@logicseek/hello-cc 0.1.3 → 0.1.5

package/scripts/regression.mjs

@@ -7,6 +7,7 @@ import process from 'node:process';
 import { spawnSync } from 'node:child_process';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { DatabaseSync } from 'node:sqlite';
+import { Readable } from 'node:stream';
 import WebSocket from 'ws';
 
 const repoRoot = path.resolve(import.meta.dirname, '..');
@@ -458,17 +459,21 @@ function assertLegacySchemaMigration() {
       for (const column of ['parent_id', 'team_role']) {
         if (!taskColumns.has(column)) fail(`legacy migration did not add tasks.${column}`);
       }
+      const lockColumns = new Set(db.prepare('PRAGMA table_info(locks)').all().map((row) => row.name));
+      for (const column of ['base_resource', 'scope']) {
+        if (!lockColumns.has(column)) fail(`legacy migration did not add locks.${column}`);
+      }
       const message = db.prepare('SELECT id, thread_id FROM messages WHERE body = ?').get('legacy-message');
       if (!message || message.thread_id !== message.id) {
         fail(`legacy message thread_id not backfilled:\n${JSON.stringify(message, null, 2)}`);
       }
       const metaVersion = db.prepare("SELECT value FROM meta WHERE key = 'schema_version'").get()?.value;
       const pragmaVersion = db.prepare('PRAGMA user_version').get().user_version;
-      if (metaVersion !== '4' || pragmaVersion !== 4) {
+      if (metaVersion !== '5' || pragmaVersion !== 5) {
         fail(`schema version not synchronized: meta=${metaVersion} pragma=${pragmaVersion}`);
       }
       const migrations = db.prepare('SELECT version, name FROM schema_migrations ORDER BY version').all();
-      if (migrations.length !== 4 || migrations[3].version !== 4 || migrations[3].name !== 'team task hierarchy') {
+      if (migrations.length !== 5 || migrations[4].version !== 5 || migrations[4].name !== 'scoped advisory locks') {
         fail(`schema migrations history wrong:\n${JSON.stringify(migrations, null, 2)}`);
       }
     } finally {
@@ -500,7 +505,7 @@ function assertRegisteredProjectDbMigration() {
         fail(`registered project DB was not migrated:\n${JSON.stringify([...taskColumns], null, 2)}`);
       }
       const version = db.prepare('PRAGMA user_version').get().user_version;
-      if (version !== 4) fail(`registered project DB user_version wrong: ${version}`);
+      if (version !== 5) fail(`registered project DB user_version wrong: ${version}`);
     } finally {
       db.close();
     }
@@ -521,7 +526,7 @@ function assertFutureSchemaMigrationHistoryRejected() {
           key TEXT PRIMARY KEY,
           value TEXT NOT NULL
         );
-        INSERT INTO meta(key, value) VALUES ('schema_version', '4');
+        INSERT INTO meta(key, value) VALUES ('schema_version', '5');
         CREATE TABLE schema_migrations (
           version INTEGER PRIMARY KEY,
           name TEXT NOT NULL,
@@ -534,7 +539,7 @@ function assertFutureSchemaMigrationHistoryRejected() {
       db.close();
     }
     const result = runMaybe(process.execPath, [hccBin, '--root', futureRoot, 'status', '--peer', 'future-schema-check'], { env });
-    if (result.status === 0 || !`${result.stdout}\n${result.stderr}`.includes('Database schema version 999 is newer than this hcc (4)')) {
+    if (result.status === 0 || !`${result.stdout}\n${result.stderr}`.includes('Database schema version 999 is newer than this hcc (5)')) {
       fail(`future schema migration history was not rejected:\nstdout=${result.stdout}\nstderr=${result.stderr}`);
     }
   } finally {
@@ -676,6 +681,11 @@ function assertGuidanceLockPolicy(file) {
     'Do not silently treat a snapshot review as final approval',
     'Before mutating work:',
     'Before editing or mutating shared resources:',
+    'module scope',
+    'Locks are coordination signals',
+    '--scope db-schema',
+    '--scope web-ui',
+    'narrower scoped locks',
     'Commit-readiness checks are read-only until staging begins',
     'lock `.git/index` only while staging and'
   ]) {
@@ -809,6 +819,39 @@ async function expectResizeReplaceSnapshot(peer, marker) {
   });
 }
 
+async function expectWebSocketInputVisible(peer, marker) {
+  await new Promise((resolve, reject) => {
+    let sawSnapshot = false;
+    let sent = false;
+    let sawMarkerAfterInput = false;
+    let sawFrameAfterInput = false;
+    const ws = new WebSocket(runtimeWsUrl(peer));
+    const timer = setTimeout(() => reject(new Error(`${peer} websocket input visibility timeout`)), 5000);
+    ws.on('message', (raw) => {
+      const msg = JSON.parse(String(raw));
+      const data = String(msg.data || '');
+      if (msg.type === 'snapshot') {
+        sawSnapshot = true;
+        if (!sent) {
+          sent = true;
