@delt/claude-alarm 0.9.0 → 1.0.0

package/dist/index.js

@@ -1,7 +1,7 @@
 // src/hub/server.ts
 import http from "http";
-import fs4 from "fs";
-import path4 from "path";
+import fs5 from "fs";
+import path5 from "path";
 import { fileURLToPath } from "url";
 import { WebSocketServer, WebSocket } from "ws";
 
@@ -36,6 +36,8 @@ var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 var PID_FILE = path.join(CONFIG_DIR, "hub.pid");
 var LOG_FILE = path.join(CONFIG_DIR, "hub.log");
 var UPLOADS_DIR = path.join(CONFIG_DIR, "uploads");
+var CODEX_PID_FILE = path.join(CONFIG_DIR, "codex.pid");
+var CODEX_LOG_FILE = path.join(CONFIG_DIR, "codex.log");
 var WS_PATH_CHANNEL = "/ws/channel";
 var WS_PATH_DASHBOARD = "/ws/dashboard";
 var CHANNEL_SERVER_NAME = "claude-alarm";
@@ -51,9 +53,9 @@ function isValidPeerName(name) {
 var SessionManager = class {
   sessions = /* @__PURE__ */ new Map();
   register(session) {
-    const baseName = session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+    const baseName = this.baseName(session);
     const existing = Array.from(this.sessions.values()).filter(
-      (s) => s.id !== session.id && (s.cwd?.replace(/^.*[/\\]/, "") || s.name) === baseName
+      (s) => s.id !== session.id && this.baseName(s) === baseName
     );
     if (existing.length > 0) {
       const usedNums = existing.map((s) => {
@@ -107,6 +109,9 @@ var SessionManager = class {
   count() {
     return this.sessions.size;
   }
+  baseName(session) {
+    return session.title || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+  }
 };
 
 // src/hub/notifier.ts
@@ -127,7 +132,7 @@ var Notifier = class {
   async notify(title, message, level = "info") {
     await this.notifyWithSession(void 0, void 0, title, message, level);
   }
-  async notifyWithSession(sessionId, sessionLabel, title, message, level = "info") {
+  async notifyWithSession(sessionId, sessionLabel2, title, message, level = "info") {
     const promises = [];
     if (this.desktopEnabled) {
       promises.push(this.sendDesktop(title, message, level));
@@ -135,8 +140,8 @@ var Notifier = class {
     for (const webhook of this.webhooks) {
       promises.push(this.sendWebhook(webhook, title, message, level));
     }
-    if (this.telegramBot && sessionId && sessionLabel) {
-      promises.push(this.telegramBot.sendNotification(sessionId, sessionLabel, title, message));
+    if (this.telegramBot && sessionId && sessionLabel2) {
+      promises.push(this.telegramBot.sendNotification(sessionId, sessionLabel2, title, message));
     }
     await Promise.allSettled(promises);
   }
@@ -222,6 +227,14 @@ var Notifier = class {
 import fs from "fs";
 import path2 from "path";
 import { randomUUID } from "crypto";
+
+// src/shared/session-label.ts
+function sessionLabel(session) {
+  const base = session.displayName || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+  return session.agentKind === "codex" ? `Codex \xB7 ${base}` : base;
+}
+
+// src/hub/telegram.ts
 var TELEGRAM_API = "https://api.telegram.org/bot";
 var TelegramBot = class _TelegramBot {
   config;
@@ -360,15 +373,14 @@ ${this.mdToHtml(message)}`;
         const pending = this.pendingMessages.get(msg.chat.id);
         if (pending) {
           this.pendingMessages.delete(msg.chat.id);
-          const sessions2 = this.getSessions?.() ?? [];
-          const idx = parseInt(selectMatch[1], 10) - 1;
-          if (idx >= 0 && idx < sessions2.length) {
+          const session = this.pendingSession(pending, parseInt(selectMatch[1], 10) - 1);
+          if (session) {
             if (pending.photoFileId) {
-              await this.deliverPhotoToSessionByFileId(sessions2[idx].id, pending.photoFileId, pending.caption);
+              await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
             } else if (pending.text) {
-              this.deliverToSession(sessions2[idx].id, pending.text);
+              this.deliverToSession(session.id, pending.text);
             }
-            this.sendMessage(`Sent to [${this.getLabel(sessions2[idx])}]`);
+            this.sendMessage(`Sent to [${this.getLabel(session)}]`);
           } else {
             this.sendMessage("Invalid session number.");
           }
@@ -389,11 +401,12 @@ ${this.mdToHtml(message)}`;
       }
       return;
     }
+    const sessionIds = sessions.map((s) => s.id);
     if (hasPhoto) {
       const largest = msg.photo[msg.photo.length - 1];
-      this.pendingMessages.set(msg.chat.id, { photoFileId: largest.file_id, caption: text });
+      this.pendingMessages.set(msg.chat.id, { photoFileId: largest.file_id, caption: text, sessionIds });
     } else {
-      this.pendingMessages.set(msg.chat.id, { text });
+      this.pendingMessages.set(msg.chat.id, { text, sessionIds });
     }
     const buttons = sessions.map((s, i) => ({
       text: this.getLabel(s),
@@ -450,11 +463,16 @@ ${this.mdToHtml(message)}`;
       logger.warn(`Telegram photo download failed: ${err.message}`);
     }
   }
+  // Buttons are numbered against the list shown when they were sent; Codex sessions come and go, so the live list may have shifted.
