@delt/claude-alarm 0.9.0 → 1.0.0

package/dist/hub/server.js

@@ -2,8 +2,8 @@
 
 // src/hub/server.ts
 import http from "http";
-import fs4 from "fs";
-import path4 from "path";
+import fs5 from "fs";
+import path5 from "path";
 import { fileURLToPath } from "url";
 import { WebSocketServer, WebSocket } from "ws";
 
@@ -38,6 +38,8 @@ var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 var PID_FILE = path.join(CONFIG_DIR, "hub.pid");
 var LOG_FILE = path.join(CONFIG_DIR, "hub.log");
 var UPLOADS_DIR = path.join(CONFIG_DIR, "uploads");
+var CODEX_PID_FILE = path.join(CONFIG_DIR, "codex.pid");
+var CODEX_LOG_FILE = path.join(CONFIG_DIR, "codex.log");
 var WS_PATH_CHANNEL = "/ws/channel";
 var WS_PATH_DASHBOARD = "/ws/dashboard";
 
@@ -51,9 +53,9 @@ function isValidPeerName(name) {
 var SessionManager = class {
   sessions = /* @__PURE__ */ new Map();
   register(session) {
-    const baseName = session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+    const baseName = this.baseName(session);
     const existing = Array.from(this.sessions.values()).filter(
-      (s) => s.id !== session.id && (s.cwd?.replace(/^.*[/\\]/, "") || s.name) === baseName
+      (s) => s.id !== session.id && this.baseName(s) === baseName
     );
     if (existing.length > 0) {
       const usedNums = existing.map((s) => {
@@ -107,6 +109,9 @@ var SessionManager = class {
   count() {
     return this.sessions.size;
   }
+  baseName(session) {
+    return session.title || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+  }
 };
 
 // src/hub/notifier.ts
@@ -127,7 +132,7 @@ var Notifier = class {
   async notify(title, message, level = "info") {
     await this.notifyWithSession(void 0, void 0, title, message, level);
   }
-  async notifyWithSession(sessionId, sessionLabel, title, message, level = "info") {
+  async notifyWithSession(sessionId, sessionLabel2, title, message, level = "info") {
     const promises = [];
     if (this.desktopEnabled) {
       promises.push(this.sendDesktop(title, message, level));
@@ -135,8 +140,8 @@ var Notifier = class {
     for (const webhook of this.webhooks) {
       promises.push(this.sendWebhook(webhook, title, message, level));
     }
-    if (this.telegramBot && sessionId && sessionLabel) {
-      promises.push(this.telegramBot.sendNotification(sessionId, sessionLabel, title, message));
+    if (this.telegramBot && sessionId && sessionLabel2) {
+      promises.push(this.telegramBot.sendNotification(sessionId, sessionLabel2, title, message));
     }
     await Promise.allSettled(promises);
   }
@@ -222,6 +227,14 @@ var Notifier = class {
 import fs from "fs";
 import path2 from "path";
 import { randomUUID } from "crypto";
+
+// src/shared/session-label.ts
+function sessionLabel(session) {
+  const base = session.displayName || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+  return session.agentKind === "codex" ? `Codex \xB7 ${base}` : base;
+}
+
+// src/hub/telegram.ts
 var TELEGRAM_API = "https://api.telegram.org/bot";
 var TelegramBot = class _TelegramBot {
   config;
@@ -360,15 +373,14 @@ ${this.mdToHtml(message)}`;
         const pending = this.pendingMessages.get(msg.chat.id);
         if (pending) {
           this.pendingMessages.delete(msg.chat.id);
-          const sessions2 = this.getSessions?.() ?? [];
-          const idx = parseInt(selectMatch[1], 10) - 1;
-          if (idx >= 0 && idx < sessions2.length) {
+          const session = this.pendingSession(pending, parseInt(selectMatch[1], 10) - 1);
+          if (session) {
             if (pending.photoFileId) {
-              await this.deliverPhotoToSessionByFileId(sessions2[idx].id, pending.photoFileId, pending.caption);
+              await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
             } else if (pending.text) {
-              this.deliverToSession(sessions2[idx].id, pending.text);
+              this.deliverToSession(session.id, pending.text);
             }
-            this.sendMessage(`Sent to [${this.getLabel(sessions2[idx])}]`);
+            this.sendMessage(`Sent to [${this.getLabel(session)}]`);
           } else {
             this.sendMessage("Invalid session number.");
           }
@@ -389,11 +401,12 @@ ${this.mdToHtml(message)}`;
       }
       return;
     }
+    const sessionIds = sessions.map((s) => s.id);
     if (hasPhoto) {
       const largest = msg.photo[msg.photo.length - 1];
-      this.pendingMessages.set(msg.chat.id, { photoFileId: largest.file_id, caption: text });
+      this.pendingMessages.set(msg.chat.id, { photoFileId: largest.file_id, caption: text, sessionIds });
     } else {
-      this.pendingMessages.set(msg.chat.id, { text });
+      this.pendingMessages.set(msg.chat.id, { text, sessionIds });
     }
     const buttons = sessions.map((s, i) => ({
       text: this.getLabel(s),
@@ -450,11 +463,16 @@ ${this.mdToHtml(message)}`;
       logger.warn(`Telegram photo download failed: ${err.message}`);
     }
   }
+  // Buttons are numbered against the list shown when they were sent; Codex sessions come and go, so the live list may have shifted.