+          ws.send(JSON.stringify({ type: 'input', data: `echo ${marker}\r` }));
+        }
+        return;
+      }
+      if (sent && ['data', 'replace'].includes(msg.type)) {
+        sawFrameAfterInput = true;
+        if (data.includes(marker)) sawMarkerAfterInput = true;
+      }
+      if (sawSnapshot && sawFrameAfterInput && sawMarkerAfterInput) {
+        clearTimeout(timer);
+        ws.close();
+        resolve();
+      }
+    });
+    ws.on('error', reject);
+  });
+}
+
 function tmuxStreamNodes() {
   const dir = path.join(root, '.hello-cc', 'bufs');
   if (!fs.existsSync(dir)) return [];
@@ -817,6 +860,13 @@ function tmuxStreamNodes() {
     .map((name) => path.join(dir, name));
 }
 
+function libModuleFiles() {
+  return fs.readdirSync(path.join(repoRoot, 'lib'))
+    .filter((name) => name.endsWith('.mjs'))
+    .sort()
+    .map((name) => path.join('lib', name));
+}
+
 async function expectBoundedTmuxStream(label) {
   let nodes = [];
   await waitFor(() => {
@@ -1125,6 +1175,13 @@ async function dbWorkflow() {
   if (stateAfterAck.automation.next_action.kind !== 'lock.acquire') {
     fail(`state automation did not suggest lock acquire after ack:\n${JSON.stringify(stateAfterAck.automation, null, 2)}`);
   }
+  const readOnlyState = hccJson(['state', '--peer', 'codex-a', '--resource', 'src/read-only', '--intent', 'review']);
+  if (readOnlyState.automation.next_action.kind === 'lock.acquire' || readOnlyState.automation.phase === 'acquire_lock') {
+    fail(`read-only state suggested acquiring a lock:\n${JSON.stringify(readOnlyState.automation, null, 2)}`);
+  }
+  if (!(readOnlyState.automation.warnings || []).some((warning) => warning.includes('read-only'))) {
+    fail(`read-only state did not explain no-lock behavior:\n${JSON.stringify(readOnlyState.automation, null, 2)}`);
+  }
   const queuedTask = hcc(['task', 'create', '--from', 'human', '--to', 'codex-a', '--title', 'queued while busy']);
   const queuedTaskMatch = queuedTask.match(/created task #(\d+):/);
   if (!queuedTaskMatch) fail(`cannot parse queued task id: ${queuedTask}`);
@@ -1148,6 +1205,93 @@ async function dbWorkflow() {
   if (!nextAgain.includes(`current task #${taskId}`)) {
     fail(`task next did not preserve current task:\n${nextAgain}`);
   }
+  const nextAgainJson = hccJson(['task', 'next', '--peer', 'codex-a']);
+  if (String(nextAgainJson.id) !== String(taskId) || nextAgainJson.current !== true || nextAgainJson.tasks) {
+    fail(`task next --json current task shape changed:\n${JSON.stringify(nextAgainJson, null, 2)}`);
+  }
+  const batchClaimIds = [];
+  for (const title of ['batch claim one', 'batch claim two']) {
+    const out = hcc(['task', 'create', '--from', 'human', '--title', title]);
+    const match = out.match(/created task #(\d+):/);
+    if (!match) fail(`cannot parse batch task id: ${out}`);
+    batchClaimIds.push(match[1]);
+  }
+  const batchClaim = hccJson(['task', 'claim', '--peer', 'batch-a', '--ids', batchClaimIds.join(',')]);
+  if (!Array.isArray(batchClaim) || batchClaim.length !== 2 || !batchClaim.every((task) => task.owner === 'batch-a')) {
+    fail(`batch claim did not claim both tasks:\n${JSON.stringify(batchClaim, null, 2)}`);
+  }
+  for (const task of batchClaim) {
+    hcc(['task', 'done', '--peer', 'batch-a', '--id', String(task.id), '--summary', 'batch claim cleanup']);
+  }
+  const batchNextIds = [];
+  for (const title of ['batch next one', 'batch next two', 'batch next three']) {
+    const out = hcc(['task', 'create', '--from', 'human', '--title', title]);
+    const match = out.match(/created task #(\d+):/);
+    if (!match) fail(`cannot parse batch next task id: ${out}`);
+    batchNextIds.push(match[1]);
+  }
+  const batchNext = hccJson(['task', 'next', '--peer', 'batch-b', '--force', '--count', '2']);
+  if (!batchNext?.tasks || batchNext.tasks.length !== 2 || !batchNext.tasks.every((task) => task.owner === 'batch-b')) {
+    fail(`task next --count did not claim two tasks:\n${JSON.stringify(batchNext, null, 2)}`);
+  }
+  for (const task of batchNext.tasks) {
+    hcc(['task', 'done', '--peer', 'batch-b', '--id', String(task.id), '--summary', 'batch next cleanup']);
+  }
+  hcc(['task', 'update', '--peer', 'human', '--id', batchNextIds[2], '--status', 'abandoned', '--summary', 'batch next leftover cleanup']);
+  const takeoverOpen = hcc(['task', 'create', '--from', 'human', '--to', 'takeover-owner', '--title', 'takeover open']);
+  const takeoverOpenMatch = takeoverOpen.match(/created task #(\d+):/);
+  if (!takeoverOpenMatch) fail(`cannot parse takeover open id: ${takeoverOpen}`);
+  const takeoverOpenId = takeoverOpenMatch[1];
+  hcc(['task', 'claim', '--peer', 'takeover-owner', '--id', takeoverOpenId]);