+  pendingSession(pending, idx) {
+    const id = pending.sessionIds[idx];
+    return id ? this.getSessions?.().find((s) => s.id === id) : void 0;
+  }
   getLabel(session) {
-    return session.displayName || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+    return sessionLabel(session);
   }
   /** Send a permission request with inline buttons */
-  async sendPermissionRequest(sessionId, sessionLabel, requestId, toolName, description, inputPreview) {
+  async sendPermissionRequest(sessionId, sessionLabel2, requestId, toolName, description, inputPreview) {
     const isNotify = toolName.endsWith("__notify") || toolName === "notify";
     let preview = inputPreview;
     let kind = "code";
@@ -507,7 +525,7 @@ ${this.mdToHtml(message)}`;
       const mcpMatch = toolName.match(/__([^_]+)$/);
       if (mcpMatch) displayTool = mcpMatch[1].charAt(0).toUpperCase() + mcpMatch[1].slice(1);
     }
-    const text = `\u26A0\uFE0F <b>Permission Request</b> \u2014 ${this.escHtml(sessionLabel)}
+    const text = `\u26A0\uFE0F <b>Permission Request</b> \u2014 ${this.escHtml(sessionLabel2)}
 
 \u{1F527} <b>${this.escHtml(displayTool)}</b>
 ${previewHtml}${truncNote}`;
@@ -521,6 +539,7 @@ ${previewHtml}${truncNote}`;
   }
   async handleCallbackQuery(query) {
     if (!query.data) return;
+    if (String(query.message?.chat.id) !== String(this.config.chatId)) return;
     if (query.data.startsWith("sess:")) {
       await this.handleSessionSelectCallback(query);
       return;
@@ -546,22 +565,18 @@ ${label}`);
     const parts = query.data.split(":");
     if (parts.length < 3) return;
     const [, idxStr, chatIdStr] = parts;
-    const idx = parseInt(idxStr, 10);
     const chatId = parseInt(chatIdStr, 10);
-    const sessions = this.getSessions?.() ?? [];
-    if (idx < 0 || idx >= sessions.length) {
+    const pending = this.pendingMessages.get(chatId);
+    const session = pending ? this.pendingSession(pending, parseInt(idxStr, 10)) : void 0;
+    if (!pending || !session) {
       await this.answerCallbackQuery(query.id, "Session not found");
       return;
     }
-    const session = sessions[idx];
-    const pending = this.pendingMessages.get(chatId);
     this.pendingMessages.delete(chatId);
-    if (pending) {
-      if (pending.photoFileId) {
-        await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
-      } else if (pending.text) {
-        this.deliverToSession(session.id, pending.text);
-      }
+    if (pending.photoFileId) {
+      await this.deliverPhotoToSessionByFileId(session.id, pending.photoFileId, pending.caption);
+    } else if (pending.text) {
+      this.deliverToSession(session.id, pending.text);
     }
     await this.answerCallbackQuery(query.id, `Sent to ${this.getLabel(session)}`);
     if (query.message) {
@@ -623,8 +638,8 @@ ${label}`);
     css: "css",
     scss: "scss"
   };
-  langOf(path5) {
-    const m = /\.([a-z0-9]+)$/i.exec(path5 || "");
+  langOf(path6) {
+    const m = /\.([a-z0-9]+)$/i.exec(path6 || "");
     return m ? _TelegramBot.LANG_BY_EXT[m[1].toLowerCase()] ?? "" : "";
   }
   /** Convert markdown to Telegram HTML (escape first, then apply formatting) */
@@ -667,9 +682,73 @@ ${bodyLines.join("\n")}`;
   }
 };
 
-// src/shared/config.ts
+// src/hub/codex-supervisor.ts
+import { spawn } from "child_process";
 import fs2 from "fs";
 import path3 from "path";
+var HEALTHY_RUN_MS = 6e4;
+function resolveAdapterScript(baseDir) {
+  return [path3.join(baseDir, "..", "codex", "main.js"), path3.join(baseDir, "codex", "main.js")].find((p) => fs2.existsSync(p));
+}
+var CodexSupervisor = class {
+  constructor(script, spawnFn = spawn, minDelayMs = 2e3, maxDelayMs = 6e4, stopGraceMs = 3e3) {
+    this.script = script;
+    this.spawnFn = spawnFn;
+    this.minDelayMs = minDelayMs;
+    this.maxDelayMs = maxDelayMs;
+    this.stopGraceMs = stopGraceMs;
+    this.delay = minDelayMs;
+  }
+  child;