+  pendingSession(pending, idx) {
+    const id = pending.sessionIds[idx];
+    return id ? this.getSessions?.().find((s) => s.id === id) : void 0;
+  }
   getLabel(session) {
-    return session.displayName || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+    return sessionLabel(session);
   }
   /** Send a permission request with inline buttons */
-  async sendPermissionRequest(sessionId, sessionLabel, requestId, toolName, description, inputPreview) {
+  async sendPermissionRequest(sessionId, sessionLabel2, requestId, toolName, description, inputPreview) {
     const isNotify = toolName.endsWith("__notify") || toolName === "notify";
     let preview = inputPreview;
     let kind = "code";
@@ -507,7 +525,7 @@ ${this.mdToHtml(message)}`;
       const mcpMatch = toolName.match(/__([^_]+)$/);
       if (mcpMatch) displayTool = mcpMatch[1].charAt(0).toUpperCase() + mcpMatch[1].slice(1);
     }
-    const text = `\u26A0\uFE0F <b>Permission Request</b> \u2014 ${this.escHtml(sessionLabel)}
+    const text = `\u26A0\uFE0F <b>Permission Request</b> \u2014 ${this.escHtml(sessionLabel2)}
 
 \u{1F527} <b>${this.escHtml(displayTool)}</b>
 ${previewHtml}${truncNote}`;
@@ -521,6 +539,7 @@ ${previewHtml}${truncNote}`;
   }
   async handleCallbackQuery(query) {
     if (!query.data) return;
+    if (String(query.message?.chat.id) !== String(this.config.chatId)) return;
     if (query.data.startsWith("sess:")) {
       await this.handleSessionSelectCallback(query);
       return;
@@ -546,22 +565,18 @@ ${label}`);
     const parts = query.data.split(":");
     if (parts.length < 3) return;
     const [, idxStr, chatIdStr] = parts;
-    const idx = parseInt(idxStr, 10);
     const chatId = parseInt(chatIdStr, 10);
-    const sessions = this.getSessions?.() ?? [];
-    if (idx < 0 || idx >= sessions.length) {
+    const pending = this.pendingMessages.get(chatId);
+    const session = pending ? this.pendingSession(pending, parseInt(idxStr, 10)) : void 0;
+    if (!pending || !session) {
       await this.answerCallbackQuery(query.id, "Session not found");
       return;
     }
-    const session = sessions[idx];
-    const pending = this.pendingMessages.get(chatId);
     this.pendingMessages.delete(chatId);
-    if (pending) {
-      if (pending.photoFileId) {
-        await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
-      } else if (pending.text) {
-        this.deliverToSession(session.id, pending.text);
-      }
+    if (pending.photoFileId) {
+      await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
+    } else if (pending.text) {
+      this.deliverToSession(session.id, pending.text);
     }
     await this.answerCallbackQuery(query.id, `Sent to ${this.getLabel(session)}`);
     if (query.message) {
@@ -623,8 +638,8 @@ ${label}`);
     css: "css",
     scss: "scss"
   };
-  langOf(path5) {
-    const m = /\.([a-z0-9]+)$/i.exec(path5 || "");
+  langOf(path6) {
+    const m = /\.([a-z0-9]+)$/i.exec(path6 || "");
     return m ? _TelegramBot.LANG_BY_EXT[m[1].toLowerCase()] ?? "" : "";
   }
   /** Convert markdown to Telegram HTML (escape first, then apply formatting) */
@@ -667,9 +682,73 @@ ${bodyLines.join("\n")}`;
   }
 };
 
-// src/shared/config.ts
+// src/hub/codex-supervisor.ts
+import { spawn } from "child_process";
 import fs2 from "fs";
 import path3 from "path";
+var HEALTHY_RUN_MS = 6e4;
+function resolveAdapterScript(baseDir) {
+  return [path3.join(baseDir, "..", "codex", "main.js"), path3.join(baseDir, "codex", "main.js")].find((p) => fs2.existsSync(p));
+}
+var CodexSupervisor = class {
+  constructor(script, spawnFn = spawn, minDelayMs = 2e3, maxDelayMs = 6e4, stopGraceMs = 3e3) {
+    this.script = script;
