@logicseek/hello-cc 0.1.6 → 0.1.8

package/lib/ui/help.mjs

@@ -60,6 +60,8 @@ Environment:
 
 Usage:
   ${cliName} task create --title TEXT [--body TEXT] [--from ID] [--to ID] [--priority N]
+  ${cliName} task dispatch --to ID --title TEXT [--body TEXT] [--from ID] [--message TEXT] [--no-inject] [--force]
+  ${cliName} task dispatch --to ID --id N [--from ID] [--message TEXT] [--no-inject] [--force]
   ${cliName} task create --title TEXT --parent N [--team-role ROLE]
   ${cliName} task list [--status pending|claimed|running|review|blocked|done|abandoned] [--peer ID] [--all]
   ${cliName} task claim [--peer ID] --id N[,N] [--id N] [--ids N,N] [--force]
@@ -74,6 +76,11 @@ Messages use per-peer unread ack state; tasks do not.
 task next returns your existing claimed/running/review/blocked task before
 claiming another pending task. Use --force when intentionally taking additional
 pending tasks; combine it with --count N for explicit batch claims.
+task dispatch explicitly assigns a new or existing task to one peer, sends a
+durable task message, and injects the startup prompt only when the peer has a
+running managed Claude/Codex terminal. Use --no-inject for message-only
+dispatch; use --force only when intentionally injecting while the target already
+owns another active task.
 Use task takeover when explicitly taking over a non-complete task from another
 owner; it records the previous owner, requires a reason, and notifies them.
 Use --policy blocked, stale, or blocked-or-stale to require an auditable
@@ -380,7 +387,7 @@ Usage:
   ${cliName} uninstall [--purge --yes]
 
 Stops the current project runtime and removes user-level hello-cc integrations:
-Claude/Codex hooks and claude/codex shims.
+Claude/Codex hooks, claude/codex shims, and the shell PATH entry for shims.
 
 With --purge --yes, also removes current project data:
   .hello-cc/
@@ -388,6 +395,34 @@ With --purge --yes, also removes current project data:
 `);
     },
 
+    helpInstallHooks() {
+      console.log(`${cliName} install-hooks
+
+Usage:
+  ${cliName} install-hooks
+  ${cliName} install-hooks --status
+  ${cliName} install-hooks --uninstall
+
+Installs, checks, or removes Claude Code and Codex hook entries used by
+hello-cc. This is a maintenance command; hcc up, hcc web, and hcc setup install
+hooks automatically when needed.
+`);
+    },
+
+    helpShim() {
+      console.log(`${cliName} shim
+
+Usage:
+  ${cliName} shim install
+  ${cliName} shim status
+  ${cliName} shim uninstall
+
+Installs, checks, or removes claude/codex shims in ~/.hcc-shims and manages the
+shell PATH entry for that directory. hcc web and hcc setup install shims
+automatically when provider CLIs are available on PATH.
+`);
+    },
+
     helpWeb() {
       console.log(`${cliName} web
 

package/lib/web/peer-actions.mjs

@@ -30,6 +30,7 @@ function requireFn(value, name) {
 export function createWebPeerActions(deps = {}) {
   const activePeerTtl = Number(deps.activePeerTtl ?? DEFAULT_ACTIVE_PEER_TTL);
   const addEvent = requireFn(deps.addEvent, 'addEvent');
+  const assertTaskOwnerForMutation = requireFn(deps.assertTaskOwnerForMutation, 'assertTaskOwnerForMutation');
   const claimNextTasksForPeer = requireFn(deps.claimNextTasksForPeer, 'claimNextTasksForPeer');
   const connect = requireFn(deps.connect, 'connect');
   const defaultLockTtl = Number(deps.defaultLockTtl ?? DEFAULT_LOCK_TTL);
@@ -44,7 +45,32 @@ export function createWebPeerActions(deps = {}) {
   const tx = requireFn(deps.tx, 'tx');
   const upsertPeer = requireFn(deps.upsertPeer, 'upsertPeer');
 
