@logicseek/hello-cc 0.1.6 → 0.1.7

package/lib/cli-runtime.mjs

@@ -8,7 +8,8 @@ export function createContext(global = {}, deps = {}) {
   const detectRoot = deps.detectRoot;
   if (typeof detectRoot !== 'function') throw new TypeError('createContext requires deps.detectRoot');
   const root = detectRoot(cwd, global.root);
-  const dbPath = path.resolve(global.db || process.env.HCC_DB || projectDbPath(root));
+  const envDb = global.root ? null : process.env.HCC_DB;
+  const dbPath = path.resolve(global.db || envDb || projectDbPath(root));
   return { cwd, root, dbPath, json: global.json, explicitRoot: Boolean(global.root || process.env.HCC_ROOT) };
 }
 

package/lib/core/coordination/tasks.mjs

@@ -19,6 +19,16 @@ export function createTaskStore(deps = {}) {
   const sendMessage = typeof deps.sendMessage === 'function' ? deps.sendMessage : noopMessage;
   const activePeerTtl = Number(deps.activePeerTtl || DEFAULT_ACTIVE_PEER_TTL);
 
+  function taskOwnedError(peer, row, action) {
+    return new CliError('TASK_OWNED', `Task #${row.id} is owned by ${row.owner}`, {
+      owner: row.owner,
+      task_id: row.id,
+      attempted_by: peer,
+      action,
+      notify_owner: true
+    });
+  }
+
   function claimTaskRowsForPeer(db, peer, ids, { force = false, source = null } = {}) {
     return tx(db, () => {
       const tasks = [];
@@ -26,7 +36,7 @@ export function createTaskStore(deps = {}) {
         const row = db.prepare('SELECT * FROM tasks WHERE id = ?').get(id);
         if (!row) throw new CliError('NOT_FOUND', `Task #${id} does not exist`);
         if (row.owner && row.owner !== peer && !force) {
-          throw new CliError('TASK_OWNED', `Task #${id} is owned by ${row.owner}`, { owner: row.owner });
+          throw taskOwnedError(peer, row, 'claim');
         }
         if (row.assignee && row.assignee !== peer && !force) {
           throw new CliError('TASK_ASSIGNED', `Task #${id} is assigned to ${row.assignee}`, { assignee: row.assignee });
@@ -211,7 +221,13 @@ export function createTaskStore(deps = {}) {
     });
   }
 
+  function assertTaskOwnerForMutation(db, peer, row, action) {
+    if (!row.owner || row.owner === peer) return;
+    throw taskOwnedError(peer, row, action);
+  }
+
   return {
+    assertTaskOwnerForMutation,
     claimNextTasksForPeer,
     claimTaskRowsForPeer,
     queryOpenTasks,

package/lib/core/coordination/timeline.mjs

@@ -25,7 +25,7 @@ export function taskParticipants(task) {
 
 export function payloadParticipants(payload) {
   const values = [];
-  for (const key of ['peer', 'from_peer', 'to_peer', 'assignee', 'owner', 'recipient', 'kept_peer', 'removed_peer', 'previous_owner']) {
+  for (const key of ['peer', 'actor_peer', 'target_peer', 'from_peer', 'to_peer', 'assignee', 'owner', 'recipient', 'kept_peer', 'removed_peer', 'previous_owner']) {
     if (payload?.[key] && payload[key] !== 'all') values.push(payload[key]);
   }
   return uniqueList(values);
@@ -59,13 +59,22 @@ const TIMELINE_EVENT_ALLOW = new Set([
   'peer.registered',
   'peer.joined',
   'peer.auto_joined',
+  'peer.start.requested',
+  'peer.attach.requested',
+  'peer.stop.requested',
   'peer.stopped',
+  'peer.restarted',
   'provider.session.merged',
+  'provider.session.rebound',
   'web.session.started',
   'web.session.exited',
+  'web.session.stop_requested',
   'tmux.session.attached',
   'tmux.session.detached',
   'tmux.session.exited',
+  'tmux.session.restarted',
+  'tmux.session.rebound',
+  'tmux.session.gc',
   'run.session.started',
   'run.session.exited'
 ]);

package/lib/core/peers/identity.mjs

@@ -43,8 +43,16 @@ export function autoPeerId(ctx, kindHint = 'shell', observation = {}) {
 }
 