+    this.spawnFn = spawnFn;
+    this.minDelayMs = minDelayMs;
+    this.maxDelayMs = maxDelayMs;
+    this.stopGraceMs = stopGraceMs;
+    this.delay = minDelayMs;
+  }
+  child;
+  timer;
+  stopped = true;
+  delay;
+  start() {
+    this.stopped = false;
+    this.launch();
+  }
+  stop() {
+    this.stopped = true;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = void 0;
+    const child = this.child;
+    this.child = void 0;
+    if (!child) return;
+    child.stdin?.end();
+    const force = setTimeout(() => child.kill(), this.stopGraceMs);
+    force.unref();
+    child.once("exit", () => clearTimeout(force));
+  }
+  launch() {
+    const startedAt = Date.now();
+    const child = this.spawnFn(process.execPath, [this.script, "--watch-stdin"], {
+      detached: true,
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true
+    });
+    this.child = child;
+    child.stdout?.on("data", (d) => process.stdout.write(d));
+    child.stderr?.on("data", (d) => process.stderr.write(d));
+    child.stdin?.on("error", () => {
+    });
+    child.on("error", (err) => logger.warn(`Codex adapter failed to start: ${err.message}`));
+    child.on("exit", (code, signal) => {
+      if (this.child === child) this.child = void 0;
+      if (this.stopped || code === 0) return;
+      if (Date.now() - startedAt > HEALTHY_RUN_MS) this.delay = this.minDelayMs;
+      logger.warn(`Codex adapter exited (${signal ?? code}); restarting in ${this.delay}ms`);
+      this.timer = setTimeout(() => {
+        this.timer = void 0;
+        if (!this.stopped) this.launch();
+      }, this.delay);
+      this.delay = Math.min(this.delay * 2, this.maxDelayMs);
+    });
+  }
+};
+
+// src/shared/config.ts
+import fs3 from "fs";
+import path4 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 var DEFAULT_CONFIG = {
   hub: {
@@ -683,18 +762,18 @@ var DEFAULT_CONFIG = {
   webhooks: []
 };
 function ensureConfigDir() {
-  if (!fs2.existsSync(CONFIG_DIR)) {
-    fs2.mkdirSync(CONFIG_DIR, { recursive: true });
+  if (!fs3.existsSync(CONFIG_DIR)) {
+    fs3.mkdirSync(CONFIG_DIR, { recursive: true });
   }
 }
 function loadConfig() {
   ensureConfigDir();
   let config;
-  if (!fs2.existsSync(CONFIG_FILE)) {
+  if (!fs3.existsSync(CONFIG_FILE)) {
     config = { ...DEFAULT_CONFIG, hub: { ...DEFAULT_CONFIG.hub } };
   } else {
     try {
-      const raw = fs2.readFileSync(CONFIG_FILE, "utf-8");
+      const raw = fs3.readFileSync(CONFIG_FILE, "utf-8");
       const parsed = JSON.parse(raw);
       config = { ...DEFAULT_CONFIG, ...parsed, hub: { ...DEFAULT_CONFIG.hub, ...parsed.hub }, ...parsed.telegram ? { telegram: parsed.telegram } : {} };
     } catch {
@@ -709,17 +788,17 @@ function loadConfig() {
 }
 function saveConfig(config) {
   ensureConfigDir();
-  fs2.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
+  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
 }
 
 // src/shared/crash-guard.ts
-import fs3 from "fs";
+import fs4 from "fs";
 var BURST_WINDOW_MS = 6e4;
 var BURST_LIMIT = 10;
 function appendToLog(text) {
   try {
-    fs3.mkdirSync(CONFIG_DIR, { recursive: true });
-    fs3.appendFileSync(LOG_FILE, text, "utf-8");
+    fs4.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs4.appendFileSync(LOG_FILE, text, "utf-8");
   } catch {
   }
 }
@@ -760,8 +839,66 @@ function logStartup(context) {
 `);
 }
 
+// src/hub/auth.ts
+import crypto from "crypto";
+var SESSION_COOKIE = "ca_session";
+var COOKIE_MAX_AGE = 30 * 24 * 60 * 60;
+function safeEqual(a, b) {
+  if (typeof a !== "string") return false;
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+function dashboardCookieValue(token) {
+  return crypto.createHmac("sha256", token).update("claude-alarm-dashboard").digest("hex");
