@delt/claude-alarm 0.9.0 → 1.0.0

package/dist/cli.js

@@ -12,7 +12,7 @@ var __export = (target, all) => {
 // src/shared/constants.ts
 import path from "path";
 import os from "os";
-var DEFAULT_HUB_HOST, DEFAULT_HUB_PORT, CONFIG_DIR, CONFIG_FILE, PID_FILE, LOG_FILE, UPLOADS_DIR, WS_PATH_CHANNEL, WS_PATH_DASHBOARD, CHANNEL_SERVER_NAME, CHANNEL_SERVER_VERSION;
+var DEFAULT_HUB_HOST, DEFAULT_HUB_PORT, CONFIG_DIR, CONFIG_FILE, PID_FILE, LOG_FILE, UPLOADS_DIR, CODEX_PID_FILE, CODEX_LOG_FILE, WS_PATH_CHANNEL, WS_PATH_DASHBOARD, CHANNEL_SERVER_NAME, CHANNEL_SERVER_VERSION;
 var init_constants = __esm({
   "src/shared/constants.ts"() {
     "use strict";
@@ -23,6 +23,8 @@ var init_constants = __esm({
     PID_FILE = path.join(CONFIG_DIR, "hub.pid");
     LOG_FILE = path.join(CONFIG_DIR, "hub.log");
     UPLOADS_DIR = path.join(CONFIG_DIR, "uploads");
+    CODEX_PID_FILE = path.join(CONFIG_DIR, "codex.pid");
+    CODEX_LOG_FILE = path.join(CONFIG_DIR, "codex.log");
     WS_PATH_CHANNEL = "/ws/channel";
     WS_PATH_DASHBOARD = "/ws/dashboard";
     CHANNEL_SERVER_NAME = "claude-alarm";
@@ -67,6 +69,12 @@ function saveConfig(config2) {
   ensureConfigDir();
   fs.writeFileSync(CONFIG_FILE, JSON.stringify(config2, null, 2), { encoding: "utf-8", mode: 384 });
 }
+function setCodexEnabled(enabled) {
+  const config2 = loadConfig();
+  config2.codex = { ...config2.codex, enabled };
+  saveConfig(config2);
+  return config2;
+}
 function setupMcpConfig(targetDir) {
   const dir = targetDir ?? process.cwd();
   const mcpPath = path2.join(dir, ".mcp.json");
@@ -211,9 +219,9 @@ var init_session_manager = __esm({
     SessionManager = class {
       sessions = /* @__PURE__ */ new Map();
       register(session) {
-        const baseName = session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+        const baseName = this.baseName(session);
         const existing = Array.from(this.sessions.values()).filter(
-          (s) => s.id !== session.id && (s.cwd?.replace(/^.*[/\\]/, "") || s.name) === baseName
+          (s) => s.id !== session.id && this.baseName(s) === baseName
         );
         if (existing.length > 0) {
           const usedNums = existing.map((s) => {
@@ -267,6 +275,9 @@ var init_session_manager = __esm({
       count() {
         return this.sessions.size;
       }
+      baseName(session) {
+        return session.title || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+      }
     };
   }
 });
@@ -294,7 +305,7 @@ var init_notifier = __esm({
       async notify(title, message, level = "info") {
         await this.notifyWithSession(void 0, void 0, title, message, level);
       }
-      async notifyWithSession(sessionId2, sessionLabel, title, message, level = "info") {
+      async notifyWithSession(sessionId2, sessionLabel2, title, message, level = "info") {
         const promises = [];
         if (this.desktopEnabled) {
           promises.push(this.sendDesktop(title, message, level));
@@ -302,8 +313,8 @@ var init_notifier = __esm({
         for (const webhook of this.webhooks) {
           promises.push(this.sendWebhook(webhook, title, message, level));
         }
-        if (this.telegramBot && sessionId2 && sessionLabel) {
-          promises.push(this.telegramBot.sendNotification(sessionId2, sessionLabel, title, message));
+        if (this.telegramBot && sessionId2 && sessionLabel2) {
+          promises.push(this.telegramBot.sendNotification(sessionId2, sessionLabel2, title, message));
         }
         await Promise.allSettled(promises);
       }
@@ -387,6 +398,17 @@ var init_notifier = __esm({
   }
 });
 
+// src/shared/session-label.ts
+function sessionLabel(session) {
+  const base = session.displayName || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+  return session.agentKind === "codex" ? `Codex \xB7 ${base}` : base;
+}
+var init_session_label = __esm({
+  "src/shared/session-label.ts"() {
+    "use strict";
+  }
+});
+
 // src/hub/telegram.ts
 import fs3 from "fs";
 import path3 from "path";
@@ -397,6 +419,7 @@ var init_telegram = __esm({
     "use strict";
     init_logger();
     init_constants();
+    init_session_label();
     TELEGRAM_API = "https://api.telegram.org/bot";
     TelegramBot = class _TelegramBot {
       config;
@@ -535,15 +558,14 @@ ${this.mdToHtml(message)}`;
             const pending = this.pendingMessages.get(msg.chat.id);
             if (pending) {
               this.pendingMessages.delete(msg.chat.id);
-              const sessions2 = this.getSessions?.() ?? [];
-              const idx = parseInt(selectMatch[1], 10) - 1;
-              if (idx >= 0 && idx < sessions2.length) {
+              const session = this.pendingSession(pending, parseInt(selectMatch[1], 10) - 1);
+              if (session) {
                 if (pending.photoFileId) {
-                  await this.deliverPhotoToSessionByFileId(sessions2[idx].id, pending.photoFileId, pending.caption);
+                  await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
                 } else if (pending.text) {
-                  this.deliverToSession(sessions2[idx].id, pending.text);
+                  this.deliverToSession(session.id, pending.text);
                 }
-                this.sendMessage(`Sent to [${this.getLabel(sessions2[idx])}]`);
+                this.sendMessage(`Sent to [${this.getLabel(session)}]`);
               } else {
                 this.sendMessage("Invalid session number.");
               }
@@ -564,11 +586,12 @@ ${this.mdToHtml(message)}`;
           }
           return;
         }
+        const sessionIds = sessions.map((s) => s.id);
         if (hasPhoto) {
           const largest = msg.photo[msg.photo.length - 1];
-          this.pendingMessages.set(msg.chat.id, { photoFileId: largest.file_id, caption: text });
+          this.pendingMessages.set(msg.chat.id, { photoFileId: largest.file_id, caption: text, sessionIds });
         } else {
-          this.pendingMessages.set(msg.chat.id, { text });
+          this.pendingMessages.set(msg.chat.id, { text, sessionIds });
         }
         const buttons = sessions.map((s, i) => ({
           text: this.getLabel(s),
@@ -625,11 +648,16 @@ ${this.mdToHtml(message)}`;
           logger.warn(`Telegram photo download failed: ${err.message}`);
         }
       }
+      // Buttons are numbered against the list shown when they were sent; Codex sessions come and go, so the live list may have shifted.