+  const blockedPolicyReject = hccMaybe(['task', 'takeover', '--peer', 'takeover-a', '--id', takeoverOpenId, '--reason', 'blocked policy smoke', '--policy', 'blocked']);
+  if (blockedPolicyReject.status === 0 || !String(blockedPolicyReject.stderr || blockedPolicyReject.stdout).includes('does not match takeover policy blocked')) {
+    fail(`takeover --policy blocked accepted non-blocked task:\n${blockedPolicyReject.stdout}\n${blockedPolicyReject.stderr}`);
+  }
+  hcc(['task', 'update', '--peer', 'takeover-owner', '--id', takeoverOpenId, '--status', 'blocked', '--summary', 'blocked for takeover smoke']);
+  const blockedTakeover = hccJson(['task', 'takeover', '--peer', 'takeover-a', '--id', takeoverOpenId, '--reason', 'blocked takeover smoke', '--policy', 'blocked']);
+  if (String(blockedTakeover.owner) !== 'takeover-a') {
+    fail(`blocked takeover did not transfer owner:\n${JSON.stringify(blockedTakeover, null, 2)}`);
+  }
+  hcc(['task', 'done', '--peer', 'takeover-a', '--id', takeoverOpenId, '--summary', 'blocked takeover cleanup']);
+  const staleOut = hcc(['task', 'create', '--from', 'human', '--to', 'stale-owner', '--title', 'stale takeover']);
+  const staleMatch = staleOut.match(/created task #(\d+):/);
+  if (!staleMatch) fail(`cannot parse stale takeover id: ${staleOut}`);
+  const staleTaskId = staleMatch[1];
+  hcc(['task', 'claim', '--peer', 'stale-owner', '--id', staleTaskId]);
+  withMeshDb((db) => {
+    const staleAt = Math.floor(Date.now() / 1000) - 7200;
+    db.prepare('UPDATE peers SET last_seen_at = ? WHERE id = ?').run(staleAt, 'stale-owner');
+  });
+  const staleTakeover = hccJson(['task', 'takeover', '--peer', 'takeover-b', '--id', staleTaskId, '--reason', 'stale takeover smoke', '--policy', 'stale', '--stale-after', '60']);
+  if (String(staleTakeover.owner) !== 'takeover-b') {
+    fail(`stale takeover did not transfer owner:\n${JSON.stringify(staleTakeover, null, 2)}`);
+  }
+  const takeoverInbox = hcc(['msg', 'inbox', '--peer', 'stale-owner', '--all']);
+  if (!takeoverInbox.includes(`Task #${staleTaskId} taken over by takeover-b`)) {
+    fail(`stale takeover did not notify previous owner:\n${takeoverInbox}`);
+  }
+  hcc(['task', 'done', '--peer', 'takeover-b', '--id', staleTaskId, '--summary', 'stale takeover cleanup']);
+  const staleLivenessOut = hcc(['task', 'create', '--from', 'human', '--to', 'stale-liveness-owner', '--title', 'stale liveness task']);
+  const staleLivenessMatch = staleLivenessOut.match(/created task #(\d+):/);
+  if (!staleLivenessMatch) fail(`cannot parse stale liveness task id: ${staleLivenessOut}`);
+  const staleLivenessTaskId = staleLivenessMatch[1];
+  hcc(['task', 'claim', '--peer', 'stale-liveness-owner', '--id', staleLivenessTaskId]);
+  withMeshDb((db) => {
+    const staleAt = Math.floor(Date.now() / 1000) - 7200;
+    db.prepare('UPDATE peers SET last_seen_at = ? WHERE id = ?').run(staleAt, 'stale-liveness-owner');
+  });
+  const staleLivenessList = hcc(['task', 'list', '--status', 'claimed']);
+  if (!staleLivenessList.includes(`#${staleLivenessTaskId}`) || !staleLivenessList.includes('stale/no-lock')) {
+    fail(`task list did not surface stale/no-lock owner state:\n${staleLivenessList}`);
+  }
+  const staleLivenessState = hccJson(['state', '--peer', 'takeover-ready-peer']);
+  if (staleLivenessState.automation?.phase !== 'takeover_task' ||
+      staleLivenessState.automation?.next_action?.kind !== 'task.takeover' ||
+      !staleLivenessState.automation.next_action.argv.includes('--policy') ||
+      !staleLivenessState.automation.next_action.argv.includes('stale')) {
+    fail(`state automation did not suggest stale takeover:\n${JSON.stringify(staleLivenessState.automation, null, 2)}`);
+  }
+  hcc(['task', 'update', '--peer', 'human', '--force', '--id', staleLivenessTaskId, '--status', 'abandoned', '--summary', 'stale liveness cleanup']);
   hcc(['task', 'update', '--peer', 'human', '--id', queuedTaskId, '--status', 'abandoned', '--summary', 'queued task cleanup']);
   hcc(['handoff', 'create', '--from', 'codex-a', '--to', 'claude-a', '--task', taskId, '--summary', 'handoff summary', '--tests', 'full script', '--risks', 'none']);
   if (!hcc(['handoff', 'list', '--task', taskId]).includes('handoff summary')) fail('handoff missing');
@@ -1221,6 +1365,27 @@ async function dbWorkflow() {
   }
   hcc(['task', 'done', '--peer', 'codex-team-captain', '--id', teamParentId, '--summary', 'team regression done']);
 
+  const scopedA = hcc(['lock', 'acquire', '--peer', 'codex-a', '--resource', 'bin/hcc.mjs', '--scope', 'db-schema', '--ttl', '60', '--reason', 'db split']);
+  const scopedB = hcc(['lock', 'acquire', '--peer', 'codex-b', '--resource', 'bin/hcc.mjs', '--scope', 'web-ui', '--ttl', '60', '--reason', 'ui split']);