+}
+function parseCookies(header) {
+  const out = {};
+  for (const part of (header ?? "").split(";")) {
+    const i = part.indexOf("=");
+    if (i <= 0) continue;
+    const raw = part.slice(i + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out[part.slice(0, i).trim()] = value;
+  }
+  return out;
+}
+function sessionCookieHeader(token, secure) {
+  return `${SESSION_COOKIE}=${dashboardCookieValue(token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${COOKIE_MAX_AGE}${secure ? "; Secure" : ""}`;
+}
+function isAuthorized(req, token, allowQueryToken) {
+  const auth = req.headers.authorization;
+  if (auth?.startsWith("Bearer ") && safeEqual(auth.slice(7), token)) return true;
+  if (safeEqual(parseCookies(req.headers.cookie)[SESSION_COOKIE], dashboardCookieValue(token))) return true;
+  if (allowQueryToken) {
+    const q = new URL(req.url ?? "/", "http://hub").searchParams.get("token");
+    if (safeEqual(q, token)) return true;
+  }
+  return false;
+}
+function isCrossOrigin(req) {
+  const origin = req.headers.origin;
+  if (!origin) return false;
+  try {
+    return new URL(origin).host !== req.headers.host;
+  } catch {
+    return true;
+  }
+}
+function isJsonRequest(req) {
+  return String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json");
+}
+function isSecureRequest(req) {
+  return req.headers["x-forwarded-proto"] === "https";
+}
+
 // src/hub/server.ts
-var __dirname = path4.dirname(fileURLToPath(import.meta.url));
+var __dirname = path5.dirname(fileURLToPath(import.meta.url));
+var MAX_WS_PAYLOAD = 16 * 1024 * 1024;
 var HubServer = class {
   httpServer;
   wssChannel;
@@ -779,13 +916,17 @@ var HubServer = class {
   heartbeatInterval;
   channelAlive = /* @__PURE__ */ new Map();
   // sessionId -> alive flag
+  socketOwners = /* @__PURE__ */ new WeakMap();
   host;
   port;
   token;
+  codexEnabled;
+  codexSupervisor;
   constructor(config) {
     this.host = config?.hub?.host ?? DEFAULT_HUB_HOST;
     this.port = config?.hub?.port ?? DEFAULT_HUB_PORT;
     this.token = config?.hub?.token;
+    this.codexEnabled = config?.codex?.enabled === true;
     if (config?.notifications) {
       this.notifier.configure({
         desktop: config.notifications.desktop
@@ -801,22 +942,23 @@ var HubServer = class {
       this.initTelegram(fullConfig.telegram);
     }
     this.httpServer = http.createServer((req, res) => this.handleHttp(req, res));
-    this.wssChannel = new WebSocketServer({ noServer: true });
+    this.wssChannel = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
     this.wssChannel.on("connection", (ws, req) => this.handleChannelConnection(ws, req));
     this.wssChannel.on("error", (err) => logger.warn(`Channel WebSocket server error: ${err.message}`));
-    this.wssDashboard = new WebSocketServer({ noServer: true });
+    this.wssDashboard = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
     this.wssDashboard.on("connection", (ws) => this.handleDashboardConnection(ws));
     this.wssDashboard.on("error", (err) => logger.warn(`Dashboard WebSocket server error: ${err.message}`));
     this.httpServer.on("upgrade", (req, socket, head) => {
       socket.on("error", (err) => logger.debug(`Upgrade socket error: ${err.message}`));
-      const url = new URL(req.url, `http://${req.headers.host}`);
+      const url = new URL(req.url ?? "/", "http://hub");
       const pathname = url.pathname;
-      if (this.token && !this.isLocalRequest(req)) {
-        const wsToken = url.searchParams.get("token");
-        if (wsToken !== this.token) {
-          socket.destroy();
-          return;
-        }
+      if (isCrossOrigin(req)) {