+  function webMutationPeer(peer, input = {}) {
+    const actorPeer = String(input.actorPeer || input.actor_peer || '').trim();
+    if (!actorPeer) {
+      throw new CliError('PEER_IDENTITY_REQUIRED', 'Web peer mutations require a managed session identity');
+    }
+    if (actorPeer !== peer) {
+      throw new CliError('PEER_IDENTITY_MISMATCH', `Web peer action for ${peer} cannot run as ${actorPeer}`, {
+        peer,
+        actor_peer: actorPeer
+      });
+    }
+    return actorPeer;
+  }
+
+  function webAuditPayload(peer, input = {}, extra = {}) {
+    const actorPeer = String(input.actorPeer || input.actor_peer || peer).trim() || peer;
+    return {
+      ...extra,
+      source: 'web',
+      actor_peer: actorPeer,
+      target_peer: peer
+    };
+  }
+
   function webPeerRegister(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const db = connect(projectCtx);
     const row = {
       id: peer,
@@ -58,7 +84,7 @@ export function createWebPeerActions(deps = {}) {
     };
     try {
       upsertPeer(db, row);
-      addEvent(db, 'peer.registered', peer, null, { ...row, source: 'web' });
+      addEvent(db, 'peer.registered', peer, null, webAuditPayload(peer, input, row));
     } finally {
       db.close();
     }
@@ -66,6 +92,7 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerHeartbeat(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const ttl = intOpt(input, 'ttl', defaultLockTtl);
     const status = input.status || null;
     const renewLocks = input['renew-locks'] !== false && input.renew_locks !== false;
@@ -80,7 +107,7 @@ export function createWebPeerActions(deps = {}) {
           WHERE owner = ? AND expires_at > ?
         `).run(t + ttl, peer, t).changes;
       }
-      addEvent(db, 'peer.heartbeat', peer, null, { status, renewed, source: 'web' });
+      addEvent(db, 'peer.heartbeat', peer, null, webAuditPayload(peer, input, { status, renewed }));
     } finally {
       db.close();
     }
@@ -93,6 +120,7 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerTaskNext(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const db = connect(projectCtx);
     try {
       touchPeer(db, peer, 'working');
@@ -117,6 +145,7 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerTaskTakeover(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const id = intOpt(input, 'id', intOpt({ id: input.task }, 'id'));
     if (!id) throw new CliError('BAD_REQUEST', 'task id required');
     const reason = required(input, 'reason');
@@ -133,6 +162,7 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerLockAcquire(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const requested = scopedLockResource(required(input, 'resource'), input.scope);
     const ttl = intOpt(input, 'ttl', defaultLockTtl);
     const taskId = intOpt(input, 'task', intOpt(input, 'task_id', null));
@@ -142,6 +172,11 @@ export function createWebPeerActions(deps = {}) {
       touchPeer(db, peer, 'working');
       const lock = tx(db, () => {
         const t = now();
+        if (taskId) {
+          const task = db.prepare('SELECT * FROM tasks WHERE id = ?').get(taskId);
+          if (!task) throw new CliError('NOT_FOUND', `Task #${taskId} does not exist`);
+          assertTaskOwnerForMutation(db, peer, task, 'lock-acquire');
+        }
         const activeLocks = db.prepare('SELECT * FROM locks WHERE expires_at > ?').all(t);
         const conflict = activeLocks.find((row) => locksConflict(row, requested) && row.owner !== peer);
         if (conflict) {
@@ -166,7 +201,7 @@ export function createWebPeerActions(deps = {}) {
             reason = excluded.reason,
             expires_at = excluded.expires_at
         `).run(requested.resource, requested.base_resource, requested.scope, peer, taskId, reason, t + ttl, existing ? existing.created_at : t);
-        addEvent(db, 'lock.acquired', peer, taskId, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, ttl, previous_owner: existing ? existing.owner : null, source: 'web' });
+        addEvent(db, 'lock.acquired', peer, taskId, webAuditPayload(peer, input, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, ttl, previous_owner: existing ? existing.owner : null }));
         return db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
       });
       return { peer, lock, summary: `locked ${lockLabel(lock)} by ${lock.owner} until ${iso(lock.expires_at)}` };
@@ -176,19 +211,20 @@ export function createWebPeerActions(deps = {}) {
   }
 
   function webPeerLockRelease(projectCtx, peer, input = {}) {
+    webMutationPeer(peer, input);
     const requested = scopedLockResource(required(input, 'resource'), input.scope);
-    const force = Boolean(input.force);
+    const force = false;
     const db = connect(projectCtx);
     try {
       touchPeer(db, peer, null);
       const result = tx(db, () => {
         const existing = db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
         if (!existing) return { released: false, ...requested };
-        if (existing.owner !== peer && !force) {
+        if (existing.owner !== peer) {
           throw new CliError('LOCK_OWNED', `Lock is owned by ${existing.owner}`, { owner: existing.owner });
         }
         db.prepare('DELETE FROM locks WHERE resource = ?').run(requested.resource);
-        addEvent(db, 'lock.released', peer, existing.task_id || null, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, force, source: 'web' });
+        addEvent(db, 'lock.released', peer, existing.task_id || null, webAuditPayload(peer, input, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, force }));
         return { released: true, ...requested };
       });
       return { peer, result, summary: result.released ? `released ${lockLabel(result)}` : `no lock for ${lockLabel(result)}` };

package/lib/web/ui-template.mjs

@@ -1693,7 +1693,7 @@ export function webIndexHtml() {
         if (!body) return;
         await api('/api/detected/' + encodeURIComponent(peer.id) + '/msg', {
           method: 'POST',
-          body: JSON.stringify({ body, from: 'web' })
+          body: JSON.stringify({ body })
           });
           document.getElementById('detMsg').value = '';
           await refreshDetectedState();
@@ -1733,7 +1733,8 @@ export function webIndexHtml() {
       const session = sessions.find((s) => s.id === active) || { id: active, kind: 'other', role: 'peer' };
       return {
         session,
-        peerId: sessionPeerId(session) || active
+        peerId: sessionPeerId(session) || active,
+        actionToken: session.action_token || ''
       };
     }
 
@@ -1807,12 +1808,13 @@ export function webIndexHtml() {
     async function runPeerAction(action) {
       const info = activePeerInfo();
       if (!info) return;
+      const readOnly = ['status', 'state', 'inbox'].includes(action);
       const payload = action === 'register'
         ? { kind: info.session.kind || 'other', role: info.session.role || 'peer', worktree: info.session.cwd || currentProject }
         : action === 'heartbeat'
           ? { renew_locks: true }
           : {};
-      const readOnly = ['status', 'state', 'inbox'].includes(action);
+      if (!readOnly) payload.action_token = info.actionToken;
       const result = await api('/api/peers/' + encodeURIComponent(info.peerId) + '/actions/' + encodeURIComponent(action), readOnly
         ? {}
         : { method: 'POST', body: JSON.stringify(payload) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logicseek/hello-cc",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Local control plane for coordinating Claude Code, Codex, and other coding CLI sessions.",
   "type": "module",
   "bin": {