isPoisoned(), false);
+      assert.deepEqual(await store.listPending(RUN), []);
+      await owner.close('turn_terminal');
+      owner.release();
+      await coordinator.close();
+    });
+  });
+
+  test('terminal handoff abort during publication closes instead of leaving a pending interaction', async () => {
+    await withStore(async ({ store }) => {
+      const abort = new AbortController();
+      const coordinator = createCoordinator(store, {
+        refreshCanonicalContinuity: async () => {
+          abort.abort();
+        },
+      });
+      const owner = coordinator.bindRun(RUN);
+      const applied: string[] = [];
+      const result = await coordinator.requestTerminalHandoff({
+        ...RUN,
+        requestId: 'cancelled-terminal',
+        signal: abort.signal,
+        request: {
+          kind: 'terminal_handoff',
+          toolUseId: 'write-terminal',
+          ref: 'maka://runtime/background-tasks/shell-1',
+          message: 'Private input',
+        },
+        canAnswer: () => true,
+        apply: async (action) => {
+          applied.push(action);
+        },
+      });
+      assert.equal(result.kind, 'closure');
+      assert.deepEqual(applied, ['cancel']);
+      assert.deepEqual(await store.listPending(RUN), []);
+      await owner.close('turn_terminal');
+      owner.release();
+      await coordinator.close();
+    });
+  });
+
   test('graph activity waits for every canonical request in a Run, including requests answered without Runtime acknowledgements', async () => {
     await withGraphInteractionActivity(
       async ({ coordinator, owner, identity, graph, activity, rootId }) => {
diff --git a/packages/runtime-host/src/__tests__/interaction-protocol.test.ts b/packages/runtime-host/src/__tests__/interaction-protocol.test.ts
index ee60f66272f..db5d782b82d 100644
--- a/packages/runtime-host/src/__tests__/interaction-protocol.test.ts
+++ b/packages/runtime-host/src/__tests__/interaction-protocol.test.ts
@@ -28,7 +28,10 @@ import {
   decodeSessionInteractionProjection,
   HOST_OPERATION_SPECS,
   INTERACTION_MAX_PENDING_PER_SESSION,
+  decodeRuntimeResourceHandoffInput,
+  decodeRuntimeResourceHandoffResult,
 } from '../protocol/index.js';
+import { decodeInteractionAnswer } from '@maka/core/interaction';
 import {
   answerOutcome,
   projectInteractionRecord,
@@ -36,6 +39,95 @@ import {
 } from '../server/interaction-projection.js';
 
 describe('Runtime Host Interaction protocol', () => {
+  test('removed terminal sharing cannot publish private text through an old client', () => {
+    assert.throws(() =>
+      decodeRuntimeResourceHandoffInput({
+        action: 'share',
+        sessionId: 'session-1',
+        requestId: 'request-1',
+        controllerId: 'card-1',
+        sequence: 1,
+        text: 'private',
+      }),
+    );
+    assert.throws(() =>
+      decodeRuntimeResourceHandoffResult({
+        status: 'shared',
+        phase: 'resumed',
+        nextSequence: 1,
+      }),
+    );
+    assert.throws(() =>
+      decodeRuntimeResourceHandoffResult({
+        status: 'rejected',
+        phase: 'resumed',
+        nextSequence: 1,
+        rejection: 'observation_expired',
+      }),
+    );
+  });
+  test('handoff outcomes distinguish rejected input and closure without private display', () => {
+    const rejected = {
+      status: 'rejected',
+      phase: 'human',
+      nextSequence: 1,
+      rejection: 'invalid_input',
+    };
+    assert.deepEqual(decodeRuntimeResourceHandoffResult(rejected), rejected);
+    const closed = { status: 'closed', phase: 'closed', nextSequence: 2, closure: 'exited' };
+    assert.deepEqual(decodeRuntimeResourceHandoffResult(closed), closed);
+    assert.throws(() =>
+      decodeRuntimeResourceHandoffResult({
+        ...closed,
+        display: { text: 'private' },
+      }),
+    );
+    assert.throws(() => decodeRuntimeResourceHandoffResult({ ...rejected, status: 'written' }));
+    assert.throws(() =>
+      decodeRuntimeResourceHandoffResult({ ...closed, closure: 'wrong_password' }),
+    );
+    const cleared = {
+      status: 'observed',
+      phase: 'resumed',
+      nextSequence: 2,
+      display: { text: '' },
+    };
+    assert.deepEqual(decodeRuntimeResourceHandoffResult(cleared), cleared);
+  });
+  test('private terminal bytes use nonjournalled control and cannot be stored in an Interaction answer', () => {
+    assert.equal(HOST_OPERATION_SPECS['runtime.resource.handoff'].mode, 'control');
+    const input = {
+      action: 'input',
+      sessionId: 'session-1',
+      requestId: 'request-1',
+      controllerId: 'card-1',
+      sequence: 1,
+      input: 'synthetic-private-value',
+    };
+    assert.deepEqual(decodeRuntimeResourceHandoffInput(input), input);
+    assert.throws(() =>
+      decodeRuntimeResourceHandoffInput({ ...input, input: 'x'.repeat(32 * 1024 + 1) }),
+    );
+    for (const field of ['input', 'password', 'values', 'text']) {
+      assert.throws(() =>
+        decodeInteractionAnswer({
+          kind: 'terminal_handoff',
+          action: 'resume',
+          controllerId: 'card-1',
+          [field]: 'synthetic-private-value',
+        }),
+      );
+    }
+    assert.deepEqual(
+      decodeInteractionAnswer({
+        kind: 'terminal_handoff',
+        action: 'resume',
+        controllerId: 'card-1',
+      }),
+      { kind: 'terminal_handoff', action: 'resume', controllerId: 'card-1' },
+    );
+  });
+
   test('decodes a closed snapshot and rejects extra fields', () => {
     const closed = {
       ...snapshotBase('interaction-1'),
diff --git a/packages/runtime-host/src/__tests__/runtime-resource-coordinator.test.ts b/packages/runtime-host/src/__tests__/runtime-resource-coordinator.test.ts
index fada222ef82..b918a12974b 100644
--- a/packages/runtime-host/src/__tests__/runtime-resource-coordinator.test.ts
+++ b/packages/runtime-host/src/__tests__/runtime-resource-coordinator.test.ts
@@ -46,11 +46,443 @@ import {
   type HostRuntimeResourceCoordinatorInput,
 } from '../server/runtime-resource-coordinator.js';
 import { SessionAdmissionGate } from '../server/session-admission-gate.js';
+import { deferred } from '@maka/core/test-only/async-primitives';
+import type { HostInteractionCoordinator } from '../server/interaction-coordinator.js';
 
 const SESSION_ID = 'session-1';
 const RUNTIME_REF = 'maka://runtime/background-tasks/shell-1';
 
 describe('Host Runtime Resource coordinator', () => {
+  test('a handoff cannot gate or stop a terminal the model is not allowed to read', async () => {
+    const harness = createHarness({
+      humanControl: {
+        preparePtyHandoff: async () => {
+          assert.fail('must validate before preparing');
+        },
+        writePrivatePtyInput: async () => {},
+        readPrivatePtySnapshot: async () => ({
+          text: '',
+        }),
+        resumePtyHandoff: async () => false,
+      },
+      interactionAuthority: () => ({
+        requestTerminalHandoff: async () => {
+          throw new Error('must not request');
+        },
+        closeTerminalHandoff: async () => {},
+      }),
+    });
+    harness.modelReadFailure = new Error('User-owned terminal');
+    await harness.coordinator.handlers['runtime.resource.handoff'](
+      { action: 'surface', sessionId: SESSION_ID, available: true },
+      connection('desktop'),
+    );
+    await assert.rejects(
+      harness.coordinator.requestHandoff(RUNTIME_REF, 'Authenticate', {
+        sessionId: SESSION_ID,
+        runId: 'run-1',
+        turnId: 'turn-1',
+        toolCallId: 'tool-1',
+        cwd: '/workspace',
+        abortSignal: new AbortController().signal,
+        emitOutput: () => {},
+      }),
+      /User-owned/,
+    );
+    assert.equal(harness.stopCount, 0);
+    const lookup = await harness.coordinator.handlers['runtime.resource.handoff'](
+      { action: 'lookup', sessionId: SESSION_ID, ref: RUNTIME_REF },
+      connection('desktop'),
+    );
+    assert.equal(lookup.ok && lookup.result.status, 'unavailable');
+  });
+
+  test('private handoff fences model writes, deduplicates input and survives controller disconnect', async () => {
+    const published = deferred();
+    const decision = deferred<import('@maka/core/interaction').InteractionCanonicalOutcome>();
+    let request!: Parameters<HostInteractionCoordinator['requestTerminalHandoff']>[0];
+    const inputs: string[] = [];
+    const harness = createHarness({
+      humanControl: {
+        preparePtyHandoff: async () => {},
+        writePrivatePtyInput: async (_session, _ref, input) => {
+          inputs.push(input);
+        },
+        readPrivatePtySnapshot: async () => ({
+          text: 'private',
+        }),
+        resumePtyHandoff: async () => true,
+      },
+      interactionAuthority: () => ({
+        requestTerminalHandoff: async (input) => {
+          request = input;
+          published.resolve();
+          return decision.promise;
+        },
+        closeTerminalHandoff: async () => {
+          await request.apply('cancel');
+          decision.resolve({
+            kind: 'closure',
+            reason: 'producer_cancelled',
+            committedAt: 1,
+          });
+        },
+      }),
+    });
+    const host = harness.coordinator;
+    const control = host.handlers['runtime.resource.handoff'];
+    assert.equal(host.isHandoffAvailable(SESSION_ID), false);
+    await control(
+      { action: 'surface', sessionId: SESSION_ID, available: true },
+      connection('desktop'),
+    );
+    const held = deferred();
+    const release = deferred();
+    const admission = harness.sessionAdmission.run(SESSION_ID, async () => {
+      held.resolve();
+      await release.promise;
+    });
+    await held.promise;
+    const handoff = host.requestHandoff(RUNTIME_REF, 'Authenticate', {
+      sessionId: SESSION_ID,
+      runId: 'run-1',
+      turnId: 'turn-1',
+      toolCallId: 'tool-1',
+      cwd: '/workspace',
+      abortSignal: new AbortController().signal,
+      emitOutput: () => {},
+    });
+    const staleWrite = assert.rejects(
+      host.writeStdin({
+        sessionId: SESSION_ID,
+        ref: RUNTIME_REF,
+        input: 'queued before handoff admission',
+      }),
+      /expired/,
+    );
+    release.resolve();
+    await admission;
+    await staleWrite;
+    await published.promise;
+    const identity = {
+      sessionId: SESSION_ID,
+      requestId: request.requestId,
+      controllerId: 'card-1',
+    };
+    assert.equal(request.canAnswer('resume', 'desktop', 'card-1'), false);
+    assert.equal((await control({ ...identity, action: 'ready' }, connection('desktop'))).ok, true);
+    const invalid = await control(
+      { ...identity, action: 'input', sequence: 1, input: 'two\nlines' },
+      connection('desktop'),
+    );
+    assert.equal(invalid.ok && invalid.result.rejection, 'invalid_input');
+    assert.equal(invalid.ok && invalid.result.nextSequence, 1);
+    assert.deepEqual(inputs, []);
+    assert.equal(request.canAnswer('resume', 'desktop', 'card-1'), true);
+    await control(
+      { ...identity, controllerId: 'replacement', action: 'ready' },
+      connection('desktop'),
+    );
+    await assert.rejects(request.apply('resume'), /controller expired before Resume/);
+    await control({ ...identity, action: 'ready' }, connection('desktop'));
+    assert.equal(request.canAnswer('resume', 'desktop', 'card-1'), true);
+    await assert.rejects(
+      host.writeStdin({
+        sessionId: SESSION_ID,
+        ref: RUNTIME_REF,
+        input: 'model write',
+      }),
+      /human/,
+    );
+    assert.equal(
+      (
+        await control(
+          {
+            ...identity,
+            action: 'input',
+            sequence: 1,
+            input: 'fixture-password',
+          },
+          connection('desktop'),
+        )
+      ).ok,
+      true,
+    );
+    assert.equal(
+      (
+        await control(
+          {
+            ...identity,
+            action: 'input',
+            sequence: 1,
+            input: 'must-not-replay',
+          },
+          connection('desktop'),
+        )
+      ).ok,
+      true,
+    );
+    assert.deepEqual(inputs, ['fixture-password\r']);
+    host.releaseConnection('desktop');
+    assert.equal(request.canAnswer('resume', 'desktop', 'card-1'), false);
+    assert.equal(
+      (
+        await control(
+          { ...identity, action: 'input', sequence: 2, input: 'stale' },
+          connection('desktop'),
+        )
+      ).ok,
+      true,
+    );
+    const expired = await control({ ...identity, action: 'observe' }, connection('desktop'));
+    assert.equal(expired.ok && expired.result.rejection, 'controller_expired');
+    assert.equal(expired.ok && expired.result.display, undefined);
+    await assert.rejects(
+      host.writeStdin({
+        sessionId: SESSION_ID,
+        ref: RUNTIME_REF,
+        input: 'model write',
+      }),
+      /human/,
+    );
+    await control(
+      { action: 'surface', sessionId: SESSION_ID, available: true },
+      connection('reconnected'),
+    );
+    const reattached = { ...identity, controllerId: 'card-2' };
+    await control({ ...reattached, action: 'ready' }, connection('reconnected'));
+    assert.equal(request.canAnswer('resume', 'reconnected', 'card-2'), true);
+    assert.equal(request.canAnswer('resume', 'reconnected', 'card-1'), false);
+    await control(
+      { ...reattached, action: 'input', sequence: 2, input: 'second-factor' },
+      connection('reconnected'),
+    );
+    assert.ok(request.withAnswerAdmission);
+    let releaseAfterCommit!: Promise<unknown>;
+    await request.withAnswerAdmission(async () => {
+      assert.equal(request.canAnswer('resume', 'reconnected', 'card-2'), true);
+      // The decision is admitted: unmount and disconnect during persistence
+      // cannot invalidate the transfer and kill the authenticated terminal.
+      releaseAfterCommit = control({ ...reattached, action: 'release' }, connection('reconnected'));
+      host.releaseConnection('reconnected');
+      await request.apply('resume');
+    });
+    await releaseAfterCommit;
+    decision.resolve({
+      kind: 'terminal_handoff_answer',
+      action: 'resume',
+      committedAt: 2,
+    });
+    assert.equal(JSON.parse(await handoff).outcome, 'resumed');
+    assert.deepEqual(inputs, ['fixture-password\r', 'second-factor\r']);
+    await host.writeStdin({
+      sessionId: SESSION_ID,
+      ref: RUNTIME_REF,
+      input: 'new model write',
+    });
+    assert.equal(harness.writeCount, 1);
+    await control({ ...reattached, action: 'release' }, connection('reconnected'));
+    const afterSwitch = await control(
+      { action: 'lookup', sessionId: SESSION_ID, ref: RUNTIME_REF },
+      connection('reconnected'),
+    );
+    assert.equal(afterSwitch.ok && afterSwitch.result.phase, 'resumed');
+    await control(
+      { action: 'surface', sessionId: SESSION_ID, available: true },
+      connection('reconnected'),
+    );
+    await control({ ...reattached, action: 'ready' }, connection('reconnected'));
+    const returned = await control({ ...reattached, action: 'observe' }, connection('reconnected'));
+    assert.equal(returned.ok && returned.result.display?.text, 'private');
+    host.observeShellRunUpdate({
+      ...ptyUpdate(),
+      result: { ...ptySnapshot(), status: 'completed', exitCode: 0 },
+    });
+    const ended = await control({ ...reattached, action: 'observe' }, connection('reconnected'));
+    assert.equal(ended.ok && ended.result.status, 'closed');
+    assert.equal(ended.ok && ended.result.closure, 'exited');
+    assert.equal(ended.ok && ended.result.display, undefined);
+    const closedLookup = await control(
+      { action: 'lookup', sessionId: SESSION_ID, ref: RUNTIME_REF },
+      connection('reconnected'),
+    );
+    assert.equal(closedLookup.ok && closedLookup.result.request?.requestId, request.requestId);
+    assert.equal(closedLookup.ok && closedLookup.result.closure, 'exited');
+    const released = await control({ ...reattached, action: 'release' }, connection('reconnected'));
+    assert.equal(released.ok && released.result.status, 'closed');
+    const releasedLookup = await control(
+      { action: 'lookup', sessionId: SESSION_ID, ref: RUNTIME_REF },
+      connection('reconnected'),
+    );
+    assert.equal(releasedLookup.ok && releasedLookup.result.status, 'unavailable');
+    assert.equal(releasedLookup.ok && releasedLookup.result.request, undefined);
+  });
+
+  test('uncertain delivery stays fenced across reconnect and never resends input', async () => {
+    const published = deferred();
+    const decision = deferred<import('@maka/core/interaction').InteractionCanonicalOutcome>();
+    let request!: Parameters<HostInteractionCoordinator['requestTerminalHandoff']>[0];
+    let writes = 0;
+    const inputStarted = deferred();
+    const inputFinished = deferred();
+    const harness = createHarness({
+      humanControl: {
+        preparePtyHandoff: async () => {},
+        writePrivatePtyInput: async () => {
+          writes++;
+          inputStarted.resolve();
+          await inputFinished.promise;
+          throw new Error('partial write');
+        },
+        readPrivatePtySnapshot: async () => ({
+          text: 'private',
+        }),
+        resumePtyHandoff: async () => {
+          assert.fail('must not resume');
+        },
+      },
+      interactionAuthority: () => ({
+        requestTerminalHandoff: async (input) => {
+          request = input;
+          published.resolve();
+          return decision.promise;
+        },
+        closeTerminalHandoff: async () => {},
+      }),
+    });
+    const control = harness.coordinator.handlers['runtime.resource.handoff'];
+    await control(
+      { action: 'surface', sessionId: SESSION_ID, available: true },
+      connection('desktop'),
+    );
+    const pending = harness.coordinator.requestHandoff(RUNTIME_REF, 'Authenticate', {
+      sessionId: SESSION_ID,
+      runId: 'run-1',
+      turnId: 'turn-1',
+      toolCallId: 'tool-1',
+      cwd: '/workspace',
+      abortSignal: new AbortController().signal,
+      emitOutput: () => {},
+    });
+    await published.promise;
+    const identity = {
+      sessionId: SESSION_ID,
+      requestId: request.requestId,
+      controllerId: 'card-1',
+    };
+    await control({ ...identity, action: 'ready' }, connection('desktop'));
+    assert.equal(request.canAnswer('resume', 'desktop', 'card-1'), true);
+    const receiptPending = control(
+      { ...identity, action: 'input', sequence: 1, input: 'secret' },
+      connection('desktop'),
+    );
+    await inputStarted.promise;
+    assert.ok(request.withAnswerAdmission);
+    let committedResume = false;
+    const racedResume = request.withAnswerAdmission(async () => {
+      if (!request.canAnswer('resume', 'desktop', 'card-1')) return;
+      committedResume = true;
+      await request.apply('resume');
+    });
+    inputFinished.resolve();
+    const receipt = await receiptPending;
+    await racedResume;
+    assert.equal(
+      committedResume,
+      false,
+      'unknown delivery refuses Resume before its decision is committed',
+    );
+    assert.equal(receipt.ok && receipt.result.status, 'outcome_unknown');
+    await control(
+      { ...identity, action: 'input', sequence: 1, input: 'secret' },
+      connection('desktop'),
+    );
+    harness.coordinator.releaseConnection('desktop');
+    await control({ action: 'surface', sessionId: SESSION_ID, available: true }, connection('new'));
+    const reclaimed = await control({ ...identity, action: 'ready' }, connection('new'));
+    assert.equal(reclaimed.ok && reclaimed.result.status, 'outcome_unknown');
+    assert.equal(request.canAnswer('resume', 'new', 'card-1'), false);
+    assert.equal(
+      (
+        await control(
+          { ...identity, action: 'input', sequence: 2, input: 'secret' },
+          connection('new'),
+        )
+      ).ok,
+      false,
+    );
+    assert.equal(writes, 1);
+    await request.apply('cancel');
+    decision.resolve({
+      kind: 'terminal_handoff_answer',
+      action: 'cancel',
+      committedAt: 1,
+    });
+    assert.equal(JSON.parse(await pending).outcome, 'closed');
+    const ended = await control({ ...identity, action: 'observe' }, connection('new'));
+    assert.equal(ended.ok && ended.result.closure, 'cancelled');
+  });
+
+  test('bounds only closed handoffs without evicting live resumed review surfaces', async () => {
+    const harness = createHarness({
+      humanControl: {
+        preparePtyHandoff: async () => {},
+        writePrivatePtyInput: async () => {},
+        readPrivatePtySnapshot: async () => ({ text: 'private' }),
+        resumePtyHandoff: async () => true,
+      },
+      interactionAuthority: () => ({
+        requestTerminalHandoff: async (request) => {
+          await harness.coordinator.handlers['runtime.resource.handoff'](
+            {
+              action: 'ready',
+              sessionId: SESSION_ID,
+              requestId: request.requestId,
+              controllerId: 'card',
+            },
+            connection('desktop'),
+          );
+          assert.equal(request.canAnswer('resume', 'desktop', 'card'), true);
+          await request.apply('resume');
+          return { kind: 'terminal_handoff_answer', action: 'resume', committedAt: 1 };
+        },
+        closeTerminalHandoff: async () => {},
+      }),
+    });
+    const host = harness.coordinator;
+    const control = host.handlers['runtime.resource.handoff'];
+    await control(
+      { action: 'surface', sessionId: SESSION_ID, available: true },
+      connection('desktop'),
+    );
+    const refs = Array.from({ length: 130 }, (_, index) => `${RUNTIME_REF}-${index}`);
+    for (const ref of refs) {
+      await host.requestHandoff(ref, 'Authenticate', {
+        sessionId: SESSION_ID,
+        runId: 'run-1',
+        turnId: 'turn-1',
+        toolCallId: ref,
+        cwd: '/workspace',
+        abortSignal: new AbortController().signal,
+        emitOutput: () => {},
+      });
+    }
+    const lookup = (ref: string) =>
+      control({ action: 'lookup', sessionId: SESSION_ID, ref }, connection('desktop'));
+    const live = await lookup(refs[0]!);
+    assert.equal(live.ok && live.result.phase, 'resumed');
+    for (const ref of refs)
+      host.observeShellRunUpdate({
+        ...ptyUpdate(),
+        result: { ...ptySnapshot(), ref, status: 'completed', exitCode: 0 },
+      });
+    const evicted = await lookup(refs[0]!);
+    const retained = await lookup(refs[2]!);
+    assert.equal(evicted.ok && evicted.result.status, 'unavailable');
+    assert.equal(retained.ok && retained.result.status, 'closed');
+    await host.close();
+  });
+
   test('pages one stable bounded projection and rejects stale continuation revisions', async () => {
     const harness = createHarness();
     harness.updates = Array.from({ length: 65 }, (_, index) => resourceUpdate(index));
@@ -117,7 +549,10 @@ describe('Host Runtime Resource coordinator', () => {
     const compact = compactState(0);
     harness.updates = [
       resourceUpdate(0, {
-        ownership: { kind: 'source_unavailable', sourceSessionId: 'source-session' },
+        ownership: {
+          kind: 'source_unavailable',
+          sourceSessionId: 'source-session',
+        },
         sourceToolCallId: 'call.1/part',
         result: compact,
       }),
@@ -306,7 +741,11 @@ describe('Host Runtime Resource coordinator', () => {
     const harness = createHarness();
     const firstConnection = connection('connection-1');
     const secondConnection = connection('connection-2');
-    const identity = { sessionId: SESSION_ID, ref: RUNTIME_REF, controllerId: 'controller-1' };
+    const identity = {
+      sessionId: SESSION_ID,
+      ref: RUNTIME_REF,
+      controllerId: 'controller-1',
+    };
 
     const acquired = await harness.coordinator.handlers['runtime.resource.controller.acquire'](
       identity,
@@ -470,7 +909,11 @@ describe('Host Runtime Resource coordinator', () => {
     const harness = createHarness();
     harness.malformedStartResult = true;
     const started = await harness.coordinator.handlers['runtime.resource.start'](
-      { sessionId: SESSION_ID, launchId: 'user-command-1', command: 'sleep 3600' },
+      {
+        sessionId: SESSION_ID,
+        launchId: 'user-command-1',
+        command: 'sleep 3600',
+      },
       connection('connection-1'),
     );
 