+      pendingSession(pending, idx) {
+        const id = pending.sessionIds[idx];
+        return id ? this.getSessions?.().find((s) => s.id === id) : void 0;
+      }
       getLabel(session) {
-        return session.displayName || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+        return sessionLabel(session);
       }
       /** Send a permission request with inline buttons */
-      async sendPermissionRequest(sessionId2, sessionLabel, requestId, toolName, description, inputPreview) {
+      async sendPermissionRequest(sessionId2, sessionLabel2, requestId, toolName, description, inputPreview) {
         const isNotify = toolName.endsWith("__notify") || toolName === "notify";
         let preview = inputPreview;
         let kind = "code";
@@ -682,7 +710,7 @@ ${this.mdToHtml(message)}`;
           const mcpMatch = toolName.match(/__([^_]+)$/);
           if (mcpMatch) displayTool = mcpMatch[1].charAt(0).toUpperCase() + mcpMatch[1].slice(1);
         }
-        const text = `\u26A0\uFE0F <b>Permission Request</b> \u2014 ${this.escHtml(sessionLabel)}
+        const text = `\u26A0\uFE0F <b>Permission Request</b> \u2014 ${this.escHtml(sessionLabel2)}
 
 \u{1F527} <b>${this.escHtml(displayTool)}</b>
 ${previewHtml}${truncNote}`;
@@ -696,6 +724,7 @@ ${previewHtml}${truncNote}`;
       }
       async handleCallbackQuery(query) {
         if (!query.data) return;
+        if (String(query.message?.chat.id) !== String(this.config.chatId)) return;
         if (query.data.startsWith("sess:")) {
           await this.handleSessionSelectCallback(query);
           return;
@@ -721,22 +750,18 @@ ${label}`);
         const parts = query.data.split(":");
         if (parts.length < 3) return;
         const [, idxStr, chatIdStr] = parts;
-        const idx = parseInt(idxStr, 10);
         const chatId = parseInt(chatIdStr, 10);
-        const sessions = this.getSessions?.() ?? [];
-        if (idx < 0 || idx >= sessions.length) {
+        const pending = this.pendingMessages.get(chatId);
+        const session = pending ? this.pendingSession(pending, parseInt(idxStr, 10)) : void 0;
+        if (!pending || !session) {
           await this.answerCallbackQuery(query.id, "Session not found");
           return;
         }
-        const session = sessions[idx];
-        const pending = this.pendingMessages.get(chatId);
         this.pendingMessages.delete(chatId);
-        if (pending) {
-          if (pending.photoFileId) {
-            await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
-          } else if (pending.text) {
-            this.deliverToSession(session.id, pending.text);
-          }
+        if (pending.photoFileId) {
+          await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
+        } else if (pending.text) {
+          this.deliverToSession(session.id, pending.text);
         }
         await this.answerCallbackQuery(query.id, `Sent to ${this.getLabel(session)}`);
         if (query.message) {
@@ -798,8 +823,8 @@ ${label}`);
         css: "css",
         scss: "scss"
       };
-      langOf(path8) {
-        const m = /\.([a-z0-9]+)$/i.exec(path8 || "");
+      langOf(path9) {
+        const m = /\.([a-z0-9]+)$/i.exec(path9 || "");
         return m ? _TelegramBot.LANG_BY_EXT[m[1].toLowerCase()] ?? "" : "";
       }
       /** Convert markdown to Telegram HTML (escape first, then apply formatting) */
@@ -844,18 +869,152 @@ ${bodyLines.join("\n")}`;
   }
 });
 
+// src/hub/codex-supervisor.ts
+import { spawn } from "child_process";
+import fs4 from "fs";
+import path4 from "path";
+function resolveAdapterScript(baseDir) {
+  return [path4.join(baseDir, "..", "codex", "main.js"), path4.join(baseDir, "codex", "main.js")].find((p) => fs4.existsSync(p));
+}
+var HEALTHY_RUN_MS, CodexSupervisor;
+var init_codex_supervisor = __esm({
+  "src/hub/codex-supervisor.ts"() {
+    "use strict";
+    init_logger();
+    HEALTHY_RUN_MS = 6e4;
+    CodexSupervisor = class {
+      constructor(script, spawnFn = spawn, minDelayMs = 2e3, maxDelayMs = 6e4, stopGraceMs = 3e3) {
+        this.script = script;
+        this.spawnFn = spawnFn;
+        this.minDelayMs = minDelayMs;
+        this.maxDelayMs = maxDelayMs;
+        this.stopGraceMs = stopGraceMs;
+        this.delay = minDelayMs;
+      }
+      child;
+      timer;
+      stopped = true;
+      delay;
+      start() {
+        this.stopped = false;
+        this.launch();
+      }
+      stop() {
+        this.stopped = true;
+        if (this.timer) clearTimeout(this.timer);
+        this.timer = void 0;
+        const child = this.child;
+        this.child = void 0;
+        if (!child) return;
+        child.stdin?.end();
+        const force = setTimeout(() => child.kill(), this.stopGraceMs);
+        force.unref();
+        child.once("exit", () => clearTimeout(force));
+      }
+      launch() {
+        const startedAt = Date.now();
+        const child = this.spawnFn(process.execPath, [this.script, "--watch-stdin"], {
+          detached: true,
+          stdio: ["pipe", "pipe", "pipe"],
+          windowsHide: true
+        });
+        this.child = child;
+        child.stdout?.on("data", (d) => process.stdout.write(d));
+        child.stderr?.on("data", (d) => process.stderr.write(d));
+        child.stdin?.on("error", () => {
+        });
+        child.on("error", (err) => logger.warn(`Codex adapter failed to start: ${err.message}`));
+        child.on("exit", (code, signal) => {
+          if (this.child === child) this.child = void 0;
+          if (this.stopped || code === 0) return;
+          if (Date.now() - startedAt > HEALTHY_RUN_MS) this.delay = this.minDelayMs;
