@logicseek/hello-cc 1.0.2-dsh.3 → 1.1.0-rc.1

package/CHANGELOG.md

@@ -16,6 +16,127 @@ the release description from the current changelog section. Use
 `npm run release:github` with `GH_TOKEN` or `GITHUB_TOKEN` only for local
 backfills.
 
+## 1.1.0-rc.1
+
+### Summary
+
+hello-cc 1.1.0-rc.1 brings project and session navigation, structured
+conversations, recoverable split panes, and bounded rendering to the Web
+workbench. It also brings HCC-owned Codex, Claude and DeepSeek Harness workers
+into the same task, message, handoff and result-review workflow, with explicit
+permissions and delivery receipts. This release is intended for the npm
+`preview` dist-tag and a GitHub prerelease.
+
+### Highlights
+
+- Switch between English, Chinese or the system language; choose system,
+  light or dark interface and terminal themes, comfortable or compact spacing,
+  terminal font size and focus mode. Settings apply without replacing active
+  terminal connections or discarding drafts, and remain reachable on mobile.
+- Search sessions by name, task, provider, path or command; combine keywords
+  and provider/activity filters. Project changes clear old session state
+  immediately and ignore delayed responses from the previous project.
+- Read Codex conversations by turn with focused user, assistant, command,
+  file-change and status cards. Preserve reading position, drafts, expanded
+  details and keyboard focus during updates. Keep approvals visible
+  independently of the conversation page.
+- Use the keyboard command palette for project, session and workbench
+  navigation. Search the current terminal scrollback locally with match counts,
+  previous/next navigation, case sensitivity and whole-word matching. The search
+  addon is served locally.
+- Restore a project-specific two-pane workspace with horizontal or vertical
+  layout, adjustable proportions and a saved secondary session. Each pane
+  retains its own connection and draft; viewing the same session twice leaves
+  the secondary pane read-only until an explicit control handoff.
+- Page long Codex timelines and large output segments while keeping all
+  retained content accessible. Copy the complete original text, including
+  content outside the visible segment. Preserve Unicode characters, scroll
+  anchors, tool expansion and drafts across streaming updates.
+- Coalesce Codex text-delta notifications within a bounded 50 ms window while
+  updating internal state immediately. Approvals, completion, errors and
+  connection changes publish promptly. Unchanged native snapshots avoid
+  redundant broadcasts without skipping ownership checks.
+- Manage owned native workers through `hcc native`: Codex App Server, the
+  optional Claude Agent SDK and DeepSeek Harness ACP share HCC coordination
+  while retaining their provider-specific lifecycle and session identity. Web
+  can discover and control an existing native worker without creating a second
+  provider process.
+- Distinguish queued, submitted, provider-accepted, completed, failed and
+  uncertain delivery states. Uncertain submissions are not automatically
+  replayed; runtime restarts preserve the uncertainty needed to avoid duplicate
+  work.
+- Handle supported Codex permission requests, questions and common MCP form
+  fields from Web or the local CLI. Claude responses approve the original tool
+  input once, and ACP approval selects a provider-offered one-time option.
+  Responses remain bound to the current worker, session, turn, request and
+  controller.
+- Give hosted executors a temporary MCP capability scoped to the project,
+  database, peer and live runtime. Coordination tools support tasks, inbox,
+  messages, handoff, owned locks and local result records. Executor shutdown
+  revokes the capability without rewriting global provider configuration.
+- Review local command results, explicitly submitted evidence and manual
+  acceptance records with separate local-validation, publication and
+  business-acceptance categories. A completed model turn or successful command
+  does not automatically complete an HCC task.
+- Include DeepSeek Harness hooks, the Cordis bundle and owned ACP workers,
+  with identity-bound crash recovery and retryable cleanup after temporary
+  database failures.
+- Use macOS `kern.bootsessionuuid` for the boot component of process identity
+  instead of wall-clock boot time. Clock adjustments no longer make the same
+  process appear replaced, while a different boot UUID still identifies a
+  reboot. Missing or malformed boot identity remains unknown.
+- Publish private-state binding manifests atomically, reject legacy-state
+  takeover during interrupted initialization, and recheck the project identity
+  before reading, writing or clearing its runtime state. A reused directory
+  path does not silently inherit the previous project's private state.
+- Validate existing SQLite files without opening and closing an additional
+  descriptor, preserving locks held by another SQLite connection in the same
+  process. File ownership, permissions, identity and sidecar checks remain in
+  place.
+
+### Compatibility Notes
+
+- Projects under shared or writable ancestors use per-user private state.
+  Existing legacy state in those projects requires an explicit offline
+  `migrate-state --offline --yes` after stopping all writers; it is not silently
+  copied or discarded. Back up both the private store and its authority marker
+  before manual recovery of a replaced project directory.
+- Node.js 24 or newer is required. Linux and macOS are supported host
+  environments; Windows users use WSL. Native Windows shells are outside the
+  supported host contract.
+- Browser-controllable terminals require tmux where documented. `node-pty`
+  remains pinned to `1.2.0-beta.15`; the terminal search addon is pinned to
+  `0.16.0`.
+- Native workers require an installed and authenticated provider. Claude's
+  Agent SDK remains optional and is loaded when a Claude worker starts; HCC
+  does not install it automatically. DeepSeek Harness integration targets
+  `0.2.0-rc.2`.
+- Closing a browser page does not stop a hosted executor. An independent
+  native runtime also survives Web-runtime shutdown; explicitly closing its
+  worker terminates that worker. Web-owned App Server executors remain owned
+  by their Web runtime.
+- Saved-session resume creates a newly owned provider connection and requires
+  the prior owner to be confirmed stopped. It does not migrate an arbitrary
+  live TUI or desktop process, and uncertain owners remain protected.
+- Existing schema v7, Runtime API v2 and provider authentication boundaries
+  continue to apply. Browser control handoff never approves a provider operation
+  by itself. Persisted macOS identities using the older boot-token format remain
+  unknown across the format transition, rather than being treated as confirmed
+  dead.
+
+### Validation
+
+Feature-specific records cover controlled browser interactions, real PTY/tmux
+behavior, provider protocols and selected authenticated model workflows. Each
+record applies to its recorded inputs and scope. The final release record
+identifies the frozen package, platform installations and checks that apply to
+this combined candidate; performance samples are controlled observations, not
+production capacity or long-term memory guarantees.
+
+Publication readback, registry installation, employee-device acceptance and
+genuine business acceptance remain distinct evidence categories. No result in
+one category automatically establishes another.
+
 ## 1.0.2-dsh.3
 
