@logicseek/hello-cc 1.0.0 → 1.0.2-dsh.3

package/lib/shared/file-lock.mjs

@@ -78,13 +78,13 @@ function startupTimeoutError(key) {
   return error;
 }
 
-function canonicalTarget(value) {
+function canonicalTarget(value, { createParent = true } = {}) {
   if (typeof value !== 'string' || value.length === 0) {
     throw new TypeError('file lock target must be a non-empty path');
   }
   const supplied = path.resolve(value);
   const suppliedParent = path.dirname(supplied);
-  fs.mkdirSync(suppliedParent, { recursive: true, mode: 0o700 });
+  if (createParent) fs.mkdirSync(suppliedParent, { recursive: true, mode: 0o700 });
   const canonicalParent = fs.realpathSync.native(suppliedParent);
   const parentIdentity = fs.statSync(canonicalParent);
   if (!parentIdentity.isDirectory()) {
@@ -330,8 +330,12 @@ export function createFileLock({ workerFactory = defaultWorkerFactory } = {}) {
   return function withConfiguredFileLock(
     target,
     fn,
-    { timeoutMs = 5000, retryMs = 25, nonblocking = false } = {}
+    options = {}
   ) {
+    const timeoutMs = options.timeoutMs === undefined ? 5000 : options.timeoutMs;
+    const retryMs = options.retryMs === undefined ? 25 : options.retryMs;
+    const nonblocking = options.nonblocking === undefined ? false : options.nonblocking;
+    const createParent = options.createParent === undefined ? true : options.createParent;
     if (typeof fn !== 'function') throw new TypeError('file lock callback must be a function');
     if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
       throw new RangeError('file lock timeoutMs must be a non-negative finite number');
@@ -342,11 +346,14 @@ export function createFileLock({ workerFactory = defaultWorkerFactory } = {}) {
     if (typeof nonblocking !== 'boolean') {
       throw new TypeError('file lock nonblocking must be a boolean');
     }
+    if (typeof createParent !== 'boolean') {
+      throw new TypeError('file lock createParent must be a boolean');
+    }
     if (fn.constructor?.name === 'AsyncFunction') {
       throw new TypeError('withFileLock requires a synchronous callback');
     }
 
-    const location = canonicalTarget(target);
+    const location = canonicalTarget(target, { createParent });
     const resources = acquireWorker(location, { timeoutMs, retryMs, nonblocking }, workerFactory);
     let result;
     let primary = NO_ERROR;

package/lib/shared/socket-lock-worker.mjs

@@ -10,9 +10,12 @@ export function runSocketLockWorker(workerData) {
   const state = new Int32Array(workerData.stateBuffer);
   const states = workerData.states;
   const targets = workerData.targets;
+  const acceptedSockets = new Set();
   let servers = [];
+  let closeOperation = null;
   let contentionDeadline = null;
   let releasing = false;
+  let terminalFailureRequested = false;
   let finished = false;
   let generation = 0;
 
@@ -24,37 +27,69 @@ export function runSocketLockWorker(workerData) {
 
   function finish(status, detail = 0) {
     if (finished) return;
+    if (terminalFailureRequested) {
+      status = states.FAILED;
+      detail = 1;
+    }
     finished = true;
     publish(status, detail);
     parentPort.close();
   }
 
   function closeServers(callback) {
-    const closing = servers;
-    servers = [];
-    if (closing.length === 0) {
-      callback(null);
+    if (closeOperation !== null) {
+      closeOperation.callbacks.push(callback);
+      if (closeOperation.cleanupStarted) destroyAcceptedSockets();
       return;
     }
-    let remaining = closing.length;
-    let firstError = null;
+    const closing = servers;
+    servers = [];
+    const operation = {
+      callbacks: [callback],
+      cleanupStarted: false,
+      closing,
+      completed: false,
+      firstError: null,
+      remaining: closing.length
+    };
+    closeOperation = operation;
+    const complete = () => {
+      if (operation.completed || !operation.cleanupStarted || operation.remaining !== 0) return;
+      operation.completed = true;
+      closeOperation = null;
+      const callbacks = operation.callbacks;
+      operation.callbacks = [];
+      operation.closing = [];
+      for (const waiting of callbacks) waiting(operation.firstError);
+    };
     const closed = (error = null) => {
-      if (error && !firstError) firstError = error;
-      remaining -= 1;
-      if (remaining === 0) callback(firstError);
+      if (error && !operation.firstError) operation.firstError = error;
+      operation.remaining -= 1;
+      complete();
     };
-    for (const server of closing) {
+    for (const server of operation.closing) {
+      let settled = false;
+      const serverClosed = (error = null) => {
+        if (settled) return;
+        settled = true;
+        closed(error);
+      };
       try {
-        server.close(closed);
+        server.close(serverClosed);
       } catch (error) {
-        closed(error);
+        serverClosed(error);
       }
     }
+    destroyAcceptedSockets();
+    operation.cleanupStarted = true;
+    complete();
   }
 