 export function resolveCurrentPeer(ctx, opts = {}, key = 'peer', kindHint = 'shell', observation = {}) {
-  if (opts[key]) return { id: opts[key], auto: false };
-  if (observation.env?.HCC_PEER) return { id: observation.env.HCC_PEER, auto: false };
+  const explicit = opts[key] || '';
+  const envPeer = observation.env?.HCC_PEER || '';
+  if (envPeer) {
+    return {
+      id: envPeer,
+      auto: false,
+      corrected_from: explicit && explicit !== envPeer ? explicit : null
+    };
+  }
+  if (explicit) return { id: explicit, auto: false, corrected_from: null };
   return { id: autoPeerId(ctx, kindHint, observation), auto: true };
 }
 

package/lib/web/peer-actions.mjs

@@ -30,6 +30,7 @@ function requireFn(value, name) {
 export function createWebPeerActions(deps = {}) {
   const activePeerTtl = Number(deps.activePeerTtl ?? DEFAULT_ACTIVE_PEER_TTL);
   const addEvent = requireFn(deps.addEvent, 'addEvent');
+  const assertTaskOwnerForMutation = requireFn(deps.assertTaskOwnerForMutation, 'assertTaskOwnerForMutation');
   const claimNextTasksForPeer = requireFn(deps.claimNextTasksForPeer, 'claimNextTasksForPeer');
   const connect = requireFn(deps.connect, 'connect');
   const defaultLockTtl = Number(deps.defaultLockTtl ?? DEFAULT_LOCK_TTL);
@@ -44,7 +45,32 @@ export function createWebPeerActions(deps = {}) {
   const tx = requireFn(deps.tx, 'tx');
   const upsertPeer = requireFn(deps.upsertPeer, 'upsertPeer');
 
+  function webMutationPeer(peer, input = {}) {
+    const actorPeer = String(input.actorPeer || input.actor_peer || '').trim();
+    if (!actorPeer) {
+      throw new CliError('PEER_IDENTITY_REQUIRED', 'Web peer mutations require a managed session identity');
+    }
+    if (actorPeer !== peer) {
+      throw new CliError('PEER_IDENTITY_MISMATCH', `Web peer action for ${peer} cannot run as ${actorPeer}`, {
+        peer,
+        actor_peer: actorPeer
+      });
+    }
+    return actorPeer;
+  }
+
+  function webAuditPayload(peer, input = {}, extra = {}) {
+    const actorPeer = String(input.actorPeer || input.actor_peer || peer).trim() || peer;
+    return {
+      ...extra,
+      source: 'web',
+      actor_peer: actorPeer,
+      target_peer: peer
+    };
+  }
+
   function webPeerRegister(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const db = connect(projectCtx);
     const row = {
       id: peer,
@@ -58,7 +84,7 @@ export function createWebPeerActions(deps = {}) {
     };
     try {
       upsertPeer(db, row);
-      addEvent(db, 'peer.registered', peer, null, { ...row, source: 'web' });
+      addEvent(db, 'peer.registered', peer, null, webAuditPayload(peer, input, row));
     } finally {
       db.close();
     }
@@ -66,6 +92,7 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerHeartbeat(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const ttl = intOpt(input, 'ttl', defaultLockTtl);
     const status = input.status || null;
     const renewLocks = input['renew-locks'] !== false && input.renew_locks !== false;
@@ -80,7 +107,7 @@ export function createWebPeerActions(deps = {}) {
           WHERE owner = ? AND expires_at > ?
         `).run(t + ttl, peer, t).changes;
       }
-      addEvent(db, 'peer.heartbeat', peer, null, { status, renewed, source: 'web' });
+      addEvent(db, 'peer.heartbeat', peer, null, webAuditPayload(peer, input, { status, renewed }));
     } finally {
       db.close();
     }
@@ -93,6 +120,7 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerTaskNext(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const db = connect(projectCtx);
     try {
       touchPeer(db, peer, 'working');
@@ -117,6 +145,7 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerTaskTakeover(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const id = intOpt(input, 'id', intOpt({ id: input.task }, 'id'));
     if (!id) throw new CliError('BAD_REQUEST', 'task id required');
     const reason = required(input, 'reason');
@@ -133,6 +162,7 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerLockAcquire(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const requested = scopedLockResource(required(input, 'resource'), input.scope);
     const ttl = intOpt(input, 'ttl', defaultLockTtl);
     const taskId = intOpt(input, 'task', intOpt(input, 'task_id', null));
@@ -142,6 +172,11 @@ export function createWebPeerActions(deps = {}) {
       touchPeer(db, peer, 'working');
       const lock = tx(db, () => {
         const t = now();
+        if (taskId) {
+          const task = db.prepare('SELECT * FROM tasks WHERE id = ?').get(taskId);
+          if (!task) throw new CliError('NOT_FOUND', `Task #${taskId} does not exist`);
+          assertTaskOwnerForMutation(db, peer, task, 'lock-acquire');
+        }
         const activeLocks = db.prepare('SELECT * FROM locks WHERE expires_at > ?').all(t);
         const conflict = activeLocks.find((row) => locksConflict(row, requested) && row.owner !== peer);
         if (conflict) {
@@ -166,7 +201,7 @@ export function createWebPeerActions(deps = {}) {
             reason = excluded.reason,
             expires_at = excluded.expires_at
         `).run(requested.resource, requested.base_resource, requested.scope, peer, taskId, reason, t + ttl, existing ? existing.created_at : t);
-        addEvent(db, 'lock.acquired', peer, taskId, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, ttl, previous_owner: existing ? existing.owner : null, source: 'web' });
+        addEvent(db, 'lock.acquired', peer, taskId, webAuditPayload(peer, input, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, ttl, previous_owner: existing ? existing.owner : null }));
         return db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
       });
       return { peer, lock, summary: `locked ${lockLabel(lock)} by ${lock.owner} until ${iso(lock.expires_at)}` };
@@ -176,19 +211,20 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerLockRelease(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const requested = scopedLockResource(required(input, 'resource'), input.scope);
-    const force = Boolean(input.force);
+    const force = false;
     const db = connect(projectCtx);
     try {
       touchPeer(db, peer, null);
       const result = tx(db, () => {
         const existing = db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
         if (!existing) return { released: false, ...requested };
-        if (existing.owner !== peer && !force) {
+        if (existing.owner !== peer) {
           throw new CliError('LOCK_OWNED', `Lock is owned by ${existing.owner}`, { owner: existing.owner });
         }
         db.prepare('DELETE FROM locks WHERE resource = ?').run(requested.resource);
-        addEvent(db, 'lock.released', peer, existing.task_id || null, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, force, source: 'web' });
+        addEvent(db, 'lock.released', peer, existing.task_id || null, webAuditPayload(peer, input, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, force }));
         return { released: true, ...requested };
       });
       return { peer, result, summary: result.released ? `released ${lockLabel(result)}` : `no lock for ${lockLabel(result)}` };