+          logger.warn(`Codex adapter exited (${signal ?? code}); restarting in ${this.delay}ms`);
+          this.timer = setTimeout(() => {
+            this.timer = void 0;
+            if (!this.stopped) this.launch();
+          }, this.delay);
+          this.delay = Math.min(this.delay * 2, this.maxDelayMs);
+        });
+      }
+    };
+  }
+});
+
+// src/hub/auth.ts
+import crypto from "crypto";
+function safeEqual(a, b) {
+  if (typeof a !== "string") return false;
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+function dashboardCookieValue(token) {
+  return crypto.createHmac("sha256", token).update("claude-alarm-dashboard").digest("hex");
+}
+function parseCookies(header) {
+  const out = {};
+  for (const part of (header ?? "").split(";")) {
+    const i = part.indexOf("=");
+    if (i <= 0) continue;
+    const raw = part.slice(i + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out[part.slice(0, i).trim()] = value;
+  }
+  return out;
+}
+function sessionCookieHeader(token, secure) {
+  return `${SESSION_COOKIE}=${dashboardCookieValue(token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${COOKIE_MAX_AGE}${secure ? "; Secure" : ""}`;
+}
+function isAuthorized(req, token, allowQueryToken) {
+  const auth = req.headers.authorization;
+  if (auth?.startsWith("Bearer ") && safeEqual(auth.slice(7), token)) return true;
+  if (safeEqual(parseCookies(req.headers.cookie)[SESSION_COOKIE], dashboardCookieValue(token))) return true;
+  if (allowQueryToken) {
+    const q = new URL(req.url ?? "/", "http://hub").searchParams.get("token");
+    if (safeEqual(q, token)) return true;
+  }
+  return false;
+}
+function isCrossOrigin(req) {
+  const origin = req.headers.origin;
+  if (!origin) return false;
+  try {
+    return new URL(origin).host !== req.headers.host;
+  } catch {
+    return true;
+  }
+}
+function isJsonRequest(req) {
+  return String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json");
+}
+function isSecureRequest(req) {
+  return req.headers["x-forwarded-proto"] === "https";
+}
+var SESSION_COOKIE, COOKIE_MAX_AGE;
+var init_auth = __esm({
+  "src/hub/auth.ts"() {
+    "use strict";
+    SESSION_COOKIE = "ca_session";
+    COOKIE_MAX_AGE = 30 * 24 * 60 * 60;
+  }
+});
+
 // src/hub/server.ts
 var server_exports = {};
 __export(server_exports, {
   HubServer: () => HubServer
 });
 import http from "http";
-import fs4 from "fs";
-import path4 from "path";
+import fs5 from "fs";
+import path5 from "path";
 import { fileURLToPath } from "url";
 import { WebSocketServer, WebSocket } from "ws";
 import { randomUUID as randomUUID3 } from "crypto";
-var __dirname, HubServer;
+var __dirname, MAX_WS_PAYLOAD, HubServer;
 var init_server = __esm({
   "src/hub/server.ts"() {
     "use strict";
@@ -864,9 +1023,13 @@ var init_server = __esm({
     init_session_manager();
     init_notifier();
     init_telegram();
+    init_codex_supervisor();
     init_config();
+    init_session_label();
     init_crash_guard();
-    __dirname = path4.dirname(fileURLToPath(import.meta.url));
+    init_auth();
+    __dirname = path5.dirname(fileURLToPath(import.meta.url));
+    MAX_WS_PAYLOAD = 16 * 1024 * 1024;
     HubServer = class {
       httpServer;
       wssChannel;
@@ -884,13 +1047,17 @@ var init_server = __esm({
       heartbeatInterval;
       channelAlive = /* @__PURE__ */ new Map();
       // sessionId -> alive flag
+      socketOwners = /* @__PURE__ */ new WeakMap();
       host;
       port;
       token;
+      codexEnabled;
+      codexSupervisor;
       constructor(config2) {
         this.host = config2?.hub?.host ?? DEFAULT_HUB_HOST;
         this.port = config2?.hub?.port ?? DEFAULT_HUB_PORT;
         this.token = config2?.hub?.token;
+        this.codexEnabled = config2?.codex?.enabled === true;
         if (config2?.notifications) {
           this.notifier.configure({
             desktop: config2.notifications.desktop
@@ -906,22 +1073,23 @@ var init_server = __esm({
           this.initTelegram(fullConfig.telegram);
         }
         this.httpServer = http.createServer((req, res) => this.handleHttp(req, res));
-        this.wssChannel = new WebSocketServer({ noServer: true });
+        this.wssChannel = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
         this.wssChannel.on("connection", (ws, req) => this.handleChannelConnection(ws, req));
         this.wssChannel.on("error", (err) => logger.warn(`Channel WebSocket server error: ${err.message}`));
-        this.wssDashboard = new WebSocketServer({ noServer: true });
+        this.wssDashboard = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
         this.wssDashboard.on("connection", (ws) => this.handleDashboardConnection(ws));
         this.wssDashboard.on("error", (err) => logger.warn(`Dashboard WebSocket server error: ${err.message}`));
         this.httpServer.on("upgrade", (req, socket, head) => {
           socket.on("error", (err) => logger.debug(`Upgrade socket error: ${err.message}`));
-          const url = new URL(req.url, `http://${req.headers.host}`);
+          const url = new URL(req.url ?? "/", "http://hub");
           const pathname = url.pathname;
-          if (this.token && !this.isLocalRequest(req)) {
-            const wsToken = url.searchParams.get("token");
-            if (wsToken !== this.token) {
-              socket.destroy();
-              return;
-            }
+          if (isCrossOrigin(req)) {
+            this.rejectUpgrade(socket, 403, "Forbidden", pathname, req);
+            return;
+          }
+          if (!this.authorized(req, true)) {
+            this.rejectUpgrade(socket, 401, "Unauthorized", pathname, req);
+            return;
           }
           if (pathname === WS_PATH_CHANNEL) {
