diff --git a/src/dashboard/public-redact.ts b/src/dashboard/public-redact.ts
index 8b67774fb..4c2172723 100644
--- a/src/dashboard/public-redact.ts
+++ b/src/dashboard/public-redact.ts
@@ -61,12 +61,17 @@ export function redactSchedulesForPublic(schedules: unknown[]): unknown[] {
   });
 }
 
-/** Branch names often carry issue/customer identifiers. `/api/sessions` and
+/** Branch names often carry issue/customer identifiers. `riffAccessUrl` is the
+ * Riff AIO Sandbox **write** capability — a bearer URL whose unique subdomain is
+ * itself the credential (riff-backend.ts:hashUrlForLog), so an anonymous read-only
+ * visitor must never receive it (they'd gain write access to the sandbox). Read
+ * access on the dashboard goes through the local worker log terminal (webPort),
+ * which stays; only the sandbox write URL is stripped. `/api/sessions` and
  * `/events` are both public-read surfaces, so keep one non-mutating projection
  * for their shared session row shape. */
 export function redactSessionForPublic(session: unknown): unknown {
   if (!session || typeof session !== 'object' || Array.isArray(session)) return session;
-  const { gitBranch: _gitBranch, ...rest } = session as Record<string, unknown>;
+  const { gitBranch: _gitBranch, riffAccessUrl: _riffAccessUrl, ...rest } = session as Record<string, unknown>;
   return rest;
 }
 
@@ -88,7 +93,7 @@ export function redactSessionEventForPublic(type: string, body: unknown): unknow
     && typeof eventBody.patch === 'object'
     && !Array.isArray(eventBody.patch)
   ) {
-    const { gitBranch: _gitBranch, ...patch } = eventBody.patch as Record<string, unknown>;
+    const { gitBranch: _gitBranch, riffAccessUrl: _riffAccessUrl, ...patch } = eventBody.patch as Record<string, unknown>;
     return { ...eventBody, patch };
   }
   return body;
diff --git a/src/dashboard/web/i18n.ts b/src/dashboard/web/i18n.ts
index 3c0c45d09..f4a648374 100644
--- a/src/dashboard/web/i18n.ts
+++ b/src/dashboard/web/i18n.ts
@@ -317,6 +317,8 @@ const zh: DashboardMessages = {
   'sessions.locating': '发送中...',
   'sessions.cooldown': '冷却 {seconds}s',
   'sessions.openTerminal': '终端',
+  'sessions.openReadonlyTerminal': '打开只读终端',
+  'sessions.openWritableTerminal': '打开可操作 Web 终端',
   'sessions.writeLink': '操作链接',
   'sessions.writeLinkHint': '获取可操作终端链接（带写权限 token，新标签打开）',
   'sessions.writeLinkFail': '获取操作链接失败',
@@ -2315,6 +2317,8 @@ const en: DashboardMessages = {
   'sessions.locating': 'Sending...',
   'sessions.cooldown': 'Cooldown {seconds}s',
   'sessions.openTerminal': 'Terminal',
+  'sessions.openReadonlyTerminal': 'Open read-only terminal',
+  'sessions.openWritableTerminal': 'Open interactive web terminal',
   'sessions.writeLink': 'Write Link',
   'sessions.writeLinkHint': 'Get a writable terminal link (carries a write-access token; opens in a new tab)',
   'sessions.writeLinkFail': 'Failed to get write link',
diff --git a/src/dashboard/web/session-terminal.ts b/src/dashboard/web/session-terminal.ts
index 0d95fe250..17eb61486 100644
--- a/src/dashboard/web/session-terminal.ts
+++ b/src/dashboard/web/session-terminal.ts
@@ -9,9 +9,12 @@ function currentLocation(): SessionTerminalLocation | null {
 }
 
