@logicseek/hello-cc 0.1.4 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logicseek/hello-cc",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Local control plane for coordinating Claude Code, Codex, and other coding CLI sessions.",
   "type": "module",
   "bin": {

package/scripts/regression.mjs

@@ -7,6 +7,7 @@ import process from 'node:process';
 import { spawnSync } from 'node:child_process';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { DatabaseSync } from 'node:sqlite';
+import { Readable } from 'node:stream';
 import WebSocket from 'ws';
 
 const repoRoot = path.resolve(import.meta.dirname, '..');
@@ -458,17 +459,21 @@ function assertLegacySchemaMigration() {
       for (const column of ['parent_id', 'team_role']) {
         if (!taskColumns.has(column)) fail(`legacy migration did not add tasks.${column}`);
       }
+      const lockColumns = new Set(db.prepare('PRAGMA table_info(locks)').all().map((row) => row.name));
+      for (const column of ['base_resource', 'scope']) {
+        if (!lockColumns.has(column)) fail(`legacy migration did not add locks.${column}`);
+      }
       const message = db.prepare('SELECT id, thread_id FROM messages WHERE body = ?').get('legacy-message');
       if (!message || message.thread_id !== message.id) {
         fail(`legacy message thread_id not backfilled:\n${JSON.stringify(message, null, 2)}`);
       }
       const metaVersion = db.prepare("SELECT value FROM meta WHERE key = 'schema_version'").get()?.value;
       const pragmaVersion = db.prepare('PRAGMA user_version').get().user_version;
-      if (metaVersion !== '4' || pragmaVersion !== 4) {
+      if (metaVersion !== '5' || pragmaVersion !== 5) {
         fail(`schema version not synchronized: meta=${metaVersion} pragma=${pragmaVersion}`);
       }
       const migrations = db.prepare('SELECT version, name FROM schema_migrations ORDER BY version').all();
-      if (migrations.length !== 4 || migrations[3].version !== 4 || migrations[3].name !== 'team task hierarchy') {
+      if (migrations.length !== 5 || migrations[4].version !== 5 || migrations[4].name !== 'scoped advisory locks') {
         fail(`schema migrations history wrong:\n${JSON.stringify(migrations, null, 2)}`);
       }
     } finally {
@@ -500,7 +505,7 @@ function assertRegisteredProjectDbMigration() {
         fail(`registered project DB was not migrated:\n${JSON.stringify([...taskColumns], null, 2)}`);
       }
       const version = db.prepare('PRAGMA user_version').get().user_version;
-      if (version !== 4) fail(`registered project DB user_version wrong: ${version}`);
+      if (version !== 5) fail(`registered project DB user_version wrong: ${version}`);
     } finally {
       db.close();
     }
@@ -521,7 +526,7 @@ function assertFutureSchemaMigrationHistoryRejected() {
           key TEXT PRIMARY KEY,
           value TEXT NOT NULL
         );
-        INSERT INTO meta(key, value) VALUES ('schema_version', '4');
+        INSERT INTO meta(key, value) VALUES ('schema_version', '5');
         CREATE TABLE schema_migrations (
           version INTEGER PRIMARY KEY,
           name TEXT NOT NULL,
@@ -534,7 +539,7 @@ function assertFutureSchemaMigrationHistoryRejected() {
       db.close();
     }
     const result = runMaybe(process.execPath, [hccBin, '--root', futureRoot, 'status', '--peer', 'future-schema-check'], { env });
-    if (result.status === 0 || !`${result.stdout}\n${result.stderr}`.includes('Database schema version 999 is newer than this hcc (4)')) {