@@ -503,7 +946,11 @@ describe('Host Runtime Resource coordinator', () => {
     harness.backgroundResult = terminalResult;
 
     const started = await harness.coordinator.handlers['runtime.resource.start'](
-      { sessionId: SESSION_ID, launchId: 'user-command-big', command: 'printf big' },
+      {
+        sessionId: SESSION_ID,
+        launchId: 'user-command-big',
+        command: 'printf big',
+      },
       connection('connection-1'),
     );
 
@@ -580,11 +1027,17 @@ describe('Host Runtime Resource coordinator', () => {
       },
     });
 
-    await harness.coordinator.runForegroundBash({ ...backgroundInput(), shell: callerPlan });
+    await harness.coordinator.runForegroundBash({
+      ...backgroundInput(),
+      shell: callerPlan,
+    });
     assert.deepEqual(harness.lastForegroundInput?.shell, callerPlan);
     assert.equal(resolveCalls, 0);
 
-    await harness.coordinator.runBackgroundBash({ ...backgroundInput(), shell: callerPlan });
+    await harness.coordinator.runBackgroundBash({
+      ...backgroundInput(),
+      shell: callerPlan,
+    });
     assert.deepEqual(harness.lastBackgroundInput?.shell, callerPlan);
     assert.equal(resolveCalls, 0);
     harness.finishBackground({ successful: true });
@@ -631,7 +1084,11 @@ describe('Host Runtime Resource coordinator', () => {
   test('starts a one-shot user command in pipes without exposing it to the model', async () => {
     const harness = createHarness();
     const started = await harness.coordinator.handlers['runtime.resource.start'](
-      { sessionId: SESSION_ID, launchId: 'user-command-1', command: 'printf user-command' },
+      {
+        sessionId: SESSION_ID,
+        launchId: 'user-command-1',
+        command: 'printf user-command',
+      },
       connection('connection-1'),
     );
 
@@ -691,7 +1148,11 @@ describe('Host Runtime Resource coordinator', () => {
     const harness = createHarness();
     const firstConnection = connection('connection-1');
     const secondConnection = connection('connection-2');
-    const identity = { sessionId: SESSION_ID, ref: RUNTIME_REF, controllerId: 'controller-1' };
+    const identity = {
+      sessionId: SESSION_ID,
+      ref: RUNTIME_REF,
+      controllerId: 'controller-1',
+    };
     await harness.coordinator.handlers['runtime.resource.controller.acquire'](
       identity,
       firstConnection,
@@ -869,7 +1330,11 @@ function createHarness(
   options: Partial<
     Pick<
       HostRuntimeResourceCoordinatorInput,
-      'requestDrain' | 'resolveShell' | 'sessionAccessAuthority'
+      | 'requestDrain'
+      | 'resolveShell'
+      | 'sessionAccessAuthority'
+      | 'humanControl'
+      | 'interactionAuthority'
     >
   > = {},
 ) {
@@ -896,6 +1361,7 @@ function createHarness(
     livePty: undefined as ShellRunPtySnapshot | null | undefined,
     inspectCalls: [] as { sessionId: string; ref: string }[],
     inspectFailure: undefined as Error | undefined,
+    modelReadFailure: undefined as Error | undefined,
     activeResidencies: 0,
     lastBackgroundInput: undefined as ShellRunBashInput | undefined,
     lastForegroundInput: undefined as ShellRunBashInput | undefined,
@@ -922,7 +1388,10 @@ function createHarness(
       }
       return state.backgroundResult ?? compactState(0);
     },
-    readRuntimeResource: async () => currentSnapshot,
+    readRuntimeResource: async () => {
+      if (state.modelReadFailure) throw state.modelReadFailure;
+      return currentSnapshot;
+    },
     stopBackgroundTask: async () => {
       state.stopCount += 1;
       return {
@@ -954,7 +1423,12 @@ function createHarness(
           kind: 'pty_control',
           failed: false,
           ...(input.input
-            ? { input: { bytes: Buffer.byteLength(input.input, 'utf8'), queued: true } }
+            ? {
+                input: {
+                  bytes: Buffer.byteLength(input.input, 'utf8'),
+                  queued: true,
+                },
+              }
             : {}),
           ...(input.size
             ? {
@@ -976,7 +1450,10 @@ function createHarness(
             ref,
             sequence: 0,
             buffer: '',
-            size: { cols: currentSnapshot.output.cols, rows: currentSnapshot.output.rows },
+            size: {
+              cols: currentSnapshot.output.cols,
+              rows: currentSnapshot.output.rows,
+            },
           },
     inspectResource: async (sessionId, ref) => {
       state.inspectCalls.push({ sessionId, ref });
@@ -1183,7 +1660,10 @@ test('Runtime Resource pages include output projections and their Session header
   }
   expected.sort((a, b) => a.result.ref.localeCompare(b.result.ref));
   const pages: Extract<RuntimeResourceQueryResult, { kind: 'page' }>[] = [];
-  let input: RuntimeResourceQueryInput = { kind: 'list_start', sessionId: SESSION_ID };
+  let input: RuntimeResourceQueryInput = {
+    kind: 'list_start',
+    sessionId: SESSION_ID,
+  };
   let end = 0;
   do {
     const outcome = await harness.coordinator.handlers['runtime.resource.query'](
diff --git a/packages/runtime-host/src/adapter/session-projector.ts b/packages/runtime-host/src/adapter/session-projector.ts
index c36d07e32a1..a7c4b3e6da1 100644
--- a/packages/runtime-host/src/adapter/session-projector.ts
+++ b/packages/runtime-host/src/adapter/session-projector.ts
@@ -593,6 +593,16 @@ export function projectRuntimeHostInteractionRequest(
       },
     ];
   }
+  if (interaction.request.kind === 'terminal_handoff') {
+    return [
+      {
+        type: 'terminal_handoff_request',
+        ...base,
+        ref: interaction.request.ref,
+        message: interaction.request.message,
+      },
+    ];
+  }
   if (interaction.request.kind === 'form') {
     return [
       {
diff --git a/packages/runtime-host/src/protocol/index.ts b/packages/runtime-host/src/protocol/index.ts
index a2b5157ce9f..24fb9083613 100644
--- a/packages/runtime-host/src/protocol/index.ts
+++ b/packages/runtime-host/src/protocol/index.ts
@@ -106,7 +106,8 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1 as const;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0 as const;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 220 as const;
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 221 as const;
+// 221: Private terminal handoff Interaction and nonjournalled Runtime Resource control.
 // 220: Client Capability results require a tri-state outcome; session tool
 // continuity and trace steps carry interrupted results. Older peers cannot
 // decode the changed strict shapes.
diff --git a/packages/runtime-host/src/protocol/operations.ts b/packages/runtime-host/src/protocol/operations.ts
index fba841c427c..cc4ed3f4572 100644
--- a/packages/runtime-host/src/protocol/operations.ts
+++ b/packages/runtime-host/src/protocol/operations.ts
@@ -334,6 +334,7 @@ export const REMOTE_OWNER_OPERATION_GRANTS = Object.freeze([
   'runtime.resource.controller.acquire',
   'runtime.resource.controller.control',
   'runtime.resource.controller.release',
+  'runtime.resource.handoff',
   'runtime.resource.query',
   'runtime.resource.start',
   'runtime.resource.stop',
diff --git a/packages/runtime-host/src/protocol/runtime-resource.ts b/packages/runtime-host/src/protocol/runtime-resource.ts
index 9f443f00d91..53c9e3b2c78 100644
--- a/packages/runtime-host/src/protocol/runtime-resource.ts
+++ b/packages/runtime-host/src/protocol/runtime-resource.ts
@@ -36,6 +36,8 @@ import {
 } from './codec.js';
 import { invalidProtocolFrame } from './errors.js';
 import { defineOperation } from './operation-spec.js';
+import { TERMINAL_HANDOFF_OPERATION_SPECS } from './terminal-handoff.js';
+export * from './terminal-handoff.js';
 
 export const RUNTIME_RESOURCE_RESULT_MAX_BYTES = 52 * 1024;
 export const RUNTIME_RESOURCE_CONTROLLER_ACQUIRE_RESULT_MAX_BYTES = 90 * 1024;
@@ -174,6 +176,7 @@ export interface RuntimeResourceStartResult {
 export type RuntimeResourceStopResult = Record<never, never>;
 
 export const RUNTIME_RESOURCE_OPERATION_SPECS = {
+  ...TERMINAL_HANDOFF_OPERATION_SPECS,
   'runtime.resource.query': defineOperation<
     RuntimeResourceQueryInput,
     RuntimeResourceQueryResult,
diff --git a/packages/runtime-host/src/protocol/terminal-handoff.ts b/packages/runtime-host/src/protocol/terminal-handoff.ts
new file mode 100644
index 00000000000..d13c4ab8b17
--- /dev/null
+++ b/packages/runtime-host/src/protocol/terminal-handoff.ts
@@ -0,0 +1,211 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import {
+  requireRecord,
+  requireExactRecord,
+  requireShapedRecord,
+  requireEntityId,
+  requireCount,
+  requireUtf8String,
+} from './codec.js';
+import { invalidProtocolFrame } from './errors.js';
+import { defineOperation } from './operation-spec.js';
+
+export type RuntimeResourceHandoffInput =
+  | { readonly action: 'lookup'; readonly sessionId: string; readonly ref: string }
+  | { readonly action: 'surface'; readonly sessionId: string; readonly available: boolean }
+  | {
+      readonly action: 'ready' | 'observe' | 'release';
+      readonly sessionId: string;
+      readonly requestId: string;
+      readonly controllerId: string;
+    }
+  | {
+      readonly action: 'input';
+      readonly sessionId: string;
+      readonly requestId: string;
+      readonly controllerId: string;
+      readonly sequence: number;
+      readonly input: string;
+    };
+
+export interface RuntimeResourceHandoffResult {
+  readonly status:
+    | 'available'
+    | 'unavailable'
+    | 'ready'
+    | 'written'
+    | 'outcome_unknown'
+    | 'rejected'
+    | 'closed'
+    | 'observed';
+  readonly nextSequence: number;
+  readonly phase: 'waiting' | 'human' | 'resumed' | 'closed';
+  /** Non-sensitive transport/lifecycle facts, never an authentication verdict. */
+  readonly rejection?: 'invalid_input' | 'controller_expired';
+  readonly closure?: 'exited' | 'cancelled' | 'unavailable';
+  /** Private live projection: never journal or attach to a model tool result. */
+  readonly display?: {
+    readonly text: string;
+  };
+  readonly request?: {
+    readonly requestId: string;
+    readonly ref: string;
+    readonly message: string;
+    readonly command: string;
+  };
+}
+
+export function decodeRuntimeResourceHandoffInput(value: unknown): RuntimeResourceHandoffInput {
+  const record = requireRecord(value, 'Terminal handoff');
+  const sessionId = requireEntityId(record.sessionId, 'sessionId');
+  if (record.action === 'lookup') {
+    requireExactRecord(record, 'Terminal handoff lookup', ['action', 'sessionId', 'ref']);
+    return { action: 'lookup', sessionId, ref: requireUtf8String(record.ref, 'ref', 256) };
+  }
+  if (record.action === 'surface') {
+    requireExactRecord(record, 'Terminal surface', ['action', 'sessionId', 'available']);
+    if (typeof record.available !== 'boolean')
+      throw invalidProtocolFrame('Invalid terminal surface readiness');
+    return { action: 'surface', sessionId, available: record.available };
+  }
+  const requestId = requireEntityId(record.requestId, 'requestId');
+  const controllerId = requireEntityId(record.controllerId, 'controllerId');
+  const base = { sessionId, requestId, controllerId };
+  if (record.action === 'ready' || record.action === 'observe' || record.action === 'release') {
+    requireExactRecord(record, 'Terminal handoff control', [
+      'action',
+      'sessionId',
+      'requestId',
+      'controllerId',
+    ]);
+    return { ...base, action: record.action };
+  }
+  const sequence = requireCount(record.sequence, 'sequence');
+  if (sequence >= Number.MAX_SAFE_INTEGER)
+    throw invalidProtocolFrame('Invalid terminal input sequence');
+  if (record.action === 'input') {
+    requireExactRecord(record, 'Private terminal input', [
+      'action',
+      'sessionId',
+      'requestId',
+      'controllerId',
+      'sequence',
+      'input',
+    ]);
+    return {
+      ...base,
+      action: 'input',
+      sequence,
+      input: requireUtf8String(record.input, 'private input', 32 * 1024),
+    };
+  }
+  throw invalidProtocolFrame('Unsupported terminal handoff action');
+}
+
+export function decodeRuntimeResourceHandoffResult(value: unknown): RuntimeResourceHandoffResult {
+  const record = requireShapedRecord(
+    value,
+    'Terminal handoff result',
+    ['status', 'nextSequence', 'phase'],
+    ['display', 'request', 'rejection', 'closure'],
+  );
+  if (
+    ![
+      'available',
+      'unavailable',
+      'ready',
+      'written',
+      'outcome_unknown',
+      'rejected',
+      'closed',
+      'observed',
+    ].includes(record.status as string) ||
+    !['waiting', 'human', 'resumed', 'closed'].includes(record.phase as string)
+  ) {
+    throw invalidProtocolFrame('Invalid terminal handoff state');
+  }
+  if (
+    (record.status === 'rejected') !== (record.rejection !== undefined) ||
+    (record.rejection !== undefined &&
+      !['invalid_input', 'controller_expired'].includes(record.rejection as string)) ||
+    (record.status === 'closed') !== (record.closure !== undefined) ||
+    (record.closure !== undefined &&
+      (!['exited', 'cancelled', 'unavailable'].includes(record.closure as string) ||
+        record.phase !== 'closed' ||
+        record.display !== undefined))
+  ) {
+    throw invalidProtocolFrame('Invalid terminal handoff outcome');
+  }
+  let display: RuntimeResourceHandoffResult['display'];
+  let request: RuntimeResourceHandoffResult['request'];
+  if (record.request !== undefined) {
+    const item = requireExactRecord(record.request, 'Terminal handoff request', [
+      'requestId',
+      'ref',
+      'message',
+      'command',
+    ]);
+    request = {
+      requestId: requireEntityId(item.requestId, 'requestId'),
+      ref: requireUtf8String(item.ref, 'ref', 256),
+      message: requireUtf8String(item.message, 'message', 2_048),
+      command: requireUtf8String(item.command, 'command', 4_096),
+    };
+  }
+  if (record.display !== undefined) {
+    const screen = requireExactRecord(record.display, 'Private terminal display', ['text']);
+    display = {
+      text: screen.text === '' ? '' : requireUtf8String(screen.text, 'private display', 48 * 1024),
+    };
+  }
+  return {
+    status: record.status as RuntimeResourceHandoffResult['status'],
+    phase: record.phase as RuntimeResourceHandoffResult['phase'],
+    nextSequence: requireCount(record.nextSequence, 'nextSequence'),
+    ...(record.rejection
+      ? { rejection: record.rejection as RuntimeResourceHandoffResult['rejection'] }
+      : {}),
+    ...(record.closure
+      ? { closure: record.closure as RuntimeResourceHandoffResult['closure'] }
+      : {}),
+    ...(display ? { display } : {}),
+    ...(request ? { request } : {}),
+  };
+}
+
+export const TERMINAL_HANDOFF_OPERATION_SPECS = {
+  'runtime.resource.handoff': defineOperation({
+    mode: 'control',
+    availability: 'ready',
+    errors: [
+      'host_not_ready',
+      'host_draining',
+      'operation_unavailable',
+      'not_found',
+      'session_archived',
+      'operation_conflict',
+      'invalid_request',
+      'internal_failure',
+    ] as const,
+    decodeInput: decodeRuntimeResourceHandoffInput,
+    decodeOutput: decodeRuntimeResourceHandoffResult,
+  }),
+} as const;
diff --git a/packages/runtime-host/src/server/execution-composition.ts b/packages/runtime-host/src/server/execution-composition.ts
index 2771c1605c6..de9532d5752 100644
--- a/packages/runtime-host/src/server/execution-composition.ts
+++ b/packages/runtime-host/src/server/execution-composition.ts
@@ -544,6 +544,8 @@ export async function createExecutionRuntimeHostComposition(
       context.requestDrain,
     );
     runtimeResources = new HostRuntimeResourceCoordinator({
+      humanControl: shellRuns,
+      interactionAuthority: () => interactions,
       manager: shellRuns,
       sessions: {
         listShellRunUpdates: (sessionId) =>
@@ -582,6 +584,14 @@ export async function createExecutionRuntimeHostComposition(
       attachmentResources,
       backgroundTasks: runtimeResources,
       ptyControls: runtimeResources,
+      terminalHandoff: {
+        available: (sessionId: string) => runtimeResources!.isHandoffAvailable(sessionId),
+        request: (
+          ref: string,
+          message: string,
+          invocation: import('@maka/runtime/tool-runtime').MakaToolContext,
+        ) => runtimeResources!.requestHandoff(ref, message, invocation),
+      },
       ...(openedContextOffloadStore
         ? {
             snapshotImage: async (input: {
diff --git a/packages/runtime-host/src/server/interaction-coordinator.ts b/packages/runtime-host/src/server/interaction-coordinator.ts
index 52ea47b0e2a..86d98601ffe 100644
--- a/packages/runtime-host/src/server/interaction-coordinator.ts
+++ b/packages/runtime-host/src/server/interaction-coordinator.ts
@@ -39,6 +39,8 @@ import {
   type InteractionClosureReason,
   type InteractionFormRequest,
   type InteractionFormResult,
+  decodeInteractionRequest,
+  type InteractionTerminalHandoffRequest,
 } from '@maka/core/interaction';
 import type {
   SandboxBoundaryRequest,
@@ -87,7 +89,7 @@ import {
   runtimeQuestionOutcome,
   runtimeFormOutcome,
 } from './interaction-projection.js';
-import type { InteractionOperationHandlerMap } from './operation-dispatcher.js';
+import type { InteractionOperationHandlerMap, ConnectionContext } from './operation-dispatcher.js';
 import { type SessionAdmissionLease, SessionAdmissionGate } from './session-admission-gate.js';
 import type { SessionPresenceReader } from './session-presence.js';
 
@@ -169,9 +171,28 @@ interface LiveClientCapabilityEntry extends LiveEntryBase {
   readonly reject: (error: unknown) => void;
 }
 
-type LiveStoredEntry = LiveQuestionEntry | LiveFormEntry | LiveClientCapabilityEntry;
+interface LiveTerminalHandoffEntry extends LiveEntryBase {
+  readonly kind: 'terminal_handoff';
+  readonly request: StoredInteractionRequest;
+  readonly apply: (action: 'resume' | 'cancel') => Promise<void>;
+  readonly withAnswerAdmission?: <T>(answer: () => Promise<T>) => Promise<T>;
+  readonly canAnswer: (
+    action: 'resume' | 'cancel',
+    connectionId: string,
+    controllerId: string,
+  ) => boolean;
+  readonly resolve: (outcome: InteractionCanonicalOutcome) => void;
+  readonly reject: (error: unknown) => void;
+}
+
+type LiveStoredEntry =
+  | LiveQuestionEntry
+  | LiveFormEntry
+  | LiveClientCapabilityEntry
+  | LiveTerminalHandoffEntry;
 type LiveEntry = LiveStoredEntry | LiveSandboxBoundaryEntry;
 type LiveStoredCandidate =
+  | Omit<LiveTerminalHandoffEntry, 'run' | 'phase'>
   | Omit<LiveQuestionEntry, 'run' | 'phase'>
   | Omit<LiveFormEntry, 'run' | 'phase'>
   | Omit<LiveClientCapabilityEntry, 'run' | 'phase'>;
@@ -219,7 +240,7 @@ export class ClientCapabilityApprovalClosedError extends Error {
 export class HostInteractionCoordinator implements RuntimeInteractionAuthority {
   readonly handlers: InteractionOperationHandlerMap = {
     'interaction.query': (input) => this.#query(input.sessionId, input.interactionId),
-    'interaction.answer': (input) => this.#answer(input),
+    'interaction.answer': (input, context) => this.#answer(input, context),
   };
 
   readonly #store: InteractiveInteractionStoreWriterFacade;
@@ -292,6 +313,83 @@ export class HostInteractionCoordinator implements RuntimeInteractionAuthority {
   }
 