 ### Summary

package/README.md

@@ -43,11 +43,20 @@ grace. `hcc gc` retains history unless `--history` is explicit. `--tls` encrypts
 the console; `--trust-proxy` requires a fixed `--proxy-origin`. Two risks remain
 intentional: the default listener is plaintext HTTP on `0.0.0.0` for trusted
 LANs, and an authenticated browser may select any existing server directory.
+Managed `.hello-cc` state is private to the current OS user. Keep project roots
+behind cross-user-stable paths for project-local storage. For a root that
+another OS user could replace, hello-cc stores managed state under
+`~/.hello-cc/projects/<root-hash>/` instead. An existing project-local state
+must be migrated explicitly while every old writer is stopped:
+`hcc --root DIR migrate-state --offline --yes`. Migration keeps the original
+directory for recovery. If you set `--db` or `HCC_DB` outside managed state,
+secure that database and its parent directory yourself.
 
 ## Highlights
 
 - **Shared project memory**: peers, tasks, messages, locks, handoffs, and
-  events are stored in `<project>/.hello-cc/mesh.db`.
+  events are stored in a private managed `mesh.db` (project-local for stable
+  roots, otherwise under the current user's home directory).
 - **Real terminal control**: Web attaches to the same local tmux pane as your
   terminal, not a separate browser-only shell.
 - **Claude/Codex awareness**: hooks inject live `hcc` state before model turns,

package/README.zh-CN.md

@@ -37,10 +37,17 @@ unknown 证据获得最长 120 秒宽限。`hcc gc` 默认保留历史，必须
 `--history`。`--tls` 提供传输加密；`--trust-proxy` 必须固定
 `--proxy-origin`。两项风险是有意保留的：默认在可信内网以明文 HTTP 监听
 `0.0.0.0`，且已认证浏览器可以选择服务器上任意已存在目录。
+默认的 `.hello-cc` 状态目录仅允许当前系统用户访问。不要把项目根目录放在
+不可信系统用户可写的位置；如果其他系统用户可替换项目路径，受管状态会改存于
+`~/.hello-cc/projects/<项目根路径哈希>/`。已有项目本地状态不会自动丢弃或迁移：
+先停止所有旧进程及外部数据库写入者，再运行
+`hcc --root 目录 migrate-state --offline --yes`；原目录保留供恢复。
+若通过 `--db` 或 `HCC_DB` 将数据库放在受管状态目录之外，请自行保护数据库及其
+父目录的权限。
 