+  if (!scopedA.includes('bin/hcc.mjs [db-schema]') || !scopedB.includes('bin/hcc.mjs [web-ui]')) {
+    fail(`scoped lock output missing labels:\n${scopedA}\n${scopedB}`);
+  }
+  const scopedRows = hccJson(['lock', 'list']);
+  if (!scopedRows.some((row) => row.base_resource === 'bin/hcc.mjs' && row.scope === 'db-schema') ||
+      !scopedRows.some((row) => row.base_resource === 'bin/hcc.mjs' && row.scope === 'web-ui')) {
+    fail(`scoped locks missing from list:\n${JSON.stringify(scopedRows, null, 2)}`);
+  }
+  const duplicateScope = hccMaybe(['lock', 'acquire', '--peer', 'claude-a', '--resource', 'bin/hcc.mjs', '--scope', 'db-schema', '--ttl', '60', '--reason', 'same scope']);
+  if (duplicateScope.status === 0 || !`${duplicateScope.stdout}\n${duplicateScope.stderr}`.includes('conflicts with lock bin/hcc.mjs [db-schema]')) {
+    fail(`same-scope lock was not rejected:\n${duplicateScope.stdout}\n${duplicateScope.stderr}`);
+  }
+  const wholeResource = hccMaybe(['lock', 'acquire', '--peer', 'claude-a', '--resource', 'bin/hcc.mjs', '--ttl', '60', '--reason', 'whole file']);
+  if (wholeResource.status === 0 || !`${wholeResource.stdout}\n${wholeResource.stderr}`.includes('conflicts with lock bin/hcc.mjs [db-schema]')) {
+    fail(`whole-resource lock did not conflict with scoped locks:\n${wholeResource.stdout}\n${wholeResource.stderr}`);
+  }
+  hcc(['lock', 'release', '--peer', 'codex-a', '--resource', 'bin/hcc.mjs', '--scope', 'db-schema']);
+  hcc(['lock', 'release', '--peer', 'codex-b', '--resource', 'bin/hcc.mjs', '--scope', 'web-ui']);
+
   const conflictTask = hcc(['task', 'create', '--from', 'human', '--to', 'codex-b', '--title', 'conflict automation task']);
   const conflictTaskMatch = conflictTask.match(/created task #(\d+):/);
   if (!conflictTaskMatch) fail(`cannot parse conflict task id: ${conflictTask}`);
@@ -1237,6 +1402,23 @@ async function dbWorkflow() {
   hcc(['lock', 'release', '--peer', 'codex-a', '--resource', 'src/conflict']);
   hcc(['task', 'done', '--peer', 'codex-b', '--id', conflictTaskId, '--summary', 'conflict done']);
 
+  const takeoverTask = hcc(['task', 'create', '--from', 'human', '--to', 'codex-owner', '--title', 'takeover regression task']);
+  const takeoverTaskMatch = takeoverTask.match(/created task #(\d+):/);
+  if (!takeoverTaskMatch) fail(`cannot parse takeover task id: ${takeoverTask}`);
+  const takeoverTaskId = takeoverTaskMatch[1];
+  hcc(['task', 'claim', '--peer', 'codex-owner', '--id', takeoverTaskId]);
+  const takeoverOutput = hcc(['task', 'takeover', '--peer', 'codex-taker', '--id', takeoverTaskId, '--reason', 'owner inactive']);
+  if (!takeoverOutput.includes(`took over task #${takeoverTaskId}`)) fail(`takeover output wrong:\n${takeoverOutput}`);
+  const takeoverRow = hccJson(['task', 'list', '--all']).find((row) => String(row.id) === String(takeoverTaskId));
+  if (!takeoverRow || takeoverRow.owner !== 'codex-taker' || takeoverRow.status !== 'claimed') {
+    fail(`takeover task row wrong:\n${JSON.stringify(takeoverRow, null, 2)}`);
+  }
+  const takeoverOwnerInbox = hcc(['msg', 'inbox', '--peer', 'codex-owner']);
+  if (!takeoverOwnerInbox.includes(`Task #${takeoverTaskId} taken over by codex-taker`)) {
+    fail(`takeover did not notify previous owner:\n${takeoverOwnerInbox}`);
+  }
+  hcc(['task', 'done', '--peer', 'codex-taker', '--id', takeoverTaskId, '--summary', 'takeover done']);
+
   const abandoned = hcc(['task', 'create', '--from', 'human', '--title', 'abandoned regression task']);
   const abandonedMatch = abandoned.match(/created task #(\d+):/);
   if (!abandonedMatch) fail(`cannot parse abandoned task id: ${abandoned}`);
@@ -1436,13 +1618,56 @@ async function multiProjectWebWorkflow() {
   ]) {
     if (!html.includes(expected)) fail(`web layout missing resizable sidebar support: ${expected}`);
   }
-  if (!html.includes('state-card') || !html.includes('peerStateView') || !html.includes('savedCardScroll') || !html.includes('lastStateRoot') || !html.includes('data-section="peers"')) {
+  if (!html.includes('state-card') || !html.includes('peerStateView') || !html.includes('savedCardScroll') || !html.includes('lastStateRoot') || !html.includes("stateCardHtml('peers'")) {
     fail('web state panel missing scrollable peer state UI');
   }
-  if (!html.includes('data-section="timeline"') || !html.includes('renderTimelineItem') || !html.includes('bodyPinned') || !html.includes('refreshCurrentState')) {
+  for (const expected of [
+    'function stateCardCollapsed(section)',
+    "localStorage.getItem('hcc.stateCard.' + section + '.collapsed')",
+    'function stateCardHtml(section, title, count, bodyHtml)',
+    'state-card-toggle',