   /** Host tools share Runtime's durable interaction lifecycle without rebinding its Run. */
+  async requestTerminalHandoff(
+    input: RuntimeInteractionRunIdentity & {
+      signal?: AbortSignal;
+      requestId: string;
+      request: InteractionTerminalHandoffRequest;
+      apply: (action: 'resume' | 'cancel') => Promise<void>;
+      withAnswerAdmission?: <T>(answer: () => Promise<T>) => Promise<T>;
+      canAnswer: (
+        action: 'resume' | 'cancel',
+        connectionId: string,
+        controllerId: string,
+      ) => boolean;
+    },
+  ): Promise<InteractionCanonicalOutcome> {
+    this.#throwIfPoisoned();
+    const run = this.#runs.get(runKey(input));
+    if (!run || !run.bound || run.released) {
+      throw new RuntimeInteractionAdmissionRejectedError(input.requestId, 'invalid_request');
+    }
+    this.#assertRunOpen(run, input.requestId);
+    // A persisted request is never permission to recreate a lost PTY.
+    if (await this.#readInteraction(input.requestId)) {
+      throw new RuntimeInteractionAdmissionRejectedError(input.requestId, 'request_settled');
+    }
+    const request = decodeInteractionRequest(input.request);
+    let resolve!: (outcome: InteractionCanonicalOutcome) => void;
+    let reject!: (error: unknown) => void;
+    const result = observed(
+      new Promise<InteractionCanonicalOutcome>((yes, no) => {
+        resolve = yes;
+        reject = no;
+      }),
+    );
+    const abort = () => {
+      void this.closeTerminalHandoff(input.sessionId, input.requestId).catch(reject);
+    };
+    input.signal?.addEventListener('abort', abort, { once: true });
+    try {
+      await this.#accept(run, {
+        kind: 'terminal_handoff',
+        request: {
+          ...runIdentity(run),
+          requestId: input.requestId,
+          createdAt: this.#now(),
+          request,
+        },
+        apply: input.apply,
+        canAnswer: input.canAnswer,
+        withAnswerAdmission: input.withAnswerAdmission,
+        resolve,
+        reject,
+      });
+      if (input.signal?.aborted) abort();
+      return await result;
+    } catch (error) {
+      reject(error);
+      throw error;
+    } finally {
+      input.signal?.removeEventListener('abort', abort);
+    }
+  }
+
+  async closeTerminalHandoff(sessionId: string, requestId: string): Promise<void> {
+    await this.#sessionAdmission.enqueueDetached(sessionId, async (admission) => {
+      const entry = this.#live.get(requestId);
+      if (!entry || entry.kind !== 'terminal_handoff' || entry.request.sessionId !== sessionId)
+        return;
+      const outcome = await this.#commitOutcome(entry.request, {
+        kind: 'closure',
+        reason: 'producer_cancelled',
+        committedAt: this.#now(),
+      });
+      await this.#refreshCanonicalContinuity(sessionId, admission);
+      await this.#applyAndDelete(entry, outcome);
+    });
+  }
+
   async requestForm(input: HostFormInput): Promise<HostFormResult> {
     this.#throwIfPoisoned();
     const run = this.#runs.get(runKey(input));
@@ -896,6 +994,7 @@ export class HostInteractionCoordinator implements RuntimeInteractionAuthority {
 
   #answer(
     input: InteractionAnswerInput,
+    context: ConnectionContext,
   ): ReturnType<InteractionOperationHandlerMap['interaction.answer']> {
     return observed(
       (async () => {
@@ -908,6 +1007,22 @@ export class HostInteractionCoordinator implements RuntimeInteractionAuthority {
           const record = await this.#readInteraction(input.interactionId);
           if (record) {
             if (record.request.sessionId !== input.sessionId) return interactionNotFound();
+            if (!record.outcome && input.answer.kind === 'terminal_handoff') {
+              const entry = this.#live.get(input.interactionId);
+              if (!entry || entry.kind !== 'terminal_handoff') {
+                return operationConflict('Terminal handoff is no longer live');
+              }
+              const answer = input.answer;
+              const commit = async () => {
+                if (!entry.canAnswer(answer.action, context.connectionId, answer.controllerId)) {
+                  return operationConflict(
+                    'Terminal handoff is not ready or this controller has expired',
+                  );
+                }
+                return this.#answerStoredInteraction(record, answer, admission);
+              };
+              return entry.withAnswerAdmission ? entry.withAnswerAdmission(commit) : commit();
+            }
             return record.request.request.kind === 'client_capability'
               ? this.#answerClientCapability(record, input.answer, admission)
               : this.#answerStoredInteraction(record, input.answer, admission);
@@ -996,7 +1111,9 @@ export class HostInteractionCoordinator implements RuntimeInteractionAuthority {
     }
     if (record.outcome) return answerOutcome(recordWithOutcome(record), answer);
     if (
-      (record.request.request.kind !== 'question' && record.request.request.kind !== 'form') ||
+      (record.request.request.kind !== 'question' &&
+        record.request.request.kind !== 'form' &&
+        record.request.request.kind !== 'terminal_handoff') ||
       record.request.request.kind !== answer.kind
     ) {
       return operationConflict('Interaction answer does not match the pending request');
@@ -1006,11 +1123,17 @@ export class HostInteractionCoordinator implements RuntimeInteractionAuthority {
     }
     const entry = this.#requireLiveStored(record.request);
     const candidate =
-      answer.kind === 'question'
-        ? questionCanonicalOutcome(answer, this.#now())
-        : answer.kind === 'form'
-          ? formCanonicalOutcome(answer, this.#now())
-          : undefined;
+      answer.kind === 'terminal_handoff'
+        ? {
+            kind: 'terminal_handoff_answer' as const,
+            action: answer.action,
+            committedAt: this.#now(),
+          }
+        : answer.kind === 'question'
+          ? questionCanonicalOutcome(answer, this.#now())
+          : answer.kind === 'form'
+            ? formCanonicalOutcome(answer, this.#now())
+            : undefined;
     if (!candidate) {
       return operationConflict('Interaction answer does not match the pending request');
     }
@@ -1113,7 +1236,10 @@ export class HostInteractionCoordinator implements RuntimeInteractionAuthority {
 
   async #commitAnswer(
     entry: LiveStoredEntry,
-    candidate: Extract<InteractionCanonicalOutcome, { kind: 'question_answer' | 'form_answer' }>,
+    candidate: Extract<
+      InteractionCanonicalOutcome,
+      { kind: 'question_answer' | 'form_answer' | 'terminal_handoff_answer' }
+    >,
     admission: SessionAdmissionLease,
   ): Promise<StoredInteractionOutcome> {
     const target = await this.#commitOutcome(entry.request, candidate);
@@ -1241,7 +1367,7 @@ export class HostInteractionCoordinator implements RuntimeInteractionAuthority {
         [...this.#live.values()]
           .filter((entry) => entry.run === run && entry.phase === 'live')
           .map((entry) =>
-            entry.kind === 'client_capability'
+            entry.kind === 'client_capability' || entry.kind === 'terminal_handoff'
               ? Promise.resolve()
               : entry.continuation.waitForPublication(),
           ),
@@ -1586,6 +1712,21 @@ export class HostInteractionCoordinator implements RuntimeInteractionAuthority {
         ),
       );
     }
+    if (entry.kind === 'terminal_handoff') {
+      try {
+        await entry.apply(
+          outcome.outcome.kind === 'terminal_handoff_answer' ? outcome.outcome.action : 'cancel',
+        );
+        this.#live.delete(entry.request.requestId);
+        entry.resolve(outcome.outcome);
+      } catch (error) {
+        // The outcome is already committed. A terminal side-effect failure is
+        // local to this request, not evidence that the Interaction store failed.
+        this.#live.delete(entry.request.requestId);
+        entry.reject(error);
+      }
+      return;
+    }
     if (entry.kind === 'client_capability') {
       this.#live.delete(entry.request.requestId);
       if (outcome.outcome.kind === 'closure') {
diff --git a/packages/runtime-host/src/server/interaction-projection.ts b/packages/runtime-host/src/server/interaction-projection.ts
index 98e614e510b..f46cf87c391 100644
--- a/packages/runtime-host/src/server/interaction-projection.ts
+++ b/packages/runtime-host/src/server/interaction-projection.ts
@@ -263,6 +263,9 @@ function canonicalOutcomeForHistoricalAnswer(
   answer: InteractionAnswer,
   committedAt: number,
 ): Exclude<InteractionCanonicalOutcome, { kind: 'closure' }> {
+  if (answer.kind === 'terminal_handoff') {
+    return { kind: 'terminal_handoff_answer', action: answer.action, committedAt };
+  }
   if (answer.kind === 'question') {
     return questionCanonicalOutcome(answer, committedAt);
   }
diff --git a/packages/runtime-host/src/server/interactive-run-composer.ts b/packages/runtime-host/src/server/interactive-run-composer.ts
index edda1484bfb..7939e9b3d54 100644
--- a/packages/runtime-host/src/server/interactive-run-composer.ts
+++ b/packages/runtime-host/src/server/interactive-run-composer.ts
@@ -494,7 +494,18 @@ export function createInteractiveRunComposerFactory(
           ? { toolProfile: backendContext.header.toolProfile }
           : {}),
         ...(clientCapabilities ? { clientCapabilities } : {}),
-        ...(input.builtinTools ? { builtinTools: input.builtinTools } : {}),
+        ...(input.builtinTools
+          ? {
+              builtinTools: {
+                ...input.builtinTools,
+                terminalHandoff: input.builtinTools.terminalHandoff?.available(
+                  backendContext.sessionId,
+                )
+                  ? input.builtinTools.terminalHandoff
+                  : undefined,
+              },
+            }
+          : {}),
         ...(hostTools.length > 0 ? { hostTools } : {}),
         ...(input.resolvePluginTools && !backendContext.tools
           ? {
diff --git a/packages/runtime-host/src/server/runtime-resource-coordinator.ts b/packages/runtime-host/src/server/runtime-resource-coordinator.ts
index f39158293b7..2dc9524756b 100644
--- a/packages/runtime-host/src/server/runtime-resource-coordinator.ts
+++ b/packages/runtime-host/src/server/runtime-resource-coordinator.ts
@@ -17,14 +17,16 @@
  * under the License.
  */
 
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { userInfo } from 'node:os';
 import type { ShellRunSnapshotResult, ShellRunUpdate, ToolResultContent } from '@maka/core/events';
 import { isActiveShellRunStatus } from '@maka/core/shell-run';
+import { isWellFormedTerminalInput } from '@maka/core/terminal-input';
 import { shellRunStateProjection } from '@maka/core/shell-run-result';
 import {
   type BackgroundTaskStopper,
   type PtyControlWriter,
+  type PtyHandoffController,
   type RuntimeResourceReader,
   type ShellRunBashInput,
   type ShellRunPtySnapshot,
@@ -54,7 +56,11 @@ import {
   type RuntimeResourceRevision,
   type RuntimeResourceStopInput,
   type RuntimeResourceStartInput,
+  type RuntimeResourceHandoffInput,
+  type RuntimeResourceHandoffResult,
 } from '../protocol/index.js';
+import type { HostInteractionCoordinator } from './interaction-coordinator.js';
+import type { MakaToolContext } from '@maka/runtime/tool-runtime';
 import type { RuntimeHostResidency } from './host-kernel.js';
 import type {
   ConnectionContext,
@@ -71,6 +77,7 @@ import {
 } from './runtime-resource-projection.js';
 
 const MAX_CONTROL_REPLAYS = 128;
+const MAX_TERMINAL_HANDOFFS = 128;
 
 interface RuntimeResourceSessionReader {
   listShellRunUpdates(sessionId: string): Promise<ShellRunUpdate[]>;
@@ -95,6 +102,11 @@ interface RuntimeResourceManager
 }
 
 export interface HostRuntimeResourceCoordinatorInput {
+  readonly humanControl?: PtyHandoffController;
+  readonly interactionAuthority?: () => Pick<
+    HostInteractionCoordinator,
+    'requestTerminalHandoff' | 'closeTerminalHandoff'
+  >;
   readonly manager: RuntimeResourceManager;
   readonly sessions: RuntimeResourceSessionReader;
   readonly sessionHeaders: RuntimeResourceHeaderReader;
@@ -127,11 +139,27 @@ interface ControlReplay {
   readonly result: ReturnType<typeof decodeRuntimeResourceControllerControlResult>;
 }
 
+interface TerminalHandoffState {
+  readonly message: string;
+  command: string;
+  readonly sessionId: string;
+  readonly ref: string;
+  readonly requestId: string;
+  phase: RuntimeResourceHandoffResult['phase'];
+  closure?: RuntimeResourceHandoffResult['closure'];
+  connectionId?: string;
+  controllerId?: string;
+  nextSequence: number;
+  lastReceipt?: { sequence: number; status: 'written' | 'outcome_unknown' };
+  readonly lifetime: AbortController;
+}
+
 /** Owns Host Shell/PTY tools plus the connection-scoped Client controller fence. */
 export class HostRuntimeResourceCoordinator
   implements ShellRunLauncher, RuntimeResourceReader, BackgroundTaskStopper, PtyControlWriter
 {
   readonly handlers: RuntimeResourceOperationHandlerMap = {
+    'runtime.resource.handoff': (input, context) => this.#handoffControl(input, context),
     'runtime.resource.query': (input, context) => this.#query(input, context),
     'runtime.resource.start': (input) => this.#start(input),
     'runtime.resource.controller.acquire': (input, context) => this.#acquire(input, context),
@@ -155,10 +183,19 @@ export class HostRuntimeResourceCoordinator
   readonly #controllers = new Map<string, ControllerState>();
   readonly #controllerResources = new Map<string, string>();
   readonly #controlReplays = new Map<string, ControlReplay>();
+  readonly #handoffs = new Map<string, TerminalHandoffState>();
+  readonly #handoffsByRequestId = new Map<string, TerminalHandoffState>();
+  readonly #terminalHandoffs = new Map<string, TerminalHandoffState>();
+  readonly #inputEpochs = new Map<string, number>();
+  readonly #humanSurfaces = new Map<string, string>();
+  readonly #humanControl: PtyHandoffController | undefined;
+  readonly #interactionAuthority: HostRuntimeResourceCoordinatorInput['interactionAuthority'];
   #draining = false;
   #termination: Promise<void> | undefined;
 
   constructor(input: HostRuntimeResourceCoordinatorInput) {
+    this.#humanControl = input.humanControl;
+    this.#interactionAuthority = input.interactionAuthority;
     this.#manager = input.manager;
     this.#sessions = input.sessions;
     this.#sessionHeaders = input.sessionHeaders;
@@ -182,7 +219,9 @@ export class HostRuntimeResourceCoordinator
         if (this.#draining) throw new Error('Runtime resources are draining');
         const shell = input.shell ?? (await this.#resolveShell());
         if (this.#draining) throw new Error('Runtime resources are draining');
-        return { execution: this.#manager.runForegroundBash({ ...input, shell }) };
+        return {
+          execution: this.#manager.runForegroundBash({ ...input, shell }),
+        };
       });
       return await execution;
     } finally {
@@ -212,7 +251,11 @@ export class HostRuntimeResourceCoordinator
         if (this.#draining) throw new Error('Runtime resources are draining');
         const shell = input.shell ?? (await this.#resolveShell());
         if (this.#draining) throw new Error('Runtime resources are draining');
-        return this.#manager.runBackgroundBash({ ...input, shell, onCompletion: complete });
+        return this.#manager.runBackgroundBash({
+          ...input,
+          shell,
+          onCompletion: complete,
+        });
       });
     } catch (error) {
       complete({ successful: false });
@@ -245,8 +288,18 @@ export class HostRuntimeResourceCoordinator
   }
 
   writeStdin(input: ShellRunWriteInput): ReturnType<PtyControlWriter['writeStdin']> {
+    const key = resourceKey(input.sessionId, input.ref);
+    const epoch = this.#inputEpochs.get(key) ?? 0;
+    if (
+      this.#handoffs.get(key)?.phase === 'human' ||
+      this.#handoffs.get(key)?.phase === 'waiting'
+    ) {
+      return Promise.reject(new Error('This terminal is awaiting explicit human completion'));
+    }
     return this.#sessionAdmission.run(input.sessionId, () =>
       this.#resourceQueue.run(resourceKey(input.sessionId, input.ref), async () => {
+        if ((this.#inputEpochs.get(key) ?? 0) !== epoch)
+          throw new Error('Terminal input expired across a human handoff');
         if (this.#controllers.has(resourceKey(input.sessionId, input.ref))) {
           throw new Error('This PTY is controlled by a connected Client');
         }
@@ -257,14 +310,429 @@ export class HostRuntimeResourceCoordinator
     );
   }
 
