@logicseek/hello-cc 1.0.1 → 1.0.2

package/lib/web/task-results.mjs

@@ -0,0 +1,76 @@
+import { createHash } from 'node:crypto';
+import { selectCurrentTask } from '../core/coordination/automation.mjs';
+import { listTaskResults, recordTaskResult, summarizeTaskResults } from '../core/coordination/results.mjs';
+import { CliError } from '../shared/errors.mjs';
+
+export function createTaskResults({ connectWebProject, resolveSessionPeerId, now, addEvent }) {
+  const turnScopes = new WeakMap();
+  function currentTask(db, peer) {
+    return selectCurrentTask(db.prepare(`SELECT id,title,status,owner,priority FROM tasks
+      WHERE owner = ? AND status NOT IN ('done','abandoned')`).all(peer), peer);
+  }
+  function readSessionResults(session) {
+    const db = connectWebProject(session.ctx);
+    try {
+      const peer = resolveSessionPeerId(db, session);
+      const task = currentTask(db, peer);
+      const results = listTaskResults(db, { peer });
+      return { results, current_task: task, summary: summarizeTaskResults(results.filter(r => r.task_id === task?.id)) };
+    } finally { db.close(); }
+  }
+  function writeSessionResult(session, input) {
+    const db = connectWebProject(session.ctx);
+    try {
+      const peer = resolveSessionPeerId(db, session);
+      const state = session.adapter?.snapshot() || session.nativeSnapshot?.() || {};
+      const result = recordTaskResult(db, { peer, taskId: input.taskId, kind: 'verification',
+        source: 'user', stage: input.stage, status: input.status, title: input.title,
+        details: input.details, evidence: input.evidence, executorId: state.executorId,
+        threadId: state.threadId || state.sessionId, turnId: state.turnId }, { now, addEvent });
+      return { result };
+    } finally { db.close(); }
+  }
+  function observeCodexResults(session, state) {
+    if (!session.binding?.provider_session_id || state.executorId !== session.adapter?.snapshot().executorId) return;
+    const thread = state.threads?.find(t => t.id === session.binding.provider_session_id);
+    if (!thread?.turns?.length) return;
+    const db = connectWebProject(session.ctx);
+    try {
+      const peer = resolveSessionPeerId(db, session);
+      let scopes = turnScopes.get(session);
+      if (!scopes) { scopes = new Map(); turnScopes.set(session, scopes); }
+      for (const event of state.events || []) {
+        if (event.method === 'turn/started' && event.params?.threadId === thread.id && event.params.turn?.id && !scopes.has(event.params.turn.id)) {
+          scopes.set(event.params.turn.id, currentTask(db, peer)?.id || null);
+        }
+      }
+      for (const turn of thread.turns) {
+        const taskId = scopes.get(turn.id);
+        if (!taskId) continue;
+        const common = { peer, taskId, executorId: state.executorId, threadId: thread.id,
+          turnId: turn.id, source: 'executor', stage: 'local' };
+        for (const item of turn.items || []) {
+          if (item.type !== 'commandExecution' || !['completed', 'failed', 'declined'].includes(item.status)) continue;
+          const exitCode = item.exitCode;
+          const status = exitCode === 0 && item.status === 'completed' ? 'passed'
+            : item.status === 'failed' || item.status === 'declined' || (Number.isSafeInteger(exitCode) && exitCode !== 0) ? 'failed' : 'pending';
+          recordTaskResult(db, { ...common, itemId: item.id, kind: 'command', status, exitCode,
+            resultKey: `${state.executorId}:${turn.id}:${item.id}:command`,
+            title: String(item.command || 'Command execution').slice(0, 300),
+            command: String(item.command || '').slice(0, 64000),
+            details: String(item.aggregatedOutput || '').slice(0, 64000), evidence: [] }, { now, addEvent });
+        }
+        if (turn.diff && ['completed', 'failed', 'interrupted'].includes(turn.status)) {
+          const diff = String(turn.diff).slice(0, 64000);
+          recordTaskResult(db, { ...common, kind: 'diff', status: 'pending', title: 'Turn changes awaiting review', diff,
+            resultKey: `${state.executorId}:${turn.id}:diff:${createHash('sha256').update(diff).digest('hex')}` }, { now, addEvent });
+        }
+      }
+      while (scopes.size > 100) scopes.delete(scopes.keys().next().value);
+    } catch (error) {
+      // A delayed executor result must not attach to a task after ownership changed.
+      if (!(error instanceof CliError) || !['TASK_OWNER_MISMATCH', 'NOT_FOUND'].includes(error.code)) throw error;
+    } finally { db.close(); }
+  }
+  return { readSessionResults, writeSessionResult, observeCodexResults };
+}