             this.wssChannel.handleUpgrade(req, socket, head, (ws) => {
@@ -947,12 +1115,15 @@ var init_server = __esm({
             this.httpServer.on("error", (err) => logger.error(`HTTP server error: ${err.message}`));
             const displayHost = this.host === "0.0.0.0" ? "127.0.0.1" : this.host;
             logger.info(`Hub server listening on http://${displayHost}:${this.port}`);
+            this.startCodexAdapter();
             resolve();
           });
         });
       }
       stop() {
         return new Promise((resolve) => {
+          this.codexSupervisor?.stop();
+          this.codexSupervisor = void 0;
           if (this.heartbeatInterval) clearInterval(this.heartbeatInterval);
           if (this.telegramBot) this.telegramBot.stopPolling();
           for (const ws of this.channelSockets.values()) ws.terminate();
@@ -973,31 +1144,28 @@ var init_server = __esm({
       }
       // --- HTTP Handler ---
       handleHttp(req, res) {
-        const url = new URL(req.url, `http://${req.headers.host}`);
-        const origin = req.headers.origin;
-        if (origin && (origin.includes("127.0.0.1") || origin.includes("localhost"))) {
-          res.setHeader("Access-Control-Allow-Origin", origin);
-        }
-        res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-        if (req.method === "OPTIONS") {
-          res.writeHead(204);
-          res.end();
+        const url = new URL(req.url ?? "/", "http://hub");
+        if (isCrossOrigin(req)) {
+          this.jsonResponse(res, 403, { error: "Cross-origin request rejected" });
           return;
         }
-        if (url.pathname !== "/" && this.token) {
-          if (!this.isLocalRequest(req)) {
-            const authHeader = req.headers["authorization"];
-            const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-            if (bearerToken !== this.token) {
-              this.jsonResponse(res, 401, { error: "Unauthorized" });
-              return;
-            }
-          }
+        if (req.method === "POST" && !isJsonRequest(req)) {
+          this.jsonResponse(res, 415, { error: "Content-Type must be application/json" });
+          return;
         }
         if (url.pathname === "/" && req.method === "GET") {
-          this.serveDashboard(res);
-        } else if (url.pathname === "/api/sessions" && req.method === "GET") {
+          this.serveDashboard(req, res, url);
+          return;
+        }
+        if (url.pathname === "/api/login" && req.method === "POST") {
+          this.handleLogin(req, res);
+          return;
+        }
+        if (!this.authorized(req, false)) {
+          this.jsonResponse(res, 401, { error: "Unauthorized" });
+          return;
+        }
+        if (url.pathname === "/api/sessions" && req.method === "GET") {
           this.jsonResponse(res, 200, { sessions: this.sessions.getAll() });
         } else if (url.pathname === "/api/status" && req.method === "GET") {
           this.jsonResponse(res, 200, {
@@ -1048,25 +1216,31 @@ var init_server = __esm({
           this.jsonResponse(res, 404, { error: "Not found" });
         }
       }
-      serveDashboard(res) {
+      serveDashboard(req, res, url) {
+        const linkToken = url.searchParams.get("token");
+        if (linkToken !== null && this.token && safeEqual(linkToken, this.token)) {
+          res.writeHead(302, { Location: "/", "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+          res.end();
+          return;
+        }
         const candidates = [
-          path4.join(__dirname, "..", "dashboard", "index.html"),
+          path5.join(__dirname, "..", "dashboard", "index.html"),
           // from dist/hub/
-          path4.join(__dirname, "dashboard", "index.html"),
+          path5.join(__dirname, "dashboard", "index.html"),
           // from dist/ (bundled index.js)
-          path4.join(__dirname, "..", "..", "src", "dashboard", "index.html"),
+          path5.join(__dirname, "..", "..", "src", "dashboard", "index.html"),
           // from dist/hub/ -> src/
-          path4.join(__dirname, "..", "src", "dashboard", "index.html"),
+          path5.join(__dirname, "..", "src", "dashboard", "index.html"),
           // from dist/ -> src/
-          path4.join(process.cwd(), "dist", "dashboard", "index.html"),
+          path5.join(process.cwd(), "dist", "dashboard", "index.html"),
           // from cwd
-          path4.join(process.cwd(), "src", "dashboard", "index.html")
+          path5.join(process.cwd(), "src", "dashboard", "index.html")
           // from cwd/src
         ];
         logger.debug(`Dashboard candidates: ${JSON.stringify(candidates)}`);
         for (const candidate of candidates) {
-          if (fs4.existsSync(candidate)) {
-            const html = fs4.readFileSync(candidate, "utf-8");
+          if (fs5.existsSync(candidate)) {
+            const html = fs5.readFileSync(candidate, "utf-8");
             res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
             res.end(html);
             return;
@@ -1075,6 +1249,20 @@ var init_server = __esm({
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end("<html><body><h1>claude-alarm</h1><p>Dashboard HTML not found. Reinstall the package.</p></body></html>");
       }
+      async handleLogin(req, res) {
+        const body = await this.readBody(req);
+        if (!this.token) {
+          res.writeHead(204);
+          res.end();
+          return;
+        }
+        if (typeof body?.token !== "string" || !safeEqual(body.token, this.token)) {
+          this.jsonResponse(res, 401, { error: "Unauthorized" });
+          return;
+        }