+    if (result.status === 0 || !`${result.stdout}\n${result.stderr}`.includes('Database schema version 999 is newer than this hcc (5)')) {
       fail(`future schema migration history was not rejected:\nstdout=${result.stdout}\nstderr=${result.stderr}`);
     }
   } finally {
@@ -676,6 +681,11 @@ function assertGuidanceLockPolicy(file) {
     'Do not silently treat a snapshot review as final approval',
     'Before mutating work:',
     'Before editing or mutating shared resources:',
+    'module scope',
+    'Locks are coordination signals',
+    '--scope db-schema',
+    '--scope web-ui',
+    'narrower scoped locks',
     'Commit-readiness checks are read-only until staging begins',
     'lock `.git/index` only while staging and'
   ]) {
@@ -850,6 +860,13 @@ function tmuxStreamNodes() {
     .map((name) => path.join(dir, name));
 }
 
+function libModuleFiles() {
+  return fs.readdirSync(path.join(repoRoot, 'lib'))
+    .filter((name) => name.endsWith('.mjs'))
+    .sort()
+    .map((name) => path.join('lib', name));
+}
+
 async function expectBoundedTmuxStream(label) {
   let nodes = [];
   await waitFor(() => {
@@ -1158,6 +1175,13 @@ async function dbWorkflow() {
   if (stateAfterAck.automation.next_action.kind !== 'lock.acquire') {
     fail(`state automation did not suggest lock acquire after ack:\n${JSON.stringify(stateAfterAck.automation, null, 2)}`);
   }
+  const readOnlyState = hccJson(['state', '--peer', 'codex-a', '--resource', 'src/read-only', '--intent', 'review']);
+  if (readOnlyState.automation.next_action.kind === 'lock.acquire' || readOnlyState.automation.phase === 'acquire_lock') {
+    fail(`read-only state suggested acquiring a lock:\n${JSON.stringify(readOnlyState.automation, null, 2)}`);
+  }
+  if (!(readOnlyState.automation.warnings || []).some((warning) => warning.includes('read-only'))) {
+    fail(`read-only state did not explain no-lock behavior:\n${JSON.stringify(readOnlyState.automation, null, 2)}`);
+  }
   const queuedTask = hcc(['task', 'create', '--from', 'human', '--to', 'codex-a', '--title', 'queued while busy']);
   const queuedTaskMatch = queuedTask.match(/created task #(\d+):/);
   if (!queuedTaskMatch) fail(`cannot parse queued task id: ${queuedTask}`);
@@ -1181,6 +1205,93 @@ async function dbWorkflow() {
   if (!nextAgain.includes(`current task #${taskId}`)) {
     fail(`task next did not preserve current task:\n${nextAgain}`);
   }
+  const nextAgainJson = hccJson(['task', 'next', '--peer', 'codex-a']);
+  if (String(nextAgainJson.id) !== String(taskId) || nextAgainJson.current !== true || nextAgainJson.tasks) {
+    fail(`task next --json current task shape changed:\n${JSON.stringify(nextAgainJson, null, 2)}`);
+  }
+  const batchClaimIds = [];
+  for (const title of ['batch claim one', 'batch claim two']) {
+    const out = hcc(['task', 'create', '--from', 'human', '--title', title]);
+    const match = out.match(/created task #(\d+):/);
+    if (!match) fail(`cannot parse batch task id: ${out}`);
+    batchClaimIds.push(match[1]);
+  }
+  const batchClaim = hccJson(['task', 'claim', '--peer', 'batch-a', '--ids', batchClaimIds.join(',')]);
+  if (!Array.isArray(batchClaim) || batchClaim.length !== 2 || !batchClaim.every((task) => task.owner === 'batch-a')) {
+    fail(`batch claim did not claim both tasks:\n${JSON.stringify(batchClaim, null, 2)}`);
+  }
+  for (const task of batchClaim) {
+    hcc(['task', 'done', '--peer', 'batch-a', '--id', String(task.id), '--summary', 'batch claim cleanup']);
+  }
+  const batchNextIds = [];