-  function closeAndFinish(status, detail = 0) {
+  function requestTerminalFailure() {
+    if (finished) return;
+    terminalFailureRequested = true;
     generation += 1;
-    closeServers((error) => finish(error ? states.FAILED : status, error ? 1 : detail));
+    closeServers(() => finish(states.FAILED, 1));
   }
 
   function retryAfterContention() {
@@ -77,8 +112,8 @@ export function runSocketLockWorker(workerData) {
     if (finished || attemptGeneration !== generation) return;
     generation += 1;
     closeServers((error) => {
-      if (error) finish(states.FAILED, 1);
-      else retryAfterContention();
+      if (error) requestTerminalFailure();
+      else if (!terminalFailureRequested) retryAfterContention();
     });
   }
 
@@ -86,6 +121,19 @@ export function runSocketLockWorker(workerData) {
     return `${PROTOCOL_PREFIX}${identity}\n`;
   }
 
+  function serveLock(socket, identity) {
+    acceptedSockets.add(socket);
+    socket.once('close', () => acceptedSockets.delete(socket));
+    socket.on('error', () => {});
+    socket.end(lockBanner(identity));
+  }
+
+  function destroyAcceptedSockets() {
+    for (const socket of acceptedSockets) {
+      try { socket.destroy(); } catch {}
+    }
+  }
+
   function probeOccupant(port, identity, callback) {
     const expected = lockBanner(identity);
     let received = '';
@@ -129,12 +177,11 @@ export function runSocketLockWorker(workerData) {
     const port = target.ports[candidateIndex];
     let candidate;
     try {
-      candidate = net.createServer((socket) => socket.end(lockBanner(target.identity)));
+      candidate = net.createServer((socket) => serveLock(socket, target.identity));
       const bindError = (error) => {
         if (finished || attemptGeneration !== generation) return;
         if (error?.code !== 'EADDRINUSE') {
-          generation += 1;
-          closeServers(() => finish(states.FAILED, 1));
+          requestTerminalFailure();
           return;
         }
         probeOccupant(port, target.identity, (matching) => {
@@ -150,13 +197,12 @@ export function runSocketLockWorker(workerData) {
           return;
         }
         candidate.off('error', bindError);
-        candidate.on('error', () => closeAndFinish(states.FAILED, 1));
+        candidate.on('error', requestTerminalFailure);
         servers.push(candidate);
         bindCandidate(targetIndex, candidateIndex + 1, boundForTarget + 1, attemptGeneration);
       });
     } catch {
-      generation += 1;
-      closeServers(() => finish(states.FAILED, 1));
+      requestTerminalFailure();
     }
   }
 
@@ -184,7 +230,10 @@ export function runSocketLockWorker(workerData) {
         Atomics.load(state, STATE_INDEX) !== states.ACQUIRED) return;
     releasing = true;
     generation += 1;
-    closeServers((error) => finish(error ? states.RELEASE_FAILED : states.RELEASED, error ? 1 : 0));
+    closeServers((error) => {
+      if (terminalFailureRequested) finish(states.FAILED, 1);
+      else finish(error ? states.RELEASE_FAILED : states.RELEASED, error ? 1 : 0);
+    });
   });
 
   try {
@@ -196,6 +245,6 @@ export function runSocketLockWorker(workerData) {
     }
     attemptAll();
   } catch {
-    closeAndFinish(states.FAILED, 1);
+    requestTerminalFailure();
   }
 }

package/lib/terminal/tmux.mjs

@@ -36,14 +36,20 @@ export function runTmux(args, opts = {}) {
   return result.stdout || '';
 }
 