+        res.writeHead(204, { "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+        res.end();
+      }
       async handleApiSend(req, res) {
         const body = await this.readBody(req);
         if (!body) {
@@ -1091,7 +1279,7 @@ var init_server = __esm({
           this.jsonResponse(res, 404, { error: "Session not connected" });
           return;
         }
-        const msg = { type: "message_to_session", sessionId: sessionId2, content };
+        const msg = { type: "message_to_session", sessionId: sessionId2, content, source: "api" };
         ws.send(JSON.stringify(msg));
         this.jsonResponse(res, 200, { ok: true });
       }
@@ -1151,6 +1339,22 @@ var init_server = __esm({
         });
       }
       handleChannelMessage(ws, isLocal, msg) {
+        if (msg.type === "register") {
+          const id = msg.session.id;
+          const owned = this.socketOwners.get(ws);
+          if (owned && owned !== id) {
+            logger.warn(`Rejected register for ${id}: connection already owns ${owned}`);
+            return;
+          }
+          const holder = this.channelSockets.get(id);
+          if (holder && holder !== ws) {
+            this.socketOwners.delete(holder);
+            holder.terminate();
+          }
+          this.socketOwners.set(ws, id);
+        } else if ("sessionId" in msg && this.socketOwners.get(ws) !== msg.sessionId) {
+          return;
+        }
         switch (msg.type) {
           case "register": {
             const session = msg.session;
@@ -1174,7 +1378,6 @@ var init_server = __esm({
             break;
           }
           case "peer_name": {
-            if (this.channelSockets.get(msg.sessionId) !== ws) break;
             const updated = this.sessions.setPeerName(msg.sessionId, msg.peerName);
             if (updated) {
               logger.info(`Peer name for ${msg.sessionId}: ${msg.peerName ?? "-"}`);
@@ -1250,7 +1453,7 @@ var init_server = __esm({
             if (msg.type === "message_to_session") {
               const channelWs = this.channelSockets.get(msg.sessionId);
               if (channelWs?.readyState === WebSocket.OPEN) {
-                channelWs.send(JSON.stringify(msg));
+                channelWs.send(JSON.stringify({ ...msg, source: "dashboard" }));
               }
             } else if (msg.type === "image_upload") {
               this.handleImageUpload(msg);
@@ -1295,11 +1498,11 @@ var init_server = __esm({
           logger.warn("Image upload rejected: exceeds 10MB");
           return;
         }
-        fs4.mkdirSync(UPLOADS_DIR, { recursive: true });
+        fs5.mkdirSync(UPLOADS_DIR, { recursive: true });
         const ext = mimeType.split("/")[1] === "jpeg" ? "jpg" : mimeType.split("/")[1];
         const filename = `${randomUUID3()}.${ext}`;
-        const filePath = path4.join(UPLOADS_DIR, filename);
-        fs4.writeFileSync(filePath, buffer);
+        const filePath = path5.join(UPLOADS_DIR, filename);
+        fs5.writeFileSync(filePath, buffer);
         const forwardMsg = {
           type: "image_to_session",
           sessionId: sessionId2,
@@ -1312,7 +1515,7 @@ var init_server = __esm({
         logger.info(`Image saved and forwarded: ${filename} (${buffer.length} bytes)`);
         setTimeout(() => {
           try {
-            fs4.unlinkSync(filePath);
+            fs5.unlinkSync(filePath);
           } catch {
           }
         }, 5 * 60 * 1e3);
@@ -1340,7 +1543,7 @@ var init_server = __esm({
         this.telegramBot.onMessageToSession = (sessionId2, content) => {
           const channelWs = this.channelSockets.get(sessionId2);
           if (channelWs?.readyState === WebSocket.OPEN) {
-            const msg = { type: "message_to_session", sessionId: sessionId2, content };
+            const msg = { type: "message_to_session", sessionId: sessionId2, content, source: "telegram" };
             channelWs.send(JSON.stringify(msg));
             logger.info(`Telegram message forwarded to session: ${sessionId2}`);
           }
@@ -1467,6 +1670,17 @@ var init_server = __esm({
           this.jsonResponse(res, 500, { error: err.message });
         }
       }
+      startCodexAdapter() {
+        if (!this.codexEnabled) return;
+        const script = resolveAdapterScript(__dirname);
+        if (!script) {
+          logger.warn("Codex adapter is enabled but codex/main.js was not found next to the hub");
+          return;
+        }
+        this.codexSupervisor = new CodexSupervisor(script);
+        this.codexSupervisor.start();
+        logger.info("Codex adapter started");
+      }
       startHeartbeat() {
         this.heartbeatInterval = setInterval(() => {
           for (const [sessionId2, ws] of this.channelSockets) {
@@ -1482,11 +1696,11 @@ var init_server = __esm({
       }
       cleanupUploads() {
         try {
-          if (!fs4.existsSync(UPLOADS_DIR)) return;
-          const files = fs4.readdirSync(UPLOADS_DIR);
+          if (!fs5.existsSync(UPLOADS_DIR)) return;
+          const files = fs5.readdirSync(UPLOADS_DIR);
           for (const file of files) {
             try {
-              fs4.unlinkSync(path4.join(UPLOADS_DIR, file));
+              fs5.unlinkSync(path5.join(UPLOADS_DIR, file));
             } catch {
             }
           }
@@ -1495,13 +1709,24 @@ var init_server = __esm({
         }
       }
       getSessionLabel(session) {
-        if (!session) return "unknown";
-        return session.displayName || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+        return session ? sessionLabel(session) : "unknown";
       }
       jsonResponse(res, status, body) {
         res.writeHead(status, { "Content-Type": "application/json" });
         res.end(JSON.stringify(body));