+  for (const title of ['batch next one', 'batch next two', 'batch next three']) {
+    const out = hcc(['task', 'create', '--from', 'human', '--title', title]);
+    const match = out.match(/created task #(\d+):/);
+    if (!match) fail(`cannot parse batch next task id: ${out}`);
+    batchNextIds.push(match[1]);
+  }
+  const batchNext = hccJson(['task', 'next', '--peer', 'batch-b', '--force', '--count', '2']);
+  if (!batchNext?.tasks || batchNext.tasks.length !== 2 || !batchNext.tasks.every((task) => task.owner === 'batch-b')) {
+    fail(`task next --count did not claim two tasks:\n${JSON.stringify(batchNext, null, 2)}`);
+  }
+  for (const task of batchNext.tasks) {
+    hcc(['task', 'done', '--peer', 'batch-b', '--id', String(task.id), '--summary', 'batch next cleanup']);
+  }
+  hcc(['task', 'update', '--peer', 'human', '--id', batchNextIds[2], '--status', 'abandoned', '--summary', 'batch next leftover cleanup']);
+  const takeoverOpen = hcc(['task', 'create', '--from', 'human', '--to', 'takeover-owner', '--title', 'takeover open']);
+  const takeoverOpenMatch = takeoverOpen.match(/created task #(\d+):/);
+  if (!takeoverOpenMatch) fail(`cannot parse takeover open id: ${takeoverOpen}`);
+  const takeoverOpenId = takeoverOpenMatch[1];
+  hcc(['task', 'claim', '--peer', 'takeover-owner', '--id', takeoverOpenId]);
+  const blockedPolicyReject = hccMaybe(['task', 'takeover', '--peer', 'takeover-a', '--id', takeoverOpenId, '--reason', 'blocked policy smoke', '--policy', 'blocked']);
+  if (blockedPolicyReject.status === 0 || !String(blockedPolicyReject.stderr || blockedPolicyReject.stdout).includes('does not match takeover policy blocked')) {
+    fail(`takeover --policy blocked accepted non-blocked task:\n${blockedPolicyReject.stdout}\n${blockedPolicyReject.stderr}`);
+  }
+  hcc(['task', 'update', '--peer', 'takeover-owner', '--id', takeoverOpenId, '--status', 'blocked', '--summary', 'blocked for takeover smoke']);
+  const blockedTakeover = hccJson(['task', 'takeover', '--peer', 'takeover-a', '--id', takeoverOpenId, '--reason', 'blocked takeover smoke', '--policy', 'blocked']);
+  if (String(blockedTakeover.owner) !== 'takeover-a') {
+    fail(`blocked takeover did not transfer owner:\n${JSON.stringify(blockedTakeover, null, 2)}`);
+  }
+  hcc(['task', 'done', '--peer', 'takeover-a', '--id', takeoverOpenId, '--summary', 'blocked takeover cleanup']);
+  const staleOut = hcc(['task', 'create', '--from', 'human', '--to', 'stale-owner', '--title', 'stale takeover']);
+  const staleMatch = staleOut.match(/created task #(\d+):/);
+  if (!staleMatch) fail(`cannot parse stale takeover id: ${staleOut}`);
+  const staleTaskId = staleMatch[1];
+  hcc(['task', 'claim', '--peer', 'stale-owner', '--id', staleTaskId]);
+  withMeshDb((db) => {
+    const staleAt = Math.floor(Date.now() / 1000) - 7200;
+    db.prepare('UPDATE peers SET last_seen_at = ? WHERE id = ?').run(staleAt, 'stale-owner');
+  });
+  const staleTakeover = hccJson(['task', 'takeover', '--peer', 'takeover-b', '--id', staleTaskId, '--reason', 'stale takeover smoke', '--policy', 'stale', '--stale-after', '60']);
+  if (String(staleTakeover.owner) !== 'takeover-b') {
+    fail(`stale takeover did not transfer owner:\n${JSON.stringify(staleTakeover, null, 2)}`);
+  }
+  const takeoverInbox = hcc(['msg', 'inbox', '--peer', 'stale-owner', '--all']);
+  if (!takeoverInbox.includes(`Task #${staleTaskId} taken over by takeover-b`)) {
+    fail(`stale takeover did not notify previous owner:\n${takeoverInbox}`);
+  }