-function tmuxInstallHint() {
-  if (process.platform === 'darwin') return 'Install tmux with: brew install tmux';
-  if (process.platform === 'linux') {
-    if (fs.existsSync('/etc/debian_version')) return 'Install tmux with: sudo apt-get update && sudo apt-get install -y tmux';
-    if (fs.existsSync('/etc/alpine-release')) return 'Install tmux with: sudo apk add tmux';
-    if (fs.existsSync('/etc/arch-release')) return 'Install tmux with: sudo pacman -S --noconfirm tmux';
-    if (fs.existsSync('/etc/fedora-release')) return 'Install tmux with: sudo dnf install -y tmux';
-    return 'Install tmux with your system package manager.';
+export function tmuxInstallHint({
+  platform = process.platform,
+  pathExists = fs.existsSync
+} = {}) {
+  if (platform === 'darwin') return 'Install tmux with: brew install tmux';
+  if (platform === 'linux') {
+    if (pathExists('/etc/debian_version')) return 'Install tmux with: sudo apt-get update && sudo apt-get install -y tmux';
+    if (pathExists('/etc/alpine-release')) return 'Install tmux with: sudo apk add tmux';
+    if (pathExists('/etc/arch-release')) return 'Install tmux with: sudo pacman -S --noconfirm tmux';
+    if (pathExists('/etc/fedora-release') || pathExists('/etc/redhat-release')) {
+      return 'Install tmux with: sudo dnf install -y tmux (or sudo yum install -y tmux on older systems)';
+    }
+    if (pathExists('/etc/SuSE-release')) return 'Install tmux with: sudo zypper --non-interactive install tmux';
+    return 'Install tmux with your Linux system package manager (apt/apt-get, dnf/yum, apk, pacman, or zypper).';
   }
   return 'Install tmux and make sure it is on PATH.';
 }
@@ -54,6 +60,36 @@ function commandExists(name) {
   }).status === 0;
 }
 
+export function tmuxInstallPlan({
+  platform = process.platform,
+  commandAvailable = commandExists,
+  isRoot = typeof process.getuid === 'function' && process.getuid() === 0
+} = {}) {
+  if (platform === 'darwin') {
+    return commandAvailable('brew')
+      ? { manager: 'brew', commands: ['brew install tmux'] }
+      : null;
+  }
+  if (platform !== 'linux') return null;
+
+  if (!isRoot && !commandAvailable('sudo')) return null;
+  const sudo = isRoot ? '' : 'sudo ';
+  if (commandAvailable('apt-get')) {
+    return {
+      manager: 'apt-get',
+      commands: [`${sudo}apt-get update`, `${sudo}apt-get install -y tmux`]
+    };
+  }
+  if (commandAvailable('dnf')) return { manager: 'dnf', commands: [`${sudo}dnf install -y tmux`] };
+  if (commandAvailable('yum')) return { manager: 'yum', commands: [`${sudo}yum install -y tmux`] };
+  if (commandAvailable('apk')) return { manager: 'apk', commands: [`${sudo}apk add tmux`] };
+  if (commandAvailable('pacman')) return { manager: 'pacman', commands: [`${sudo}pacman -S --noconfirm tmux`] };
+  if (commandAvailable('zypper')) {
+    return { manager: 'zypper', commands: [`${sudo}zypper --non-interactive install tmux`] };
+  }
+  return null;
+}
+
 function runInstallCommand(command) {
   const result = spawnSync('sh', ['-lc', command], {
     encoding: 'utf8',
@@ -70,22 +106,16 @@ export function tryInstallTmux() {
   if (process.env.HCC_NO_AUTO_INSTALL_TMUX === '1') {
     return { ok: false, output: 'automatic tmux installation disabled by HCC_NO_AUTO_INSTALL_TMUX=1' };
   }
-  const sudo = typeof process.getuid === 'function' && process.getuid() === 0 ? '' : (commandExists('sudo') ? 'sudo ' : '');
-  if (process.platform === 'darwin' && commandExists('brew')) {
-    return runInstallCommand('brew install tmux');
-  }
-  if (process.platform === 'linux') {
-    if (commandExists('apt-get')) {
-      const update = runInstallCommand(`${sudo}apt-get update`);
-      if (!update.ok) return update;
-      return runInstallCommand(`${sudo}apt-get install -y tmux`);
-    }
-    if (commandExists('dnf')) return runInstallCommand(`${sudo}dnf install -y tmux`);
-    if (commandExists('yum')) return runInstallCommand(`${sudo}yum install -y tmux`);
-    if (commandExists('apk')) return runInstallCommand(`${sudo}apk add tmux`);
-    if (commandExists('pacman')) return runInstallCommand(`${sudo}pacman -S --noconfirm tmux`);
+  const plan = tmuxInstallPlan();
+  if (!plan) return { ok: false, output: 'no supported package manager with sufficient privileges found' };
+
+  const output = [];
+  for (const command of plan.commands) {
+    const result = runInstallCommand(command);
+    if (result.output) output.push(result.output);
+    if (!result.ok) return { ok: false, output: output.join('\n') };
   }
-  return { ok: false, output: 'no supported package manager found' };
+  return { ok: true, output: output.join('\n') };
 }
 