+  isHandoffAvailable(sessionId: string): boolean {
+    return (
+      !this.#draining &&
+      process.platform !== 'win32' &&
+      Boolean(
+        this.#humanControl && this.#interactionAuthority && this.#humanSurfaces.has(sessionId),
+      )
+    );
+  }
+
+  async requestHandoff(ref: string, message: string, ctx: MakaToolContext): Promise<string> {
+    if (!this.isHandoffAvailable(ctx.sessionId) || !ctx.runId) {
+      throw new Error(
+        'Interactive terminal handoff is unavailable. Open this task in a connected Desktop window.',
+      );
+    }
+    const key = resourceKey(ctx.sessionId, ref);
+    const state: TerminalHandoffState = {
+      message,
+      command: '',
+      sessionId: ctx.sessionId,
+      ref,
+      requestId: randomUUID(),
+      phase: 'waiting',
+      nextSequence: 1,
+      lifetime: new AbortController(),
+    };
+    await this.#sessionAdmission.run(ctx.sessionId, async () => {
+      await this.#assertActiveSession(ctx.sessionId);
+      // Validate model visibility before installing a fence or any failure cleanup.
+      // Client inspection alone also accepts user-owned terminals.
+      await this.#manager.readRuntimeResource(ctx.sessionId, ref, ctx.abortSignal);
+      const previous = this.#handoffs.get(key);
+      if (previous && previous.phase !== 'resumed' && previous.phase !== 'closed')
+        throw new Error('Terminal handoff is already pending');
+      if (previous) this.#discardHandoff(key, previous);
+      const resource = await this.#manager.inspectResource(ctx.sessionId, ref);
+      state.command = Array.from(resource.cmd).slice(0, 1_024).join('');
+      if (resource.mode !== 'pty' || !isActiveShellRunStatus(resource.status))
+        throw new Error('Handoff requires the original live PTY');
+      const controller = this.#controllers.get(key);
+      if (controller && controller.connectionId !== this.#humanSurfaces.get(ctx.sessionId))
+        throw new Error('Terminal is controlled by another client');
+      this.#inputEpochs.set(key, (this.#inputEpochs.get(key) ?? 0) + 1);
+      this.#releaseController(key);
+      this.#handoffs.set(key, state);
+      this.#handoffsByRequestId.set(state.requestId, state);
+    });
+    const authority = this.#interactionAuthority!();
+    const abort = () => {
+      state.lifetime.abort();
+      void authority
+        .closeTerminalHandoff(ctx.sessionId, state.requestId)
+        .catch(() => this.#requestDrain());
+    };
+    ctx.abortSignal.addEventListener('abort', abort, { once: true });
+    // Bound only readiness, never the time a person needs to authenticate.
+    const readyDeadline = setTimeout(() => {
+      if (state.phase === 'waiting') abort();
+    }, 30_000);
+    readyDeadline.unref();
+    try {
+      const signal = AbortSignal.any([
+        ctx.abortSignal,
+        state.lifetime.signal,
+        AbortSignal.timeout(5_000),
+      ]);
+      await this.#resourceQueue.run(key, () =>
+        this.#humanControl!.preparePtyHandoff(ctx.sessionId, ref, signal),
+      );
+      if (!this.isHandoffAvailable(ctx.sessionId) || ctx.abortSignal.aborted)
+        throw new Error('Interactive terminal surface disappeared before handoff');
+      let resumeController: { connectionId: string; controllerId: string } | undefined;
+      let answerAdmissionActive = false;
+      const outcome = await authority.requestTerminalHandoff({
+        signal: state.lifetime.signal,
+        sessionId: ctx.sessionId,
+        runId: ctx.runId,
+        turnId: ctx.turnId,
+        requestId: state.requestId,
+        request: {
+          kind: 'terminal_handoff',
+          toolUseId: ctx.toolCallId,
+          ref,
+          message,
+        },
+        // Keep queued input/release and the durable decision in one admission.
+        // A stale controller or uncertain receipt is refused before persistence.
+        withAnswerAdmission: (answer) =>
+          this.#resourceQueue.run(key, async () => {
+            answerAdmissionActive = true;
+            try {
+              return await answer();
+            } finally {
+              answerAdmissionActive = false;
+            }
+          }),
+        canAnswer: (action, connectionId, controllerId) => {
+          if (action === 'cancel') return true;
+          const allowed =
+            state.phase === 'human' &&
+            state.connectionId === connectionId &&
+            state.controllerId === controllerId &&
+            state.lastReceipt?.status !== 'outcome_unknown';
+          if (allowed) resumeController = { connectionId, controllerId };
+          return allowed;
+        },
+        apply: async (action) => {
+          const apply = async () => {
+            if (this.#handoffs.get(key) !== state || state.phase === 'closed') return;
+            if (action === 'resume') {
+              // Durable answers hold this queue through transfer. Retain the
+              // fence for direct lifecycle calls that do not own answer admission.
+              if (state.phase !== 'human' || state.lastReceipt?.status === 'outcome_unknown') {
+                throw new Error('Terminal cannot resume after uncertain input delivery');
+              }
+              if (
+                !answerAdmissionActive &&
+                (!resumeController ||
+                  state.connectionId !== resumeController.connectionId ||
+                  state.controllerId !== resumeController.controllerId)
+              ) {
+                throw new Error('Terminal handoff controller expired before Resume');
+              }
+              // A child can exit while its final input fence is draining. That
+              // closes this handoff; it is not an Interaction-store failure.
+              const live = await this.#humanControl!.resumePtyHandoff(ctx.sessionId, ref).catch(
+                () => false,
+              );
+              state.phase = live ? 'resumed' : 'closed';
+              if (!live) state.closure = 'unavailable';
+              this.#retainTerminalHandoff(key, state);
+              this.#inputEpochs.set(key, (this.#inputEpochs.get(key) ?? 0) + 1);
+              if (!live) {
+                state.lifetime.abort();
+                await this.#manager.stopBackgroundTask(
+                  ctx.sessionId,
+                  ref,
+                  new AbortController().signal,
+                  'model',
+                );
+              }
+            } else {
+              state.phase = 'closed';
+              state.closure = 'cancelled';
+              this.#retainTerminalHandoff(key, state);
+              state.lifetime.abort();
+              await this.#manager.stopBackgroundTask(
+                ctx.sessionId,
+                ref,
+                new AbortController().signal,
+                'client',
+              );
+            }
+          };
+          // Answer admission already owns this queue through commit and apply.
+          if (answerAdmissionActive) await apply();
+          else await this.#resourceQueue.run(key, apply);
+        },
+      });
+      return JSON.stringify({
+        ref,
+        outcome:
+          outcome.kind === 'terminal_handoff_answer' &&
+          outcome.action === 'resume' &&
+          state.phase === 'resumed'
+            ? 'resumed'
+            : 'closed',
+        outputVisibility: 'private',
+        instruction:
+          state.phase === 'resumed'
+            ? 'The user checked that this terminal is ready and explicitly pressed Resume. Continue the original task now: send the next requested command to this same ref under existing permissions. Do not ask for another confirmation or a post-login prompt. The user confirmation is not machine-verified authentication success: do not claim success or describe unseen output. This terminal output remains private and unavailable to Read. If observing the result is necessary, report that limitation. Do not ask the user to copy private terminal output into chat or hand off again just to inspect the result.'
+            : 'The handoff closed without returning control. Do not retry credentials or recreate the original terminal.',
+      });
+    } catch (error) {
+      state.phase = 'closed';
+      state.closure = 'unavailable';
+      this.#retainTerminalHandoff(key, state);
+      state.lifetime.abort();
+      // Failure after admission must not leave a secretly writable half-handoff.
+      await this.#manager
+        .stopBackgroundTask(ctx.sessionId, ref, new AbortController().signal, 'model')
+        .catch(() => {});
+      throw error;
+    } finally {
+      clearTimeout(readyDeadline);
+      ctx.abortSignal.removeEventListener('abort', abort);
+    }
+  }
+
+  async #handoffControl(
+    input: RuntimeResourceHandoffInput,
+    context: ConnectionContext,
+  ): Promise<OperationOutcome<'runtime.resource.handoff'>> {
+    try {
+      const failure = await this.#mutableSessionFailure(input.sessionId);
+      if (failure) return mutationFailure('runtime.resource.handoff', failure);
+      if (input.action === 'lookup') {
+        const handoff = this.#handoffs.get(resourceKey(input.sessionId, input.ref));
+        return {
+          ok: true,
+          result: {
+            status: handoff?.phase === 'closed' ? 'closed' : handoff ? 'available' : 'unavailable',
+            ...(handoff?.phase === 'closed' ? { closure: handoff.closure ?? 'exited' } : {}),
+            phase: handoff?.phase ?? 'closed',
+            nextSequence: handoff?.nextSequence ?? 1,
+            ...(handoff
+              ? {
+                  request: {
+                    requestId: handoff.requestId,
+                    ref: handoff.ref,
+                    message: handoff.message,
+                    command: handoff.command,
+                  },
+                }
+              : {}),
+          },
+        };
+      }
+      if (input.action === 'surface') {
+        if (input.available) this.#humanSurfaces.set(input.sessionId, context.connectionId);
+        else if (this.#humanSurfaces.get(input.sessionId) === context.connectionId)
+          this.#humanSurfaces.delete(input.sessionId);
+        return {
+          ok: true,
+          result: {
+            status: this.isHandoffAvailable(input.sessionId) ? 'available' : 'unavailable',
+            phase: 'waiting',
+            nextSequence: 1,
+          },
+        };
+      }
+      const state = this.#handoffsByRequestId.get(input.requestId);
+      if (!state || !this.#humanControl)
+        throw new Error('Original terminal handoff is no longer live');
+      if (state.sessionId !== input.sessionId)
+        throw new Error('Original terminal handoff belongs to another session');
+      return await this.#resourceQueue.run(resourceKey(state.sessionId, state.ref), async () => {
+        if (state.phase === 'closed') {
+          const closed = {
+            ok: true as const,
+            result: {
+              status: 'closed' as const,
+              phase: 'closed' as const,
+              nextSequence: state.nextSequence,
+              closure: state.closure ?? 'exited',
+            },
+          };
+          if (
+            input.action === 'release' &&
+            state.connectionId === context.connectionId &&
+            state.controllerId === input.controllerId
+          ) {
+            this.#discardHandoff(resourceKey(state.sessionId, state.ref), state);
+          }
+          return closed;
+        }
+        const result = (
+          status: RuntimeResourceHandoffResult['status'],
+        ): RuntimeResourceHandoffResult => ({
+          status: state.lastReceipt?.status === 'outcome_unknown' ? 'outcome_unknown' : status,
+          phase: state.phase,
+          nextSequence: state.nextSequence,
+        });
+        if (input.action === 'ready') {
+          if (this.#humanSurfaces.get(input.sessionId) !== context.connectionId)
+            throw new Error('No interactive terminal surface on this connection');
+          // A renderer reload keeps the Desktop's authenticated Host connection.
+          // Reclaiming from that connection fences the old card identity.
+          if (state.connectionId && state.connectionId !== context.connectionId)
+            throw new Error('Terminal handoff belongs to another controller');
+          state.connectionId = context.connectionId;
+          state.controllerId = input.controllerId;
+          if (state.phase === 'waiting') state.phase = 'human';
+          return { ok: true as const, result: result('ready') };
+        }
+        if (
+          state.connectionId !== context.connectionId ||
+          state.controllerId !== input.controllerId
+        )
+          return {
+            ok: true as const,
+            result: {
+              ...result('rejected'),
+              status: 'rejected' as const,
+              rejection: 'controller_expired' as const,
+            },
+          };
+        if (input.action === 'release') {
+          delete state.connectionId;
+          delete state.controllerId;
+          // Hiding the card releases its controller, not the live private output.
+          // Returning must be able to reclaim the same private display.
+          return { ok: true as const, result: result('observed') };
+        }
+        if (input.action === 'observe') {
+          const display = await this.#humanControl!.readPrivatePtySnapshot(
+            state.sessionId,
+            state.ref,
+          );
+          return {
+            ok: true as const,
+            result: {
+              ...result('observed'),
+              display: {
+                ...display,
+                text: Array.from(display.text).slice(-12_000).join(''),
+              },
+            },
+          };
+        }
+        if (input.action !== 'input' || state.phase !== 'human')
+          throw new Error('Terminal is not accepting private input');
+        if (state.lastReceipt?.sequence === input.sequence)
+          return {
+            ok: true as const,
+            result: result(state.lastReceipt.status),
+          };
+        if (state.lastReceipt?.status === 'outcome_unknown')
+          throw new Error('Resolve unknown input delivery by stopping this terminal');
+        if (input.sequence !== state.nextSequence)
+          throw new Error('Private input sequence expired');
+        if (
+          !input.input ||
+          !isWellFormedTerminalInput(input.input) ||
+          /[\x00-\x1f\x7f]/.test(input.input)
+        )
+          return {
+            ok: true as const,
+            result: {
+              ...result('rejected'),
+              rejection: 'invalid_input' as const,
+            },
+          };
+        state.nextSequence++;
+        state.lastReceipt = {
+          sequence: input.sequence,
+          status: 'outcome_unknown',
+        };
+        try {
+          await this.#humanControl!.writePrivatePtyInput(
+            state.sessionId,
+            state.ref,
+            `${input.input}\r`,
+            AbortSignal.any([state.lifetime.signal, AbortSignal.timeout(5_000)]),
+          );
+          state.lastReceipt.status = 'written';
+        } catch {
+          // Never echo input, retry it, or call a partial delivery "not sent".
+        }
+        return {
+          ok: true as const,
+          result: result(state.lastReceipt.status),
+        };
+      });
+    } catch (error) {
+      console.error(
+        `[runtime-host] terminal handoff control failed: ${boundedFailureDiagnostic(error)}`,
+      );
+      return mutationFailure('runtime.resource.handoff', {
+        code: 'operation_conflict',
+        message:
+          'Terminal handoff is unavailable, stale, or no longer accepts this operation. Reconnect to the original task and inspect its live terminal.',
+      });
+    }
+  }
+
   observeShellRunUpdate(update: ShellRunUpdate): void {
     if (!isActiveShellRunStatus(update.result.status)) {
+      const key = resourceKey(update.sessionId, update.result.ref);
+      this.#inputEpochs.delete(key);
+      const handoff = this.#handoffs.get(key);
+      if (handoff) {
+        handoff.phase = 'closed';
+        handoff.closure ??= 'exited';
+        this.#retainTerminalHandoff(key, handoff);
+        handoff.lifetime.abort();
+        // Retain identity/status only so an open or reconnected card can explain
+        // why it closed. Private output stays owned by the live PTY and is gone.
+        void this.#interactionAuthority?.()
+          .closeTerminalHandoff(handoff.sessionId, handoff.requestId)
+          .catch(() => this.#requestDrain());
+      }
       this.#releaseController(resourceKey(update.sessionId, update.result.ref));
     }
     this.#onProjectionChanged(update);
   }
 
+  #discardHandoff(key: string, state: TerminalHandoffState): void {
+    if (this.#handoffs.get(key) === state) this.#handoffs.delete(key);
+    if (this.#handoffsByRequestId.get(state.requestId) === state) {
+      this.#handoffsByRequestId.delete(state.requestId);
+    }
+    if (this.#terminalHandoffs.get(key) === state) {
+      this.#terminalHandoffs.delete(key);
+    }
+  }
+
+  #retainTerminalHandoff(key: string, state: TerminalHandoffState): void {
+    if (this.#handoffs.get(key) !== state) return;
+    this.#terminalHandoffs.delete(key);
+    // A resumed live process still needs its private display. Only closed
+    // tombstones are bounded; live state dies with the resource or Host drain.
+    if (state.phase !== 'closed') return;
+    this.#terminalHandoffs.set(key, state);
+    while (this.#terminalHandoffs.size > MAX_TERMINAL_HANDOFFS) {
+      const oldest = this.#terminalHandoffs.entries().next().value;
+      if (!oldest) break;
+      const [expiredKey, expired] = oldest;
+      this.#discardHandoff(expiredKey, expired);
+    }
+  }
+
   releaseConnection(connectionId: string): void {
+    for (const [sessionId, connection] of this.#humanSurfaces) {
+      if (connection === connectionId) this.#humanSurfaces.delete(sessionId);
+    }
+    for (const handoff of this.#handoffs.values()) {
+      if (handoff.connectionId === connectionId) {
+        delete handoff.connectionId;
+        delete handoff.controllerId;
+      }
+    }
     for (const [key, controller] of this.#controllers) {
       if (controller.connectionId === connectionId) this.#releaseController(key);
     }
@@ -276,9 +744,14 @@ export class HostRuntimeResourceCoordinator
   beginDrain(): void {
     if (this.#draining) return;
     this.#draining = true;
+    for (const handoff of this.#handoffs.values()) handoff.lifetime.abort();
+    this.#humanSurfaces.clear();
     this.#controllers.clear();
     this.#controllerResources.clear();
     this.#controlReplays.clear();
+    this.#handoffs.clear();
+    this.#handoffsByRequestId.clear();
+    this.#terminalHandoffs.clear();
     this.#termination = this.#manager.terminateAll();
   }
 
@@ -350,7 +823,11 @@ export class HostRuntimeResourceCoordinator
           if (input.kind === 'list_continue' && input.revision !== revision) {
             return {
               ok: true,
-              result: { kind: 'revision_changed', expected: input.revision, actual: revision },
+              result: {
+                kind: 'revision_changed',
+                expected: input.revision,
+                actual: revision,
+              },
             };
           }
           const offset = input.kind === 'list_start' ? 0 : decodeCursor(input.cursor);
@@ -536,6 +1013,11 @@ export class HostRuntimeResourceCoordinator
             });
           }
           const key = resourceKey(input.sessionId, input.ref);
+          if (this.#handoffs.has(key))
+            return mutationFailure('runtime.resource.controller.acquire', {
+              code: 'operation_conflict',
+              message: 'Use this terminal’s private handoff surface',
+            });
           const identity = controllerIdentity(context.connectionId, input.controllerId);
           const claimedResource = this.#controllerResources.get(identity);
           if (claimedResource && claimedResource !== key) {
@@ -592,6 +1074,11 @@ export class HostRuntimeResourceCoordinator
     return this.#sessionAdmission.run(input.sessionId, () =>
       this.#resourceQueue.run(resourceKey(input.sessionId, input.ref), async () => {
         const key = resourceKey(input.sessionId, input.ref);
+        if (this.#handoffs.has(key))
+          return mutationFailure('runtime.resource.controller.control', {
+            code: 'operation_conflict',
+            message: 'Use this terminal’s private handoff surface',
+          });
         const digest = controlDigest(input.control);
         const replay = this.#controlReplays.get(controlReplayKey(context.connectionId, input));
         if (replay && replay.sequence === input.sequence) {
@@ -733,10 +1220,12 @@ export class HostRuntimeResourceCoordinator
     }
   }
 
-  async #mutableSessionFailure(
-    sessionId: string,
-  ): Promise<
-    { code: 'not_found' | 'session_archived' | 'internal_failure'; message: string } | undefined
+  async #mutableSessionFailure(sessionId: string): Promise<
+    | {
+        code: 'not_found' | 'session_archived' | 'internal_failure';
+        message: string;
+      }
+    | undefined
   > {
     try {
       const header = await this.#sessionHeaders.readHeader(sessionId);
@@ -748,7 +1237,10 @@ export class HostRuntimeResourceCoordinator
         return { code: 'not_found', message: 'Session was not found' };
       }
       this.#requestDrain();
-      return { code: 'internal_failure', message: 'Session state is unavailable' };
+      return {
+        code: 'internal_failure',
+        message: 'Session state is unavailable',
+      };
     }
   }
 
@@ -802,7 +1294,10 @@ function controlWrite(
     case 'resize':
       return { size: { cols: control.cols, rows: control.rows } };
     case 'input_and_resize':
-      return { input: control.input, size: { cols: control.cols, rows: control.rows } };
+      return {
+        input: control.input,
+        size: { cols: control.cols, rows: control.rows },
+      };
   }
 }
 
@@ -892,7 +1387,10 @@ function releaseSuccess(
   controllerId: string,
   released: boolean,
 ): OperationOutcome<'runtime.resource.controller.release'> {
-  const result: RuntimeResourceControllerReleaseResult = { controllerId, released };
+  const result: RuntimeResourceControllerReleaseResult = {
+    controllerId,
+    released,
+  };
   return { ok: true, result };
 }
 
diff --git a/packages/runtime/src/__tests__/builtin-tools.test.ts b/packages/runtime/src/__tests__/builtin-tools.test.ts
index 361c070fefa..8f0a3234822 100644
--- a/packages/runtime/src/__tests__/builtin-tools.test.ts
+++ b/packages/runtime/src/__tests__/builtin-tools.test.ts
@@ -1829,6 +1829,98 @@ describe('builtin Bash streaming output', () => {
     );
   });
 
+  test('WriteStdin handoff is discoverable only with support and excludes ordinary input', async () => {
+    const ptyControls = {
+      writeStdin: () => Promise.reject(new Error('not used')),
+    } satisfies PtyControlWriter;
+    const options = {
+      ptyControls,
+      terminalHandoff: { available: () => true, request: async () => 'resumed' },
+    };
+    const enabled = buildBuiltinTools(options).find((tool) => tool.name === 'WriteStdin')!;
+    const disabled = buildBuiltinTools({ ptyControls }).find((tool) => tool.name === 'WriteStdin')!;
+    const shellRuns = {
+      runForegroundBash: async () => {
+        throw new Error('not used');
+      },
+      runBackgroundBash: async () => {
+        throw new Error('not used');
+      },
+    };
+    const shellWithSurface = buildBuiltinTools({ ...options, shellRuns }).find(
+      (tool) => tool.name === 'Bash',
+    )!;
+    const shellWithoutSurface = buildBuiltinTools({ shellRuns }).find(
+      (tool) => tool.name === 'Bash',
+    )!;
+    assert.match(shellWithSurface.description, /discover WriteStdin via tool_search/);
+    assert.doesNotMatch(shellWithoutSurface.description, /private input card/);
+    type Parameters = {
+      jsonSchema: PromiseLike<{ properties: Record<string, unknown> }>;
+      validate(value: unknown): PromiseLike<{ success: boolean }>;
+    };
+    const schema = enabled.parameters as Parameters;
+    assert.ok((await schema.jsonSchema).properties.handoff);
+    assert.equal(
+      (await (disabled.parameters as Parameters).jsonSchema).properties.handoff,
+      undefined,
+    );
+    const ref = shellRunResourceRef('shell-run-1');
+    assert.equal(
+      (
+        await schema.validate({
+          ref,
+          handoff: { message: 'Authenticate' },
+          actions: null,
+          size: null,
+        })
+      ).success,
+      true,
+    );
+    assert.equal(
+      (
+        await schema.validate({
+          ref,
+          handoff: { message: 'Authenticate' },
+          actions: [{ type: 'key', key: 'enter' }],
+        })
+      ).success,
+      false,
+    );
+    assert.equal(
+      (
+        await schema.validate({
+          ref,
+          handoff: null,
+          actions: [
+            {
+              type: 'text',
+              text: 'pwd',
+              key: null,
+              button: null,
+              event: null,
+              x: null,
+              y: null,
+              direction: null,
+              modifiers: null,
+            },
+          ],
+          size: null,
+        })
+      ).success,
+      true,
+    );
+    assert.equal(
+      (
+        await (disabled.parameters as Parameters).validate({
+          ref,
+          handoff: { message: 'Authenticate' },
+        })
+      ).success,
+      false,
+    );
+  });
+
   test('preserves Bash failure contract when the executor reports non-zero exit', async () => {
     const cwd = await mkdtemp(join(tmpdir(), 'maka-bash-executor-'));
     const bash = buildBuiltinTools({
diff --git a/packages/runtime/src/__tests__/pty-process-driver-write-lifecycle.test.ts b/packages/runtime/src/__tests__/pty-process-driver-write-lifecycle.test.ts
new file mode 100644
index 00000000000..ac5bd730d80
--- /dev/null
+++ b/packages/runtime/src/__tests__/pty-process-driver-write-lifecycle.test.ts
@@ -0,0 +1,142 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { test } from 'node:test';
+
+const DRIVER_MODULE_URL = new URL('../pty-process-driver.js', import.meta.url).href;
+const CHILD_SOURCE = String.raw`
+  import assert from 'node:assert/strict';
+  import { createRequire, syncBuiltinESMExports } from 'node:module';
+  import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+  import { tmpdir } from 'node:os';
+  import { join } from 'node:path';
+
+  const require = createRequire(import.meta.url);
+  const fs = require('node:fs');
+  const { spawn: spawnPty } = require('node-pty');
+  const originalWriteSync = fs.writeSync;
+  let blockedFd;
+  fs.writeSync = (...args) => {
+    if (args[0] === blockedFd) {
+      const error = new Error('backpressure');
+      error.code = 'EAGAIN';
+      throw error;
+    }
+    return originalWriteSync(...args);
+  };
+  syncBuiltinESMExports();
+  const { PtyProcessDriver } = await import(process.env.DRIVER_MODULE_URL);
+
+  const root = mkdtempSync(join(tmpdir(), 'maka-pty-driver-fd-reuse-'));
+  const closeFlag = join(root, 'close');
+  const terminals = [];
+  let terminal;
+  let sentinel;
+  let exited = false;
+  let invariantFailure;
+  let ready;
+  const started = new Promise(resolve => { ready = resolve; });
+  const driver = new PtyProcessDriver({
+    stack: { spawn: (...args) => { terminal = spawnPty(...args); return terminal; } },
+    file: '/bin/sh',
+    args: ['-c', 'trap "" HUP; printf READY; while [ ! -f "$1" ]; do sleep 0.01; done; exec 0<&- 1>&- 2>&-; sleep 30', 'fixture', closeFlag],
+    cwd: process.cwd(),
+    env: process.env,
+    cols: 80,
+    rows: 24,
+    onData(data) { if (data.includes('READY')) ready(); },
+    onExit() { exited = true; },
+    onInvariantFailure(error) { invariantFailure = error; },
+  });
+
+  try {
+    await started;
+    assert.equal(driver.supportsInputFence, true, 'pinned writer patch must be installed');
+    const originalFd = terminal.fd;
+    blockedFd = originalFd;
+    // Hold the retry until the other PTY owns exactly the retired fd number.
+    const originalSetTimeout = globalThis.setTimeout;
+    let retry;
+    globalThis.setTimeout = (fn, ms, ...args) => {
+      if (ms === 1) { retry = () => fn(...args); return originalSetTimeout(() => {}, 1000); }
+      return originalSetTimeout(fn, ms, ...args);
+    };
+    if (process.env.FIRST_WRITE !== '1') driver.write('SECRET-PASSWORD\r');
+    globalThis.setTimeout = originalSetTimeout;
+    if (process.env.FIRST_WRITE !== '1') assert.ok(retry, 'secret must be queued under backpressure');
+    const closed = new Promise(resolve => terminal._socket.once('close', resolve));
+    writeFileSync(closeFlag, 'close');
+    // Linux reads EIO immediately; macOS may defer it until process exit.
+    // Close the actual read stream there to exercise the same pre-exit window.
+    if (process.platform === 'darwin') terminal._socket.destroy();
+    await closed;
+    assert.equal(exited, false, 'exercise EIO before child exit');
+    let output = '';
+    for (let attempt = 0; attempt < 32; attempt++) {
+      const next = spawnPty(process.execPath, ['-e',
+        'process.stdin.setRawMode(true); process.stdin.on("data", data => process.stdout.write("B-GOT:" + data)); process.stdout.write("B-READY");'
+      ], { cols: 80, rows: 24 });
+      terminals.push(next);
+      next.onData(data => { if (next === sentinel) output += data; });
+      if (next.fd === originalFd || process.platform === 'darwin') { sentinel = next; break; }
+    }
+    assert.ok(sentinel, 'second real PTY must reuse the original fd');
+    if (process.platform === 'linux') assert.equal(sentinel.fd, originalFd);
+    while (!output.includes('B-READY')) await new Promise(resolve => setTimeout(resolve, 5));
+    fs.writeSync = originalWriteSync;
+    syncBuiltinESMExports();
+    if (process.env.FIRST_WRITE === '1' || process.env.FIRST_WRITE === 'pending') {
+      // A pending retry must not turn a newly admitted write into a false receipt.
+      assert.throws(() => driver.write('FIRST-SECRET\r'), /input is closed/);
+    } else {
+      retry();
+    }
+    assert.throws(() => driver.resize(132, 43), /input is closed/);
+    sentinel.write('SAFE\r');
+    while (!output.includes('B-GOT:SAFE')) await new Promise(resolve => setTimeout(resolve, 5));
+    assert.equal(output.includes('SECRET'), false, 'private input reached the other PTY');
+    await assert.rejects(driver.drainInput(AbortSignal.timeout(1000)), /input is closed/);
+    assert.throws(() => driver.write('SECOND-SECRET\r'), /input is closed/);
+    assert.equal(invariantFailure, undefined, 'normal input closure is not an integrity failure');
+  } finally {
+    driver.dispose();
+    terminal?.kill('SIGKILL');
+    for (const pty of terminals) pty.kill('SIGKILL');
+    rmSync(root, { recursive: true, force: true });
+  }
+`;
+
+test('closed PTY input cannot reach a replacement PTY (same fd on Linux) before child exit', {
+  skip: process.platform === 'win32' ? 'Unix PTY file-descriptor lifecycle only' : false,
+}, () => {
+  for (const firstWrite of ['0', '1', 'pending']) {
+    const result = spawnSync(process.execPath, ['--input-type=module', '--eval', CHILD_SOURCE], {
+      cwd: process.cwd(),
+      encoding: 'utf8',
+      timeout: 10_000,
+      env: { ...process.env, DRIVER_MODULE_URL, FIRST_WRITE: firstWrite },
+    });
+
+    assert.ifError(result.error);
+    assert.equal(result.signal, null, result.stderr);
+    assert.equal(result.status, 0, result.stderr);
+  }
+});
diff --git a/packages/runtime/src/__tests__/pty-process-driver.test.ts b/packages/runtime/src/__tests__/pty-process-driver.test.ts
index 51575e206e0..319800df64d 100644
--- a/packages/runtime/src/__tests__/pty-process-driver.test.ts
+++ b/packages/runtime/src/__tests__/pty-process-driver.test.ts
@@ -81,3 +81,63 @@ function withTimeout<T>(promise: Promise<T>, message: string): Promise<T> {
     }),
   ]);
 }
+
+test('a real PTY input fence drains backpressure before the next owner writes', {
+  skip: process.platform === 'win32',
+}, async () => {
+  const stack = await loadPtyStack();
+  let ready!: () => void;
+  let finished!: () => void;
+  const started = new Promise<void>((resolve) => {
+    ready = resolve;
+  });
+  const complete = new Promise<void>((resolve) => {
+    finished = resolve;
+  });
+  const count = 512 * 1024;
+  let output = '';
+  const driver = new PtyProcessDriver({
+    stack,
+    file: process.execPath,
+    args: [
+      '-e',
+      `process.stdin.setRawMode(true); process.stdin.pause(); process.stdout.write('READY');
+      setTimeout(() => { let received = ''; process.stdin.on('data', data => {
+        received += data; if (received.includes('!')) {
+          process.stdout.write(received === 'A'.repeat(${count}) + '!' ? 'ORDER_OK' : 'ORDER_BAD');
+        }
+      }); process.stdin.resume(); }, 150);`,
+    ],
+    cwd: process.cwd(),
+    env: process.env,
+    cols: 80,
+    rows: 24,
+    onData: (data) => {
+      output += data;
+      if (output.includes('READY')) ready();
+      if (output.includes('ORDER_')) finished();
+    },
+    onExit: () => {},
+    onInvariantFailure: (error) => {
+      throw error;
+    },
+  });
+  try {
+    await withTimeout(started, 'Child did not become ready');
+    driver.write('A'.repeat(count));
+    let drained = false;
+    const fence = driver.drainInput(AbortSignal.timeout(TEST_TIMEOUT_MS)).then(() => {
+      drained = true;
+    });
+    assert.equal(drained, false, 'backpressured input was reported delivered synchronously');
+    await fence;
+    driver.write('!');
+    await driver.drainInput(AbortSignal.timeout(TEST_TIMEOUT_MS));
+    await withTimeout(complete, 'Child did not acknowledge complete input');
+    assert.match(output, /ORDER_OK/);
+    assert.doesNotMatch(output, /ORDER_BAD/);
+  } finally {
+    driver.kill('SIGKILL');
+    driver.dispose();
+  }
+});
diff --git a/packages/runtime/src/__tests__/pty-screen-collector.test.ts b/packages/runtime/src/__tests__/pty-screen-collector.test.ts
index b4c94555602..19ce348fff6 100644
--- a/packages/runtime/src/__tests__/pty-screen-collector.test.ts
+++ b/packages/runtime/src/__tests__/pty-screen-collector.test.ts
@@ -43,6 +43,25 @@ describe('PtyScreenCollector', () => {
     }
   });
 