       }
+      authorized(req, allowQueryToken) {
+        return !this.token || isAuthorized(req, this.token, allowQueryToken);
+      }
+      rejectUpgrade(socket, status, text, pathname, req) {
+        logger.warn(`Rejected ${pathname} upgrade (${status}) from ${req.socket.remoteAddress}`);
+        socket.write(`HTTP/1.1 ${status} ${text}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+        socket.destroy();
+      }
       isLocalRequest(req) {
         const addr = req.socket.remoteAddress;
         return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
@@ -1556,48 +1781,41 @@ var init_hub_client = __esm({
     init_logger();
     init_constants();
     HubClient = class {
-      constructor(sessionId2, sessionName2, hubHost2 = DEFAULT_HUB_HOST, hubPort2 = DEFAULT_HUB_PORT, token, getPeerName = () => void 0) {
+      constructor(sessionId2, sessionName2, hubHost2 = DEFAULT_HUB_HOST, hubPort2 = DEFAULT_HUB_PORT, token, getPeerName = () => void 0, getRegistration = () => ({})) {
         this.sessionId = sessionId2;
         this.sessionName = sessionName2;
         this.hubHost = hubHost2;
         this.hubPort = hubPort2;
         this.token = token;
         this.getPeerName = getPeerName;
+        this.getRegistration = getRegistration;
       }
       ws = null;
       reconnectTimer = null;
       messageHandlers = [];
       queue = [];
       connected = false;
+      closed = false;
       connect() {
+        this.closed = false;
         const tokenQuery = this.token ? `?token=${encodeURIComponent(this.token)}` : "";
         const url = `ws://${this.hubHost}:${this.hubPort}${WS_PATH_CHANNEL}${tokenQuery}`;
         logger.debug(`Connecting to hub at ${url}`);
         try {
-          this.ws = new WebSocket2(url);
-          this.ws.on("open", () => {
+          const ws = new WebSocket2(url);
+          this.ws = ws;
+          ws.on("open", () => {
+            if (this.ws !== ws) return;
             logger.info("Connected to hub");
             this.connected = true;
-            const registration = {
-              type: "register",
-              session: {
-                id: this.sessionId,
-                name: this.sessionName,
-                status: "idle",
-                connectedAt: Date.now(),
-                lastActivity: Date.now(),
-                cwd: process.cwd(),
-                channelEnabled: true,
-                peerName: this.getPeerName()
-              }
-            };
-            this.ws.send(JSON.stringify(registration));
+            this.ws.send(JSON.stringify(this.registration()));
             for (const msg of this.queue) {
               this.ws.send(JSON.stringify(msg));
             }
             this.queue = [];
           });
-          this.ws.on("message", (data) => {
+          ws.on("message", (data) => {
+            if (this.ws !== ws) return;
             try {
               const msg = JSON.parse(data.toString());
               for (const handler of this.messageHandlers) {
@@ -1607,12 +1825,14 @@ var init_hub_client = __esm({
               logger.warn("Failed to parse hub message:", err);
             }
           });
-          this.ws.on("close", () => {
+          ws.on("close", () => {
+            if (this.ws !== ws) return;
             logger.info("Disconnected from hub");
             this.connected = false;
-            this.scheduleReconnect();
+            if (!this.closed) this.scheduleReconnect();
           });
-          this.ws.on("error", (err) => {
+          ws.on("error", (err) => {
+            if (this.ws !== ws) return;
             logger.debug(`Hub connection error: ${err.message}`);
             this.connected = false;
           });
@@ -1635,6 +1855,7 @@ var init_hub_client = __esm({
         this.messageHandlers.push(handler);
       }
       disconnect() {
+        this.closed = true;
         if (this.reconnectTimer) {
           clearTimeout(this.reconnectTimer);
           this.reconnectTimer = null;
@@ -1645,8 +1866,29 @@ var init_hub_client = __esm({
         }
         this.connected = false;
       }
+      reregister() {
+        if (this.connected && this.ws?.readyState === WebSocket2.OPEN) {
+          this.ws.send(JSON.stringify(this.registration()));
+        }
+      }
+      registration() {
+        return {
+          type: "register",
+          session: {
+            id: this.sessionId,
+            name: this.sessionName,
+            status: "idle",
+            connectedAt: Date.now(),
+            lastActivity: Date.now(),
+            cwd: process.cwd(),
+            channelEnabled: true,
+            peerName: this.getPeerName(),
+            ...this.getRegistration()
+          }
+        };
+      }
       scheduleReconnect() {
-        if (this.reconnectTimer) return;
+        if (this.reconnectTimer || this.closed) return;
         this.reconnectTimer = setTimeout(() => {
           this.reconnectTimer = null;
           this.connect();
@@ -1657,9 +1899,9 @@ var init_hub_client = __esm({
 });
 
 // src/channel/peer-name.ts
-import fs5 from "fs";
+import fs6 from "fs";
 import os2 from "os";
-import path5 from "path";
+import path6 from "path";
 function findPeerName(records, env) {
   const valid = records.filter((r) => typeof r === "object" && r !== null);
   const nameOf = (match) => {
@@ -1679,18 +1921,18 @@ function readPeerName(env = process.env) {
     sessionId: env.CLAUDE_CODE_SESSION_ID
   };
   if (!lookup.messagingSocket && !lookup.sessionId) return void 0;
-  const configDir = env.CLAUDE_CONFIG_DIR || path5.join(os2.homedir(), ".claude");
-  const dir = path5.join(configDir, "sessions");