+  hcc(['task', 'done', '--peer', 'takeover-b', '--id', staleTaskId, '--summary', 'stale takeover cleanup']);
+  const staleLivenessOut = hcc(['task', 'create', '--from', 'human', '--to', 'stale-liveness-owner', '--title', 'stale liveness task']);
+  const staleLivenessMatch = staleLivenessOut.match(/created task #(\d+):/);
+  if (!staleLivenessMatch) fail(`cannot parse stale liveness task id: ${staleLivenessOut}`);
+  const staleLivenessTaskId = staleLivenessMatch[1];
+  hcc(['task', 'claim', '--peer', 'stale-liveness-owner', '--id', staleLivenessTaskId]);
+  withMeshDb((db) => {
+    const staleAt = Math.floor(Date.now() / 1000) - 7200;
+    db.prepare('UPDATE peers SET last_seen_at = ? WHERE id = ?').run(staleAt, 'stale-liveness-owner');
+  });
+  const staleLivenessList = hcc(['task', 'list', '--status', 'claimed']);
+  if (!staleLivenessList.includes(`#${staleLivenessTaskId}`) || !staleLivenessList.includes('stale/no-lock')) {
+    fail(`task list did not surface stale/no-lock owner state:\n${staleLivenessList}`);
+  }
+  const staleLivenessState = hccJson(['state', '--peer', 'takeover-ready-peer']);
+  if (staleLivenessState.automation?.phase !== 'takeover_task' ||
+      staleLivenessState.automation?.next_action?.kind !== 'task.takeover' ||
+      !staleLivenessState.automation.next_action.argv.includes('--policy') ||
+      !staleLivenessState.automation.next_action.argv.includes('stale')) {
+    fail(`state automation did not suggest stale takeover:\n${JSON.stringify(staleLivenessState.automation, null, 2)}`);
+  }
+  hcc(['task', 'update', '--peer', 'human', '--force', '--id', staleLivenessTaskId, '--status', 'abandoned', '--summary', 'stale liveness cleanup']);
   hcc(['task', 'update', '--peer', 'human', '--id', queuedTaskId, '--status', 'abandoned', '--summary', 'queued task cleanup']);
   hcc(['handoff', 'create', '--from', 'codex-a', '--to', 'claude-a', '--task', taskId, '--summary', 'handoff summary', '--tests', 'full script', '--risks', 'none']);
   if (!hcc(['handoff', 'list', '--task', taskId]).includes('handoff summary')) fail('handoff missing');
@@ -1254,6 +1365,27 @@ async function dbWorkflow() {
   }
   hcc(['task', 'done', '--peer', 'codex-team-captain', '--id', teamParentId, '--summary', 'team regression done']);
 
+  const scopedA = hcc(['lock', 'acquire', '--peer', 'codex-a', '--resource', 'bin/hcc.mjs', '--scope', 'db-schema', '--ttl', '60', '--reason', 'db split']);
+  const scopedB = hcc(['lock', 'acquire', '--peer', 'codex-b', '--resource', 'bin/hcc.mjs', '--scope', 'web-ui', '--ttl', '60', '--reason', 'ui split']);
+  if (!scopedA.includes('bin/hcc.mjs [db-schema]') || !scopedB.includes('bin/hcc.mjs [web-ui]')) {
+    fail(`scoped lock output missing labels:\n${scopedA}\n${scopedB}`);
+  }
+  const scopedRows = hccJson(['lock', 'list']);
+  if (!scopedRows.some((row) => row.base_resource === 'bin/hcc.mjs' && row.scope === 'db-schema') ||
+      !scopedRows.some((row) => row.base_resource === 'bin/hcc.mjs' && row.scope === 'web-ui')) {
+    fail(`scoped locks missing from list:\n${JSON.stringify(scopedRows, null, 2)}`);
+  }
+  const duplicateScope = hccMaybe(['lock', 'acquire', '--peer', 'claude-a', '--resource', 'bin/hcc.mjs', '--scope', 'db-schema', '--ttl', '60', '--reason', 'same scope']);
+  if (duplicateScope.status === 0 || !`${duplicateScope.stdout}\n${duplicateScope.stderr}`.includes('conflicts with lock bin/hcc.mjs [db-schema]')) {
+    fail(`same-scope lock was not rejected:\n${duplicateScope.stdout}\n${duplicateScope.stderr}`);
+  }