+    'aria-expanded=',
+    'state-card-collapsed',
+    'function bindStateCardToggles()',
+    "localStorage.setItem('hcc.stateCard.' + section + '.collapsed'",
+    "stateCardHtml('automation'",
+    "stateCardHtml('timeline'",
+    "stateCardHtml('messages'",
+    "stateCardHtml('peers'",
+    "stateCardHtml('tasks'",
+    "stateCardHtml('locks'",
+    'bindStateCardToggles();'
+  ]) {
+    if (!html.includes(expected)) fail(`web state panel missing collapsible card support: ${expected}`);
+  }
+  for (const expected of [
+    'id="actionResult"',
+    'data-action="state"',
+    'data-action="status"',
+    'data-action="inbox"',
+    'data-action="task-next"',
+    'data-action="heartbeat"',
+    'data-action="register"',
+    'data-terminal-action="status"',
+    'function runPeerAction(action)',
+    "'/api/peers/' + encodeURIComponent(info.peerId) + '/actions/' + encodeURIComponent(action)",
+    'showActionResult(result)'
+  ]) {
+    if (!html.includes(expected)) fail(`web actions missing API result UI: ${expected}`);
+  }
+  if (html.includes('data-send=') || html.includes("document.querySelectorAll('[data-send]')")) {
+    fail('web actions still use implicit terminal command injection');
+  }
+  for (const expected of [
+    'term.onData((data) => {',
+    "ws.send(JSON.stringify({ type: 'input', data }))"
+  ]) {
+    if (!html.includes(expected)) fail(`web terminal input forwarding missing: ${expected}`);
+  }
+  if (!html.includes("stateCardHtml('timeline'") || !html.includes('renderTimelineItem') || !html.includes('bodyPinned') || !html.includes('refreshCurrentState')) {
     fail('web state panel missing collaboration timeline or refresh routing');
   }
-  if (!html.includes('data-section="messages"') || !html.includes('messagesData.length')) {
+  if (!html.includes("stateCardHtml('messages'") || !html.includes('messagesData.length')) {
     fail('web state panel missing dedicated messages card');
   }
 
@@ -1463,6 +1688,40 @@ async function multiProjectWebWorkflow() {
     fail(`second project API did not see its session:\n${JSON.stringify(otherSessions)}`);
   }
 
+  hcc(['register', '--peer', 'web-action-peer', '--kind', 'codex', '--role', 'peer']);
+  hcc(['msg', 'send', '--from', 'human', '--to', 'web-action-peer', '--body', 'web action inbox ok']);
+  const actionStatus = await (await runtimeFetch('/api/peers/web-action-peer/actions/status', {}, { root })).json();
+  if (!actionStatus.ok || actionStatus.action !== 'status' || actionStatus.peer !== 'web-action-peer' || !actionStatus.data || typeof actionStatus.data.unread !== 'number') {
+    fail(`web status action did not return structured status:\n${JSON.stringify(actionStatus, null, 2)}`);
+  }
+  const actionInbox = await (await runtimeFetch('/api/peers/web-action-peer/actions/inbox', {}, { root })).json();
+  if (!actionInbox.ok || actionInbox.action !== 'inbox' || !(actionInbox.data?.messages || []).some((m) => m.body === 'web action inbox ok')) {
+    fail(`web inbox action did not return unread messages:\n${JSON.stringify(actionInbox, null, 2)}`);
+  }
+  const actionState = await (await runtimeFetch('/api/peers/web-action-peer/actions/state', {}, { root })).json();
+  if (!actionState.ok || actionState.action !== 'state' || actionState.data?.automation?.peer?.id !== 'web-action-peer') {
+    fail(`web state action did not return peer automation:\n${JSON.stringify(actionState, null, 2)}`);
+  }
+  const taskOutput = hcc(['task', 'create', '--title', 'web action task', '--body', 'claim through web action']);
+  const taskMatch = taskOutput.match(/created task #(\d+):/);
+  if (!taskMatch) fail(`cannot parse web action task id:\n${taskOutput}`);
+  const actionNext = await (await runtimeFetch('/api/peers/web-action-peer/actions/task-next', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: '{}'
+  }, { root })).json();
+  if (!actionNext.ok || actionNext.action !== 'task-next' || String(actionNext.data?.task?.id) !== taskMatch[1]) {
+    fail(`web task-next action did not claim pending task #${taskMatch[1]}:\n${JSON.stringify(actionNext, null, 2)}`);
+  }
+  const actionHeartbeat = await (await runtimeFetch('/api/peers/web-action-peer/actions/heartbeat', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ renew_locks: true })
+  }, { root })).json();
+  if (!actionHeartbeat.ok || actionHeartbeat.action !== 'heartbeat' || actionHeartbeat.data?.peer !== 'web-action-peer') {
+    fail(`web heartbeat action did not return structured result:\n${JSON.stringify(actionHeartbeat, null, 2)}`);
+  }
+
   const startProvider = async (payload) => {
     const response = await runtimeFetch('/api/sessions', {
       method: 'POST',
@@ -1599,6 +1858,7 @@ async function tmuxBackedStartWorkflow() {