package/lib/web/tmux-sessions.mjs

@@ -13,11 +13,13 @@ import { tx } from '../db/schema.mjs';
 import { required } from '../cli-args.mjs';
 import { readClockGraceUntil } from '../shared/clock-grace.mjs';
 import { peerEvidenceAllowsReap } from '../core/peers/evidence.mjs';
+import { isDshHookBinding } from '../core/peers/bindings.mjs';
 import { conditionalTmuxKill, conditionalTmuxRename, prepareTmuxRestartBinding, rollbackTmuxRestartBinding, validateTmuxDestructiveEvidence } from '../core/peers/tmux-safety.mjs';
 import { LAUNCH_FINGERPRINT_ENV, PROVIDER_STATE_ENV, childSessionEnv, isRelaunchableProviderSession, isolatedEnvCommandArgs, launchFingerprint, providerRestartReason } from '../core/sessions/launch.mjs';
 import { defaultSessionCommand, inferPeerKind } from '../integrations/providers.mjs';
 import { contextForProject } from '../runtime/paths.mjs';
 import { detectBranch } from '../project-context.mjs';
+import { adoptionPaused } from './adoption-state.mjs';
 import { ensureTmuxAvailable, runTmux, tmuxCapturePane, tmuxEnvironmentArgs, tmuxHasSession, tmuxKillSession, tmuxLaunchFingerprint, tmuxListSessionNames, tmuxManagedSessionName, tmuxManagedSessionNameMatches, tmuxPaneInfo, tmuxProviderState, tmuxSendLiteral, tmuxSessionEnvironmentValue, tmuxSessionHasClients } from '../tmux.mjs';
 
 export function createTmuxSessions(deps) {
@@ -41,6 +43,26 @@ export function createTmuxSessions(deps) {
     findProviderSessionBinding, providerOwnerEvidenceFromDb,
     shellCommand, detectBranch
   } = deps;
+  const adoptionPaneInfo = deps.tmuxPaneInfo || tmuxPaneInfo;
+  const adoptionSessionNames = deps.tmuxListSessionNames || tmuxListSessionNames;
+  const adoptionSessionEnvironment = deps.tmuxSessionEnvironmentValue || tmuxSessionEnvironmentValue;
+  const adoptionSessionMatches = deps.tmuxManagedSessionNameMatches || tmuxManagedSessionNameMatches;
+
+  function isAdoptionPaused(projectCtx, info, peer, existingDb = null) {
+    const db = existingDb || connectWebProject(projectCtx);
+    try {
+      return adoptionPaused(db, {
+        peer,
+        pane: info.pane,
+        pid: info.pid,
+        process_identity: liveProcessIdentity(info.pid),
+        tmux_session_created: tmuxSessionCreationToken(info.pane),
+        tmux_session_id: tmuxSessionId(info.pane)
+      });
+    } finally {
+      if (!existingDb) db.close();
+    }
+  }
 
   // ── Serialize + broadcast helpers ─────────────────────────────────────────
   function detachTmuxSession(session, status = 'detached') {
@@ -493,14 +515,50 @@ export function createTmuxSessions(deps) {
     return false;
   }
 