 ## 特色
 
-- **项目本地共享状态**：peers、tasks、messages、locks、handoffs 和 events 写入 `<project>/.hello-cc/mesh.db`。
+- **项目共享状态**：peers、tasks、messages、locks、handoffs 和 events 写入私有的 `mesh.db`；路径稳定时保留项目本地目录，否则存于当前用户的 home 目录。
 - **Web 控制真实终端**：浏览器 attach 到和本地终端相同的 tmux pane，不是浏览器里另开的临时 shell。
 - **Claude/Codex 感知项目状态**：hooks 会在模型回答前注入实时 `hcc` 状态。
 - **减少编辑冲突**：通过 advisory lock 和 handoff 显式协调多 agent 修改。

package/docs/commands.md

@@ -14,12 +14,36 @@ authenticated access to any existing server directory are accepted risks.
 
 ```text
 hcc update [--tag TAG] [--registry URL] [--dry-run]
+hcc --root DIR migrate-state --offline --yes
 hcc uninstall [--purge --yes]
 ```
 
-`hcc update` updates the global npm install. `hcc uninstall` removes local
-hooks, shims, and the shell PATH entry; add `--purge --yes` only when you also want to remove the
-current project's `.hello-cc` data and guidance blocks.
+`hcc update` updates the global npm install. If another OS user can replace a
+project path, managed state is kept in a private directory under the current
+user's home. Existing project-local `.hello-cc` data requires an explicit
+offline migration: stop all hello-cc and external writers first, then run
+`migrate-state --offline --yes`. It copies SQLite snapshots (including WAL
+contents) and other validated state, keeps the old directory untouched, and
+rebuilds managed DSH path-bound configuration. Do not restart an old writer
+against the retained directory. `hcc uninstall` removes local hooks, shims,
+and the shell PATH entry; add `--purge --yes` only when you also want to remove
+the selected current project's managed data and guidance blocks. A retained
+legacy migration source is not deleted by purge.
+Private-state creation and purge leave a durable authority marker so a retained
+or newly written project-local database cannot silently become active again.
+After purge, a remaining legacy directory still requires an explicit offline
+`migrate-state --offline --yes`; if no legacy directory remains, a fresh `init`
+creates new private state. If a private store disappears without an explicit
+purge, restore it from backup or use `uninstall --purge --yes` to deliberately
+discard the missing state before starting fresh.
+An interrupted private purge stays marked `purging`; normal access fails closed.
+After confirming old writers are stopped, repeat `uninstall --purge --yes` to
+finish deleting that private store. If the project root is replaced by a new
+directory at the same path, its inode no longer matches the old private binding.
+The CLI intentionally refuses automatic purge or rebinding: preserve and back
+up both the old private store and its `.authority.json` marker, stop all writers,
+and have an operator compare the old and new root identities before a manual
+recovery. Do not delete the marker alone or point the new root at the old data.
 
 ## Read-only Diagnostics
 
@@ -54,7 +78,7 @@ Use `--local` to bind only `127.0.0.1`, `--token` or `HCC_WEB_TOKEN` to set an
 explicit token, `HCC_RUNTIME_CA` to trust a private HTTPS Runtime API CA, and
 `--no-token` only in trusted local/test environments. Use `hcc up` only when you
 want coordination without the Web console or shims. Provider shims only join
-projects with a local `.hello-cc/runtime.json` from `hcc web`; they do not use a
+projects with a managed `runtime.json` from `hcc web`; they do not use a
 global runtime to manage arbitrary directories.
 
 ## Native Workers

package/docs/commands.zh-CN.md

@@ -12,12 +12,28 @@ unknown 证据获得 120 秒宽限；历史清理必须显式使用 `gc --histor
 
 ```text
 hcc update [--tag TAG] [--registry URL] [--dry-run]
+hcc --root 目录 migrate-state --offline --yes
 hcc uninstall [--purge --yes]
 ```
 