   await waitForFile(file, 'PTY_OK', 'pty injection');
   await expectWebSocketMarker('shell-a', 'WS_PTY_OK');
   await expectResizeReplaceSnapshot('shell-a', 'WS_RESIZE_OK');
+  await expectWebSocketInputVisible('shell-a', 'WS_INPUT_VISIBLE_OK');
   await expectBoundedTmuxStream('tmux-backed FIFO stream');
 
   await stopRuntime();
@@ -1845,17 +2105,29 @@ async function downGcPackWorkflow() {
   hcc(['gc', '--older-than', '0', '--yes']);
   const pack = JSON.parse(run('npm', ['pack', '--dry-run', '--json']));
   const files = new Set(pack[0]?.files?.map((entry) => entry.path) || []);
-  for (const file of ['assets/logo.svg', 'CHANGELOG.md', 'docs/commands.md', 'docs/commands.zh-CN.md', 'scripts/github-release.mjs']) {
+  for (const file of [
+    'assets/logo.svg',
+    'CHANGELOG.md',
+    'docs/commands.md',
+    'docs/commands.zh-CN.md',
+    ...libModuleFiles(),
+    'scripts/github-release.mjs'
+  ]) {
     if (!files.has(file)) fail(`npm package missing ${file}`);
   }
+  const packageVersion = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8')).version;
   const releaseCheck = run('npm', ['run', 'release:check']);
-  if (!releaseCheck.includes('release notes ok: 0.1.3')) fail(`release check output wrong:\n${releaseCheck}`);
+  if (!releaseCheck.includes(`release notes ok: ${packageVersion}`)) fail(`release check output wrong:\n${releaseCheck}`);
   const releaseNotes = run('npm', ['run', 'release:notes']);
-  if (!releaseNotes.includes('## 0.1.3') || !releaseNotes.includes('### Summary')) {
+  if (!releaseNotes.includes(`## ${packageVersion}`) || !releaseNotes.includes('### Summary')) {
     fail(`release notes output wrong:\n${releaseNotes}`);
   }
-  const githubRelease = JSON.parse(run(process.execPath, [path.join(repoRoot, 'scripts', 'github-release.mjs'), '--dry-run', '--version', '0.1.3']));
-  if (!githubRelease.ok || !githubRelease.dry_run || githubRelease.repo !== 'Dullne/hello-cc' || githubRelease.tag !== 'v0.1.3' || githubRelease.body_length < 100) {
+  const releaseNotesWithV = run(process.execPath, [path.join(repoRoot, 'scripts', 'release-notes.mjs'), '--version', `v${packageVersion}`]);
+  if (!releaseNotesWithV.includes(`## ${packageVersion}`) || releaseNotesWithV.includes(`## v${packageVersion}`)) {
+    fail(`release notes v-prefixed version output wrong:\n${releaseNotesWithV}`);
+  }
+  const githubRelease = JSON.parse(run(process.execPath, [path.join(repoRoot, 'scripts', 'github-release.mjs'), '--dry-run', '--version', packageVersion]));
+  if (!githubRelease.ok || !githubRelease.dry_run || githubRelease.repo !== 'Dullne/hello-cc' || githubRelease.tag !== `v${packageVersion}` || githubRelease.body_length < 100) {
     fail(`github release dry run output wrong:\n${JSON.stringify(githubRelease, null, 2)}`);
   }
   const docsIndex = fs.readFileSync(path.join(repoRoot, 'docs', 'README.md'), 'utf8');
@@ -1905,11 +2177,151 @@ function oldNameScan() {
   if (rg.status !== 1) fail(`rg failed:\n${rg.stderr || rg.stdout}`);
 }
 
-function syntaxAndHelp() {
+async function syntaxAndHelp() {
   log('[11/12] syntax/help');
   run(process.execPath, ['--check', path.join(repoRoot, 'bin', 'hcc.mjs')]);
-  run(process.execPath, ['--check', path.join(repoRoot, 'lib', 'setup.mjs')]);
-  run(process.execPath, ['--check', path.join(repoRoot, 'lib', 'discover.mjs')]);
+  for (const file of libModuleFiles()) {
+    run(process.execPath, ['--check', path.join(repoRoot, file)]);
+  }
+  const hccSource = fs.readFileSync(hccBin, 'utf8');
+  const webUiTemplateSource = fs.readFileSync(path.join(repoRoot, 'lib', 'web-ui-template.mjs'), 'utf8');
+  for (const expected of [
+    'function scheduleTmuxInputRefresh(session)',
+    "runTmux(['pipe-pane', '-t', session.pane]);",
+    'if (session.inputRefreshTimer) return;',
+    'session.inputRefreshTimer = setTimeout',
+    'scheduleTmuxInputRefresh(session)',
+    "if (session.inputRefreshTimer) { clearTimeout(session.inputRefreshTimer); session.inputRefreshTimer = null; }",
+    "broadcast(session, { type: 'replace', data: refreshTmuxSnapshot(session) });"
+  ]) {
+    if (!hccSource.includes(expected)) fail(`web terminal input refresh support missing: ${expected}`);
+  }
+  for (const expected of [
+    'function detectedPeerCanStop(peer)',
+    "if (['exited', 'detached'].includes(status)) return false;",
+    'const canStop = detectedPeerCanStop(p);',
+    '${canStop ?',
+    "if (e.target.closest('[data-action]')) return;",
+    'id="stopKillLabel" data-i18n="dialog.killTmux"',
+    'id="stopCancelBtn" type="button" data-i18n="dialog.cancel"',
+    'id="stopConfirmBtn" type="button" data-i18n="stop"'
+  ]) {
+    if (!webUiTemplateSource.includes(expected)) fail(`web display regression guard missing: ${expected}`);