+  timer;
+  stopped = true;
+  delay;
+  start() {
+    this.stopped = false;
+    this.launch();
+  }
+  stop() {
+    this.stopped = true;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = void 0;
+    const child = this.child;
+    this.child = void 0;
+    if (!child) return;
+    child.stdin?.end();
+    const force = setTimeout(() => child.kill(), this.stopGraceMs);
+    force.unref();
+    child.once("exit", () => clearTimeout(force));
+  }
+  launch() {
+    const startedAt = Date.now();
+    const child = this.spawnFn(process.execPath, [this.script, "--watch-stdin"], {
+      detached: true,
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true
+    });
+    this.child = child;
+    child.stdout?.on("data", (d) => process.stdout.write(d));
+    child.stderr?.on("data", (d) => process.stderr.write(d));
+    child.stdin?.on("error", () => {
+    });
+    child.on("error", (err) => logger.warn(`Codex adapter failed to start: ${err.message}`));
+    child.on("exit", (code, signal) => {
+      if (this.child === child) this.child = void 0;
+      if (this.stopped || code === 0) return;
+      if (Date.now() - startedAt > HEALTHY_RUN_MS) this.delay = this.minDelayMs;
+      logger.warn(`Codex adapter exited (${signal ?? code}); restarting in ${this.delay}ms`);
+      this.timer = setTimeout(() => {
+        this.timer = void 0;
+        if (!this.stopped) this.launch();
+      }, this.delay);
+      this.delay = Math.min(this.delay * 2, this.maxDelayMs);
+    });
+  }
+};
+
+// src/shared/config.ts
+import fs3 from "fs";
+import path4 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 var DEFAULT_CONFIG = {
   hub: {
@@ -683,18 +762,18 @@ var DEFAULT_CONFIG = {
   webhooks: []
 };
 function ensureConfigDir() {
-  if (!fs2.existsSync(CONFIG_DIR)) {
-    fs2.mkdirSync(CONFIG_DIR, { recursive: true });
+  if (!fs3.existsSync(CONFIG_DIR)) {
+    fs3.mkdirSync(CONFIG_DIR, { recursive: true });
   }
 }
 function loadConfig() {
   ensureConfigDir();
   let config;
-  if (!fs2.existsSync(CONFIG_FILE)) {
+  if (!fs3.existsSync(CONFIG_FILE)) {
     config = { ...DEFAULT_CONFIG, hub: { ...DEFAULT_CONFIG.hub } };
   } else {
     try {
-      const raw = fs2.readFileSync(CONFIG_FILE, "utf-8");
+      const raw = fs3.readFileSync(CONFIG_FILE, "utf-8");
       const parsed = JSON.parse(raw);
       config = { ...DEFAULT_CONFIG, ...parsed, hub: { ...DEFAULT_CONFIG.hub, ...parsed.hub }, ...parsed.telegram ? { telegram: parsed.telegram } : {} };
     } catch {
@@ -709,15 +788,15 @@ function loadConfig() {
 }
 function saveConfig(config) {
   ensureConfigDir();
-  fs2.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
+  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
 }
 function setupMcpConfig(targetDir) {
   const dir = targetDir ?? process.cwd();
-  const mcpPath = path3.join(dir, ".mcp.json");
+  const mcpPath = path4.join(dir, ".mcp.json");
   let mcpConfig = {};
-  if (fs2.existsSync(mcpPath)) {
+  if (fs3.existsSync(mcpPath)) {
     try {
-      mcpConfig = JSON.parse(fs2.readFileSync(mcpPath, "utf-8"));
+      mcpConfig = JSON.parse(fs3.readFileSync(mcpPath, "utf-8"));
     } catch {
       mcpConfig = {};
     }
@@ -729,21 +808,21 @@ function setupMcpConfig(targetDir) {
     command: "npx",
     args: ["-y", "@delt/claude-alarm", "serve"],
     env: {
-      CLAUDE_ALARM_SESSION_NAME: path3.basename(dir)
+      CLAUDE_ALARM_SESSION_NAME: path4.basename(dir)
     }
   };
-  fs2.writeFileSync(mcpPath, JSON.stringify(mcpConfig, null, 2), "utf-8");
+  fs3.writeFileSync(mcpPath, JSON.stringify(mcpConfig, null, 2), "utf-8");
   return mcpPath;
 }
 
 // src/shared/crash-guard.ts
-import fs3 from "fs";
+import fs4 from "fs";
 var BURST_WINDOW_MS = 6e4;
 var BURST_LIMIT = 10;
 function appendToLog(text) {
   try {
-    fs3.mkdirSync(CONFIG_DIR, { recursive: true });
-    fs3.appendFileSync(LOG_FILE, text, "utf-8");