 export function sessionTerminalHref(s: any, loc: SessionTerminalLocation | null = currentLocation()): string | null {
-  // riff：dashboard 行内按钮保留 AIO Sandbox 直达（飞书卡片侧 Web终端=日志页、
-  // 操作链接=AIO；dashboard 只有一个终端入口，直达沙箱更有用）。
-  if (s?.riffAccessUrl) return s.riffAccessUrl;
+  // riff：只读入口对齐飞书卡片语义 —— 「Web终端=日志页」走本地 worker 端口的
+  // 只读日志视图，而不是 riffAccessUrl。riffAccessUrl 是 AIO Sandbox 的**可写**
+  // capability（bearer URL，见 riff-backend.ts:hashUrlForLog「the unique subdomain
+  // IS the write capability」），只能经鉴权的 /write-link（🔑「操作链接=AIO」）下发。
+  // 若在此短路返回它，只读图标会打开可写沙箱、且匿名只读面板也会拿到写能力 ——
+  // 故这里一律走 webPort 分支，让读/写入口与卡片侧一一对应。
   if (!s?.webPort || !loc) return null;
   // On the central HTTPS machine domain, terminals must go through the same
   // origin `/s/<session>` reverse proxy. Exposing a raw port would produce a
diff --git a/src/dashboard/web/sessions-kanban.tsx b/src/dashboard/web/sessions-kanban.tsx
index e417a6992..1d0ada3da 100644
--- a/src/dashboard/web/sessions-kanban.tsx
+++ b/src/dashboard/web/sessions-kanban.tsx
@@ -45,6 +45,7 @@ export interface SessionsKanbanIcons {
   details: string;
   feishu: string;
   history: string;
+  key: string;
   lock: string;
   restart: string;
   terminal: string;
@@ -79,6 +80,7 @@ export interface SessionsKanbanCallbacks {
   onNeedTeamBoard: (team: SessionsKanbanTeam) => void;
   onNeedTeams: () => void;
   onOpenTerminal?: (row: any) => void;
+  onOpenWritableTerminal?: (row: any, button: HTMLButtonElement) => void;
   onRename: (row: any, title: string) => void;
   onRestart: (row: any, button: HTMLButtonElement) => void;
   onTeamScope: (scope: { chats: number; sessions: number } | null) => void;
@@ -431,10 +433,18 @@ function KanbanCard(props: {
         <CardActButton
           action="terminal"
           icon={callbacks.icons.terminal}
-          label={t('sessions.openTerminal')}
+          label={t('sessions.openReadonlyTerminal')}
           onClick={() => callbacks.onOpenTerminal?.(row)}
         />
       ) : null}
+      {row.webPort && callbacks.onOpenWritableTerminal ? (
+        <CardActButton
+          action="write-link"
+          icon={callbacks.icons.key}
+          label={t('sessions.openWritableTerminal')}
+          onClick={button => callbacks.onOpenWritableTerminal?.(row, button)}
+        />
+      ) : null}
       {row.feishuChatLink ? (
         <a
           className="card-act kanban-card-act"
diff --git a/src/dashboard/web/sessions-page.tsx b/src/dashboard/web/sessions-page.tsx
index cc60ae569..675428e15 100644
--- a/src/dashboard/web/sessions-page.tsx
+++ b/src/dashboard/web/sessions-page.tsx
@@ -244,34 +244,34 @@ function IconActionButton(props: {
 
 function TerminalControls(props: { row: any; url: string | null }): JSX.Element | null {
   if (!props.url || !dashboardShellAllowsWebTerminal()) return null;
-  const readOnly = !shouldOpenWritableTerminal();
+  const canOpenWritable = shouldOpenWritableTerminal();
   return (
-    <span className={`term-pill${readOnly ? ' readonly' : ' writable'}`}>
-      {readOnly ? (
-        <a
-          className="term-btn term-open"
-          href={props.url}
-          target="_blank"
-          rel="noopener"
-          data-tip={t('sessions.openTerminal')}
-          aria-label={t('sessions.openTerminal')}
-          onClick={event => event.stopPropagation()}
-          dangerouslySetInnerHTML={rawHtml(ICON.terminal)}
-        />
-      ) : (
+    <span className="term-pill">
+      <a
+        className="term-btn term-open"
+        href={props.url}
+        target="_blank"
+        rel="noopener"
+        data-action="terminal"
+        data-tip={t('sessions.openReadonlyTerminal')}
+        aria-label={t('sessions.openReadonlyTerminal')}
+        onClick={event => event.stopPropagation()}
+        dangerouslySetInnerHTML={rawHtml(ICON.terminal)}
+      />
+      {canOpenWritable ? (
         <button
           type="button"
           className="term-btn term-write"
           data-action="write-link"
-          data-tip={t('sessions.openTerminal')}
-          aria-label={t('sessions.openTerminal')}
+          data-tip={t('sessions.openWritableTerminal')}
+          aria-label={t('sessions.openWritableTerminal')}
           onClick={(event) => {
             event.stopPropagation();
             void openWriteLink(props.row, event.currentTarget);
           }}
-          dangerouslySetInnerHTML={rawHtml(ICON.terminal)}
+          dangerouslySetInnerHTML={rawHtml(ICON.key)}
         />
-      )}
+      ) : null}
     </span>
   );
 }
@@ -2725,20 +2725,11 @@ function SessionsPage(): JSX.Element {
       setDrawerSessionId(row.sessionId);
       return;
     }
-    setTermState({ sessionId: row.sessionId, url: readonlyUrl, loading: true });
-    void (async () => {
-      let url = readonlyUrl;
-      if (shouldOpenWritableTerminal()) {
-        try {
-          const r = await fetch(`/api/sessions/${encodeURIComponent(row.sessionId)}/write-link`);
-          const body = await r.json().catch(() => ({}));
-          if (r.ok && body?.ok !== false && body?.url) url = body.url;
-        } catch {
-          // fallback to read-only URL
-        }
-      }
-      setTermState(prev => prev?.sessionId === row.sessionId ? { sessionId: row.sessionId, url, loading: false } : prev);
-    })();
+    setTermState({ sessionId: row.sessionId, url: readonlyUrl, loading: false });
+  }, []);
+
+  const openWritableTerminal = useCallback((row: any, button?: HTMLButtonElement): void => {
+    void openWriteLink(row, button);
   }, []);
 