+  }
+  if (webUiTemplateSource.includes("p.status === 'running' ?")) {
+    fail('detected peer action rendering still depends on status === running instead of liveness');
+  }
+  for (const expected of [
+    'function webPeerAction(projectCtx, peer, action, input = {})',
+    'function claimNextTasksForPeer(db, peer, { force = false, count = 1 } = {})',
+    'function takeOverTaskForPeer(db, peer, id, { reason, policy = ',
+    'function statusSummary(ctx, peer = null, identity = null)',
+    'const peerActionMatch = url.pathname.match(/^\\/api\\/peers\\/([^/]+)\\/actions\\/([^/]+)$/)',
+    "const readOnly = ['status', 'state', 'inbox'].includes(action)",
+    "sendJson(res, 200, webPeerAction(reqCtx, peer, action, input));"
+  ]) {
+    if (!hccSource.includes(expected)) fail(`web peer action API support missing: ${expected}`);
+  }
+  const packageVersion = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8')).version;
+  const cliVersion = run(process.execPath, [hccBin, '--version']).trim();
+  if (cliVersion !== packageVersion) {
+    fail(`CLI version ${cliVersion} does not match package.json ${packageVersion}`);
+  }
+  if (!hccSource.includes("import { readPackageMeta } from '../lib/package-meta.mjs'") ||
+      !hccSource.includes("} from '../lib/cli-args.mjs'") ||
+      !hccSource.includes("import { CliError } from '../lib/errors.mjs'") ||
+      !hccSource.includes("} from '../lib/db-schema.mjs'") ||
+      !hccSource.includes("} from '../lib/format.mjs'") ||
+      !hccSource.includes("} from '../lib/runtime-paths.mjs'") ||
+      !hccSource.includes("} from '../lib/web-runtime.mjs'") ||
+      !hccSource.includes("} from '../lib/web-http.mjs'") ||
+      !hccSource.includes("import { webIndexHtml } from '../lib/web-ui-template.mjs'") ||
+      !hccSource.includes('const VERSION = PACKAGE_META.version') ||
+      !hccSource.includes('writeGuidanceForRoot(ctx.root)')) {
+    fail('CLI still has duplicated package metadata, cli args, DB schema helpers, format helpers, runtime paths, web runtime/HTTP/UI helpers, or guidance wiring');
+  }
+  if (hccSource.includes('function createBaseSchema') ||
+      hccSource.includes('function runSchemaMigrations') ||
+      hccSource.includes('function readSchemaVersion')) {
+    fail('CLI still embeds DB schema or migration helpers');
+  }
+  for (const helper of [
+    'function runtimeBaseUrl',
+    'function runtimeApiUrl',
+    'function requestUrl',
+    'function runtimeUrlQuery',
+    'function makeWebToken',
+    'function validateWebTokenOpts',
+    'function expectedWebHost',
+    'function webRuntimeMatchesRequest',
+    'function publicRuntimeUrl',
+    'function localRuntimeUrl'
+  ]) {
+    if (hccSource.includes(helper)) fail(`CLI still embeds web runtime helper: ${helper}`);
+  }
+  for (const helper of [
+    'function readRequestBody',
+    'function readJsonRequest',
+    'function sendHttp',
+    'function sendJson',
+    'function sendFile',
+    'function authOk'
+  ]) {
+    if (hccSource.includes(helper)) fail(`CLI still embeds web HTTP helper: ${helper}`);
+  }
+  if (hccSource.includes('new URL(req.url')) fail('CLI still embeds raw server request URL parsing');
+  if (hccSource.includes('function webIndexHtml()')) fail('CLI still embeds the web UI template');
+  const webRuntime = await import(path.join(repoRoot, 'lib', 'web-runtime.mjs'));
+  const webHttp = await import(path.join(repoRoot, 'lib', 'web-http.mjs'));
+  const webUiTemplate = await import(path.join(repoRoot, 'lib', 'web-ui-template.mjs'));
+  const expectEqual = (actual, expected, label) => {
+    if (actual !== expected) fail(`${label}: expected ${expected}, got ${actual}`);
+  };
+  const html = webUiTemplate.webIndexHtml();
+  if (!html.includes('<!doctype html>') ||
+      !html.includes('<div class="app">') ||
+      !html.includes('<script src="/assets/xterm.js"></script>')) {
+    fail('web UI template module did not render the expected shell HTML');
+  }
+  const jsonReq = Readable.from(['{"ok":true}']);
+  jsonReq.headers = {};
+  const parsedJson = await webHttp.readJsonRequest(jsonReq);
+  if (parsedJson.ok !== true) fail(`web HTTP helper failed to parse JSON request: ${JSON.stringify(parsedJson)}`);
+  const emptyReq = Readable.from(['']);
+  emptyReq.headers = {};
+  const parsedEmpty = await webHttp.readJsonRequest(emptyReq);
+  if (Object.keys(parsedEmpty).length !== 0) fail(`web HTTP helper failed empty request fallback: ${JSON.stringify(parsedEmpty)}`);
+  const mockRes = {
+    status: null,
+    headers: null,
+    body: '',
+    writeHead(status, headers) { this.status = status; this.headers = headers; },
+    end(body) { this.body = body; }
+  };