+    fs4.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs4.appendFileSync(LOG_FILE, text, "utf-8");
   } catch {
   }
 }
@@ -784,8 +863,66 @@ function logStartup(context) {
 `);
 }
 
+// src/hub/auth.ts
+import crypto from "crypto";
+var SESSION_COOKIE = "ca_session";
+var COOKIE_MAX_AGE = 30 * 24 * 60 * 60;
+function safeEqual(a, b) {
+  if (typeof a !== "string") return false;
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+function dashboardCookieValue(token) {
+  return crypto.createHmac("sha256", token).update("claude-alarm-dashboard").digest("hex");
+}
+function parseCookies(header) {
+  const out = {};
+  for (const part of (header ?? "").split(";")) {
+    const i = part.indexOf("=");
+    if (i <= 0) continue;
+    const raw = part.slice(i + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out[part.slice(0, i).trim()] = value;
+  }
+  return out;
+}
+function sessionCookieHeader(token, secure) {
+  return `${SESSION_COOKIE}=${dashboardCookieValue(token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${COOKIE_MAX_AGE}${secure ? "; Secure" : ""}`;
+}
+function isAuthorized(req, token, allowQueryToken) {
+  const auth = req.headers.authorization;
+  if (auth?.startsWith("Bearer ") && safeEqual(auth.slice(7), token)) return true;
+  if (safeEqual(parseCookies(req.headers.cookie)[SESSION_COOKIE], dashboardCookieValue(token))) return true;
+  if (allowQueryToken) {
+    const q = new URL(req.url ?? "/", "http://hub").searchParams.get("token");
+    if (safeEqual(q, token)) return true;
+  }
+  return false;
+}
+function isCrossOrigin(req) {
+  const origin = req.headers.origin;
+  if (!origin) return false;
+  try {
+    return new URL(origin).host !== req.headers.host;
+  } catch {
+    return true;
+  }
+}
+function isJsonRequest(req) {
+  return String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json");
+}
+function isSecureRequest(req) {
+  return req.headers["x-forwarded-proto"] === "https";
+}
+
 // src/hub/server.ts
-var __dirname = path4.dirname(fileURLToPath(import.meta.url));
+var __dirname = path5.dirname(fileURLToPath(import.meta.url));
+var MAX_WS_PAYLOAD = 16 * 1024 * 1024;
 var HubServer = class {
   httpServer;
   wssChannel;
@@ -803,13 +940,17 @@ var HubServer = class {
   heartbeatInterval;
   channelAlive = /* @__PURE__ */ new Map();
   // sessionId -> alive flag
+  socketOwners = /* @__PURE__ */ new WeakMap();
   host;
   port;
   token;
+  codexEnabled;
+  codexSupervisor;
   constructor(config) {
     this.host = config?.hub?.host ?? DEFAULT_HUB_HOST;
     this.port = config?.hub?.port ?? DEFAULT_HUB_PORT;
     this.token = config?.hub?.token;
+    this.codexEnabled = config?.codex?.enabled === true;
     if (config?.notifications) {
       this.notifier.configure({
         desktop: config.notifications.desktop
@@ -825,22 +966,23 @@ var HubServer = class {
       this.initTelegram(fullConfig.telegram);
     }
     this.httpServer = http.createServer((req, res) => this.handleHttp(req, res));
-    this.wssChannel = new WebSocketServer({ noServer: true });
+    this.wssChannel = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
     this.wssChannel.on("connection", (ws, req) => this.handleChannelConnection(ws, req));
     this.wssChannel.on("error", (err) => logger.warn(`Channel WebSocket server error: ${err.message}`));
-    this.wssDashboard = new WebSocketServer({ noServer: true });
+    this.wssDashboard = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
     this.wssDashboard.on("connection", (ws) => this.handleDashboardConnection(ws));
     this.wssDashboard.on("error", (err) => logger.warn(`Dashboard WebSocket server error: ${err.message}`));
     this.httpServer.on("upgrade", (req, socket, head) => {
       socket.on("error", (err) => logger.debug(`Upgrade socket error: ${err.message}`));
-      const url = new URL(req.url, `http://${req.headers.host}`);
+      const url = new URL(req.url ?? "/", "http://hub");