+  test('suppresses replay queries without coalescing away fresh replies', async () => {
+    const replies: string[] = [];
+    const { collector, failures } = await createCollector({
+      onProtocolReply: (data) => replies.push(data),
+    });
+    try {
+      collector.accept('history\u001b[5n', false);
+      // Arrives before historical parsing starts: both entries are queued.
+      collector.accept('live\u001b[5n');
+      collector.accept('\u001b[5n');
+      const snapshot = await collector.snapshotAtCut();
+      assert.deepEqual(replies, ['\u001b[0n\u001b[0n']);
+      assert.match(snapshot.output.screen, /historylive/);
+      assert.deepEqual(failures, []);
+    } finally {
+      collector.dispose();
+    }
+  });
+
   test('coalesces queued parser writes so a cut waits behind bounded work', async () => {
     const replies: string[] = [];
     const { collector, failures } = await createCollector({
diff --git a/packages/runtime/src/__tests__/shell-run-manager.test.ts b/packages/runtime/src/__tests__/shell-run-manager.test.ts
index 6b1cfe8245f..8c426b4a672 100644
--- a/packages/runtime/src/__tests__/shell-run-manager.test.ts
+++ b/packages/runtime/src/__tests__/shell-run-manager.test.ts
@@ -45,9 +45,9 @@ import {
   type ShellRunProcessManagerInput,
 } from '../shell-run-contract.js';
 import { defaultShellPlan, type ShellPlan } from '../shell-detect.js';
-import { PtyProcessDriver as NativePtyDriver } from '../pty-process-driver.js';
+import { PtyInputClosedError, PtyProcessDriver as NativePtyDriver } from '../pty-process-driver.js';
 import xtermHeadless from '@xterm/headless';
-import { PTY_PROTOCOL_REPLY_MAX_BYTES } from '../pty-screen-collector.js';
+import { PTY_PROTOCOL_REPLY_MAX_BYTES, PtyScreenCollector } from '../pty-screen-collector.js';
 import { waitFor } from '@maka/core/test-only/async-primitives';
 
 const NO_ABORT = new AbortController().signal;
@@ -63,6 +63,261 @@ after(async () => {
 });
 
 describe('ShellRunProcessManager', () => {
+  test('input closure before process exit rejects control without failing the terminal', async (t) => {
+    const cwd = await workspace();
+    const manager = createManager(sqliteShellRunStore(cwd));
+    const initial = await manager.runBackgroundBash(
+      shellInput({
+        cwd,
+        pty: true,
+        command: nodeCommand('process.stdout.write("READY"); setInterval(() => {}, 1000);'),
+      }),
+    );
+    try {
+      await waitForPtyText(manager, initial.ref, /READY/);
+      t.mock.method(NativePtyDriver.prototype, 'write', () => {
+        throw new PtyInputClosedError();
+      });
+      t.mock.method(NativePtyDriver.prototype, 'resize', () => {
+        throw new PtyInputClosedError();
+      });
+      for (const control of [
+        { input: 'first' },
+        { input: 'later' },
+        { size: { cols: 100, rows: 30 } },
+      ]) {
+        await assert.rejects(
+          manager.writeStdin({ sessionId: 'session-1', ref: initial.ref, ...control }),
+          ShellRunPtyControlClosedError,
+        );
+      }
+      const snapshot = await manager.inspectResource('session-1', initial.ref);
+      assert.equal(snapshot.status, 'running');
+      assert.equal(snapshot.failureMessage, undefined);
+    } finally {
+      t.mock.restoreAll();
+      await manager.terminateAll();
+    }
+  });
+
+  test('handoff answers a query still queued in the public parser exactly once', {
+    skip: process.platform === 'win32',
+  }, async (t) => {
+    const cwd = await workspace();
+    const manager = createManager(sqliteShellRunStore(cwd));
+    const queryQueued = deferred();
+    const privateInstalled = deferred();
+    const parseGate = deferred();
+    const accept = PtyScreenCollector.prototype.accept;
+    const write = NativePtyDriver.prototype.write;
+    let replies = 0;
+    t.mock.method(
+      NativePtyDriver.prototype,
+      'write',
+      function (this: NativePtyDriver, data: string) {
+        if (data === '\x1b[0n') replies += 1;
+        return write.call(this, data);
+      },
+    );
+    t.mock.method(
+      PtyScreenCollector.prototype,
+      'accept',
+      function (this: PtyScreenCollector, data: string, replyToQueries = true) {
+        if (replyToQueries && data.includes('\x1b[5n')) {
+          void this.mutateAtCut(() => parseGate.promise);
+          queryQueued.resolve();
+        }
+        accept.call(this, data, replyToQueries);
+        if (data.includes('Terminal output is private')) privateInstalled.resolve();
+      },
+    );
+    const initial = await manager.runBackgroundBash(
+      shellInput({
+        cwd,
+        pty: true,
+        command: nodeCommand(`
+          process.stdin.setRawMode(true);
+          process.stdin.once('data', () => {
+            process.stdin.on('data', data => process.stdout.write('REPLY:' + data.toString('hex')));
+            process.stdout.write('\\u001b[5n');
+          });
+          process.stdout.write('READY');
+        `),
+      }),
+    );
+    try {
+      await waitForPtyText(manager, initial.ref, /READY/);
+      await manager.writeStdin({ sessionId: 'session-1', ref: initial.ref, input: 'query' });
+      await queryQueued.promise;
+      const handoff = manager.preparePtyHandoff(
+        'session-1',
+        initial.ref,
+        AbortSignal.timeout(5_000),
+      );
+      await privateInstalled.promise;
+      parseGate.resolve();
+      await handoff;
+      await waitUntil(async () =>
+        (await manager.readPrivatePtySnapshot('session-1', initial.ref)).text.includes(
+          'REPLY:1b5b306e',
+        ),
+      );
+      assert.equal(replies, 1, 'the public query must be answered once, with replay suppressed');
+      assert.doesNotMatch(
+        JSON.stringify(await manager.inspectResource('session-1', initial.ref)),
+        /REPLY:/,
+      );
+    } finally {
+      parseGate.resolve();
+      t.mock.restoreAll();
+      await manager.terminateAll();
+    }
+  });
+
+  test('handoff replay does not inject an old DSR response into a private prompt', {
+    skip: process.platform === 'win32',
+  }, async () => {
+    const cwd = await workspace();
+    const manager = createManager(sqliteShellRunStore(cwd));
+    const initial = await manager.runBackgroundBash(
+      shellInput({
+        cwd,
+        pty: true,
+        command: nodeCommand(`
+      process.stdin.setRawMode(true);
+      let first = true;
+      process.stdin.on('data', data => {
+        if (first) {
+          first = false;
+          process.stdout.write('AUTH_READY');
+        } else {
+          process.stdout.write('PRIVATE_INPUT:' + data.toString('hex') + '\\n');
+        }
+      });
+      process.stdout.write('\\u001b[5n');
+    `),
+      }),
+    );
+    try {
+      await waitForPtyText(manager, initial.ref, /AUTH_READY/);
+      assert.match(manager.getLivePtySnapshot('session-1', initial.ref)!.buffer, /\u001b\[5n/);
+      await manager.preparePtyHandoff('session-1', initial.ref, AbortSignal.timeout(5_000));
+      await manager.writePrivatePtyInput(
+        'session-1',
+        initial.ref,
+        'safe\r',
+        AbortSignal.timeout(5_000),
+      );
+      await waitUntil(async () =>
+        (await manager.readPrivatePtySnapshot('session-1', initial.ref)).text.includes(
+          'PRIVATE_INPUT:',
+        ),
+      );
+      const snapshot = await manager.readPrivatePtySnapshot('session-1', initial.ref);
+      assert.doesNotMatch(
+        snapshot.text,
+        /1b5b306e/,
+        'historical DSR must not reach the current prompt',
+      );
+      assert.match(snapshot.text, /736166650d/);
+    } finally {
+      await manager.terminateAll();
+    }
+  });
+
+  test('private handoff preserves a real shell and excludes immediate and delayed echoes from durable projections', {
+    skip: process.platform === 'win32',
+  }, async () => {
+    const cwd = await workspace();
+    const store = sqliteShellRunStore(cwd);
+    const publicData: string[] = [];
+    const updates: ShellRunUpdate[] = [];
+    const manager = createManager(store, (update) => updates.push(update), {
+      onPtyData: (event) => publicData.push(event.data),
+    });
+    const secret = `synthetic-${crypto.randomUUID()}`;
+    const command =
+      'stty -echo; printf "AUTH_READY\\n"; IFS= read -r credential; marker=handoff-preserved; cd /tmp; printf "%s\\nAUTH_DONE\\n" "$credential"; while IFS= read -r operation; do eval "$operation"; done';
+    const initial = await manager.runBackgroundBash(shellInput({ cwd, command, pty: true }));
+    try {
+      await waitForPtyText(manager, initial.ref, /AUTH_READY/);
+      await manager.preparePtyHandoff('session-1', initial.ref, AbortSignal.timeout(5_000));
+      await assert.rejects(
+        () =>
+          manager.writeStdin({
+            sessionId: 'session-1',
+            ref: initial.ref,
+            input: 'must-not-enter\r',
+          }),
+        /human input/,
+      );
+      await manager.writePrivatePtyInput(
+        'session-1',
+        initial.ref,
+        `${secret}\r`,
+        AbortSignal.timeout(5_000),
+      );
+      await waitUntil(async () =>
+        (await manager.readPrivatePtySnapshot('session-1', initial.ref)).text.includes('AUTH_DONE'),
+      );
+      assert.ok(
+        (await manager.readPrivatePtySnapshot('session-1', initial.ref)).text.includes(secret),
+      );
+      assert.equal(await manager.resumePtyHandoff('session-1', initial.ref), true);
+      assert.equal(
+        (await manager.readPrivatePtySnapshot('session-1', initial.ref)).text.includes(secret),
+        false,
+      );
+      await manager.writeStdin({
+        sessionId: 'session-1',
+        ref: initial.ref,
+        input: 'printf "%s\\n" "$credential"; printf "CONTINUITY:%s:%s\\n" "$marker" "$PWD"\r',
+      });
+      await waitUntil(async () =>
+        (await manager.readPrivatePtySnapshot('session-1', initial.ref)).text.includes(
+          'CONTINUITY:handoff-preserved:/tmp',
+        ),
+      );
+      await manager.writeStdin({
+        sessionId: 'session-1',
+        ref: initial.ref,
+        input:
+          nodeCommand(`
+          process.stdin.setRawMode(true);
+          process.stdin.once('data', data => {
+            process.stdout.write('PRIVATE-DSR:' + data.toString('hex') + '\\n', () => process.exit(0));
+          });
+          process.stdout.write('\\u001b[5n');
+        `) + '\r',
+      });
+      await waitUntil(async () =>
+        (await manager.readPrivatePtySnapshot('session-1', initial.ref)).text.includes(
+          'PRIVATE-DSR:1b5b306e',
+        ),
+      );
+      const privateView = await manager.readPrivatePtySnapshot('session-1', initial.ref);
+      assert.ok(privateView.text.includes(secret), 'fixture must actually echo after Resume');
+      const observed = await manager.readRuntimeResource('session-1', initial.ref, NO_ABORT);
+      assert.equal(JSON.stringify(observed).includes('CONTINUITY:handoff-preserved:/tmp'), false);
+      assert.match(JSON.stringify(observed), /Terminal output is private/);
+      const persisted = await store.listSessionShellRuns('session-1');
+      for (const projection of [
+        observed,
+        persisted,
+        updates,
+        publicData,
+        manager.getLivePtySnapshot('session-1', initial.ref),
+      ]) {
+        assert.equal(
+          JSON.stringify(projection).includes(secret),
+          false,
+          'private bytes escaped a public projection',
+        );
+      }
+    } finally {
+      await manager.terminateAll();
+    }
+  });
   test('rejects a model Read of a user-owned resource while preserving client inspection', async () => {
     const store = createSqliteShellRunStore(await workspace());
     await store.createShellRun({
diff --git a/packages/runtime/src/builtin-tools.ts b/packages/runtime/src/builtin-tools.ts
index df4d176468c..9f4c5ebb0a6 100644
--- a/packages/runtime/src/builtin-tools.ts
+++ b/packages/runtime/src/builtin-tools.ts
@@ -61,7 +61,7 @@ import {
   shapeTerminalResult,
   withTurnShellGuidance,
 } from './shell-tools.js';
-import type { ShellRunLauncher } from './shell-tools.js';
+import type { ShellRunLauncher, TerminalHandoffToolSupport } from './shell-tools.js';
 import { defaultShellPlan, throwIfShellSetupFailed, type TurnShellPlan } from './shell-detect.js';
 import type {
   BackgroundTaskStopper,
@@ -177,6 +177,7 @@ export interface BuildBuiltinToolsOptions {
   };
   backgroundTasks?: BackgroundTaskStopper;
   ptyControls?: PtyControlWriter;
+  terminalHandoff?: TerminalHandoffToolSupport;
   executor?: WorkspaceExecutor;
   /**
    * Turn-scoped shell resolution that runs Bash commands. Defaults to the
@@ -222,6 +223,7 @@ export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaT
         buildManagedBashTool(options.shellRuns, {
           executionFacts,
           shell,
+          terminalHandoffAvailable: Boolean(options.terminalHandoff),
           declareSandboxBoundary: options.declareSandboxBoundary !== false,
           ...(options.sandboxManager
             ? {
@@ -267,7 +269,9 @@ export function buildBuiltinTools(options: BuildBuiltinToolsOptions = {}): MakaT
       ];
   const backgroundTools = [
     ...(options.backgroundTasks ? [buildStopBackgroundTaskTool(options.backgroundTasks)] : []),
-    ...(options.ptyControls ? [buildWriteStdinTool(options.ptyControls)] : []),
+    ...(options.ptyControls
+      ? [buildWriteStdinTool(options.ptyControls, options.terminalHandoff)]
+      : []),
   ];
   const applyPatchTool = {
     name: 'apply_patch',
diff --git a/packages/runtime/src/pty-process-driver.ts b/packages/runtime/src/pty-process-driver.ts
index b8d21a36638..64cc1a2737e 100644
--- a/packages/runtime/src/pty-process-driver.ts
+++ b/packages/runtime/src/pty-process-driver.ts
@@ -39,13 +39,30 @@ export interface PtyProcessDriverOptions {
   onInvariantFailure: (error: Error) => void;
 }
 
+export class PtyInputClosedError extends Error {
+  constructor() {
+    super('PTY input is closed');
+    this.name = 'PtyInputClosedError';
+  }
+}
+
 export class PtyProcessDriver {
   private readonly pty: IPty;
   private readonly subscriptions: IDisposable[];
   private exited = false;
   private disposed = false;
+  // Own the Unix write queue so a control handoff can fence every actual write.
+  // node-pty's void write() only acknowledges admission to its private queue.
+  private readonly writes: Array<{ buffer: Buffer; offset: number }> = [];
+  private queuedBytes = 0;
+  private writeTimer?: ReturnType<typeof setTimeout>;
+  private writeFailure?: Error;
+  private readonly drains = new Set<{ resolve(): void; reject(error: Error): void }>();
+  private readonly onWriteFailure: (error: Error) => void;
+  private readonly writeOwnedInput?: (buffer: Buffer, offset: number, length: number) => number;
 
   constructor(options: PtyProcessDriverOptions) {
+    this.onWriteFailure = options.onInvariantFailure;
     const env = { ...options.env, TERM: 'xterm-256color', COLORTERM: 'truecolor' };
     const pty = options.stack.spawn(options.file, options.args, {
       cwd: options.cwd,
@@ -57,6 +74,14 @@ export class PtyProcessDriver {
       handleFlowControl: false,
     });
     this.pty = pty;
+    // The pinned node-pty patch owns both the synchronous write and close fence.
+    // fstat metadata cannot identify a PTY master on Linux (/dev/ptmx is shared).
+    const ownedWriter = (
+      pty as IPty & {
+        makaWriteSync?: (buffer: Buffer, offset: number, length: number) => number;
+      }
+    ).makaWriteSync;
+    this.writeOwnedInput = process.platform !== 'win32' ? ownedWriter?.bind(pty) : undefined;
     const subscriptions: IDisposable[] = [];
     try {
       subscriptions.push(
@@ -73,6 +98,7 @@ export class PtyProcessDriver {
         pty.onExit((exit) => {
           if (this.disposed || this.exited) return;
           this.exited = true;
+          this.closeWrites();
           options.onExit(exit);
         }),
       );
@@ -100,11 +126,118 @@ export class PtyProcessDriver {
   }
 
   write(data: string): void {
-    this.pty.write(data);
+    if (this.writeFailure) throw this.writeFailure;
+    if (this.exited || this.disposed) throw new PtyInputClosedError();
+    if (!this.supportsInputFence) {
+      this.pty.write(data);
+      return;
+    }
+    const buffer = Buffer.from(data, 'utf8');
+    if (this.queuedBytes + buffer.length > 2 * 1024 * 1024) {
+      throw new Error('PTY input queue capacity exceeded');
+    }
+    this.writes.push({ buffer, offset: 0 });
+    this.queuedBytes += buffer.length;
+    // Recheck the owned writer on each admission, even while a backpressure
+    // retry is pending: the PTY may have closed before its exit event arrives.
+    if (this.writeTimer) clearTimeout(this.writeTimer);
+    this.writeTimer = undefined;
+    this.flushWrites();
+    if (this.writeFailure) throw this.writeFailure;
+  }
+
+  get supportsInputFence(): boolean {
+    return this.writeOwnedInput !== undefined;
+  }
+
+  /** Wait for admitted bytes to reach the OS, not for the child to consume them. */
+  async drainInput(signal: AbortSignal): Promise<void> {
+    if (this.writeFailure) throw this.writeFailure;
+    if (!this.supportsInputFence)
+      throw new Error('PTY input fencing is unavailable on this platform');
+    if (signal.aborted) throw new Error('PTY input fence cancelled');
+    if (this.exited || this.disposed) throw new PtyInputClosedError();
+    if (this.writes.length === 0) return;
+    await new Promise<void>((resolve, reject) => {
+      const finish = (error?: Error) => {
+        signal.removeEventListener('abort', abort);
+        this.drains.delete(waiter);
+        if (error) reject(error);
+        else resolve();
+      };
+      const abort = () => finish(new Error('PTY input fence cancelled'));
+      const waiter = { resolve: () => finish(), reject: (error: Error) => finish(error) };
+      this.drains.add(waiter);
+      signal.addEventListener('abort', abort, { once: true });
+    });
+  }
+
+  private flushWrites(): void {
+    if (this.writeTimer || this.exited || this.disposed) return;
+    const write = this.writeOwnedInput;
+    if (!write) return;
+    // A synchronous nonblocking write cannot outlive this PTY's fd ownership.
+    // Yield under backpressure and between bounded batches, never in the write.
+    let budget = 64 * 1024;
+    try {
+      while (this.writes.length && budget > 0) {
+        const entry = this.writes[0]!;
+        const length = Math.min(entry.buffer.length - entry.offset, budget);
+        if (length === 0) {
+          this.writes.shift();
+          continue;
+        }
+        const written = write(entry.buffer, entry.offset, length);
+        if (written === 0) break;
+        entry.offset += written;
+        this.queuedBytes -= written;
+        budget -= written;
+        if (entry.offset === entry.buffer.length) this.writes.shift();
+      }
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code === 'EPIPE' || code === 'EIO' || code === 'EBADF') {
+        this.writeFailure = new PtyInputClosedError();
+        this.closeWrites();
+        return;
+      }
+      if (code !== 'EAGAIN' && code !== 'EWOULDBLOCK' && code !== 'EINTR') {
+        this.failWrites();
+        return;
+      }
+    }
+    if (this.writes.length) {
+      this.writeTimer = setTimeout(() => {
+        this.writeTimer = undefined;
+        this.flushWrites();
+      }, 1);
+    } else {
+      for (const waiter of [...this.drains]) waiter.resolve();
+    }
+  }
+
+  private failWrites(): void {
+    this.writeFailure = new Error('PTY input delivery failed');
+    this.closeWrites();
+    this.onWriteFailure(this.writeFailure);
+  }
+
+  private closeWrites(): void {
+    if (this.writeTimer) clearTimeout(this.writeTimer);
+    this.writeTimer = undefined;
+    this.writes.length = 0;
+    this.queuedBytes = 0;
+    for (const waiter of [...this.drains])
+      waiter.reject(this.writeFailure ?? new PtyInputClosedError());
   }
 
   resize(cols: number, rows: number): void {
-    this.pty.resize(cols, rows);
+    try {
+      this.pty.resize(cols, rows);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'EPIPE') throw new PtyInputClosedError();
+      throw error;
+    }
   }
 
   kill(signal: 'SIGTERM' | 'SIGKILL'): void {
@@ -114,6 +247,7 @@ export class PtyProcessDriver {
   dispose(): void {
     if (this.disposed) return;
     this.disposed = true;
+    this.closeWrites();
     for (const subscription of this.subscriptions) {
       try {
         subscription.dispose();
diff --git a/packages/runtime/src/pty-screen-collector.ts b/packages/runtime/src/pty-screen-collector.ts
index 79486391ef3..8e228093430 100644
--- a/packages/runtime/src/pty-screen-collector.ts
+++ b/packages/runtime/src/pty-screen-collector.ts
@@ -47,6 +47,7 @@ interface PendingEntry {
   generation: number;
   dropped: boolean;
   started: boolean;
+  replyToQueries: boolean;
 }
 
 interface SanitizedBuffer {
@@ -115,7 +116,7 @@ export class PtyScreenCollector {
     return !this.failure && !this.disposed;
   }
 