+  function assertDshTerminalAttachAllowed(db, id, kind, provider) {
+    const binding = db?.prepare('SELECT * FROM peer_bindings WHERE peer = ?').get(id);
+    if (kind !== 'dsh' && provider !== 'dsh' && !isDshHookBinding(binding)) return;
+    throw new CliError('DSH_SESSION_CONTROL_UNSUPPORTED',
+      'dsh sessions use their native Web UI. Use hcc dsh web; the shared service pane cannot be attached as a session terminal.',
+      { peer: id, provider: 'dsh' });
+  }
+
+  function assertStructuredTerminalAttachAllowed(db, id, proposedBinding = null) {
+    const owner = db.prepare('SELECT * FROM peer_bindings WHERE peer = ?').get(id);
+    const providerOwner = proposedBinding && findProviderSessionBinding(db, { ...proposedBinding, peer: id });
+    if ([owner, providerOwner].some(binding => ['native', 'app-server'].includes(binding?.transport))) {
+      throw new CliError('STRUCTURED_SESSION_NO_TERMINAL',
+        'Open the structured worker; a service process or saved thread cannot be replaced with a terminal', { peer: id });
+    }
+  }
+
   function attachTmuxSession(input) {
     const pctx = input.projectCtx || ctx;
     const id = input.id;
     if (!id) throw new CliError('BAD_REQUEST', 'id required');
     const actorPeer = requestActorPeer(input, id);
     const auditSource = requestSource(input, input.autoAttach ? 'runtime' : 'web');
+    // Logical dsh sessions share a service process. Reject before pane
+    // takeover, even when an explicit shell kind or force flag is supplied.
+    const preflightDb = connectWebProject(pctx);
+    try {
+      assertStructuredTerminalAttachAllowed(preflightDb, id, input.binding);
+      assertDshTerminalAttachAllowed(preflightDb, id, input.kind, input.binding?.provider);
+    } finally {
+      preflightDb.close();
+    }
     const info = tmuxPaneInfo(input.pane || null);
     if (info.dead) throw new CliError('TMUX_PANE_DEAD', `tmux pane is not running: ${info.pane}`);
+    const kind = inferPeerKind(id, input.kind || null, info.command);
+    assertDshTerminalAttachAllowed(null, id, kind, input.binding?.provider);
+    for (const existing of sessions.values()) {
+      if (existing.pane === info.pane ||
+          (existing.root === pctx.root && [existing.id, existing.peerId].includes(id)) ||
+          providerSessionBindingMatches(existing.binding, input.binding)) input.authorizeMutation?.(existing);
+    }
+    if ((input.autoAttach || auditSource === 'runtime') && isAdoptionPaused(pctx, info, id)) {
+      throw new CliError('WEB_ADOPTION_PAUSED', 'Web terminal adoption is paused; explicitly attach to resume', { peer: id, pane: info.pane });
+    }
 
     for (const existing of [...sessions.values()]) {
       if (existing.type === 'tmux' && existing.pane === info.pane && existing.id !== id) {
@@ -523,7 +581,6 @@ export function createTmuxSessions(deps) {
       }
     }
 
-    const kind = inferPeerKind(id, input.kind || null, info.command);
     const role = input.role || 'peer';
     const cwd = path.resolve(input.cwd || info.cwd || pctx.root);
     const command = input.command || `tmux ${info.pane} (${info.command})`;
@@ -557,6 +614,12 @@ export function createTmuxSessions(deps) {
       command,
       cwd,
       pid: info.pid,
+      adoptionIdentity: {
+        pid: info.pid,
+        process_identity: attachedEvidence.process_identity,
+        tmux_session_created: attachedEvidence.session_created,
+        tmux_session_id: attachedEvidence.session_id
+      },
       type: 'tmux',
       pane: info.pane,
       status: 'running',
@@ -631,6 +694,9 @@ export function createTmuxSessions(deps) {
         }
       }
       tx(db, () => {
+        // A hook may have registered the same peer after the early check.
+        assertStructuredTerminalAttachAllowed(db, id, nextBinding);
+        assertDshTerminalAttachAllowed(db, id, kind, nextBinding.provider);
         if (rebindOldBindingSubject) {
           const currentOldBinding = db.prepare('SELECT * FROM peer_bindings WHERE peer = ?').get(rebindOldPeer);
           if (JSON.stringify(currentOldBinding || null) !== JSON.stringify(rebindOldBindingSubject)) {
@@ -735,7 +801,7 @@ export function createTmuxSessions(deps) {
 
   function writeSessionInput(session, data) {
     if (session.type === 'external') {
-      try { fs.appendFileSync(session.inFile, data); } catch {}
+      fs.appendFileSync(session.inFile, data);
     } else if (session.type === 'tmux') {
       tmuxSendLiteral(session.pane, data);
       scheduleTmuxInputRefresh(session);
@@ -778,10 +844,16 @@ export function createTmuxSessions(deps) {
   }
 