       const pathname = url.pathname;
-      if (this.token && !this.isLocalRequest(req)) {
-        const wsToken = url.searchParams.get("token");
-        if (wsToken !== this.token) {
-          socket.destroy();
-          return;
-        }
+      if (isCrossOrigin(req)) {
+        this.rejectUpgrade(socket, 403, "Forbidden", pathname, req);
+        return;
+      }
+      if (!this.authorized(req, true)) {
+        this.rejectUpgrade(socket, 401, "Unauthorized", pathname, req);
+        return;
       }
       if (pathname === WS_PATH_CHANNEL) {
         this.wssChannel.handleUpgrade(req, socket, head, (ws) => {
@@ -866,12 +1008,15 @@ var HubServer = class {
         this.httpServer.on("error", (err) => logger.error(`HTTP server error: ${err.message}`));
         const displayHost = this.host === "0.0.0.0" ? "127.0.0.1" : this.host;
         logger.info(`Hub server listening on http://${displayHost}:${this.port}`);
+        this.startCodexAdapter();
         resolve();
       });
     });
   }
   stop() {
     return new Promise((resolve) => {
+      this.codexSupervisor?.stop();
+      this.codexSupervisor = void 0;
       if (this.heartbeatInterval) clearInterval(this.heartbeatInterval);
       if (this.telegramBot) this.telegramBot.stopPolling();
       for (const ws of this.channelSockets.values()) ws.terminate();
@@ -892,31 +1037,28 @@ var HubServer = class {
   }
   // --- HTTP Handler ---
   handleHttp(req, res) {
-    const url = new URL(req.url, `http://${req.headers.host}`);
-    const origin = req.headers.origin;
-    if (origin && (origin.includes("127.0.0.1") || origin.includes("localhost"))) {
-      res.setHeader("Access-Control-Allow-Origin", origin);
-    }
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-    if (req.method === "OPTIONS") {
-      res.writeHead(204);
-      res.end();
+    const url = new URL(req.url ?? "/", "http://hub");
+    if (isCrossOrigin(req)) {
+      this.jsonResponse(res, 403, { error: "Cross-origin request rejected" });
       return;
     }
-    if (url.pathname !== "/" && this.token) {
-      if (!this.isLocalRequest(req)) {
-        const authHeader = req.headers["authorization"];
-        const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-        if (bearerToken !== this.token) {
-          this.jsonResponse(res, 401, { error: "Unauthorized" });
-          return;
-        }
-      }
+    if (req.method === "POST" && !isJsonRequest(req)) {
+      this.jsonResponse(res, 415, { error: "Content-Type must be application/json" });
+      return;
     }
     if (url.pathname === "/" && req.method === "GET") {
-      this.serveDashboard(res);
-    } else if (url.pathname === "/api/sessions" && req.method === "GET") {
+      this.serveDashboard(req, res, url);
+      return;
+    }
+    if (url.pathname === "/api/login" && req.method === "POST") {
+      this.handleLogin(req, res);
+      return;
+    }
+    if (!this.authorized(req, false)) {
+      this.jsonResponse(res, 401, { error: "Unauthorized" });
+      return;
+    }
+    if (url.pathname === "/api/sessions" && req.method === "GET") {
       this.jsonResponse(res, 200, { sessions: this.sessions.getAll() });
     } else if (url.pathname === "/api/status" && req.method === "GET") {
       this.jsonResponse(res, 200, {
@@ -967,25 +1109,31 @@ var HubServer = class {
       this.jsonResponse(res, 404, { error: "Not found" });
     }
   }
-  serveDashboard(res) {
+  serveDashboard(req, res, url) {
+    const linkToken = url.searchParams.get("token");
+    if (linkToken !== null && this.token && safeEqual(linkToken, this.token)) {
+      res.writeHead(302, { Location: "/", "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+      res.end();
+      return;
+    }
     const candidates = [
-      path4.join(__dirname, "..", "dashboard", "index.html"),
+      path5.join(__dirname, "..", "dashboard", "index.html"),