+  const wholeResource = hccMaybe(['lock', 'acquire', '--peer', 'claude-a', '--resource', 'bin/hcc.mjs', '--ttl', '60', '--reason', 'whole file']);
+  if (wholeResource.status === 0 || !`${wholeResource.stdout}\n${wholeResource.stderr}`.includes('conflicts with lock bin/hcc.mjs [db-schema]')) {
+    fail(`whole-resource lock did not conflict with scoped locks:\n${wholeResource.stdout}\n${wholeResource.stderr}`);
+  }
+  hcc(['lock', 'release', '--peer', 'codex-a', '--resource', 'bin/hcc.mjs', '--scope', 'db-schema']);
+  hcc(['lock', 'release', '--peer', 'codex-b', '--resource', 'bin/hcc.mjs', '--scope', 'web-ui']);
+
   const conflictTask = hcc(['task', 'create', '--from', 'human', '--to', 'codex-b', '--title', 'conflict automation task']);
   const conflictTaskMatch = conflictTask.match(/created task #(\d+):/);
   if (!conflictTaskMatch) fail(`cannot parse conflict task id: ${conflictTask}`);
@@ -1270,6 +1402,23 @@ async function dbWorkflow() {
   hcc(['lock', 'release', '--peer', 'codex-a', '--resource', 'src/conflict']);
   hcc(['task', 'done', '--peer', 'codex-b', '--id', conflictTaskId, '--summary', 'conflict done']);
 
+  const takeoverTask = hcc(['task', 'create', '--from', 'human', '--to', 'codex-owner', '--title', 'takeover regression task']);
+  const takeoverTaskMatch = takeoverTask.match(/created task #(\d+):/);
+  if (!takeoverTaskMatch) fail(`cannot parse takeover task id: ${takeoverTask}`);
+  const takeoverTaskId = takeoverTaskMatch[1];
+  hcc(['task', 'claim', '--peer', 'codex-owner', '--id', takeoverTaskId]);
+  const takeoverOutput = hcc(['task', 'takeover', '--peer', 'codex-taker', '--id', takeoverTaskId, '--reason', 'owner inactive']);
+  if (!takeoverOutput.includes(`took over task #${takeoverTaskId}`)) fail(`takeover output wrong:\n${takeoverOutput}`);
+  const takeoverRow = hccJson(['task', 'list', '--all']).find((row) => String(row.id) === String(takeoverTaskId));
+  if (!takeoverRow || takeoverRow.owner !== 'codex-taker' || takeoverRow.status !== 'claimed') {
+    fail(`takeover task row wrong:\n${JSON.stringify(takeoverRow, null, 2)}`);
+  }
+  const takeoverOwnerInbox = hcc(['msg', 'inbox', '--peer', 'codex-owner']);
+  if (!takeoverOwnerInbox.includes(`Task #${takeoverTaskId} taken over by codex-taker`)) {
+    fail(`takeover did not notify previous owner:\n${takeoverOwnerInbox}`);
+  }
+  hcc(['task', 'done', '--peer', 'codex-taker', '--id', takeoverTaskId, '--summary', 'takeover done']);
+
   const abandoned = hcc(['task', 'create', '--from', 'human', '--title', 'abandoned regression task']);
   const abandonedMatch = abandoned.match(/created task #(\d+):/);
   if (!abandonedMatch) fail(`cannot parse abandoned task id: ${abandoned}`);
@@ -1961,9 +2110,7 @@ async function downGcPackWorkflow() {
     'CHANGELOG.md',
     'docs/commands.md',
     'docs/commands.zh-CN.md',
-    'lib/guidance.mjs',
-    'lib/package-meta.mjs',
-    'lib/release-notes.mjs',
+    ...libModuleFiles(),
     'scripts/github-release.mjs'
   ]) {
     if (!files.has(file)) fail(`npm package missing ${file}`);
@@ -2030,15 +2177,14 @@ function oldNameScan() {
   if (rg.status !== 1) fail(`rg failed:\n${rg.stderr || rg.stdout}`);
 }
 
-function syntaxAndHelp() {
+async function syntaxAndHelp() {
   log('[11/12] syntax/help');
   run(process.execPath, ['--check', path.join(repoRoot, 'bin', 'hcc.mjs')]);
-  run(process.execPath, ['--check', path.join(repoRoot, 'lib', 'setup.mjs')]);
-  run(process.execPath, ['--check', path.join(repoRoot, 'lib', 'discover.mjs')]);