+  webHttp.sendJson(mockRes, 202, { ok: true });
+  if (mockRes.status !== 202 ||
+      mockRes.headers?.['Content-Type'] !== 'application/json; charset=utf-8' ||
+      mockRes.headers?.['Cache-Control'] !== 'no-store' ||
+      !mockRes.body.includes('"ok": true')) {
+    fail(`web HTTP helper failed sendJson response: ${JSON.stringify(mockRes)}`);
+  }
+  if (!webHttp.authOk(new URL('http://example.test/?token=tok'), { headers: {} }, 'tok') ||
+      !webHttp.authOk(new URL('http://example.test/'), { headers: { authorization: 'Bearer tok' } }, 'tok') ||
+      webHttp.authOk(new URL('http://example.test/?token=bad'), { headers: {} }, 'tok')) {
+    fail('web HTTP helper authOk token checks failed');
+  }
+  const wildcardRuntime = { host: '0.0.0.0', port: 8787, token: 'tok' };
+  const ipv6WildcardRuntime = { host: '::', port: 8788, token: 'tok' };
+  const localRuntime = { host: '127.0.0.1', port: 8789, token: 'tok' };
+  expectEqual(webRuntime.runtimeBaseUrl('0.0.0.0', 8787), 'http://127.0.0.1:8787', 'runtimeBaseUrl 0.0.0.0');
+  expectEqual(webRuntime.runtimeBaseUrl('::', 8788), 'http://127.0.0.1:8788', 'runtimeBaseUrl ::');
+  expectEqual(String(webRuntime.runtimeApiUrl({ base_url: 'http://127.0.0.1:8787/base' }, '/api/state?peer=a b')), 'http://127.0.0.1:8787/api/state?peer=a%20b', 'runtimeApiUrl route');
+  expectEqual(String(webRuntime.requestUrl({ url: '/api/state?peer=a b', headers: { host: 'example.test:8787' } })), 'http://example.test:8787/api/state?peer=a%20b', 'requestUrl host and query');
+  expectEqual(String(webRuntime.requestUrl({ url: '', headers: {} })), 'http://localhost/', 'requestUrl fallback');
+  expectEqual(webRuntime.publicRuntimeUrl(wildcardRuntime, '/tmp/hcc project'), 'http://<machine-ip>:8787/?token=tok&project=%2Ftmp%2Fhcc%20project', 'publicRuntimeUrl wildcard');
+  expectEqual(webRuntime.localRuntimeUrl(wildcardRuntime, '/tmp/hcc project'), 'http://127.0.0.1:8787/?token=tok&project=%2Ftmp%2Fhcc%20project', 'localRuntimeUrl wildcard');
+  expectEqual(webRuntime.publicRuntimeUrl(ipv6WildcardRuntime, '/tmp/hcc project'), 'http://<machine-ip>:8788/?token=tok&project=%2Ftmp%2Fhcc%20project', 'publicRuntimeUrl ipv6 wildcard');
+  expectEqual(webRuntime.localRuntimeUrl(localRuntime, null), 'http://127.0.0.1:8789/?token=tok', 'localRuntimeUrl no project');
   const mainHelp = run(process.execPath, [hccBin, '--help']);
   if (mainHelp.includes('setup') || mainHelp.includes('--web-managed')) {
     fail(`public help exposes maintenance or removed commands:\n${mainHelp}`);
@@ -1932,7 +2344,11 @@ function syntaxAndHelp() {
   }
   const taskHelp = run(process.execPath, [hccBin, 'task', '--help']);
   if (!taskHelp.includes('task next [--peer ID] [--force]') ||
+      !taskHelp.includes('[--count N]') ||
       !taskHelp.includes('existing claimed/running/review/blocked task') ||
+      !taskHelp.includes('task takeover [--peer ID] --id N --reason TEXT') ||
+      !taskHelp.includes('[--policy any|blocked|stale|blocked-or-stale]') ||
+      !taskHelp.includes('task claim [--peer ID] --id N[,N]') ||
       !taskHelp.includes('task create --title TEXT --parent N')) {
     fail(`task help missing current-task task next semantics:\n${taskHelp}`);
   }
@@ -1941,9 +2357,18 @@ function syntaxAndHelp() {
     fail(`team help missing expected content:\n${teamHelp}`);
   }
   const stateHelp = run(process.execPath, [hccBin, 'state', '--help']);
-  if (!stateHelp.includes('hcc state') || !stateHelp.includes('automation.next_action.argv') || !stateHelp.includes('automation.current_task') || !stateHelp.includes('hcc team plan')) {
+  if (!stateHelp.includes('hcc state') ||
+      !stateHelp.includes('--scope SCOPE') ||
+      !stateHelp.includes('--intent read|review|work|write|stop|finish') ||
+      !stateHelp.includes('automation.next_action.argv') ||
+      !stateHelp.includes('automation.current_task') ||
+      !stateHelp.includes('hcc team plan')) {
     fail(`state help missing expected content:\n${stateHelp}`);
   }
+  const lockHelp = run(process.execPath, [hccBin, 'lock', '--help']);
+  if (!lockHelp.includes('--scope SCOPE') || !lockHelp.toLowerCase().includes('different scopes on the same resource')) {
+    fail(`lock help missing scoped lock content:\n${lockHelp}`);
+  }
   const updateHelp = run(process.execPath, [hccBin, 'update', '--help']);
   if (!updateHelp.includes('hcc update') || !updateHelp.includes('npm install -g @logicseek/hello-cc@TAG')) {
     fail(`update help missing expected content:\n${updateHelp}`);
@@ -2054,7 +2479,7 @@ async function main() {
   await askBroadcastWorkflow();
   await downGcPackWorkflow();
   oldNameScan();
-  syntaxAndHelp();
+  await syntaxAndHelp();
   uninstallWorkflow();
   log('FULL_REGRESSION_OK');
 }