-`hcc update` 更新全局 npm 安装。`hcc uninstall` 移除本机 hooks、shims 和 shell PATH 配置；
-只有在确定也要删除当前项目的 `.hello-cc` 数据和指导块时，才加
-`--purge --yes`。
+`hcc update` 更新全局 npm 安装。如果其他系统用户可替换项目路径，受管状态会放在
+当前用户 home 下的私有目录。已有项目本地 `.hello-cc` 必须离线迁移：先停止
+所有 hello-cc 进程和外部写入者，再显式执行 `migrate-state --offline --yes`。
+迁移会复制包含 WAL 内容的 SQLite 快照和其他经检查的状态，保留原目录，
+并重建由 hello-cc 管理且绑定旧绝对路径的 DSH 配置。不要让旧版写入者继续写原目录。
+`hcc uninstall` 移除本机 hooks、shims 和 shell PATH 配置；只有在确定也要删除
+当前项目选定的受管数据和指导块时，才加 `--purge --yes`。迁移后保留的旧目录
+不会被 purge 删除。
+新建或 purge 私有数据后仍保留持久的权威标记，防止保留或后来写入的项目本地数据库
+自动重新生效。purge 后若旧目录仍在，必须停止所有旧写入者并显式执行
+`migrate-state --offline --yes`；若旧目录已不存在，可重新运行 `init` 创建新的私有
+状态。如果私有目录未经 purge 就丢失，请从备份恢复，或通过
+`uninstall --purge --yes` 明确放弃已丢失的状态后重新初始化。
+私有状态的 purge 若中断，会保留 `purging` 标记并拒绝正常访问。确认旧写入者均已停止后，
+再次运行 `uninstall --purge --yes` 完成删除。若项目根目录在同一路径被新目录替换，
+新 inode 与旧私有绑定不符；CLI 会拒绝自动 purge 或重绑。请先保留并备份旧私有状态目录
+及其 `.authority.json` 标记，停止所有写入者，由管理员核对新旧根目录身份后再人工恢复。
+不要只删除标记，也不要让新根目录直接使用旧数据。
 
 ## 只读诊断
 
@@ -48,7 +64,7 @@ runtime 生成 URL token。用 `--local` 可只绑定 `127.0.0.1`，用 `--token
 `HCC_WEB_TOKEN` 可设置显式 token；私有 HTTPS Runtime API CA 用
 `HCC_RUNTIME_CA` 指定。只有在可信本地/测试环境才使用 `--no-token`。
 只想使用本地协作、不需要 Web 或 shims 时，再使用 `hcc up`。provider shim 只会加入
-已经由 `hcc web` 生成本地 `.hello-cc/runtime.json` 的项目，不会使用全局 runtime
+已经由 `hcc web` 生成受管 `runtime.json` 的项目，不会使用全局 runtime
 去管理任意目录。
 
 ## Native 后台 worker

package/docs/native.md

@@ -87,7 +87,7 @@ or dsh executable. Claude uses the SDK and rejects `--binary`.
 | `hcc native deliveries` | Optional `--peer NAME`; inspect delivery receipts |
 | `hcc native events` | Required `--peer NAME`; optional `--after ID`; inspect a bounded event history |
 | `hcc native requests` | Requires `--peer NAME`; inspect pending requests bound to this executor, session and turn |
-| `hcc native respond` | Requires `--peer NAME --request ID --decision accept\|decline\|cancel`; use `--response-file JSON` for permission subsets or answers |
+| `hcc native respond` | Requires `--peer NAME --request ID --decision accept\|decline\|cancel`; use `--response-file JSON` for permission subsets, answers or MCP form content |
 | `hcc native interrupt` | Required `--peer NAME`; optional `--turn ID`; request interruption of the active turn |
 | `hcc native close` | Required `--peer NAME`; close that worker's owned connection/process |
 | `hcc native down` | Request worker closure and runtime shutdown; returns a stop-request receipt |
@@ -170,12 +170,18 @@ hosted responder retain conservative denial.
 
 | Provider | Hosted interaction |
 | --- | --- |
-| Codex | Command/file approval, requested filesystem/network permission subsets with explicit turn/session duration, questions including freeform/secret input, and one-call empty-form MCP tool approvals |
+| Codex | Command/file approval, requested filesystem/network permission subsets with explicit turn/session duration, questions including freeform/secret input, one-call empty-form MCP tool approvals and common MCP form fields |
 | Claude | SDK tool permission callback; approval grants the original tool input once without rewriting it |
 | dsh ACP | Offered permission choices; approval selects only `allow_once`, never `allow_always` |
 
 rc.2 may send only a tool-call ID in an ACP approval request. The adapter correlates same-session/turn tool updates to show the operation input. Missing or truncated input still allows rejection; acceptance returns `NATIVE_APPROVAL_CONTEXT_MISSING`. See dsh installed acceptance (source checkout: `docs/verification/2026-10-02-dsh-cordis-native.md`).
 