-  accept(data: string): void {
+  accept(data: string, replyToQueries = true): void {
     if (!data) return;
     if (!this.dataOpen || this.disposed) {
       this.fail(new Error('PTY data arrived after collector admission closed'));
@@ -133,13 +134,14 @@ export class PtyScreenCollector {
       tail &&
       !tail.dropped &&
       !tail.started &&
+      tail.replyToQueries === replyToQueries &&
       tail.bytes + bytes <= PTY_PARSER_HIGH_WATER_BYTES
     ) {
       tail.data += data;
       tail.bytes += bytes;
       tail.generation = generation;
     } else {
-      this.enqueue({ data, bytes, generation, dropped: false, started: false });
+      this.enqueue({ data, bytes, generation, dropped: false, started: false, replyToQueries });
     }
     this.pendingBytes += bytes;
     this.evictOldestIfOverBudget();
@@ -151,7 +153,7 @@ export class PtyScreenCollector {
     const parse = this.sequence.then(() => {
       if (entry.dropped) return undefined;
       entry.started = true;
-      return this.write(entry.data);
+      return this.write(entry.data, entry.replyToQueries);
     });
     this.sequence = parse.then(
       () => {
@@ -349,7 +351,7 @@ export class PtyScreenCollector {
     );
   }
 
-  private write(data: string): Promise<void> {
+  private write(data: string, replyToQueries: boolean): Promise<void> {
     this.throwIfUnavailable();
     return new Promise<void>((resolve, reject) => {
       this.protocolReplyBatch = '';
@@ -362,7 +364,7 @@ export class PtyScreenCollector {
           this.suppressNextNormalScrollRetention = false;
           const protocolReply = this.protocolReplyBatch;
           this.protocolReplyBatch = undefined;
-          if (!this.failure && protocolReply) {
+          if (!this.failure && protocolReply && replyToQueries) {
             try {
               this.options.onProtocolReply(protocolReply);
             } catch (error) {
diff --git a/packages/runtime/src/session-event-runtime-mapper.ts b/packages/runtime/src/session-event-runtime-mapper.ts
index a49d0bc94a1..7203789d564 100644
--- a/packages/runtime/src/session-event-runtime-mapper.ts
+++ b/packages/runtime/src/session-event-runtime-mapper.ts
@@ -159,6 +159,8 @@ function isHostProjectionSessionEvent(event: SessionEvent): event is Extract<
       | 'message_admission'
       | 'context_compaction_started'
       | 'client_capability_request'
+      | 'terminal_handoff_request'
+      | 'terminal_handoff_answer_ack'
       | 'client_capability_decision_ack';
   }
 > {
@@ -167,6 +169,8 @@ function isHostProjectionSessionEvent(event: SessionEvent): event is Extract<
     event.type === 'message_admission' ||
     event.type === 'context_compaction_started' ||
     event.type === 'client_capability_request' ||
+    event.type === 'terminal_handoff_request' ||
+    event.type === 'terminal_handoff_answer_ack' ||
     event.type === 'client_capability_decision_ack'
   );
 }
diff --git a/packages/runtime/src/shell-run-contract.ts b/packages/runtime/src/shell-run-contract.ts
index 963cd17e05d..981ff5a0c33 100644
--- a/packages/runtime/src/shell-run-contract.ts
+++ b/packages/runtime/src/shell-run-contract.ts
@@ -156,6 +156,23 @@ export interface PtyControlWriter {
   writeStdin(input: ShellRunWriteInput): Promise<ShellRunToolResult>;
 }
 
+export interface PtyPrivateSnapshot {
+  readonly text: string;
+}
+
+/** Host-owned human control. None of these payloads are model tool arguments. */
+export interface PtyHandoffController {
+  preparePtyHandoff(sessionId: string, ref: string, signal: AbortSignal): Promise<void>;
+  writePrivatePtyInput(
+    sessionId: string,
+    ref: string,
+    input: string,
+    signal: AbortSignal,
+  ): Promise<void>;
+  readPrivatePtySnapshot(sessionId: string, ref: string): Promise<PtyPrivateSnapshot>;
+  resumePtyHandoff(sessionId: string, ref: string): Promise<boolean>;
+}
+
 export function validateWriteStdinInput(input: ShellRunWriteInput): void {
   if (input.input !== undefined && input.actions !== undefined) {
     throw new Error('WriteStdin raw input and terminal actions are mutually exclusive');
diff --git a/packages/runtime/src/shell-run-manager.ts b/packages/runtime/src/shell-run-manager.ts
index a0882fd9d7d..bdd01c912b2 100644
--- a/packages/runtime/src/shell-run-manager.ts
+++ b/packages/runtime/src/shell-run-manager.ts
@@ -48,7 +48,11 @@ import {
 import { buildPtyShellSpawnPlan, buildShellSpawnPlan, defaultShellPlan } from './shell-detect.js';
 import { PipeProcessDriver, type PipeProcessExit } from './pipe-process-driver.js';
 import { PipeTailCollector } from './pipe-tail-collector.js';
-import { PtyProcessDriver, type PtyProcessExit } from './pty-process-driver.js';
+import {
+  PtyInputClosedError,
+  PtyProcessDriver,
+  type PtyProcessExit,
+} from './pty-process-driver.js';
 import {
   PTY_INITIAL_COLS,
   PTY_INITIAL_ROWS,
@@ -229,6 +233,7 @@ interface LivePtyShellRun extends LiveShellRunBase {
   rawSequence: number;
   pendingRawData: string;
   rawPublishTimer?: NodeJS.Timeout;
+  privateTerminal?: { collector: PtyScreenCollector; inputOpen: boolean };
 }
 
 type LiveShellRun = LivePipeShellRun | LivePtyShellRun;
@@ -368,6 +373,7 @@ export class ShellRunProcessManager
     if (!live) return this.writeStdinWithoutLive(input, target.shellRunId);
     assertShellRunCaller(live.record, input.caller);
     if (live.mode !== 'pty') throw new Error('WriteStdin requires a PTY background task ref');
+    if (live.privateTerminal?.inputOpen) throw new Error('This terminal is awaiting human input');
     if (live.driverExit) {
       const record = await this.markObserved(await live.finished.join());
       return shellRunContent(
@@ -391,6 +397,7 @@ export class ShellRunProcessManager
     let operationFailed = false;
     let exitBeforeControlCut = false;
     const mutation = (): void => {
+      if (live.privateTerminal?.inputOpen) throw new Error('This terminal is awaiting human input');
       if (input.abortSignal?.aborted) {
         throw abortError('WriteStdin aborted before the control operation was committed');
       }
@@ -403,7 +410,7 @@ export class ShellRunProcessManager
         input.input ??
         (input.actions
           ? encodeTerminalInputActions(input.actions, {
-              ...live.collector.currentInputState(),
+              ...(live.privateTerminal?.collector ?? live.collector).currentInputState(),
               ...(input.size ? { cols: input.size.cols, rows: input.size.rows } : {}),
             })
           : undefined);
@@ -412,11 +419,17 @@ export class ShellRunProcessManager
         if (currentSize.cols === input.size.cols && currentSize.rows === input.size.rows) {
           resizeApplied = true;
         } else {
-          live.driver.resize(input.size.cols, input.size.rows);
+          try {
+            live.driver.resize(input.size.cols, input.size.rows);
+          } catch (error) {
+            if (error instanceof PtyInputClosedError) throw new ShellRunPtyControlClosedError();
+            throw error;
+          }
           resizeApplied = true;
           resizeChanged = true;
           try {
             live.collector.resize(input.size.cols, input.size.rows);
+            live.privateTerminal?.collector.resize(input.size.cols, input.size.rows);
           } catch (error) {
             operationFailed = true;
             this.handleIntegrityFailure(live, asError(error, 'PTY screen resize failed'));
@@ -429,6 +442,7 @@ export class ShellRunProcessManager
           live.driver.write(terminalInput);
           inputQueued = true;
         } catch (error) {
+          if (error instanceof PtyInputClosedError) throw new ShellRunPtyControlClosedError();
           operationFailed = true;
           this.handleIntegrityFailure(live, asError(error, 'PTY input write failed'));
         }
@@ -633,6 +647,102 @@ export class ShellRunProcessManager
     };
   }
 
+  async preparePtyHandoff(sessionId: string, ref: string, signal: AbortSignal): Promise<void> {
+    const live = this.requirePrivatePtyTarget(sessionId, ref);
+    assertShellRunCaller(live.record, 'model');
+    if (!live.driver.supportsInputFence)
+      throw new Error('Private terminal input is unavailable on this platform');
+    if (live.privateTerminal?.inputOpen) throw new Error('Terminal handoff is already active');
+    if (!live.privateTerminal) {
+      const stack = await loadPtyStack();
+      if (live.driverExit || live.termination)
+        throw new Error('Original terminal is no longer running');
+      const size = live.collector.currentSize();
+      const collector = new PtyScreenCollector({
+        stack,
+        ...size,
+        onProtocolReply: (data) => {
+          // Only fresh queries receive replies; historical replay is marked
+          // when admitted to the parser, before asynchronous parsing begins.
+          if (!live.privateTerminal || live.driverExit || live.termination || live.integrityFailure)
+            return;
+          try {
+            live.driver.write(data);
+          } catch (error) {
+            if (!(error instanceof PtyInputClosedError)) throw error;
+          }
+        },
+        onDirty: () => {},
+        onFailure: () =>
+          this.handleIntegrityFailure(live, new Error('Private terminal display failed')),
+      });
+      collector.accept(live.rawBuffer, false);
+      live.privateTerminal = { collector, inputOpen: true };
+      if (live.rawPublishTimer) clearTimeout(live.rawPublishTimer);
+      live.rawPublishTimer = undefined;
+      live.rawBuffer = '';
+      live.pendingRawData = '';
+      // The public parser never sees a private byte, including delayed echoes.
+      live.collector.accept('\x1bc[Terminal output is private and unavailable to the agent.]\r\n');
+    } else {
+      live.privateTerminal.inputOpen = true;
+    }
+    try {
+      await live.driver.drainInput(signal);
+      await this.persistObservation(live);
+    } catch (error) {
+      live.privateTerminal.inputOpen = false;
+      throw error;
+    }
+  }
+
+  async writePrivatePtyInput(
+    sessionId: string,
+    ref: string,
+    input: string,
+    signal: AbortSignal,
+  ): Promise<void> {
+    const live = this.requirePrivatePtyTarget(sessionId, ref);
+    if (!live.privateTerminal?.inputOpen)
+      throw new Error('Terminal handoff is not accepting input');
+    validateWriteStdinInput({ sessionId, ref, input });
+    if (signal.aborted) throw new Error('Private input cancelled before delivery');
+    live.driver.write(input);
+    await live.driver.drainInput(signal);
+  }
+
+  async readPrivatePtySnapshot(sessionId: string, ref: string) {
+    const live = this.requirePrivatePtyTarget(sessionId, ref);
+    const terminal = live.privateTerminal;
+    if (!terminal) throw new Error('Terminal has no private display');
+    const snapshot = await terminal.collector.snapshotAtCut();
+    return {
+      text: [snapshot.output.scrollback, snapshot.output.screen].filter(Boolean).join('\n'),
+    };
+  }
+
+  async resumePtyHandoff(sessionId: string, ref: string): Promise<boolean> {
+    const target = parseShellRunResourceRef(ref);
+    const live = target ? this.liveResource(sessionId, target.shellRunId) : undefined;
+    if (!live || live.mode !== 'pty' || live.driverExit || live.termination) return false;
+    if (!live.privateTerminal) return false;
+    await live.driver.drainInput(AbortSignal.timeout(5_000));
+    live.privateTerminal.inputOpen = false;
+    // Discard the authentication screen; later output still remains private.
+    live.privateTerminal.collector.accept('\x1bc');
+    await live.privateTerminal.collector.snapshotAtCut();
+    return true;
+  }
+
+  private requirePrivatePtyTarget(sessionId: string, ref: string): LivePtyShellRun {
+    const target = parseShellRunResourceRef(ref);
+    const live = target ? this.liveResource(sessionId, target.shellRunId) : undefined;
+    if (!live || live.mode !== 'pty' || live.driverExit || live.termination) {
+      throw new Error('Original terminal is no longer running');
+    }
+    return live;
+  }
+
   async recoverOrphanedSession(sessionId: string): Promise<number> {
     const records = await this.input.store.listSessionShellRuns(sessionId);
     let recovered = 0;
@@ -861,8 +971,14 @@ export class ShellRunProcessManager
         onProtocolReply: (data) => {
           if (!live || !driver)
             throw new Error('PTY protocol reply arrived before driver admission');
+          // The public parser only receives pre-handoff bytes. Reply to queries
+          // already queued there even after the private collector takes over.
           if (live.driverExit || live.termination || live.integrityFailure) return;
-          driver.write(data);
+          try {
+            driver.write(data);
+          } catch (error) {
+            if (!(error instanceof PtyInputClosedError)) throw error;
+          }
         },
         onDirty: () => dispatch((target) => this.scheduleAutomaticFlush(target)),
         onFailure: (error) => dispatch((target) => this.handleIntegrityFailure(target, error)),
@@ -1030,6 +1146,10 @@ export class ShellRunProcessManager
 
   private onPtyData(live: LivePtyShellRun, data: string): void {
     if (live.driverExit || live.finalizeOnce) return;
+    if (live.privateTerminal) {
+      live.privateTerminal.collector.accept(data);
+      return;
+    }
     // Amortize the tail trim: slicing on every tiny node-pty event copies the
     // whole 16K replay buffer per event.
     live.rawBuffer += data;
@@ -1285,7 +1405,10 @@ export class ShellRunProcessManager
     }
     let cleanupError: Error | undefined;
     try {
-      if (live.mode === 'pty') live.collector.dispose();
+      if (live.mode === 'pty') {
+        live.collector.dispose();
+        live.privateTerminal?.collector.dispose();
+      }
     } catch (error) {
       cleanupError ??= asError(error, 'PTY collector cleanup failed');
     }
@@ -1578,6 +1701,7 @@ export class ShellRunProcessManager
       if (live.mode === 'pty') {
         live.collector.closeDataAdmission();
         live.collector.dispose();
+        live.privateTerminal?.collector.dispose();
       }
     } catch (error) {
       cleanupError ??= asError(error, 'PTY collector startup cleanup failed');
diff --git a/packages/runtime/src/shell-tools.ts b/packages/runtime/src/shell-tools.ts
index 7be0ee63dfa..f25653e52c5 100644
--- a/packages/runtime/src/shell-tools.ts
+++ b/packages/runtime/src/shell-tools.ts
@@ -179,6 +179,8 @@ export function buildManagedBashTool(
     shell?: TurnShellPlan;
     /** Opening sentence of the description, before the shared foreground/background/PTY contract. */
     lead?: string;
+    /** Advertise discovery from the always-available shell entry point. */
+    terminalHandoffAvailable?: boolean;
     /**
      * Whether this host has a sandbox boundary the model can be asked to declare.
      * False drops `boundary_intent` and `required_boundary` from the schema
@@ -265,6 +267,9 @@ export function buildManagedBashTool(
       ` Foreground is the default (timeout ${DEFAULT_BASH_TIMEOUT_MS}ms, maximum ${MAX_FOREGROUND_BASH_TIMEOUT_MS}ms).` +
       ` Set run_in_background=true only when the command should continue as a tracked runtime background task; background commands have no default timeout (maximum explicit timeout ${MAX_SHELL_RUN_TIMEOUT_MS}ms).` +
       ' Set pty=true together with run_in_background=true only for terminal semantics or later input; use the returned ref with Read or WriteStdin.' +
+      (options.terminalHandoffAvailable
+        ? ' Starting a PTY does not reveal a terminal or let the user type. When the user needs to enter a password or other terminal input, discover WriteStdin via tool_search and invoke its handoff action on this ref to open the private input card and wait. Do this before telling the user to type or ending the turn to wait for them; never collect credentials in chat.'
+        : '') +
       (declareSandboxBoundary ? ' Enforced by the current session sandbox boundary.' : ''),
     parameters: declareSandboxBoundary
       ? preprocessBashBoundaryDeclaration(
@@ -486,9 +491,15 @@ export interface WriteStdinInput {
   input?: string;
   actions?: TerminalInputAction[];
   size?: { cols: number; rows: number };
+  handoff?: { message: string };
 }
 
-export function createWriteStdinSchemas(): {
+export interface TerminalHandoffToolSupport {
+  available(sessionId: string): boolean;
+  request(ref: string, message: string, context: MakaToolContext): Promise<string>;
+}
+
+export function createWriteStdinSchemas(handoffAvailable = false): {
   providerParameters: z.ZodTypeAny;
   strictParameters: z.ZodType<WriteStdinInput, unknown>;
 } {
@@ -507,6 +518,12 @@ export function createWriteStdinSchemas(): {
     normalizeProviderWriteStdinInput,
     z
       .object({
+        handoff: handoffAvailable
+          ? z
+              .object({ message: z.string().min(1).max(512) })
+              .strict()
+              .optional()
+          : z.never().optional(),
         ref: z
           .string()
           .max(MAX_SHELL_RUN_RESOURCE_REF_CHARS)
@@ -535,12 +552,25 @@ export function createWriteStdinSchemas(): {
       })
       .refine(
         (value) =>
-          value.input !== undefined || value.actions !== undefined || value.size !== undefined,
+          value.input !== undefined ||
+          value.actions !== undefined ||
+          value.size !== undefined ||
+          ('handoff' in value && value.handoff !== undefined),
         {
           message: 'input, actions, and/or size is required',
         },
       )
       .superRefine((value, context) => {
+        if (
+          'handoff' in value &&
+          value.handoff !== undefined &&
+          (value.input !== undefined || value.actions !== undefined || value.size !== undefined)
+        ) {
+          context.addIssue({
+            code: 'custom',
+            message: 'handoff cannot include terminal input or size',
+          });
+        }
         if (!value.actions) return;
         try {
           if (encodedTerminalInputActionsByteLength(value.actions) > MAX_WRITE_STDIN_INPUT_BYTES) {
@@ -560,46 +590,73 @@ export function createWriteStdinSchemas(): {
       type: z.enum(['text', 'key', 'mouse']).describe('Action kind'),
       text: z
         .string()
-        .describe('Visible text for a text action; omit it for a key action')
+        .describe('Visible text for a text action; use null for other action kinds')
+        .nullable()
         .optional(),
       key: z
         .string()
         .describe(
-          `Named key (${TERMINAL_INPUT_NAMED_KEYS.join(', ')}) or one printable ASCII character for a key action; omit it for a text action`,
+          `Named key (${TERMINAL_INPUT_NAMED_KEYS.join(', ')}) or one printable ASCII character for a key action; use null for other action kinds`,
         )
+        .nullable()
         .optional(),
       event: z
         .enum(TERMINAL_MOUSE_EVENTS)
-        .describe('Mouse event; omit it for text and key actions')
+        .describe('Mouse event; use null for text and key actions')
+        .nullable()
         .optional(),
       x: z
         .number()
         .int()
         .min(0)
-        .describe('Zero-based terminal cell column for a mouse action')
+        .describe('Zero-based terminal cell column for a mouse action; otherwise null')
+        .nullable()
         .optional(),
       y: z
         .number()
         .int()
         .min(0)
-        .describe('Zero-based terminal cell row for a mouse action')
+        .describe('Zero-based terminal cell row for a mouse action; otherwise null')
+        .nullable()
         .optional(),
       button: z
         .enum(TERMINAL_MOUSE_BUTTONS)
-        .describe('Mouse button; required for click, press, and release')
+        .describe('Mouse button; required for click, press, and release; otherwise null')
+        .nullable()
         .optional(),
       direction: z
         .enum(TERMINAL_MOUSE_SCROLL_DIRECTIONS)
-        .describe('Scroll direction; required only for scroll')
+        .describe('Scroll direction; required only for scroll; otherwise null')
+        .nullable()
         .optional(),
       modifiers: z
         .array(z.enum(TERMINAL_INPUT_MODIFIERS))
         .describe('Optional unique modifiers for a key or mouse action')
+        .nullable()
         .optional(),
     })
     .strict();
   const providerParameters = z
     .object({
+      ...(handoffAvailable
+        ? {
+            handoff: z
+              .object({
+                message: z
+                  .string()
+                  .max(512)
+                  .describe(
+                    'Explain the purpose and target of the human terminal handoff; never include a password',
+                  ),
+              })
+              .strict()
+              .nullable()
+              .optional()
+              .describe(
+                'Request human input only. Use null for ordinary terminal actions or resizing; never combine a handoff with actions or size.',
+              ),
+          }
+        : {}),
       ref: z
         .string()
         .max(MAX_SHELL_RUN_RESOURCE_REF_CHARS)
@@ -608,15 +665,17 @@ export function createWriteStdinSchemas(): {
         .array(providerAction)
         .max(MAX_WRITE_STDIN_ACTIONS)
         .describe(
-          'Ordered terminal input actions. Text uses type and text. Key uses type, key, and optional modifiers. Mouse uses type, event, zero-based x/y, event-specific button or direction, and optional modifiers. Omit it for a resize-only call.',
+          'Ordered terminal input actions. Text uses type and text. Key uses type, key, and optional modifiers. Mouse uses type, event, zero-based x/y, event-specific button or direction, and optional modifiers. Use null for a handoff or resize-only call.',
         )
+        .nullable()
         .optional(),
       size: z
         .object({
-          cols: z.number().describe('Terminal columns').optional(),
-          rows: z.number().describe('Terminal rows').optional(),
+          cols: z.number().describe('Terminal columns').nullable().optional(),
+          rows: z.number().describe('Terminal rows').nullable().optional(),
         })
         .strict()
+        .nullable()
         .optional(),
     })
     .strict()
@@ -624,8 +683,11 @@ export function createWriteStdinSchemas(): {
   return { providerParameters, strictParameters };
 }
 