+        this.rejectUpgrade(socket, 403, "Forbidden", pathname, req);
+        return;
+      }
+      if (!this.authorized(req, true)) {
+        this.rejectUpgrade(socket, 401, "Unauthorized", pathname, req);
+        return;
       }
       if (pathname === WS_PATH_CHANNEL) {
         this.wssChannel.handleUpgrade(req, socket, head, (ws) => {
@@ -842,12 +984,15 @@ var HubServer = class {
         this.httpServer.on("error", (err) => logger.error(`HTTP server error: ${err.message}`));
         const displayHost = this.host === "0.0.0.0" ? "127.0.0.1" : this.host;
         logger.info(`Hub server listening on http://${displayHost}:${this.port}`);
+        this.startCodexAdapter();
         resolve();
       });
     });
   }
   stop() {
     return new Promise((resolve) => {
+      this.codexSupervisor?.stop();
+      this.codexSupervisor = void 0;
       if (this.heartbeatInterval) clearInterval(this.heartbeatInterval);
       if (this.telegramBot) this.telegramBot.stopPolling();
       for (const ws of this.channelSockets.values()) ws.terminate();
@@ -868,31 +1013,28 @@ var HubServer = class {
   }
   // --- HTTP Handler ---
   handleHttp(req, res) {
-    const url = new URL(req.url, `http://${req.headers.host}`);
-    const origin = req.headers.origin;
-    if (origin && (origin.includes("127.0.0.1") || origin.includes("localhost"))) {
-      res.setHeader("Access-Control-Allow-Origin", origin);
-    }
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-    if (req.method === "OPTIONS") {
-      res.writeHead(204);
-      res.end();
+    const url = new URL(req.url ?? "/", "http://hub");
+    if (isCrossOrigin(req)) {
+      this.jsonResponse(res, 403, { error: "Cross-origin request rejected" });
       return;
     }
-    if (url.pathname !== "/" && this.token) {
-      if (!this.isLocalRequest(req)) {
-        const authHeader = req.headers["authorization"];
-        const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-        if (bearerToken !== this.token) {
-          this.jsonResponse(res, 401, { error: "Unauthorized" });
-          return;
-        }
-      }
+    if (req.method === "POST" && !isJsonRequest(req)) {
+      this.jsonResponse(res, 415, { error: "Content-Type must be application/json" });
+      return;
     }
     if (url.pathname === "/" && req.method === "GET") {
-      this.serveDashboard(res);
-    } else if (url.pathname === "/api/sessions" && req.method === "GET") {
+      this.serveDashboard(req, res, url);
+      return;
+    }
+    if (url.pathname === "/api/login" && req.method === "POST") {
+      this.handleLogin(req, res);
+      return;
+    }
+    if (!this.authorized(req, false)) {
+      this.jsonResponse(res, 401, { error: "Unauthorized" });
+      return;
+    }
+    if (url.pathname === "/api/sessions" && req.method === "GET") {
       this.jsonResponse(res, 200, { sessions: this.sessions.getAll() });
     } else if (url.pathname === "/api/status" && req.method === "GET") {
       this.jsonResponse(res, 200, {
@@ -943,25 +1085,31 @@ var HubServer = class {
       this.jsonResponse(res, 404, { error: "Not found" });
     }
   }
-  serveDashboard(res) {
+  serveDashboard(req, res, url) {
+    const linkToken = url.searchParams.get("token");
+    if (linkToken !== null && this.token && safeEqual(linkToken, this.token)) {
+      res.writeHead(302, { Location: "/", "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+      res.end();
+      return;
+    }
     const candidates = [
-      path4.join(__dirname, "..", "dashboard", "index.html"),
+      path5.join(__dirname, "..", "dashboard", "index.html"),
       // from dist/hub/
-      path4.join(__dirname, "dashboard", "index.html"),