 export function ensureTmuxAvailable({ autoInstall = true } = {}) {

package/lib/ui/help.mjs

@@ -8,13 +8,15 @@ export function createHelpFunctions(config = {}) {
     helpMain() {
       console.log(`${productName} ${version}
 
-Project-local coordination bus for multiple Claude Code and Codex CLI sessions.
+Project-local coordination bus for Claude Code, Codex, and DeepSeek Harness sessions.
 
 Usage:
   ${cliName} [--root DIR] [--db FILE] [--json] <command> [args]
 
 Commands:
   web                          Start coordination, shims, tmux, and browser console
+  dsh <setup|status|web>        Connect DeepSeek Harness through project-local hooks
+  native <subcommand>           Run owned Codex/Claude/dsh workers through native protocols
   up                           Initialize local coordination only
   down                         Stop the running hello-cc web runtime
   update                       Update the global npm install of hello-cc
@@ -44,7 +46,8 @@ Commands:
   gc [--older-than DAYS] [--history] [--yes] Clean technical state; opt in to history cleanup
   doctor                       Run a read-only database health check (integrity, sizes, row counts)
 Internal:
-  hook                         Hook entrypoint used by Claude/Codex
+  mcp serve --peer ID           Serve executor-authorized project coordination tools over stdio
+  hook                         Hook entrypoint used by Claude/Codex/dsh
   find-root                    Shim helper
   which-real                   Shim helper
 

package/lib/web/adoption-state.mjs

@@ -0,0 +1,55 @@
+// Persist Web terminal detachment separately from process liveness. Existing
+// audit events survive a runtime restart without changing the database schema.
+
+function identityFor(value = {}) {
+  const identity = value.adoptionIdentity || value.identity || value;
+  const processIdentity = identity.process_identity || identity.processIdentity || {};
+  return {
+    pid: identity.pid || processIdentity.pid || value.pid || null,
+    process_start_token: identity.process_start_token || processIdentity.startToken || null,
+    tmux_session_created: identity.tmux_session_created || identity.session_created || null,
+    tmux_session_id: identity.tmux_session_id || identity.session_id || null
+  };
+}
+
+export function writeAdoptionState(db, session, paused, time) {
+  const peer = session?.peerId || session?.peer || session?.id;
+  if (typeof peer !== 'string' || !peer || typeof paused !== 'boolean' ||
+      !Number.isSafeInteger(time) || time < 0) {
+    throw new TypeError('Adoption state requires a peer, a boolean paused value, and an integer timestamp');
+  }
+  const payload = {
+    peer,
+    pane: session.pane || null,
+    identity: identityFor(session),
+    source: 'web',
+    target_peer: peer,
+    runtime_session_id: session.id || null
+  };
+  db.prepare(`
+    INSERT INTO events(type, actor, task_id, payload, created_at)
+    VALUES (?, 'web', NULL, ?, ?)
+  `).run(paused ? 'web.adoption.paused' : 'web.adoption.resumed', JSON.stringify(payload), time);
+  return { ...payload, paused };
+}
+
+export function adoptionPaused(db, { peer, pane = null, ...observed } = {}) {
+  if (typeof peer !== 'string' || !peer) return false;
+  const event = db.prepare(`
+    SELECT type, payload FROM events
+    WHERE type IN ('web.adoption.paused', 'web.adoption.resumed')
+      AND json_valid(payload)
+      AND json_extract(payload, '$.peer') = ?
+      AND (? IS NULL OR json_extract(payload, '$.pane') = ? OR json_extract(payload, '$.pane') IS NULL)
+    ORDER BY id DESC LIMIT 1
+  `).get(peer, pane, pane);
+  if (!event || event.type !== 'web.adoption.paused') return false;
+  const stored = identityFor(JSON.parse(event.payload));
+  const current = identityFor(observed);
+  // Known identity changes mean a different live terminal. An unavailable
+  // observation cannot silently revoke an intentional pause.
+  for (const key of Object.keys(stored)) {
+    if (stored[key] !== null && current[key] !== null && String(stored[key]) !== String(current[key])) return false;
+  }
+  return true;
+}