-  run(process.execPath, ['--check', path.join(repoRoot, 'lib', 'guidance.mjs')]);
-  run(process.execPath, ['--check', path.join(repoRoot, 'lib', 'package-meta.mjs')]);
-  run(process.execPath, ['--check', path.join(repoRoot, 'lib', 'release-notes.mjs')]);
+  for (const file of libModuleFiles()) {
+    run(process.execPath, ['--check', path.join(repoRoot, file)]);
+  }
   const hccSource = fs.readFileSync(hccBin, 'utf8');
+  const webUiTemplateSource = fs.readFileSync(path.join(repoRoot, 'lib', 'web-ui-template.mjs'), 'utf8');
   for (const expected of [
     'function scheduleTmuxInputRefresh(session)',
     "runTmux(['pipe-pane', '-t', session.pane]);",
@@ -2050,9 +2196,25 @@ function syntaxAndHelp() {
   ]) {
     if (!hccSource.includes(expected)) fail(`web terminal input refresh support missing: ${expected}`);
   }
+  for (const expected of [
+    'function detectedPeerCanStop(peer)',
+    "if (['exited', 'detached'].includes(status)) return false;",
+    'const canStop = detectedPeerCanStop(p);',
+    '${canStop ?',
+    "if (e.target.closest('[data-action]')) return;",
+    'id="stopKillLabel" data-i18n="dialog.killTmux"',
+    'id="stopCancelBtn" type="button" data-i18n="dialog.cancel"',
+    'id="stopConfirmBtn" type="button" data-i18n="stop"'
+  ]) {
+    if (!webUiTemplateSource.includes(expected)) fail(`web display regression guard missing: ${expected}`);
+  }
+  if (webUiTemplateSource.includes("p.status === 'running' ?")) {
+    fail('detected peer action rendering still depends on status === running instead of liveness');
+  }
   for (const expected of [
     'function webPeerAction(projectCtx, peer, action, input = {})',
-    'function claimNextTaskForPeer(db, peer, force = false)',
+    'function claimNextTasksForPeer(db, peer, { force = false, count = 1 } = {})',
+    'function takeOverTaskForPeer(db, peer, id, { reason, policy = ',
     'function statusSummary(ctx, peer = null, identity = null)',
     'const peerActionMatch = url.pathname.match(/^\\/api\\/peers\\/([^/]+)\\/actions\\/([^/]+)$/)',
     "const readOnly = ['status', 'state', 'inbox'].includes(action)",
@@ -2066,10 +2228,100 @@ function syntaxAndHelp() {
     fail(`CLI version ${cliVersion} does not match package.json ${packageVersion}`);
   }
   if (!hccSource.includes("import { readPackageMeta } from '../lib/package-meta.mjs'") ||
+      !hccSource.includes("} from '../lib/cli-args.mjs'") ||
+      !hccSource.includes("import { CliError } from '../lib/errors.mjs'") ||
+      !hccSource.includes("} from '../lib/db-schema.mjs'") ||
+      !hccSource.includes("} from '../lib/format.mjs'") ||
+      !hccSource.includes("} from '../lib/runtime-paths.mjs'") ||
+      !hccSource.includes("} from '../lib/web-runtime.mjs'") ||
+      !hccSource.includes("} from '../lib/web-http.mjs'") ||
+      !hccSource.includes("import { webIndexHtml } from '../lib/web-ui-template.mjs'") ||
       !hccSource.includes('const VERSION = PACKAGE_META.version') ||
       !hccSource.includes('writeGuidanceForRoot(ctx.root)')) {
-    fail('CLI still has duplicated package metadata or guidance wiring');
-  }
+    fail('CLI still has duplicated package metadata, cli args, DB schema helpers, format helpers, runtime paths, web runtime/HTTP/UI helpers, or guidance wiring');
+  }
+  if (hccSource.includes('function createBaseSchema') ||
+      hccSource.includes('function runSchemaMigrations') ||
+      hccSource.includes('function readSchemaVersion')) {
+    fail('CLI still embeds DB schema or migration helpers');
+  }
+  for (const helper of [
+    'function runtimeBaseUrl',