   function startTmuxManagedSession(input) {
+    for (const existing of sessions.values()) {
+      if (providerSessionBindingMatches(existing.binding, input.binding)) input.authorizeMutation?.(existing);
+    }
     ensureTmuxAvailable({ autoInstall: false });
     const pctx = input.projectCtx || ctx;
     const kind = input.kind || 'shell';
     const id = input.id || nextProjectSessionId(pctx, kind);
+    const structuredDb = connectWebProject(pctx);
+    try { assertStructuredTerminalAttachAllowed(structuredDb, id, input.binding); }
+    finally { structuredDb.close(); }
     const actorPeer = requestActorPeer(input, id);
     const auditSource = requestSource(input, 'web');
     const role = input.role || 'peer';
@@ -1141,7 +1213,9 @@ export function createTmuxSessions(deps) {
         continue;
       }
       try {
-        attachTmuxSession({
+        const info = adoptionPaneInfo(row.runtime_target);
+        if (isAdoptionPaused(projectCtx, info, row.id)) continue;
+        (deps.attachTmuxSession || attachTmuxSession)({
           id: row.id,
           kind: row.kind,
           role: row.role || 'peer',
@@ -1168,7 +1242,7 @@ export function createTmuxSessions(deps) {
     }
     // The fast path above only re-adopts bindings whose runtime_target is still
     // set. Also sweep by session name so sessions left alive with a cleared
-    // runtime_target (default Stop = detach-without-kill) are recovered.
+    // runtime_target are recovered unless an explicit Web detach paused them.
     reAdoptOrphanManagedTmuxSessions(projectCtx);
   }
 
@@ -1181,10 +1255,10 @@ export function createTmuxSessions(deps) {
     const live = new Set();
     let names;
     try {
-      names = tmuxListSessionNames().filter((name) => isProjectManagedTmuxSession(
+      names = adoptionSessionNames().filter((name) => isProjectManagedTmuxSession(
         projectCtx,
         name,
-        tmuxSessionEnvironmentValue(name, 'HCC_ROOT')
+        adoptionSessionEnvironment(name, 'HCC_ROOT')
       ));
     } catch {
       return live;
@@ -1200,7 +1274,7 @@ export function createTmuxSessions(deps) {
         for (const row of db.prepare(`
           SELECT p.id, p.status, p.pid, p.pid_start_token, p.pid_command_hash,
                  b.provider, b.provider_session_id, b.provider_session_name,
-                 b.resume_mode, b.resume_arg, b.command, b.runtime_target
+                 b.resume_mode, b.resume_arg, b.command, b.runtime_target, b.transport
           FROM peers p
           LEFT JOIN peer_bindings b ON b.peer = p.id
         `).all()) {
@@ -1221,15 +1295,16 @@ export function createTmuxSessions(deps) {
 
     for (const name of names) {
       // Ownership: the session's HCC_ROOT env must match this project root.
-      const hccRoot = tmuxSessionEnvironmentValue(name, 'HCC_ROOT');
+      const hccRoot = adoptionSessionEnvironment(name, 'HCC_ROOT');
       if (rootEvidence(projectCtx.root, hccRoot).state !== 'match') continue;
 
       let info;
-      try { info = tmuxPaneInfo(`${name}:0.0`); } catch { continue; }
+      try { info = adoptionPaneInfo(`${name}:0.0`); } catch { continue; }
       if (!info || info.dead) continue;
 
       const candidates = [...bindingByPeer.entries()].filter(([peerId, binding]) => {
-        if (!tmuxManagedSessionNameMatches(projectCtx, name, peerId, hccRoot)) return false;
+        if (['native', 'app-server'].includes(binding.transport)) return false;
+        if (!adoptionSessionMatches(projectCtx, name, peerId, hccRoot)) return false;
         return observePeerEvidence(projectCtx, binding, {
           transport: 'tmux',
           runtime_target: info.pane
@@ -1239,6 +1314,12 @@ export function createTmuxSessions(deps) {
       const [[peerId, b]] = candidates;
       live.add(peerId);
       if (tracked.has(peerId)) continue;
+      try {
+        if (isAdoptionPaused(projectCtx, info, peerId)) continue;
+      } catch {
+        // Missing pause state never authorizes automatic terminal adoption.
+        continue;
+      }
       const binding = b ? {
         provider: b.provider,
         provider_session_id: b.provider_session_id,
@@ -1252,7 +1333,7 @@ export function createTmuxSessions(deps) {
       } : null;
 
       try {
-        attachTmuxSession({
+        (deps.attachTmuxSession || attachTmuxSession)({
           id: peerId,
           pane: info.pane,
           cwd: info.cwd || projectCtx.root,

package/lib/web/tmux-stream.mjs

@@ -19,8 +19,8 @@ export function createTmuxStream({
 }) {
   function cursorEscape(payload) {
     if (!payload) return '';
-    return '[' + (payload.row + 1) + ';' + (payload.col + 1) + 'H' +
-      (payload.visible ? '[?25h' : '[?25l');
+    return '\x1b[' + (payload.row + 1) + ';' + (payload.col + 1) + 'H' +
+      (payload.visible ? '\x1b[?25h' : '\x1b[?25l');
   }
 
   function tmuxSnapshot(session) {