+      path5.join(__dirname, "dashboard", "index.html"),
       // from dist/ (bundled index.js)
-      path4.join(__dirname, "..", "..", "src", "dashboard", "index.html"),
+      path5.join(__dirname, "..", "..", "src", "dashboard", "index.html"),
       // from dist/hub/ -> src/
-      path4.join(__dirname, "..", "src", "dashboard", "index.html"),
+      path5.join(__dirname, "..", "src", "dashboard", "index.html"),
       // from dist/ -> src/
-      path4.join(process.cwd(), "dist", "dashboard", "index.html"),
+      path5.join(process.cwd(), "dist", "dashboard", "index.html"),
       // from cwd
-      path4.join(process.cwd(), "src", "dashboard", "index.html")
+      path5.join(process.cwd(), "src", "dashboard", "index.html")
       // from cwd/src
     ];
     logger.debug(`Dashboard candidates: ${JSON.stringify(candidates)}`);
     for (const candidate of candidates) {
-      if (fs4.existsSync(candidate)) {
-        const html = fs4.readFileSync(candidate, "utf-8");
+      if (fs5.existsSync(candidate)) {
+        const html = fs5.readFileSync(candidate, "utf-8");
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end(html);
         return;
@@ -970,6 +1118,20 @@ var HubServer = class {
     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
     res.end("<html><body><h1>claude-alarm</h1><p>Dashboard HTML not found. Reinstall the package.</p></body></html>");
   }
+  async handleLogin(req, res) {
+    const body = await this.readBody(req);
+    if (!this.token) {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    if (typeof body?.token !== "string" || !safeEqual(body.token, this.token)) {
+      this.jsonResponse(res, 401, { error: "Unauthorized" });
+      return;
+    }
+    res.writeHead(204, { "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+    res.end();
+  }
   async handleApiSend(req, res) {
     const body = await this.readBody(req);
     if (!body) {
@@ -986,7 +1148,7 @@ var HubServer = class {
       this.jsonResponse(res, 404, { error: "Session not connected" });
       return;
     }
-    const msg = { type: "message_to_session", sessionId, content };
+    const msg = { type: "message_to_session", sessionId, content, source: "api" };
     ws.send(JSON.stringify(msg));
     this.jsonResponse(res, 200, { ok: true });
   }
@@ -1046,6 +1208,22 @@ var HubServer = class {
     });
   }
   handleChannelMessage(ws, isLocal, msg) {
+    if (msg.type === "register") {
+      const id = msg.session.id;
+      const owned = this.socketOwners.get(ws);
+      if (owned && owned !== id) {
+        logger.warn(`Rejected register for ${id}: connection already owns ${owned}`);
+        return;
+      }
+      const holder = this.channelSockets.get(id);
+      if (holder && holder !== ws) {
+        this.socketOwners.delete(holder);
+        holder.terminate();
+      }
+      this.socketOwners.set(ws, id);
+    } else if ("sessionId" in msg && this.socketOwners.get(ws) !== msg.sessionId) {
+      return;
+    }
     switch (msg.type) {
       case "register": {
         const session = msg.session;
@@ -1069,7 +1247,6 @@ var HubServer = class {
         break;
       }
       case "peer_name": {
-        if (this.channelSockets.get(msg.sessionId) !== ws) break;
         const updated = this.sessions.setPeerName(msg.sessionId, msg.peerName);
         if (updated) {
           logger.info(`Peer name for ${msg.sessionId}: ${msg.peerName ?? "-"}`);
@@ -1145,7 +1322,7 @@ var HubServer = class {
         if (msg.type === "message_to_session") {
           const channelWs = this.channelSockets.get(msg.sessionId);
           if (channelWs?.readyState === WebSocket.OPEN) {
-            channelWs.send(JSON.stringify(msg));