       // from dist/hub/
-      path4.join(__dirname, "dashboard", "index.html"),
+      path5.join(__dirname, "dashboard", "index.html"),
       // from dist/ (bundled index.js)
-      path4.join(__dirname, "..", "..", "src", "dashboard", "index.html"),
+      path5.join(__dirname, "..", "..", "src", "dashboard", "index.html"),
       // from dist/hub/ -> src/
-      path4.join(__dirname, "..", "src", "dashboard", "index.html"),
+      path5.join(__dirname, "..", "src", "dashboard", "index.html"),
       // from dist/ -> src/
-      path4.join(process.cwd(), "dist", "dashboard", "index.html"),
+      path5.join(process.cwd(), "dist", "dashboard", "index.html"),
       // from cwd
-      path4.join(process.cwd(), "src", "dashboard", "index.html")
+      path5.join(process.cwd(), "src", "dashboard", "index.html")
       // from cwd/src
     ];
     logger.debug(`Dashboard candidates: ${JSON.stringify(candidates)}`);
     for (const candidate of candidates) {
-      if (fs4.existsSync(candidate)) {
-        const html = fs4.readFileSync(candidate, "utf-8");
+      if (fs5.existsSync(candidate)) {
+        const html = fs5.readFileSync(candidate, "utf-8");
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end(html);
         return;
@@ -994,6 +1142,20 @@ var HubServer = class {
     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
     res.end("<html><body><h1>claude-alarm</h1><p>Dashboard HTML not found. Reinstall the package.</p></body></html>");
   }
+  async handleLogin(req, res) {
+    const body = await this.readBody(req);
+    if (!this.token) {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    if (typeof body?.token !== "string" || !safeEqual(body.token, this.token)) {
+      this.jsonResponse(res, 401, { error: "Unauthorized" });
+      return;
+    }
+    res.writeHead(204, { "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+    res.end();
+  }
   async handleApiSend(req, res) {
     const body = await this.readBody(req);
     if (!body) {
@@ -1010,7 +1172,7 @@ var HubServer = class {
       this.jsonResponse(res, 404, { error: "Session not connected" });
       return;
     }
-    const msg = { type: "message_to_session", sessionId, content };
+    const msg = { type: "message_to_session", sessionId, content, source: "api" };
     ws.send(JSON.stringify(msg));
     this.jsonResponse(res, 200, { ok: true });
   }
@@ -1070,6 +1232,22 @@ var HubServer = class {
     });
   }
   handleChannelMessage(ws, isLocal, msg) {
+    if (msg.type === "register") {
+      const id = msg.session.id;
+      const owned = this.socketOwners.get(ws);
+      if (owned && owned !== id) {
+        logger.warn(`Rejected register for ${id}: connection already owns ${owned}`);
+        return;
+      }
+      const holder = this.channelSockets.get(id);
+      if (holder && holder !== ws) {
+        this.socketOwners.delete(holder);
+        holder.terminate();
+      }
+      this.socketOwners.set(ws, id);
+    } else if ("sessionId" in msg && this.socketOwners.get(ws) !== msg.sessionId) {
+      return;
+    }
     switch (msg.type) {
       case "register": {
         const session = msg.session;
@@ -1093,7 +1271,6 @@ var HubServer = class {
         break;
       }
       case "peer_name": {
-        if (this.channelSockets.get(msg.sessionId) !== ws) break;
         const updated = this.sessions.setPeerName(msg.sessionId, msg.peerName);
         if (updated) {
           logger.info(`Peer name for ${msg.sessionId}: ${msg.peerName ?? "-"}`);
@@ -1169,7 +1346,7 @@ var HubServer = class {
         if (msg.type === "message_to_session") {
           const channelWs = this.channelSockets.get(msg.sessionId);
           if (channelWs?.readyState === WebSocket.OPEN) {
-            channelWs.send(JSON.stringify(msg));
+            channelWs.send(JSON.stringify({ ...msg, source: "dashboard" }));
           }