+    'function runtimeApiUrl',
+    'function requestUrl',
+    'function runtimeUrlQuery',
+    'function makeWebToken',
+    'function validateWebTokenOpts',
+    'function expectedWebHost',
+    'function webRuntimeMatchesRequest',
+    'function publicRuntimeUrl',
+    'function localRuntimeUrl'
+  ]) {
+    if (hccSource.includes(helper)) fail(`CLI still embeds web runtime helper: ${helper}`);
+  }
+  for (const helper of [
+    'function readRequestBody',
+    'function readJsonRequest',
+    'function sendHttp',
+    'function sendJson',
+    'function sendFile',
+    'function authOk'
+  ]) {
+    if (hccSource.includes(helper)) fail(`CLI still embeds web HTTP helper: ${helper}`);
+  }
+  if (hccSource.includes('new URL(req.url')) fail('CLI still embeds raw server request URL parsing');
+  if (hccSource.includes('function webIndexHtml()')) fail('CLI still embeds the web UI template');
+  const webRuntime = await import(path.join(repoRoot, 'lib', 'web-runtime.mjs'));
+  const webHttp = await import(path.join(repoRoot, 'lib', 'web-http.mjs'));
+  const webUiTemplate = await import(path.join(repoRoot, 'lib', 'web-ui-template.mjs'));
+  const expectEqual = (actual, expected, label) => {
+    if (actual !== expected) fail(`${label}: expected ${expected}, got ${actual}`);
+  };
+  const html = webUiTemplate.webIndexHtml();
+  if (!html.includes('<!doctype html>') ||
+      !html.includes('<div class="app">') ||
+      !html.includes('<script src="/assets/xterm.js"></script>')) {
+    fail('web UI template module did not render the expected shell HTML');
+  }
+  const jsonReq = Readable.from(['{"ok":true}']);
+  jsonReq.headers = {};
+  const parsedJson = await webHttp.readJsonRequest(jsonReq);
+  if (parsedJson.ok !== true) fail(`web HTTP helper failed to parse JSON request: ${JSON.stringify(parsedJson)}`);
+  const emptyReq = Readable.from(['']);
+  emptyReq.headers = {};
+  const parsedEmpty = await webHttp.readJsonRequest(emptyReq);
+  if (Object.keys(parsedEmpty).length !== 0) fail(`web HTTP helper failed empty request fallback: ${JSON.stringify(parsedEmpty)}`);
+  const mockRes = {
+    status: null,
+    headers: null,
+    body: '',
+    writeHead(status, headers) { this.status = status; this.headers = headers; },
+    end(body) { this.body = body; }
+  };
+  webHttp.sendJson(mockRes, 202, { ok: true });
+  if (mockRes.status !== 202 ||
+      mockRes.headers?.['Content-Type'] !== 'application/json; charset=utf-8' ||
+      mockRes.headers?.['Cache-Control'] !== 'no-store' ||
+      !mockRes.body.includes('"ok": true')) {
+    fail(`web HTTP helper failed sendJson response: ${JSON.stringify(mockRes)}`);
+  }
+  if (!webHttp.authOk(new URL('http://example.test/?token=tok'), { headers: {} }, 'tok') ||
+      !webHttp.authOk(new URL('http://example.test/'), { headers: { authorization: 'Bearer tok' } }, 'tok') ||
+      webHttp.authOk(new URL('http://example.test/?token=bad'), { headers: {} }, 'tok')) {
+    fail('web HTTP helper authOk token checks failed');
+  }
+  const wildcardRuntime = { host: '0.0.0.0', port: 8787, token: 'tok' };
+  const ipv6WildcardRuntime = { host: '::', port: 8788, token: 'tok' };
+  const localRuntime = { host: '127.0.0.1', port: 8789, token: 'tok' };
+  expectEqual(webRuntime.runtimeBaseUrl('0.0.0.0', 8787), 'http://127.0.0.1:8787', 'runtimeBaseUrl 0.0.0.0');
+  expectEqual(webRuntime.runtimeBaseUrl('::', 8788), 'http://127.0.0.1:8788', 'runtimeBaseUrl ::');