+  const configDir = env.CLAUDE_CONFIG_DIR || path6.join(os2.homedir(), ".claude");
+  const dir = path6.join(configDir, "sessions");
   let files;
   try {
-    files = fs5.readdirSync(dir).filter((f) => f.endsWith(".json"));
+    files = fs6.readdirSync(dir).filter((f) => f.endsWith(".json"));
   } catch {
     return void 0;
   }
   const records = [];
   for (const f of files) {
     try {
-      records.push(JSON.parse(fs5.readFileSync(path5.join(dir, f), "utf8")));
+      records.push(JSON.parse(fs6.readFileSync(path6.join(dir, f), "utf8")));
     } catch {
     }
   }
@@ -1713,7 +1955,7 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import { randomUUID as randomUUID4 } from "crypto";
-import path6 from "path";
+import path7 from "path";
 async function main() {
   logger.info(`Starting MCP channel server (session: ${sessionId})`);
   hubClient.connect();
@@ -1782,7 +2024,7 @@ var init_server2 = __esm({
     init_hub_client();
     init_peer_name2();
     sessionId = randomUUID4();
-    sessionName = process.env.CLAUDE_ALARM_SESSION_NAME ?? path6.basename(process.cwd());
+    sessionName = process.env.CLAUDE_ALARM_SESSION_NAME ?? path7.basename(process.cwd());
     peerName = readPeerName();
     server = new Server(
       {
@@ -1961,12 +2203,18 @@ init_config();
 init_constants();
 init_logger();
 init_crash_guard();
-import { spawn } from "child_process";
-import fs6 from "fs";
-import path7 from "path";
+import { spawn as spawn2 } from "child_process";
+import fs7 from "fs";
+import path8 from "path";
 import readline from "readline";
 import { fileURLToPath as fileURLToPath2 } from "url";
-var __dirname2 = path7.dirname(fileURLToPath2(import.meta.url));
+var __dirname2 = path8.dirname(fileURLToPath2(import.meta.url));
+function authHeaders(token) {
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+function loginLink(displayHost, port, token) {
+  return `http://${displayHost}:${port}/${token ? `?token=${encodeURIComponent(token)}` : ""}`;
+}
 function printUsage() {
   console.log(`
 claude-alarm - Monitor Claude Code sessions with notifications
@@ -1979,6 +2227,11 @@ Usage:
   claude-alarm setup [dir]      Add claude-alarm to .mcp.json
   claude-alarm test             Send a test notification
   claude-alarm token            Show current auth token
+  claude-alarm codex enable     Start the Codex adapter together with the hub
+  claude-alarm codex disable    Stop starting the Codex adapter with the hub
+  claude-alarm codex start      Run the Codex adapter on its own (e.g. Codex on another PC)
+  claude-alarm codex stop       Stop a running Codex adapter
+  claude-alarm codex status     Show Codex adapter status
   claude-alarm help             Show this help
 
 Quick start:
@@ -1987,8 +2240,8 @@ Quick start:
 }
 async function checkForUpdates() {
   try {
-    const pkgPath = path7.join(__dirname2, "..", "package.json");
-    const pkg = JSON.parse(fs6.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = path8.join(__dirname2, "..", "package.json");
+    const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
     const currentVersion = pkg.version;
     const res = await fetch("https://registry.npmjs.org/@delt/claude-alarm/latest", {
       signal: AbortSignal.timeout(3e3)
@@ -2011,28 +2264,28 @@ async function hubStart(daemon) {
   const port = config2.hub.port ?? DEFAULT_HUB_PORT;
   const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
   checkForUpdates();
-  if (fs6.existsSync(PID_FILE)) {
-    const pid = parseInt(fs6.readFileSync(PID_FILE, "utf-8").trim(), 10);
+  if (fs7.existsSync(PID_FILE)) {
+    const pid = parseInt(fs7.readFileSync(PID_FILE, "utf-8").trim(), 10);
     if (isProcessRunning(pid)) {
-      console.log(`Hub is already running (PID: ${pid}) on http://${displayHost}:${port}`);
+      console.log(`Hub is already running (PID: ${pid}). Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
       return;
     }
-    fs6.unlinkSync(PID_FILE);
+    fs7.unlinkSync(PID_FILE);
   }
   if (daemon) {
     ensureConfigDir();
-    const logFd = fs6.openSync(LOG_FILE, "a");
-    const hubScript = path7.join(__dirname2, "hub", "server.js");
-    const child = spawn(process.execPath, [hubScript], {
+    const logFd = fs7.openSync(LOG_FILE, "a");
+    const hubScript = path8.join(__dirname2, "hub", "server.js");
+    const child = spawn2(process.execPath, [hubScript], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: { ...process.env }
     });
     if (child.pid) {
-      fs6.writeFileSync(PID_FILE, String(child.pid), "utf-8");
+      fs7.writeFileSync(PID_FILE, String(child.pid), "utf-8");
       child.unref();
       console.log(`Hub started as daemon (PID: ${child.pid})`);
-      console.log(`Dashboard: http://${displayHost}:${port}`);
+      console.log(`Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
       console.log(`Token: ${config2.hub.token}`);
       console.log(`Logs: ${LOG_FILE}`);
     } else {
@@ -2041,6 +2294,7 @@ async function hubStart(daemon) {
     }
   } else {
     console.log(`Starting hub on http://${displayHost}:${port} (press Ctrl+C to stop)`);
+    console.log(`Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
     console.log(`Token: ${config2.hub.token}`);
     console.log(`Logs: ${LOG_FILE}`);
     installCrashGuard("hub foreground");
@@ -2049,11 +2303,11 @@ async function hubStart(daemon) {
     const hub = new HubServer2(config2);
     await hub.start();
     ensureConfigDir();
-    fs6.writeFileSync(PID_FILE, String(process.pid), "utf-8");
+    fs7.writeFileSync(PID_FILE, String(process.pid), "utf-8");
     const shutdown = async () => {
       console.log("\nShutting down...");
       await hub.stop();
-      if (fs6.existsSync(PID_FILE)) fs6.unlinkSync(PID_FILE);