package/lib/web/auto-attach.mjs

@@ -5,6 +5,9 @@
 import { inferPeerKind } from '../integrations/providers.mjs';
 import { runTmux } from '../tmux.mjs';
 import { inspectProviderProcess } from '../integrations/peers/processes.mjs';
+import { isDshHookBinding } from '../core/peers/bindings.mjs';
+import { inspectProcessIdentity } from '../process/identity.mjs';
+import { adoptionPaused } from './adoption-state.mjs';
 
 export function createAutoAttach(deps) {
   const {
@@ -17,6 +20,8 @@ export function createAutoAttach(deps) {
     resolveSessionPeerId,
     reAdoptOrphanManagedTmuxSessions, reapDeadPeersForProject
   } = deps;
+  const execTmux = deps.runTmux || runTmux;
+  const inspectIdentity = deps.inspectProcessIdentity || inspectProcessIdentity;
 
   function listTmuxPanesOnce() {
     // Use '|' not '\t' as the field separator: older tmux (3.3a) replaces
@@ -25,7 +30,7 @@ export function createAutoAttach(deps) {
     // user-created session name could contain '|', corrupting the parse. Callers
     // that need the session name use tmuxSessionNameForPane(pane.pane) which
     // queries a single field with no separator issue.
-    const result = runTmux([
+    const result = execTmux([
       'list-panes',
       '-a',
       '-F',
@@ -98,7 +103,7 @@ export function createAutoAttach(deps) {
         SELECT p.id, p.kind, p.role, p.worktree, p.pid,
                b.peer AS binding_peer, b.provider, b.provider_session_id,
                b.provider_session_name, b.resume_mode, b.resume_arg,
-               b.command AS binding_command, b.runtime_session_id,
+               b.command AS binding_command, b.transport AS binding_transport, b.runtime_session_id,
                b.runtime_target
         FROM peers p
         LEFT JOIN peer_bindings b ON b.peer = p.id
@@ -130,12 +135,23 @@ export function createAutoAttach(deps) {
       const attached = attachedTmuxState(ctx, db);
 
       for (const row of rows) {
+        if (['native', 'app-server'].includes(row.binding_transport)) continue;
+        // A dsh PID/pane belongs to the service, which may host many Agent
+        // sessions. A hook's conversation binding grants no terminal control.
+        if (isDshHookBinding({ provider: row.provider || row.kind, transport: row.binding_transport })) continue;
         if (attached.peers.has(row.id)) continue;
         if (row.binding_peer && attached.peers.has(row.binding_peer)) continue;
         if (row.runtime_session_id && attached.peers.has(row.runtime_session_id)) continue;
 
         const pane = paneByPid.get(Number(row.pid));
         if (!pane || attached.panes.has(pane.pane)) continue;
+        const identity = inspectIdentity(pane.pid);
+        if (adoptionPaused(db, {
+          peer: row.id,
+          pane: pane.pane,
+          pid: pane.pid,
+          process_identity: identity?.state === 'live' ? identity.identity : null
+        })) continue;
 
         const binding = row.binding_peer ? {
           provider: row.provider,

package/lib/web/buffer-gc-runtime.mjs

@@ -147,8 +147,8 @@ export function createBufferGcRuntime(deps) {
             olderThanDays: 14,
             dryRun: false,
             scope: 'auto',
-            collectBufferEvidenceNow: () => collectRuntimeBufferEvidence([
-              bufferDirectory(projectCtx)
+            collectBufferEvidenceNow: (directory) => collectRuntimeBufferEvidence([
+              directory
             ])
           });
           const appliedDatabaseRows = result.expired_locks + result.old_events;