package/lib/web/ui-template.mjs

@@ -1693,7 +1693,7 @@ export function webIndexHtml() {
         if (!body) return;
         await api('/api/detected/' + encodeURIComponent(peer.id) + '/msg', {
           method: 'POST',
-          body: JSON.stringify({ body, from: 'web' })
+          body: JSON.stringify({ body })
           });
           document.getElementById('detMsg').value = '';
           await refreshDetectedState();
@@ -1733,7 +1733,8 @@ export function webIndexHtml() {
       const session = sessions.find((s) => s.id === active) || { id: active, kind: 'other', role: 'peer' };
       return {
         session,
-        peerId: sessionPeerId(session) || active
+        peerId: sessionPeerId(session) || active,
+        actionToken: session.action_token || ''
       };
     }
 
@@ -1807,12 +1808,13 @@ export function webIndexHtml() {
     async function runPeerAction(action) {
       const info = activePeerInfo();
       if (!info) return;
+      const readOnly = ['status', 'state', 'inbox'].includes(action);
       const payload = action === 'register'
         ? { kind: info.session.kind || 'other', role: info.session.role || 'peer', worktree: info.session.cwd || currentProject }
         : action === 'heartbeat'
           ? { renew_locks: true }
           : {};
-      const readOnly = ['status', 'state', 'inbox'].includes(action);
+      if (!readOnly) payload.action_token = info.actionToken;
       const result = await api('/api/peers/' + encodeURIComponent(info.peerId) + '/actions/' + encodeURIComponent(action), readOnly
         ? {}
         : { method: 'POST', body: JSON.stringify(payload) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logicseek/hello-cc",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Local control plane for coordinating Claude Code, Codex, and other coding CLI sessions.",
   "type": "module",
   "bin": {