+      if (fs7.existsSync(PID_FILE)) fs7.unlinkSync(PID_FILE);
       process.exit(0);
     };
     process.on("SIGINT", shutdown);
@@ -2061,18 +2315,18 @@ async function hubStart(daemon) {
   }
 }
 function hubStop() {
-  if (!fs6.existsSync(PID_FILE)) {
+  if (!fs7.existsSync(PID_FILE)) {
     console.log("Hub is not running (no PID file found)");
     return;
   }
-  const pid = parseInt(fs6.readFileSync(PID_FILE, "utf-8").trim(), 10);
+  const pid = parseInt(fs7.readFileSync(PID_FILE, "utf-8").trim(), 10);
   try {
     process.kill(pid, "SIGTERM");
     console.log(`Hub stopped (PID: ${pid})`);
   } catch {
     console.log("Hub process not found (may have already stopped)");
   }
-  fs6.unlinkSync(PID_FILE);
+  fs7.unlinkSync(PID_FILE);
 }
 async function hubStatus() {
   const config2 = loadConfig();
@@ -2080,8 +2334,8 @@ async function hubStatus() {
   const port = config2.hub.port ?? DEFAULT_HUB_PORT;
   const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
   let pidInfo = "not running";
-  if (fs6.existsSync(PID_FILE)) {
-    const pid = parseInt(fs6.readFileSync(PID_FILE, "utf-8").trim(), 10);
+  if (fs7.existsSync(PID_FILE)) {
+    const pid = parseInt(fs7.readFileSync(PID_FILE, "utf-8").trim(), 10);
     if (isProcessRunning(pid)) {
       pidInfo = `running (PID: ${pid})`;
     } else {
@@ -2089,7 +2343,7 @@ async function hubStatus() {
     }
   }
   try {
-    const res = await fetch(`http://${host}:${port}/api/status`);
+    const res = await fetch(`http://${host}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
     if (res.ok) {
       const data = await res.json();
       console.log(`Hub: running (PID: ${data.pid})`);
@@ -2153,7 +2407,7 @@ function ask(question) {
 }
 async function init() {
   const dir = process.cwd();
-  const projectName = path7.basename(dir);
+  const projectName = path8.basename(dir);
   console.log(`
 claude-alarm init for "${projectName}"
 `);
@@ -2173,11 +2427,11 @@ claude-alarm init for "${projectName}"
     if (port) env.CLAUDE_ALARM_HUB_PORT = port;
     if (token) env.CLAUDE_ALARM_HUB_TOKEN = token;
   }
-  const mcpPath = path7.join(dir, ".mcp.json");
+  const mcpPath = path8.join(dir, ".mcp.json");
   let mcpConfig = {};
-  if (fs6.existsSync(mcpPath)) {
+  if (fs7.existsSync(mcpPath)) {
     try {
-      mcpConfig = JSON.parse(fs6.readFileSync(mcpPath, "utf-8"));
+      mcpConfig = JSON.parse(fs7.readFileSync(mcpPath, "utf-8"));
     } catch {
       mcpConfig = {};
     }
@@ -2188,7 +2442,7 @@ claude-alarm init for "${projectName}"
     args: ["-y", "@delt/claude-alarm", "serve"],
     env
   };
-  fs6.writeFileSync(mcpPath, JSON.stringify(mcpConfig, null, 2), "utf-8");
+  fs7.writeFileSync(mcpPath, JSON.stringify(mcpConfig, null, 2), "utf-8");
   console.log(`
 \u2713 Created ${mcpPath}`);
   if (remote.toLowerCase() !== "y") {
@@ -2198,7 +2452,7 @@ claude-alarm init for "${projectName}"
     const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
     let hubRunning = false;
     try {
-      const res = await fetch(`http://${host}:${port}/api/status`);
+      const res = await fetch(`http://${host}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
       hubRunning = res.ok;
     } catch {
     }
@@ -2233,6 +2487,54 @@ function isProcessRunning(pid) {
     return false;
   }
 }
+function readCodexPid() {
+  if (!fs7.existsSync(CODEX_PID_FILE)) return void 0;
+  const pid = parseInt(fs7.readFileSync(CODEX_PID_FILE, "utf-8").trim(), 10);
+  return Number.isNaN(pid) ? void 0 : pid;
+}
+function codexEnable(enabled) {
+  setCodexEnabled(enabled);
+  console.log(enabled ? "Codex adapter enabled. Restart the hub to apply: claude-alarm hub stop, then claude-alarm hub start" : "Codex adapter disabled. Restart the hub to apply.");
+}
+function codexStart() {
+  const pid = readCodexPid();
+  if (pid !== void 0 && isProcessRunning(pid)) {
+    console.log(`Codex adapter is already running (PID: ${pid})`);
+    return;
+  }
+  ensureConfigDir();
+  const logFd = fs7.openSync(CODEX_LOG_FILE, "a");
+  const child = spawn2(process.execPath, [path8.join(__dirname2, "codex", "main.js")], {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
+    env: { ...process.env }
+  });
+  child.unref();
+  console.log(`Codex adapter started (PID: ${child.pid}). Logs: ${CODEX_LOG_FILE}`);
+}
+function codexStop() {
+  const pid = readCodexPid();
+  if (pid === void 0) {
+    console.log("Codex adapter is not running");
+    return;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+    console.log(`Codex adapter stopped (PID: ${pid})`);
+  } catch {
+    console.log("Codex adapter process not found (may have already stopped)");
+  }
+  try {
+    fs7.unlinkSync(CODEX_PID_FILE);
+  } catch {
+  }
+}
+function codexStatus() {
+  const pid = readCodexPid();
+  const state = pid === void 0 ? "not running" : isProcessRunning(pid) ? `running (PID: ${pid})` : "not running (stale PID file)";
+  console.log(`Codex adapter: ${state}`);
+  console.log(`Start with hub: ${loadConfig().codex?.enabled ? "enabled" : "disabled"}`);
+}
 async function main2() {
   const args = process.argv.slice(2);
   const cmd = args[0];
@@ -2264,6 +2566,19 @@ async function main2() {
     }
     return;
   }
+  if (cmd === "codex") {
+    if (sub === "enable") codexEnable(true);
+    else if (sub === "disable") codexEnable(false);
+    else if (sub === "start") codexStart();
+    else if (sub === "stop") codexStop();
+    else if (sub === "status") codexStatus();
+    else {
+      console.error(`Unknown codex command: ${sub}`);
+      printUsage();
+      process.exit(1);
+    }
+    return;
+  }
   if (cmd === "setup") {
     setup(args[1]);
     return;