         } else if (msg.type === "image_upload") {
           this.handleImageUpload(msg);
@@ -1214,11 +1391,11 @@ var HubServer = class {
       logger.warn("Image upload rejected: exceeds 10MB");
       return;
     }
-    fs4.mkdirSync(UPLOADS_DIR, { recursive: true });
+    fs5.mkdirSync(UPLOADS_DIR, { recursive: true });
     const ext = mimeType.split("/")[1] === "jpeg" ? "jpg" : mimeType.split("/")[1];
     const filename = `${randomUUID3()}.${ext}`;
-    const filePath = path4.join(UPLOADS_DIR, filename);
-    fs4.writeFileSync(filePath, buffer);
+    const filePath = path5.join(UPLOADS_DIR, filename);
+    fs5.writeFileSync(filePath, buffer);
     const forwardMsg = {
       type: "image_to_session",
       sessionId,
@@ -1231,7 +1408,7 @@ var HubServer = class {
     logger.info(`Image saved and forwarded: ${filename} (${buffer.length} bytes)`);
     setTimeout(() => {
       try {
-        fs4.unlinkSync(filePath);
+        fs5.unlinkSync(filePath);
       } catch {
       }
     }, 5 * 60 * 1e3);
@@ -1259,7 +1436,7 @@ var HubServer = class {
     this.telegramBot.onMessageToSession = (sessionId, content) => {
       const channelWs = this.channelSockets.get(sessionId);
       if (channelWs?.readyState === WebSocket.OPEN) {
-        const msg = { type: "message_to_session", sessionId, content };
+        const msg = { type: "message_to_session", sessionId, content, source: "telegram" };
         channelWs.send(JSON.stringify(msg));
         logger.info(`Telegram message forwarded to session: ${sessionId}`);
       }
@@ -1386,6 +1563,17 @@ var HubServer = class {
       this.jsonResponse(res, 500, { error: err.message });
     }
   }
+  startCodexAdapter() {
+    if (!this.codexEnabled) return;
+    const script = resolveAdapterScript(__dirname);
+    if (!script) {
+      logger.warn("Codex adapter is enabled but codex/main.js was not found next to the hub");
+      return;
+    }
+    this.codexSupervisor = new CodexSupervisor(script);
+    this.codexSupervisor.start();
+    logger.info("Codex adapter started");
+  }
   startHeartbeat() {
     this.heartbeatInterval = setInterval(() => {
       for (const [sessionId, ws] of this.channelSockets) {
@@ -1401,11 +1589,11 @@ var HubServer = class {
   }
   cleanupUploads() {
     try {
-      if (!fs4.existsSync(UPLOADS_DIR)) return;
-      const files = fs4.readdirSync(UPLOADS_DIR);
+      if (!fs5.existsSync(UPLOADS_DIR)) return;
+      const files = fs5.readdirSync(UPLOADS_DIR);
       for (const file of files) {
         try {
-          fs4.unlinkSync(path4.join(UPLOADS_DIR, file));
+          fs5.unlinkSync(path5.join(UPLOADS_DIR, file));
         } catch {
         }
       }
@@ -1414,13 +1602,24 @@ var HubServer = class {
     }
   }
   getSessionLabel(session) {
-    if (!session) return "unknown";
-    return session.displayName || session.cwd?.replace(/^.*[/\\]/, "") || session.name;
+    return session ? sessionLabel(session) : "unknown";
   }
   jsonResponse(res, status, body) {
     res.writeHead(status, { "Content-Type": "application/json" });
     res.end(JSON.stringify(body));
   }
+  authorized(req, allowQueryToken) {
+    return !this.token || isAuthorized(req, this.token, allowQueryToken);
+  }
+  rejectUpgrade(socket, status, text, pathname, req) {
+    logger.warn(`Rejected ${pathname} upgrade (${status}) from ${req.socket.remoteAddress}`);
+    socket.write(`HTTP/1.1 ${status} ${text}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+    socket.destroy();
+  }
   isLocalRequest(req) {
     const addr = req.socket.remoteAddress;
     return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
@@ -1467,48 +1666,41 @@ if (process.argv[1] && (process.argv[1].endsWith("hub/server.js") || process.arg
 // src/channel/hub-client.ts
 import WebSocket2 from "ws";
 var HubClient = class {
-  constructor(sessionId, sessionName, hubHost = DEFAULT_HUB_HOST, hubPort = DEFAULT_HUB_PORT, token, getPeerName = () => void 0) {