+            channelWs.send(JSON.stringify({ ...msg, source: "dashboard" }));
           }
         } else if (msg.type === "image_upload") {
           this.handleImageUpload(msg);
@@ -1190,11 +1367,11 @@ var HubServer = class {
       logger.warn("Image upload rejected: exceeds 10MB");
       return;
     }
-    fs4.mkdirSync(UPLOADS_DIR, { recursive: true });
+    fs5.mkdirSync(UPLOADS_DIR, { recursive: true });
     const ext = mimeType.split("/")[1] === "jpeg" ? "jpg" : mimeType.split("/")[1];
     const filename = `${randomUUID3()}.${ext}`;
-    const filePath = path4.join(UPLOADS_DIR, filename);
-    fs4.writeFileSync(filePath, buffer);
+    const filePath = path5.join(UPLOADS_DIR, filename);
+    fs5.writeFileSync(filePath, buffer);
     const forwardMsg = {
       type: "image_to_session",
       sessionId,
@@ -1207,7 +1384,7 @@ var HubServer = class {
     logger.info(`Image saved and forwarded: ${filename} (${buffer.length} bytes)`);
     setTimeout(() => {
       try {
-        fs4.unlinkSync(filePath);
+        fs5.unlinkSync(filePath);
       } catch {
       }
     }, 5 * 60 * 1e3);
@@ -1235,7 +1412,7 @@ var HubServer = class {
     this.telegramBot.onMessageToSession = (sessionId, content) => {
       const channelWs = this.channelSockets.get(sessionId);
       if (channelWs?.readyState === WebSocket.OPEN) {
-        const msg = { type: "message_to_session", sessionId, content };
+        const msg = { type: "message_to_session", sessionId, content, source: "telegram" };
         channelWs.send(JSON.stringify(msg));
         logger.info(`Telegram message forwarded to session: ${sessionId}`);
       }
@@ -1362,6 +1539,17 @@ var HubServer = class {
       this.jsonResponse(res, 500, { error: err.message });
     }
   }
+  startCodexAdapter() {
+    if (!this.codexEnabled) return;
+    const script = resolveAdapterScript(__dirname);
+    if (!script) {
+      logger.warn("Codex adapter is enabled but codex/main.js was not found next to the hub");
+      return;
+    }
+    this.codexSupervisor = new CodexSupervisor(script);
+    this.codexSupervisor.start();
+    logger.info("Codex adapter started");
+  }
   startHeartbeat() {
     this.heartbeatInterval = setInterval(() => {
       for (const [sessionId, ws] of this.channelSockets) {
@@ -1377,11 +1565,11 @@ var HubServer = class {
   }
   cleanupUploads() {
     try {
-      if (!fs4.existsSync(UPLOADS_DIR)) return;
-      const files = fs4.readdirSync(UPLOADS_DIR);
+      if (!fs5.existsSync(UPLOADS_DIR)) return;
+      const files = fs5.readdirSync(UPLOADS_DIR);
       for (const file of files) {
         try {
-          fs4.unlinkSync(path4.join(UPLOADS_DIR, file));
+          fs5.unlinkSync(path5.join(UPLOADS_DIR, file));
         } catch {
         }
       }
@@ -1390,13 +1578,24 @@ var HubServer = class {
     }
   }
   getSessionLabel(session) {
-    if (!session) return "unknown";
-    return session.displayName || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+    return session ? sessionLabel(session) : "unknown";
   }
   jsonResponse(res, status, body) {
     res.writeHead(status, { "Content-Type": "application/json" });
     res.end(JSON.stringify(body));
   }
+  authorized(req, allowQueryToken) {
+    return !this.token || isAuthorized(req, this.token, allowQueryToken);
+  }
+  rejectUpgrade(socket, status, text, pathname, req) {
+    logger.warn(`Rejected ${pathname} upgrade (${status}) from ${req.socket.remoteAddress}`);
+    socket.write(`HTTP/1.1 ${status} ${text}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+    socket.destroy();
+  }
   isLocalRequest(req) {
     const addr = req.socket.remoteAddress;
     return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";