   const runBulkClose = useCallback(async (): Promise<void> => {
@@ -3225,6 +3216,7 @@ function SessionsPage(): JSX.Element {
                 details: ICON.details,
                 feishu: ICON.feishu,
                 history: ICON.history,
+                key: ICON.key,
                 lock: ICON.lock,
                 restart: ICON.restart,
                 terminal: ICON.terminal,
@@ -3238,6 +3230,7 @@ function SessionsPage(): JSX.Element {
               onNeedTeamBoard={team => { void ensureTeamBoard(team); }}
               onNeedTeams={() => { void loadKanbanTeams(); }}
               onOpenTerminal={dashboardShellAllowsWebTerminal() ? openTerminalModal : undefined}
+              onOpenWritableTerminal={dashboardShellAllowsWebTerminal() && shouldOpenWritableTerminal() ? openWritableTerminal : undefined}
               onRename={(row, title) => { const s = store.sessions.get(String(row.sessionId)); if (s) void persistRename(s, title); }}
               onRestart={(row, button) => { const s = store.sessions.get(String(row.sessionId)); if (s) void restartSession(s, button); }}
               onTeamScope={scope => setTeamScopeText(scope ? t('sessions.kanban.teamScope', { chats: scope.chats, sessions: scope.sessions }) : '')}
diff --git a/src/dashboard/web/style.css b/src/dashboard/web/style.css
index 5590d81e4..a8c18dae1 100644
--- a/src/dashboard/web/style.css
+++ b/src/dashboard/web/style.css
@@ -3687,11 +3687,11 @@ button.primary {
 }
 .card-act:active { transform: scale(0.9); }
 
-/* 单一终端入口：私有 dashboard 默认打开可写终端；显式开启公共只读时，
-   同一个图标降级为只读链接，避免并排「终端 + 钥匙」造成两个主操作。 */
+/* 终端与可操作 Web 终端分成两个明确入口：钥匙按钮只在有写权限时显示。 */
 .term-pill {
   display: inline-flex;
   align-items: center;
+  gap: 6px;
 }
 .term-pill .term-btn {
   width: 30px;
diff --git a/test/dashboard-monitor-room.test.ts b/test/dashboard-monitor-room.test.ts
index 382a9e13a..3dae51027 100644
--- a/test/dashboard-monitor-room.test.ts
+++ b/test/dashboard-monitor-room.test.ts
@@ -75,6 +75,19 @@ describe('session terminal href', () => {
     expect(sessionTerminalHref({ sessionId: 'a b', webPort: 3001, proxyPort: 8801 }, platform)).toBe('https://m-1.example.test/s/a%20b');
     expect(sessionTerminalHref({ sessionId: 'abc', webPort: 3001 }, platform)).toBeNull();
   });
+
+  it('resolves a Riff read-only terminal to the local worker log port, never the writable sandbox URL', () => {
+    // riffAccessUrl is the AIO Sandbox WRITE capability (a bearer URL). The
+    // read-only href must align with the Feishu card「Web终端=日志页」and open
+    // the local worker log terminal (webPort); the sandbox link is reachable
+    // only through the authenticated /write-link (🔑「操作链接=AIO」).
+    const riff = { sessionId: 'riff-1', webPort: 3001, riffAccessUrl: 'https://abc123.sandbox.example/term' };
+    expect(sessionTerminalHref(riff, local)).toBe('http://localhost:3001');
+    expect(sessionTerminalHref(riff, local)).not.toContain('sandbox.example');
+    // Without a local webPort there is no read-only entry (returns null rather
+    // than falling back to the writable sandbox URL).
+    expect(sessionTerminalHref({ sessionId: 'riff-2', riffAccessUrl: 'https://abc123.sandbox.example/term' }, local)).toBeNull();
+  });
 });
 