+  constructor(sessionId, sessionName, hubHost = DEFAULT_HUB_HOST, hubPort = DEFAULT_HUB_PORT, token, getPeerName = () => void 0, getRegistration = () => ({})) {
     this.sessionId = sessionId;
     this.sessionName = sessionName;
     this.hubHost = hubHost;
     this.hubPort = hubPort;
     this.token = token;
     this.getPeerName = getPeerName;
+    this.getRegistration = getRegistration;
   }
   ws = null;
   reconnectTimer = null;
   messageHandlers = [];
   queue = [];
   connected = false;
+  closed = false;
   connect() {
+    this.closed = false;
     const tokenQuery = this.token ? `?token=${encodeURIComponent(this.token)}` : "";
     const url = `ws://${this.hubHost}:${this.hubPort}${WS_PATH_CHANNEL}${tokenQuery}`;
     logger.debug(`Connecting to hub at ${url}`);
     try {
-      this.ws = new WebSocket2(url);
-      this.ws.on("open", () => {
+      const ws = new WebSocket2(url);
+      this.ws = ws;
+      ws.on("open", () => {
+        if (this.ws !== ws) return;
         logger.info("Connected to hub");
         this.connected = true;
-        const registration = {
-          type: "register",
-          session: {
-            id: this.sessionId,
-            name: this.sessionName,
-            status: "idle",
-            connectedAt: Date.now(),
-            lastActivity: Date.now(),
-            cwd: process.cwd(),
-            channelEnabled: true,
-            peerName: this.getPeerName()
-          }
-        };
-        this.ws.send(JSON.stringify(registration));
+        this.ws.send(JSON.stringify(this.registration()));
         for (const msg of this.queue) {
           this.ws.send(JSON.stringify(msg));
         }
         this.queue = [];
       });
-      this.ws.on("message", (data) => {
+      ws.on("message", (data) => {
+        if (this.ws !== ws) return;
         try {
           const msg = JSON.parse(data.toString());
           for (const handler of this.messageHandlers) {
@@ -1518,12 +1710,14 @@ var HubClient = class {
           logger.warn("Failed to parse hub message:", err);
         }
       });
-      this.ws.on("close", () => {
+      ws.on("close", () => {
+        if (this.ws !== ws) return;
         logger.info("Disconnected from hub");
         this.connected = false;
-        this.scheduleReconnect();
+        if (!this.closed) this.scheduleReconnect();
       });
-      this.ws.on("error", (err) => {
+      ws.on("error", (err) => {
+        if (this.ws !== ws) return;
         logger.debug(`Hub connection error: ${err.message}`);
         this.connected = false;
       });
@@ -1546,6 +1740,7 @@ var HubClient = class {
     this.messageHandlers.push(handler);
   }
   disconnect() {
+    this.closed = true;
     if (this.reconnectTimer) {
       clearTimeout(this.reconnectTimer);
       this.reconnectTimer = null;
@@ -1556,8 +1751,29 @@ var HubClient = class {
     }
     this.connected = false;
   }
+  reregister() {
+    if (this.connected && this.ws?.readyState === WebSocket2.OPEN) {
+      this.ws.send(JSON.stringify(this.registration()));
+    }
+  }
+  registration() {
+    return {
+      type: "register",
+      session: {
+        id: this.sessionId,
+        name: this.sessionName,
+        status: "idle",
+        connectedAt: Date.now(),
+        lastActivity: Date.now(),
+        cwd: process.cwd(),
+        channelEnabled: true,
+        peerName: this.getPeerName(),
+        ...this.getRegistration()
+      }
+    };
+  }
   scheduleReconnect() {
-    if (this.reconnectTimer) return;
+    if (this.reconnectTimer || this.closed) return;
     this.reconnectTimer = setTimeout(() => {
       this.reconnectTimer = null;
       this.connect();
@@ -1567,6 +1783,8 @@ var HubClient = class {
 export {
   CHANNEL_SERVER_NAME,
   CHANNEL_SERVER_VERSION,
+  CODEX_LOG_FILE,
+  CODEX_PID_FILE,
   CONFIG_DIR,
   CONFIG_FILE,
   DEFAULT_HUB_HOST,