-export function buildWriteStdinTool(ptyControls: PtyControlWriter): MakaTool {
-  const { providerParameters, strictParameters } = createWriteStdinSchemas();
+export function buildWriteStdinTool(
+  ptyControls: PtyControlWriter,
+  handoff?: TerminalHandoffToolSupport,
+): MakaTool {
+  const { providerParameters, strictParameters } = createWriteStdinSchemas(Boolean(handoff));
   const providerSchema = zodSchema(providerParameters);
   const parameters = jsonSchema(async () => await providerSchema.jsonSchema, {
     validate: async (value) => {
@@ -640,6 +702,9 @@ export function buildWriteStdinTool(ptyControls: PtyControlWriter): MakaTool {
     name: 'WriteStdin',
     activityKind: 'command',
     description:
+      (handoff
+        ? 'For interactive login, passwords, or other human terminal input, use only {ref, handoff:{message}} to reveal this exact terminal and wait for explicit human Resume. Never put credentials in tool arguments. A resumed outcome means the user has confirmed the terminal is ready for your next requested action: execute it on this same ref without asking for another confirmation or a prompt screenshot. Resume is not machine-verified authentication success. Output remains private and cannot be read by the agent. Report this limitation if the task requires observing the result; do not claim an unseen result or ask the user to copy private terminal output into chat. '
+        : '') +
       'Send an ordered sequence of text, key, and mouse actions to a background PTY and/or resize it, then return the terminal state at the next parser cut. ' +
       `Named keys are ${TERMINAL_INPUT_NAMED_KEYS.join(', ')}. Use a printable ASCII key with ctrl or alt for chords such as Ctrl-B; use text for ordinary typing. ` +
       'Mouse coordinates are zero-based terminal cells and work only while the application has enabled SGR cell mouse reporting. ' +
@@ -649,7 +714,12 @@ export function buildWriteStdinTool(ptyControls: PtyControlWriter): MakaTool {
     parameters,
     permissionArgs: (input) => parseInput(input),
     impl: (input, ctx) => {
-      const { ref, input: rawInput, actions, size } = parseInput(input);
+      const { ref, input: rawInput, actions, size, handoff: requestedHandoff } = parseInput(input);
+      if (requestedHandoff) {
+        if (!handoff?.available(ctx.sessionId))
+          throw new Error('Interactive terminal surface is no longer available');
+        return handoff.request(ref, requestedHandoff.message, ctx);
+      }
       return ptyControls.writeStdin({
         sessionId: ctx.sessionId,
         ref,
@@ -665,6 +735,7 @@ export function buildWriteStdinTool(ptyControls: PtyControlWriter): MakaTool {
 function normalizeProviderWriteStdinInput(value: unknown): unknown {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return value;
   const normalized = { ...(value as Record<string, unknown>) };
+  if (normalized.handoff === null) delete normalized.handoff;
   if (normalized.actions === null || isEmptyArray(normalized.actions)) {
     delete normalized.actions;
   } else if (Array.isArray(normalized.actions)) {
diff --git a/packages/ui/src/__tests__/live-turn-projection.test.ts b/packages/ui/src/__tests__/live-turn-projection.test.ts
index 30dcb5f0ed4..fa3b345a326 100644
--- a/packages/ui/src/__tests__/live-turn-projection.test.ts
+++ b/packages/ui/src/__tests__/live-turn-projection.test.ts
@@ -32,6 +32,19 @@ import { materializeTurns, overlayLiveTurn, type ToolActivityItem } from '../mat
 import { redactSecrets } from '../redact.js';
 import { getConversationCopy } from '../conversation-copy.js';
 
+it('a pending terminal handoff restores its waiting tool after reload without replaying private input', () => {
+  const request = { type: 'terminal_handoff_request' as const, id: 'request-event', turnId: 'turn-1', ts: 2,
+    requestId: 'request-1', toolUseId: 'tool-1', ref: 'maka://runtime/background-tasks/terminal-1', message: 'Authenticate' };
+  const live = applyLiveTurnEvent(undefined, request)!;
+  const messages: StoredMessage[] = [{ type: 'tool_call', id: 'tool-1', turnId: 'turn-1', ts: 1,
+    toolName: 'WriteStdin', args: { ref: request.ref, handoff: { message: 'Authenticate' } } }];
+  const restored = overlayLiveTurn(materializeTurns(messages, 'en'), live, 'en');
+  assert.equal(restored[0]?.tools[0]?.status, 'running');
+  assert.deepEqual(restored[0]?.tools[0]?.args, { ref: request.ref });
+  const ended = applyLiveTurnEvent(live, { type: 'complete', id: 'end', turnId: 'turn-1', ts: 3, stopReason: 'end_turn' })!;
+  assert.equal(applyLiveTurnEvent(ended, request), ended);
+});
+
 // A client that just sent cannot read "has my turn started" off session status:
 // it is the same before the turn starts and after it ends. The arm carries
 // `unconfirmed` until the authority says something about THAT turn, which is
diff --git a/packages/ui/src/interaction-queue.ts b/packages/ui/src/interaction-queue.ts
index 1f3ffd6b2eb..3edf79f283a 100644
--- a/packages/ui/src/interaction-queue.ts
+++ b/packages/ui/src/interaction-queue.ts
@@ -24,10 +24,12 @@ import type {
   SandboxBoundaryRequestEvent,
   SessionEvent,
   UserQuestionRequestEvent,
+  TerminalHandoffRequestEvent,
 } from '@maka/core/events';
 
 /** Requests this surface can render and settle itself. */
 export type ComposerInteraction =
+  | TerminalHandoffRequestEvent
   | SandboxBoundaryRequestEvent
   | ClientCapabilityRequestEvent
   | UserQuestionRequestEvent
@@ -36,6 +38,7 @@ export type InteractionQueues = Record<string, ComposerInteraction[]>;
 
 function isComposerInteraction(event: ActiveInteractionRequestEvent): event is ComposerInteraction {
   return (
+    event.type === 'terminal_handoff_request' ||
     event.type === 'sandbox_boundary_request' ||
     event.type === 'client_capability_request' ||
     event.type === 'user_question_request' ||
@@ -85,6 +88,7 @@ export function reduceInteractionQueues(
   event: SessionEvent,
 ): InteractionQueues {
   switch (event.type) {
+    case 'terminal_handoff_request':
     case 'sandbox_boundary_request':
     case 'client_capability_request':
     case 'user_question_request':
@@ -94,6 +98,7 @@ export function reduceInteractionQueues(
     case 'client_capability_decision_ack':
     case 'user_question_answer_ack':
     case 'form_answer_ack':
+    case 'terminal_handoff_answer_ack':
       return dequeueInteractionByRequestId(queues, sessionId, event.requestId);
     case 'tool_result':
       return dequeueInteractionByToolUseId(queues, sessionId, event.toolUseId);
diff --git a/packages/ui/src/live-turn-projection.ts b/packages/ui/src/live-turn-projection.ts
index a47a8068104..bee251c3cb5 100644
--- a/packages/ui/src/live-turn-projection.ts
+++ b/packages/ui/src/live-turn-projection.ts
@@ -217,6 +217,15 @@ function projectLiveTurnEvent(
   event: SessionEvent,
   locale: UiLocale,
 ): LiveTurnProjection | undefined {
+  if (event.type === 'terminal_handoff_request') {
+    // A pending request replayed after reload is live evidence of the waiting
+    // tool. Without it, an unfinished historical call looks interrupted.
+    if (current?.turnId === event.turnId && current.terminal) return current;
+    return projectLiveTurnEvent(current, {
+      type: 'tool_start', id: event.id, turnId: event.turnId, ts: event.ts,
+      toolUseId: event.toolUseId, toolName: 'WriteStdin', activityKind: 'command', args: { ref: event.ref },
+    }, locale);
+  }
   if (event.type === 'steering_message') {
     const prior = current?.turnId === event.turnId
       ? current
diff --git a/patches/README.md b/patches/README.md
index e41dd37b734..63be8645d7e 100644
--- a/patches/README.md
+++ b/patches/README.md
@@ -162,6 +162,15 @@ reuse. The patch keeps writes synchronous on node-pty's non-blocking PTY master,
 checks an `fstat` fingerprint before retries, yields between attempts, and cancels
 the queue at the native exit fence. See #2978.
 
+The `makaWriteSync` seam lets Runtime's bounded input queue obtain an actual
+nonblocking OS receipt while using the same write-stream/socket close fence.
+Runtime must not write directly to a cached fd: unrelated Linux PTY masters can
+have identical `fstat` fields. The real two-PTY regression forces EIO before exit
+and fd reuse on Linux; the macOS variant closes the read stream before exit.
+An unpatched dependency does not advertise support for fenced private input.
+The resize method also rejects a closed socket/write stream before using its fd;
+the lifecycle regression checks both first-write rejection and stale resize.
+
 Delete when node-pty ships an equivalent Unix write-lifecycle fix.
 