 describe('monitor room frame geometry', () => {
diff --git a/test/dashboard-public-redact.test.ts b/test/dashboard-public-redact.test.ts
index 62ebd2602..909d910e7 100644
--- a/test/dashboard-public-redact.test.ts
+++ b/test/dashboard-public-redact.test.ts
@@ -168,6 +168,30 @@ describe('session presentation redaction', () => {
     expect(updated.patch).toEqual({ repoName: 'customer-a' });
     expect(updateBody.patch.gitBranch).toBe('issue/CUSTOMER-456');
   });
+
+  it('strips the Riff sandbox write URL from anonymous REST rows without mutating authenticated data', () => {
+    // riffAccessUrl is a bearer WRITE capability (the unique sandbox subdomain
+    // IS the credential). An anonymous read-only visitor must never receive it,
+    // or the public board would hand out write access to the sandbox. Read
+    // access stays available via the local worker log terminal (webPort).
+    const riffSession = { sessionId: 's-riff', webPort: 3007, riffAccessUrl: 'https://abc123.sandbox.example/term' };
+    const out = redactSessionsForPublic([riffSession]) as any[];
+    expect(out[0]).toMatchObject({ sessionId: 's-riff', webPort: 3007 });
+    expect(out[0]).not.toHaveProperty('riffAccessUrl');
+    expect(riffSession.riffAccessUrl).toBe('https://abc123.sandbox.example/term');
+  });
+
+  it('strips riffAccessUrl from spawned and update SSE bodies', () => {
+    const riffSession = { sessionId: 's-riff', webPort: 3007, riffAccessUrl: 'https://abc123.sandbox.example/term' };
+    const spawned = redactSessionEventForPublic('session.spawned', { session: riffSession }) as any;
+    expect(spawned.session).not.toHaveProperty('riffAccessUrl');
+    expect(spawned.session).toMatchObject({ sessionId: 's-riff', webPort: 3007 });
+
+    const updateBody = { sessionId: 's-riff', patch: { riffAccessUrl: 'https://def456.sandbox.example/term', webPort: 3007 } };
+    const updated = redactSessionEventForPublic('session.update', updateBody) as any;
+    expect(updated.patch).toEqual({ webPort: 3007 });
+    expect(updateBody.patch.riffAccessUrl).toBe('https://def456.sandbox.example/term');
+  });
 });
 
 describe('redactSettingsForPublic', () => {
diff --git a/test/dashboard-sessions-ui.test.ts b/test/dashboard-sessions-ui.test.ts
index da789e1d8..21c956aac 100644
--- a/test/dashboard-sessions-ui.test.ts
+++ b/test/dashboard-sessions-ui.test.ts
@@ -23,6 +23,7 @@ const kanbanCallbacks: SessionsKanbanCallbacks = {
     details: '<svg></svg>',
     feishu: '<svg></svg>',
     history: '<svg></svg>',
+    key: '<svg></svg>',
     lock: '<svg></svg>',
     restart: '<svg></svg>',
     terminal: '<svg></svg>',
@@ -36,6 +37,7 @@ const kanbanCallbacks: SessionsKanbanCallbacks = {
   onNeedTeamBoard: () => {},
   onNeedTeams: () => {},
   onOpenTerminal: () => {},
+  onOpenWritableTerminal: () => {},
   onRename: () => {},
   onRestart: () => {},
   onTeamScope: () => {},
@@ -406,6 +408,7 @@ describe('dashboard sessions kanban react view', () => {
       host: null,
       ...kanbanCallbacks,
       onOpenTerminal: undefined,
+      onOpenWritableTerminal: undefined,
       rows: [{
         sessionId: 'embedded-session',
         status: 'working',
@@ -424,5 +427,23 @@ describe('dashboard sessions kanban react view', () => {
     }));
 
     expect(html).not.toContain('data-action="terminal"');
+    expect(html).not.toContain('data-action="write-link"');
+  });
+
+  it('renders separate read-only and writable terminal actions when both are available', () => {
+    const html = renderKanban({
+      rows: [{
+        sessionId: 'dual-terminal-session',
+        status: 'working',
+        cliId: 'codex',
+        title: 'Dual terminal',
+        botName: 'Bot A',
+        lastMessageAt: 1000,
+        webPort: 3001,
+      }],
+    });
+
+    expect(html).toContain('data-action="terminal"');
+    expect(html).toContain('data-action="write-link"');
   });
 });