+  expectEqual(String(webRuntime.runtimeApiUrl({ base_url: 'http://127.0.0.1:8787/base' }, '/api/state?peer=a b')), 'http://127.0.0.1:8787/api/state?peer=a%20b', 'runtimeApiUrl route');
+  expectEqual(String(webRuntime.requestUrl({ url: '/api/state?peer=a b', headers: { host: 'example.test:8787' } })), 'http://example.test:8787/api/state?peer=a%20b', 'requestUrl host and query');
+  expectEqual(String(webRuntime.requestUrl({ url: '', headers: {} })), 'http://localhost/', 'requestUrl fallback');
+  expectEqual(webRuntime.publicRuntimeUrl(wildcardRuntime, '/tmp/hcc project'), 'http://<machine-ip>:8787/?token=tok&project=%2Ftmp%2Fhcc%20project', 'publicRuntimeUrl wildcard');
+  expectEqual(webRuntime.localRuntimeUrl(wildcardRuntime, '/tmp/hcc project'), 'http://127.0.0.1:8787/?token=tok&project=%2Ftmp%2Fhcc%20project', 'localRuntimeUrl wildcard');
+  expectEqual(webRuntime.publicRuntimeUrl(ipv6WildcardRuntime, '/tmp/hcc project'), 'http://<machine-ip>:8788/?token=tok&project=%2Ftmp%2Fhcc%20project', 'publicRuntimeUrl ipv6 wildcard');
+  expectEqual(webRuntime.localRuntimeUrl(localRuntime, null), 'http://127.0.0.1:8789/?token=tok', 'localRuntimeUrl no project');
   const mainHelp = run(process.execPath, [hccBin, '--help']);
   if (mainHelp.includes('setup') || mainHelp.includes('--web-managed')) {
     fail(`public help exposes maintenance or removed commands:\n${mainHelp}`);
@@ -2092,7 +2344,11 @@ function syntaxAndHelp() {
   }
   const taskHelp = run(process.execPath, [hccBin, 'task', '--help']);
   if (!taskHelp.includes('task next [--peer ID] [--force]') ||
+      !taskHelp.includes('[--count N]') ||
       !taskHelp.includes('existing claimed/running/review/blocked task') ||
+      !taskHelp.includes('task takeover [--peer ID] --id N --reason TEXT') ||
+      !taskHelp.includes('[--policy any|blocked|stale|blocked-or-stale]') ||
+      !taskHelp.includes('task claim [--peer ID] --id N[,N]') ||
       !taskHelp.includes('task create --title TEXT --parent N')) {
     fail(`task help missing current-task task next semantics:\n${taskHelp}`);
   }
@@ -2101,9 +2357,18 @@ function syntaxAndHelp() {
     fail(`team help missing expected content:\n${teamHelp}`);
   }
   const stateHelp = run(process.execPath, [hccBin, 'state', '--help']);
-  if (!stateHelp.includes('hcc state') || !stateHelp.includes('automation.next_action.argv') || !stateHelp.includes('automation.current_task') || !stateHelp.includes('hcc team plan')) {
+  if (!stateHelp.includes('hcc state') ||
+      !stateHelp.includes('--scope SCOPE') ||
+      !stateHelp.includes('--intent read|review|work|write|stop|finish') ||
+      !stateHelp.includes('automation.next_action.argv') ||
+      !stateHelp.includes('automation.current_task') ||
+      !stateHelp.includes('hcc team plan')) {
     fail(`state help missing expected content:\n${stateHelp}`);
   }
+  const lockHelp = run(process.execPath, [hccBin, 'lock', '--help']);
+  if (!lockHelp.includes('--scope SCOPE') || !lockHelp.toLowerCase().includes('different scopes on the same resource')) {
+    fail(`lock help missing scoped lock content:\n${lockHelp}`);
+  }
   const updateHelp = run(process.execPath, [hccBin, 'update', '--help']);
   if (!updateHelp.includes('hcc update') || !updateHelp.includes('npm install -g @logicseek/hello-cc@TAG')) {
     fail(`update help missing expected content:\n${updateHelp}`);
@@ -2214,7 +2479,7 @@ async function main() {
   await askBroadcastWorkflow();
   await downGcPackWorkflow();
   oldNameScan();
-  syntaxAndHelp();
+  await syntaxAndHelp();
   uninstallWorkflow();
   log('FULL_REGRESSION_OK');
 }