 ## `@ai-sdk/provider-utils@5.0.51`
diff --git a/patches/node-pty+1.2.0-beta.15.patch b/patches/node-pty+1.2.0-beta.15.patch
index 17b74f5853c..e1c520e7a1d 100644
--- a/patches/node-pty+1.2.0-beta.15.patch
+++ b/patches/node-pty+1.2.0-beta.15.patch
@@ -1,5 +1,5 @@
 diff --git a/node_modules/node-pty/lib/unixTerminal.js b/node_modules/node-pty/lib/unixTerminal.js
-index af2d24c..a16ab59 100644
+index af2d24c..b38396e 100644
 --- a/node_modules/node-pty/lib/unixTerminal.js
 +++ b/node_modules/node-pty/lib/unixTerminal.js
 @@ -65,6 +65,10 @@ var UnixTerminal = /** @class */ (function (_super) {
@@ -29,7 +29,35 @@ index af2d24c..a16ab59 100644
              if (_this._emittedClose) {
                  return;
              }
-@@ -288,12 +294,19 @@ var CustomWriteStream = /** @class */ (function () {
+@@ -157,6 +163,16 @@ var UnixTerminal = /** @class */ (function (_super) {
+     UnixTerminal.prototype._write = function (data) {
+         this._writeStream.write(data);
+     };
++    // Maka's fenced queue needs an OS receipt, with this terminal's close fence.
++    // Never expose a raw fd to a second writer with a separate lifetime.
++    UnixTerminal.prototype.makaWriteSync = function (buffer, offset, length) {
++        if (!this._writeStream || this._writeStream._disposed || this._socket.destroyed) {
++            var error = new Error('PTY input is closed');
++            error.code = 'EPIPE';
++            throw error;
++        }
++        return fs.writeSync(this._fd, buffer, offset, length);
++    };
+     Object.defineProperty(UnixTerminal.prototype, "fd", {
+         /* Accessors */
+         get: function () { return this._fd; },
+@@ -251,5 +267,10 @@ var UnixTerminal = /** @class */ (function (_super) {
+     UnixTerminal.prototype.resize = function (cols, rows, pixelSize) {
+         var _a, _b;
++        if (!this._writeStream || this._writeStream._disposed || this._socket.destroyed) {
++            var error = new Error('PTY input is closed');
++            error.code = 'EPIPE';
++            throw error;
++        }
+         if (cols <= 0 || rows <= 0 || isNaN(cols) || isNaN(rows) || cols === Infinity || rows === Infinity) {
+             throw new Error('resizing must be done using positive cols and rows');
+         }
+@@ -288,12 +309,19 @@ var CustomWriteStream = /** @class */ (function () {
          this._fd = _fd;
          this._encoding = _encoding;
          this._writeQueue = [];
@@ -49,7 +77,7 @@ index af2d24c..a16ab59 100644
          // Writes are put in a queue and processed asynchronously in order to handle
          // backpressure from the kernel buffer.
          var buffer = typeof data === 'string'
-@@ -309,42 +322,53 @@ var CustomWriteStream = /** @class */ (function () {
+@@ -309,42 +337,53 @@ var CustomWriteStream = /** @class */ (function () {
      CustomWriteStream.prototype._processWriteQueue = function () {
          var _this = this;
          this._writeImmediate = undefined;
diff --git a/scripts/terminal-handoff/README.md b/scripts/terminal-handoff/README.md
new file mode 100644
index 00000000000..57b94848619
--- /dev/null
+++ b/scripts/terminal-handoff/README.md
@@ -0,0 +1,91 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+
+# Real terminal handoff acceptance
+
+Opt-in macOS/Linux test using a real model, Electron, Runtime Host, Unix PTY,
+OpenSSH client and a loopback SSH server. It incurs provider usage. The fixture
+does not modify the system SSH server or use the operating-system password.
+
+After installing workspace dependencies, applying the repository dependency
+patches and building Runtime Host and Desktop, install Paramiko in a temporary
+Python environment. Put the provider key in a private file outside the checkout:
+
+```sh
+python3 -m venv /tmp/maka-handoff-python
+/tmp/maka-handoff-python/bin/pip install paramiko
+HANDOFF_PYTHON=/tmp/maka-handoff-python/bin/python \
+HANDOFF_API_KEY_FILE=/path/to/private-key-file \
+HANDOFF_BASE_URL=http://127.0.0.1:8080/v1 \
+HANDOFF_MODEL=gpt-5.6-terra \
+node scripts/terminal-handoff/real-model.mjs
+```
+
+The connection uses the custom Responses API with native `apply_patch` disabled,
+so compatible providers need only support function tools. A transparent local
+HTTP proxy checks every outgoing provider request for the generated test secrets;
+it does not replace responses or rewrite tools. The real key stays in the test
+process. Desktop's isolated profile contains only a proxy placeholder credential.
+
+The test drives the actual password card through preload/main IPC, including
+refresh with an unsubmitted draft, a rejected password and successful retry, a
+second verification challenge, explicit Resume, a command
+in the original shell, and hiding/reopening and reloading the terminal display.
+The completed input card disappears. Two further conversation turns use the
+same authenticated shell without opening another input card; both preserve the
+original shell-local marker and working directory.
+There is no selection/sharing flow. The server intentionally echoes both
+the password and verification code, including a delayed echo after Resume.
+
+This is now a **scoped acceptance test**, not full issue acceptance. It verifies
+private input, continuation in the same shell, sharing removal and output
+isolation. The agent still cannot observe the private command result; the report
+explicitly records `fullIssueAcceptance: false` and
+`automaticResultObservation: false`. A validated automatic result boundary is
+required before the original issue can be considered complete.
+
+The task prompt describes an SSH destination and the desired shell result without
+naming `WriteStdin`, `handoff`, discovery tools or invocation syntax. It verifies
+autonomous discovery as well as input validation, the retry hint, draft reveal
+and hide, explicit single-click completion, the unsent-draft Resume guard, and a
+closed card after process exit.
+The fixture allows ten minutes for model reasoning and human authentication.
+`HANDOFF_BASE_URL` and `HANDOFF_MODEL` can target any compatible Responses API
+provider with function-tool support; the values above record our acceptance run.
+Set `HANDOFF_KEEP_OPEN=1` to leave the successful run visible until you close its
+window. In that mode the report explicitly records `profileClosed: false`:
+profile scanning occurs while the app remains open, rather than after shutdown.
+Set `HANDOFF_CAPTURE_SCREENSHOTS=0` to run the same assertions without capturing
+any screenshots.
+
+Assertions cover provider requests, ordinary Session events, process/renderer
+logs, live workspace files (including SQLite/WAL), and the closed Desktop profile.
+The fixture prints an artifact directory containing sequential screenshots,
+their ordered captions/redaction flags in `screenshots.json`, and `result.json`.
+When a private terminal display contains a generated credential, only that
+display is masked in the screenshot; the actual UI is unchanged. Password input
+drafts retain their normal masked appearance. This records every interaction
+without placing the fixture's echoed credentials in review artifacts.
+Failures retain sanitized diagnostics. No profile or credential file belongs in
+a commit; remove temporary profiles after reviewing them.
+
+State ordering, input fencing and durable Interaction behavior have lower-tier
+tests in Runtime and Runtime Host. This opt-in journey verifies the actual
+Electron renderer/preload/main-to-Host boundary and real-provider tool discovery;
+it does not add cases to the deterministic fake-backend E2E suite.
diff --git a/scripts/terminal-handoff/real-model.mjs b/scripts/terminal-handoff/real-model.mjs
new file mode 100644
index 00000000000..548348d273a
--- /dev/null
+++ b/scripts/terminal-handoff/real-model.mjs
@@ -0,0 +1,546 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+// Opt-in real-provider acceptance: actual Electron preload/main IPC -> Host ->
+// PTY -> SSH. No fake Backend, tool implementation or scripted model response.
+// A Node-only test cannot detect a missing scoped IPC route or a card that
+// never receives its canonical Host interaction. See README.md for invocation.
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { _electron as electron, expect } from '@playwright/test';
+import { resolveStorageRoot, tryAcquireInteractiveRootOwner } from '@maka/storage/root-authority';
+import { openInteractiveRuntimePolicyStoresForWrite } from '@maka/storage/runtime-policy-stores';
+import { createSettingsStore } from '@maka/storage/settings-store';
+import { buildFixtureEnv } from '../fixture-env.mjs';
+import { closeElectronApplication } from '../electron-lifecycle.mjs';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const root = resolve(here, '../..');
+const artifactDir = await mkdtemp(join(tmpdir(), 'maka-handoff-acceptance-'));
+console.log(JSON.stringify({ artifactDir, phase: 'starting' }));
+const profile = join(artifactDir, 'profile');
+const home = join(artifactDir, 'home');
+await mkdir(home);
+const password = `fixture-password-${randomUUID()}`;
+const factor = `fixture-factor-${randomUUID()}`;
+const model = process.env.HANDOFF_MODEL ?? 'gpt-5.6-terra';
+const upstream = (process.env.HANDOFF_BASE_URL ?? 'http://127.0.0.1:8080/v1').replace(/\/$/, '');
+const apiKey = (await readFile(process.env.HANDOFF_API_KEY_FILE, 'utf8')).trim();
+const requests = [];
+const providerErrors = [];
+const providerLeaks = [];
+const proxy = createServer(async (request, response) => {
+  try {
+    const chunks = [];
+    for await (const chunk of request) chunks.push(chunk);
+    const body = Buffer.concat(chunks);
+    if (body.includes(password) || body.includes(factor)) providerLeaks.push(request.url);
+    if (request.method === 'POST') {
+      const payload = JSON.parse(body.toString());
+      requests.push({
+        model: payload.model,
+        path: request.url,
+        privateHandoffOffered: JSON.stringify(payload.tools).includes('"handoff":'),
+        handoffDiscoveryHintSeen: body.includes('Starting a PTY does not reveal'),
+        resultObservationSeen: body.includes('CONTINUITY:original-shell:/tmp'),
+        resumeInstructionSeen: body.includes('Continue the original task now'),
+      });
+    }
+    const result = await fetch(`${upstream}${request.url.replace(/^\/v1/, '')}`, {
+      method: request.method,
+      headers: { 'content-type': 'application/json', authorization: `Bearer ${apiKey}` },
+      ...(body.length ? { body } : {}),
+    });
+    response.writeHead(result.status, {
+      'content-type': result.headers.get('content-type') ?? 'application/json',
+    });
+    if (!result.ok) {
+      const diagnostic = (await result.text())
+        .replaceAll(apiKey, '[credential]')
+        .replaceAll(password, '[private]')
+        .replaceAll(factor, '[private]');
+      providerErrors.push({ status: result.status, diagnostic });
+      console.log(JSON.stringify({ providerError: providerErrors.at(-1) }));
+      response.end(diagnostic);
+      return;
+    }
+    for await (const chunk of result.body) response.write(chunk);
+    response.end();
+  } catch {
+    response.writeHead(502);
+    response.end('Acceptance proxy failed');
+  }
+});
+await new Promise((resolve) => proxy.listen(0, '127.0.0.1', resolve));
+
+const ssh = spawn(process.env.HANDOFF_PYTHON ?? 'python3', [join(here, 'ssh-fixture.py')], {
+  env: { ...process.env, HANDOFF_FIXTURE_PASSWORD: password, HANDOFF_FIXTURE_FACTOR: factor },
+  stdio: ['ignore', 'pipe', 'pipe'],
+});
+const sshPort = await new Promise((resolve, reject) => {
+  let text = '';
+  ssh.stdout.on('data', (chunk) => {
+    text += chunk;
+    if (text.includes('\n')) resolve(JSON.parse(text.split('\n')[0]).port);
+  });
+  ssh.once('exit', () =>
+    reject(new Error('SSH fixture exited before readiness (install paramiko)')),
+  );
+});
+const workspace = join(profile, 'workspaces/default');
+const capability = await resolveStorageRoot({ path: workspace, kind: 'interactive' });
+const owner = await tryAcquireInteractiveRootOwner(capability);
+assert.ok(owner);
+try {
+  const stores = await openInteractiveRuntimePolicyStoresForWrite(owner.lease);
+  const created = await stores.connectionCatalog.create({
+    expectedCatalogRevision: 0,
+    connection: {
+      slug: 'handoff-real',
+      name: 'Terminal handoff acceptance',
+      providerType: 'custom',
+      defaultApiProtocol: 'openai-responses',
+      baseUrl: `http://127.0.0.1:${proxy.address().port}/v1`,
+      enabled: true,
+      enabledModelIds: [model],
+      modelOverrides: { [model]: { applyPatch: false } },
+    },
+  });
+  assert.equal(created.kind, 'committed');
+  const connection = created.snapshot.connections[0];
+  const credential = await stores.credentialVault.set({
+    locator: { scope: 'connection', connectionId: connection.connectionId, kind: 'api_key' },
+    expected: null,
+    secret: 'acceptance-proxy',
+  });
+  assert.equal(credential.kind, 'committed');
+  const fetch = await stores.operations.beginModelFetch(connection.connectionId);
+  assert.equal(fetch.kind, 'ready');
+  const inventory = await stores.operations.completeModelFetch(fetch.ticket, {
+    models: [{ id: model }],
+    source: 'fallback',
+    fetchedAt: Date.now(),
+  });
+  assert.equal(inventory.kind, 'committed');
+  const selected = await stores.connectionCatalog.setDefaultTarget({
+    expectedCatalogRevision: inventory.snapshot.revision,
+    target: { connectionId: connection.connectionId, modelId: model },
+  });
+  assert.equal(selected.kind, 'committed');
+} finally {
+  await owner.close();
+}
+await createSettingsStore(workspace).update({ personalization: { uiLocale: 'en' } });
+let app;
+let page;
+const logs = [];
+const keepOpen = process.env.HANDOFF_KEEP_OPEN === '1';
+const screenshots = [];
+async function recordScreenshot(file, title) {
+  if (process.env.HANDOFF_CAPTURE_SCREENSHOTS === '0') return;
+  const displays = page.locator('[data-private-terminal]:visible');
+  const text = (await displays.allTextContents()).join('\n');
+  const redacted = text.includes(password) || text.includes(factor);
+  await page.screenshot({
+    path: join(artifactDir, file),
+    animations: 'disabled',
+    ...(redacted ? { mask: [displays], maskColor: '#20252b' } : {}),
+  });
+  screenshots.push({ file, title, redacted });
+  await writeFile(join(artifactDir, 'screenshots.json'), JSON.stringify(screenshots, null, 2));
+}
+try {
+  const env = buildFixtureEnv(profile, home, { showWindow: true, locale: 'en' });
+  delete env.MAKA_E2E;
+  env.MAKA_CU_REAL_MODEL_E2E = '1';
+  env.MAKA_CU_REAL_MODEL_POLICY = JSON.stringify({
+    allowedActions: ['wait'],
+    maxTotalActions: 1,
+    maxActionCounts: { wait: 1 },
+    allowedApps: ['Terminal handoff acceptance'],
+  });
+  app = await electron.launch({ args: ['apps/desktop'], cwd: root, env, timeout: 30_000 });
+  app.process().stdout?.on('data', (chunk) => logs.push(String(chunk)));
+  app.process().stderr?.on('data', (chunk) => logs.push(String(chunk)));
+  page = await app.firstWindow();
+  page.on('console', (message) => logs.push(message.text()));
+  page.on('pageerror', (error) => logs.push(error.message));
+  await page.waitForFunction(() => Boolean(window.maka?.sessions));
+  await app.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows()[0].setSize(1440, 960));
+  const sessionId = await page.evaluate(
+    async ({ model, home }) => {
+      const session = await window.maka.sessions.create({
+        backend: 'ai-sdk',
+        permissionMode: 'bypass',
+        name: 'Private SSH handoff',
+        cwd: home,
+      });
+      window.handoffAcceptance = { events: [] };
+      window.maka.sessions.subscribeEvents(session.id, (event) =>
+        window.handoffAcceptance.events.push(event),
+      );
+      return session.id;
+    },
+    { model, home },
+  );
+  const expand = page.getByRole('button', { name: /^(Expand sidebar|展开侧边栏)$/ });
+  if (await expand.isVisible()) await expand.click();
+  await page
+    .locator(`[data-session-id=${JSON.stringify(sessionId)}]`)
+    .first()
+    .click();
+  await expect(
+    page.locator('.maka-composer-editor [contenteditable="true"]').first(),
+  ).toBeVisible();
+  // The normal user terminal is a baseline, never a replacement for the SSH PTY.
+  await page.keyboard.press('Control+Backquote');
+  await expect(page.locator('.maka-session-terminal-xterm .xterm')).toBeVisible();
+  await recordScreenshot('01-normal.png', '普通终端：接管前的基线');
+  const prompt = `Please log in to fixture@127.0.0.1 on SSH port ${sshPort}. This is my authorized, isolated local test server; it uses password authentication, and for this loopback test you may skip host-key verification without updating known_hosts. I will enter the password and any verification code myself in the app; do not ask me to put credentials in chat or look for them in files. After I finish, use that same remote shell to print CONTINUITY: followed by the shell-local variable marker and the current directory, separated by colons, then report the result promptly. Allow ten minutes for login and follow-up commands, but do not wait out that period before reporting; leave the connection open in the background. Use the terminal rather than a graphical SSH app. This test server accepts interactive shell sessions only, with no SSH remote-command argument. It already initializes the shell-local marker variable; inspect its existing value without setting or exporting it.`;
+  const editor = page.locator('.maka-composer-editor [contenteditable="true"]').first();
+  await editor.fill(prompt);
+  await expect(page.locator('.maka-composer button[type="submit"]').first()).toBeEnabled();
+  await editor.press('Enter');
+  await recordScreenshot('task-started.png', '提交自然语言任务，Agent 自主发现接管能力');
+  const card = page.getByTestId('terminal-handoff');
+  const privateField = card.locator('input[type="password"]');
+  await Promise.race([
+    expect(card.locator('input[type="password"]')).toBeVisible({ timeout: 180_000 }),
+    page
+      .waitForFunction(
+        () => window.handoffAcceptance?.events.some((event) => event.type === 'error') ?? false,
+        undefined,
+        { timeout: 180_000 },
+      )
+      .then(() => {
+        throw new Error('Real model turn failed before terminal handoff');
+      }),
+  ]);
+  await recordScreenshot('02-waiting.png', '自动展开原终端，等待用户私密输入');
+  await expect(card.locator('details')).not.toHaveAttribute('open');
+  await expect(card.locator('header')).toContainText('fixture@127.0.0.1');
+  await card.locator('summary').click();
+  await recordScreenshot(
+    'connection-details.png',
+    '按需展开连接详情，查看 Agent 说明、执行主机和资源标识',
+  );
+  await card.locator('summary').click();
+  console.log(JSON.stringify({ phase: 'awaiting-private-input' }));
+  const beforeReload = await page.evaluate(() => window.handoffAcceptance.events);
+  // A harmless draft makes the reveal control reviewable without photographing a credential.
+  await privateField.fill('review-demo');
+  await card.getByRole('button', { name: 'Show input', exact: true }).click();
+  await expect(card.locator('input[type="text"]')).toHaveValue('review-demo');
+  await recordScreenshot('visible-draft.png', '点击眼睛核对输入：演示文字非真实凭据');
+  await card.getByRole('button', { name: 'Hide input', exact: true }).click();
+  await expect(privateField).toHaveValue('review-demo');
+  await recordScreenshot('hidden-draft.png', '再次点击眼睛，恢复掩码');
+  await privateField.fill(password);
+  await recordScreenshot('masked-draft.png', '密码草稿以掩码显示，尚未提交');
+  await page.reload();
+  await page.waitForFunction(() => Boolean(window.maka?.sessions));
+  await page.evaluate((id) => {
+    window.handoffAcceptance = { events: [] };
+    window.maka.sessions.subscribeEvents(id, (event) =>
+      window.handoffAcceptance.events.push(event),
+    );
+  }, sessionId);
+  await expect(card.locator('input[type="password"]')).toBeVisible({ timeout: 30_000 });
+  await expect(privateField).toHaveValue('');
+  await recordScreenshot('draft-cleared.png', '刷新后清空草稿，恢复原接管');
+  await expect(
+    card.getByRole('button', { name: 'Done, continue task', exact: true }),
+  ).toBeDisabled();
+  await privateField.fill('invalid\u0007line');
+  await card.getByRole('button', { name: 'Submit', exact: true }).click();
+  await expect(card).toContainText('Not sent. Enter one line');
+  await expect(privateField).toBeEnabled();
+  await recordScreenshot('invalid-input.png', '输入校验失败：未发送，可编辑');
+  await privateField.fill(factor);
+  await card.getByRole('button', { name: 'Submit', exact: true }).click();
+  await expect(card.locator('pre')).toContainText('Permission denied', { timeout: 30_000 });
+  await expect(card).toContainText('SSH rejected authentication');
+  await expect(
+    card.getByRole('button', { name: 'Done, continue task', exact: true }),
+  ).toBeDisabled();
+  await recordScreenshot('04-retry.png', 'SSH 密码错误：错误提示与重试入口');
+  await privateField.fill(password);
+  await card.getByRole('button', { name: 'Submit', exact: true }).click();
+  await expect(card.locator('pre')).toContainText('Verification code:', { timeout: 30_000 });
+  await recordScreenshot('verification-code.png', '密码通过，目标程序请求验证码');
+  await privateField.fill(factor);
+  await card.getByRole('button', { name: 'Submit', exact: true }).click();
+  await expect(card.locator('pre')).toContainText('AUTHENTICATED', { timeout: 30_000 });
+  await recordScreenshot('authentication-complete.png', '验证完成，点击一次已完成即可继续任务');
+  await expect(card.getByRole('checkbox')).toHaveCount(0);
+  await expect(privateField).toHaveValue('');
+  await expect(
+    card.getByRole('button', { name: 'Done, continue task', exact: true }),
+  ).toBeEnabled();
+  await expect(card.locator('input')).toHaveCount(1);
+  await privateField.fill('unsubmitted');
+  await expect(
+    card.getByRole('button', { name: 'Done, continue task', exact: true }),
+  ).toBeDisabled();
+  await recordScreenshot('unsent-draft.png', '仍有未提交草稿时，禁止交还');
+  await privateField.fill('');
+  const before = await page.evaluate(() => window.handoffAcceptance.events);
+  assert.equal(JSON.stringify(before).includes(password), false);
+  assert.equal(JSON.stringify(before).includes(factor), false);
+  await card.getByRole('button', { name: 'Done, continue task', exact: true }).click();
+  console.log(JSON.stringify({ phase: 'resumed' }));
+  await expect(card).toHaveCount(0);
+  const terminalView = page.getByTestId('private-terminal');
+  await expect(terminalView).toBeVisible();
+  await expect(terminalView.locator('input, header, details, button')).toHaveCount(0);
+  await recordScreenshot('03-resumed.png', '点击继续后输入卡片退出，仅保留原终端的私密显示');
+  const safe = 'CONTINUITY:original-shell:/tmp';
+  await expect(terminalView.locator('pre')).toContainText(safe, { timeout: 180_000 });
+  console.log(JSON.stringify({ phase: 'same-shell-command-observed' }));
+  await recordScreenshot('command-result.png', 'Agent 在原 shell 执行命令；结果仍仅对用户可见');
+  // Real hide/remount paths must keep the same private display.
+  await page.getByRole('button', { name: 'Collapse task workbar', exact: true }).click();
+  await expect(terminalView).toBeHidden();
+  await expect(terminalView.locator('pre')).toHaveText('');
+  console.log(JSON.stringify({ phase: 'resumed-card-hidden' }));
+  await recordScreenshot('panel-hidden.png', '收起工作栏，私密显示清除');
+  await page.getByRole('button', { name: 'Expand task workbar', exact: true }).click();
+  await expect(terminalView).toBeVisible();
+  await expect(terminalView.locator('pre')).toContainText(safe, { timeout: 30_000 });
+  console.log(JSON.stringify({ phase: 'resumed-card-expanded' }));
+  await recordScreenshot('panel-restored.png', '重新展开，原私密结果恢复');
+  const tabs = page.locator('.maka-workbar-tab-list [role="tab"]');
+  const activeTab = await tabs.evaluateAll((elements) =>
+    elements.findIndex((element) => element.getAttribute('aria-selected') === 'true'),
+  );
+  assert.ok(activeTab >= 0 && (await tabs.count()) >= 2);
+  await tabs.nth(activeTab === 0 ? 1 : 0).click();
+  await expect(terminalView).toBeHidden();
+  await recordScreenshot('other-tab.png', '切换到另一个终端标签');
+  await tabs.nth(activeTab).click();
+  await expect(terminalView).toBeVisible();
+  await expect(terminalView.locator('pre')).toContainText(safe, { timeout: 30_000 });
+  console.log(JSON.stringify({ phase: 'resumed-card-tab-returned' }));
+  await recordScreenshot('tab-restored.png', '切回原标签，私密显示恢复，无分享入口');
+  const beforeReturn = await page.evaluate(() => window.handoffAcceptance?.events ?? []);
+  await page.reload();
+  await page.waitForFunction(() => Boolean(window.maka?.sessions));
+  await page.evaluate(
+    ({ id, events }) => {
+      window.handoffAcceptance = { events };
+      window.maka.sessions.subscribeEvents(id, (event) =>
+        window.handoffAcceptance.events.push(event),
+      );
+    },
+    { id: sessionId, events: beforeReturn },
+  );
+  await expect(terminalView.locator('pre')).toContainText(safe, { timeout: 30_000 });
+  console.log(JSON.stringify({ phase: 'resumed-card-recovered' }));
+  await expect(card).toHaveCount(0);
+  await recordScreenshot('reload-restored.png', '刷新 App 后恢复同一终端，无分享入口');
+  await page.waitForFunction(
+    () => window.handoffAcceptance.events.some((event) => event.type === 'complete'),
+    undefined,
+    { timeout: 180_000 },
+  );
+  for (const turn of [2, 3]) {
+    const eventCount = await page.evaluate(() => window.handoffAcceptance.events.length);
+    await editor.fill(
+      `Continue in the same authenticated SSH terminal. Print FOLLOWUP${turn}: followed by the existing shell-local marker and current directory, separated by colons. Do not set the marker or change directories. Execute the command even if its output remains private; in that case say you cannot observe its result. Leave the connection open.`,
+    );
+    await editor.press('Enter');
+    await expect(terminalView.locator('pre')).toContainText(`FOLLOWUP${turn}:original-shell:/tmp`, {
+      timeout: 180_000,
+    });
+    await expect(card).toHaveCount(0);
+    await page.waitForFunction(
+      (count) =>
+        window.handoffAcceptance.events.slice(count).some((event) => event.type === 'complete'),
+      eventCount,
+      { timeout: 180_000 },
+    );
+    console.log(JSON.stringify({ phase: 'same-connection-followup', turn }));
+    await recordScreenshot(
+      `followup-${turn}.png`,
+      `第 ${turn} 轮对话复用原 SSH 连接，无需再次输入密码`,
+    );
+  }
+  const events = [
+    ...beforeReload,
+    ...beforeReturn,
+    ...(await page.evaluate(() => window.handoffAcceptance.events)),
+  ];
+  const wire = JSON.stringify(events);
+  assert.equal(
+    requests.some((request) => request.resultObservationSeen),
+    false,
+    'removing sharing must not silently publish private output',
+  );
+  assert.equal(wire.includes(password), false);
+  assert.equal(wire.includes(factor), false);
+  assert.deepEqual(providerLeaks, []);
+  assert.ok(requests.some((request) => request.model === model && request.privateHandoffOffered));
+  assert.equal(logs.join('').includes(password), false);
+  assert.equal(logs.join('').includes(factor), false);
+  await recordScreenshot('agent-report.png', '当前限制：Agent 无法读取私密结果，完整任务尚未闭环');
+  // End the remote process, not the UI's "close tab" command: an exited
+  // process should leave an explanatory card in the original open tab.
+  ssh.kill('SIGTERM');
+  await expect(terminalView).toContainText('The original terminal process exited', {
+    timeout: 30_000,
+  });
+  await expect(card).toHaveCount(0);
+  await expect(terminalView.locator('pre')).toHaveText('');
+  await recordScreenshot('05-exited.png', '远端进程退出，原卡片明确结束');
+  const liveFiles = await scanFiles(workspace);
+  if (!keepOpen) {
+    await closeElectronApplication(app);
+    app = undefined;
+  }
+  const scanned = await scanFiles(profile);
+  await writeFile(
+    join(artifactDir, 'result.json'),
+    JSON.stringify(
+      {
+        passed: true,
+        scope: 'private input, same-shell continuation, sharing removal and privacy isolation',
+        fullIssueAcceptance: false,
+        automaticResultObservation: false,
+        model,
+        requests,
+        liveWorkspaceFiles: liveFiles,
+        scannedFiles: scanned,
+        profileClosed: !keepOpen,
+        providerLeaks: 0,
+        reloadClearedDraft: true,
+        autonomousHandoff: true,
+        inputValidationAndResumeGuard: true,
+        singleClickCompletionWithoutCheckbox: true,
+        completedInputCardRemoved: true,
+        sameConnectionFollowupTurns: 2,
+        explicitProcessExit: true,
+        resumedCardRecovered: true,
+        sameShellObservation: safe,
+      },
+      null,
+      2,
+    ),
+  );
+  console.log(
+    JSON.stringify({
+      passed: true,
+      artifactDir,
+      providerRequests: requests.length,
+      scannedFiles: scanned,
+    }),
+  );
+  if (keepOpen) {
+    console.log(JSON.stringify({ phase: 'open-for-review', artifactDir }));
+    await new Promise((resolve) => app.process().once('exit', resolve));
+    app = undefined;
+  }
+} catch (error) {
+  // Safe diagnostics only: never dump private DOM, inputs, screenshots or raw logs on failure.
+  console.error(
+    JSON.stringify({
+      passed: false,
+      artifactDir,
+      message: String(error).replaceAll(password, '[private]').replaceAll(factor, '[private]'),
+      requests,
+      providerErrors,
+    }),
+  );
+  const sanitize = (value) =>
+    String(value)
+      .replaceAll(password, '[private]')
+      .replaceAll(factor, '[private]')
+      .replaceAll(apiKey, '[credential]');
+  await writeFile(join(artifactDir, 'diagnostic.log'), sanitize(logs.join('\n')));
+  if (page)
+    await writeFile(
+      join(artifactDir, 'page-state.txt'),
+      sanitize(
+        await page
+          .locator('body')
+          .evaluate((element) => {
+            const clone = element.cloneNode(true);
+            clone.querySelectorAll('pre, input, script, style').forEach((node) => node.remove());
+            return clone.textContent;
+          })
+          .catch(() => 'No page'),
+      ),
+    );
+  if (page)
+    await writeFile(
+      join(artifactDir, 'card-state.txt'),
+      sanitize(
+        await page
+          .getByTestId('terminal-handoff')
+          .evaluate((element) => {
+            const clone = element.cloneNode(true);
+            clone.querySelectorAll('pre, input').forEach((node) => node.remove());
+            return clone.textContent;
+          })
+          .catch(() => 'No card'),
+      ),
+    );
+  if (page)
+    await writeFile(
+      join(artifactDir, 'events.json'),
+      sanitize(
+        JSON.stringify(
+          await page.evaluate(() => window.handoffAcceptance?.events ?? []).catch(() => []),
+          null,
+          2,
+        ),
+      ),
+    );
+  process.exitCode = 1;
+} finally {
+  if (app) await closeElectronApplication(app);
+  ssh.kill('SIGTERM');
+  proxy.closeAllConnections();
+  proxy.close();
+}
+
+async function scanFiles(directory) {
+  const files = await readdir(directory, { recursive: true, withFileTypes: true });
+  let scanned = 0;
+  for (const entry of files) {
+    if (!entry.isFile()) continue;
+    const path = join(entry.parentPath, entry.name);
+    const bytes = await readFile(path).catch((error) => {
+      if (error.code === 'ENOENT') return Buffer.alloc(0);
+      throw error;
+    });
+    assert.equal(
+      bytes.includes(password) || bytes.includes(factor),
+      false,
+      `Private credential persisted: ${path}`,
+    );
+    scanned++;
+  }
+  return scanned;
+}
diff --git a/scripts/terminal-handoff/ssh-fixture.py b/scripts/terminal-handoff/ssh-fixture.py
new file mode 100644
index 00000000000..c0375df129d
--- /dev/null
+++ b/scripts/terminal-handoff/ssh-fixture.py
@@ -0,0 +1,132 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Loopback-only SSH acceptance fixture. Requires paramiko; no system sshd changes."""
+import json
+import os
+import pty
+import select
+import signal
+import socket
+import subprocess
+import threading
+
+import paramiko
+
+password = os.environ.pop("HANDOFF_FIXTURE_PASSWORD")
+factor = os.environ.pop("HANDOFF_FIXTURE_FACTOR")
+key = paramiko.RSAKey.generate(2048)
+stopping = threading.Event()
+transports = []
+
+
+def stop_server(_signal, _frame):
+    stopping.set()
+    for transport in tuple(transports):
+        transport.close()
+
+
+signal.signal(signal.SIGTERM, stop_server)
+signal.signal(signal.SIGINT, stop_server)
+
+
+class Server(paramiko.ServerInterface):
+    def __init__(self):
+        self.ready = threading.Event()
+
+    def get_allowed_auths(self, username):
+        return "password"
+
+    def check_auth_password(self, username, supplied):
+        return paramiko.AUTH_SUCCESSFUL if username == "fixture" and supplied == password else paramiko.AUTH_FAILED
+
+    def check_channel_request(self, kind, chanid):
+        return paramiko.OPEN_SUCCEEDED if kind == "session" else paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED
+
+    def check_channel_pty_request(self, *args):
+        return True
+
+    def check_channel_shell_request(self, channel):
+        self.ready.set()
+        return True
+
+
+def serve(client):
+    transport = paramiko.Transport(client)
+    transports.append(transport)
+    # Natural model discovery plus human entry can take minutes. This fixture
+    # must not close the server while the app is legitimately awaiting input.
+    transport.auth_timeout = 600
+    server = Server()
+    child = None
+    master = None
+    try:
+        transport.add_server_key(key)
+        transport.start_server(server=server)
+        channel = transport.accept(600)
+        if channel is None or not server.ready.wait(30):
+            return
+        master, slave = pty.openpty()
+        # Intentionally echo secrets immediately AND after the agent resumes.
+        # Neither may reach ordinary Runtime observations or provider requests.
+        command = ('stty -echo; printf "Verification code: "; IFS= read -r response; '
+                   'test "$response" = "$EXPECTED_FACTOR" || exit 23; '
+                   'printf "\\n%s\\nAUTHENTICATED\\n" "$response"; '
+                   'marker=original-shell; cd /tmp; '
+                   'while IFS= read -r operation; do '
+                   'printf "%s\\n" "$response"; eval "$operation"; done')
+        child = subprocess.Popen(["/bin/bash", "-c", command], stdin=slave, stdout=slave, stderr=slave,
+                                 env={**os.environ, "EXPECTED_FACTOR": factor}, start_new_session=True)
+        os.close(slave)
+        channel.sendall((password + "\r\n").encode())
+        while transport.is_active() and child.poll() is None:
+            readable, _, _ = select.select([master, channel], [], [], 1)
+            if master in readable:
+                try:
+                    data = os.read(master, 65536)
+                except OSError:
+                    break
+                if not data:
+                    break
+                channel.sendall(data)
+            if channel in readable:
+                data = channel.recv(65536)
+                if not data:
+                    break
+                os.write(master, data)
+    finally:
+        if child is not None:
+            child.terminate()
+            child.wait()
+        if master is not None:
+            os.close(master)
+        transport.close()
+        transports.remove(transport)
+
+
+listener = socket.socket()
+listener.bind(("127.0.0.1", 0))
+listener.listen(2)
+listener.settimeout(0.5)
+print(json.dumps({"port": listener.getsockname()[1]}), flush=True)
+while not stopping.is_set():
+    try:
+        client, _ = listener.accept()
+    except socket.timeout:
+        continue
+    threading.Thread(target=serve, args=(client,)).start()
+listener.close()