+Native approval cards show the tool, command or target path and a content
+preview before the decision. Full operation details can be expanded and stay
+expanded across state refreshes. ACP approval is disabled when operation input
+or a one-time option is missing; rejection remains available. Shortened
+previews are identified, with complete parameters still available.
+
 Hosted interactive Codex threads explicitly enable
 `features.default_mode_request_user_input` and `features.request_permissions_tool`
 in their private start/resume configuration. Web-owned start/resume/fork uses
@@ -209,12 +215,10 @@ hcc native respond --peer codex-reviewer --request REQUEST_ID --decision accept
 hcc native respond --peer codex-reviewer --request REQUEST_ID --decision cancel
 ```
 
-Only `permissions`, `scope` and `answers` are accepted in that file. Permissions
+Only `permissions`, `scope`, `answers` and `content` are accepted in that file. For MCP forms, use the original field names and types, for example `{"content":{"project":"demo","count":2,"enabled":false}}`. Permissions
 can narrow the request but cannot add paths or network access; requested deny
 entries must be retained when granting filesystem access. Answer every question
-explicitly. Truncated requests can only be declined or cancelled. Arbitrary MCP
-forms, URL authentication, dynamic tools and account-token refresh requests are
-outside this responder's supported interaction set.
+explicitly. Truncated requests can only be declined or cancelled. Nested schemas, dynamic tools and account-token refresh requests remain unsupported. Correlated MCP `url` requests are supported through the Web authorization entry described below.
 
 ## Current boundaries
 
@@ -234,7 +238,8 @@ outside this responder's supported interaction set.
   task's business acceptance.
 - Adapter tests cover protocol and interaction boundaries. The authenticated
   checks below provide separate evidence for model execution and scoped MCP;
-  packaged-client installation and business acceptance remain unverified.
+  the installed-package harness below checks installation separately.
+  Stakeholder acceptance of a production workflow remains a separate step.
 
 
 ## Authenticated acceptance on October 2, 2026
@@ -255,8 +260,20 @@ survival after closing that bridge. These receipts are separate source snapshots
 
 Codex MCP tool approvals use `mcpServer/elicitation/request`. HCC submits the
 official action/content response for explicit tool confirmations without
-persisting session/always authorization. Approving arbitrary form fields or URL
-authentication is unsupported; decline and cancel remain available.
+persisting session/always authorization. Standard `form` requests support strings, numbers/integers, booleans, single-select and string-enum multi-select fields, with titles, descriptions, suggested defaults, required fields, length/numeric/selection limits and common mailbox/URI/date/date-time format checks. Optional fields are sent only when explicitly included, and booleans require a yes/no choice. Limits are 50 fields, 100 options per field, 8192 UTF-16 units per string and 65536 characters each for schema and response content.
+
+Correlated MCP `url` requests display the authorization destination and an **Open authorization page** action. Only the current controller can submit it. HCC reserves a blank tab on the explicit click and navigates after the original executor accepts the exact request; stale requests close the blank tab. Popup blocking leaves the request pending. HTTPS and loopback HTTP are allowed; credentials in the URL, other schemes, missing elicitation identities and truncated requests block acceptance while retaining decline/cancel. The new tab has no opener or referrer. Loopback destinations require a browser on the executor computer; HCC does not proxy local login callbacks to another device.
+
+Opening sends only `{ "action": "accept" }` and is not proof of successful authentication. Complete the external flow, then return to the task and follow the provider result. HCC does not invent a completion event or collect credentials in its form. URLs, device messages, opaque elicitation ids and metadata remain in the live pending request only; HCC interaction events and browser storage do not retain them. Provider-owned logs/history and the destination browser retain their existing behavior. Account login, token refresh, `openai/userVerification` and external-flow completion APIs remain separate unsupported capabilities.
+
+State refresh keeps edits in page memory. Submission, request removal or session changes clear them; a full page reload does not recover answers. HCC browser storage, events and delivery receipts do not retain form responses through the interaction-response path. Provider-owned history and model output retain their existing behavior. The owning server revalidates types and constraints and preserves executor/session/turn/request fencing. Nested objects, unrestricted arrays, unknown constraints and OpenAI extended form modes remain visibly unsupported with decline/cancel available.
+
+To reproduce browser acceptance, set `HCC_ACCEPTANCE_PLAYWRIGHT` to a Playwright module and run `node scripts/web-mcp-form-acceptance.mjs --run-browser`; optionally set `HCC_ACCEPTANCE_CHROME`. This uses simulated providers with the production HTTP/SQLite/native runtime and isolated browsers; it makes no model calls. See the source-checkout report `docs/verification/2026-10-02-mcp-form-web-validation.md`.
+
+Installed-model acceptance uses `node scripts/web-mcp-form-live-acceptance.mjs --run-live` with `HCC_ACCEPTANCE_PLAYWRIGHT`; `HCC_ACCEPTANCE_CHROME`, `HCC_ACCEPTANCE_TMUX`, `--codex-bin PATH` and `--output NEW_FILE` are optional. Without the opt-in flag it only prints help. A live run consumes quota on the currently configured model/account. Installed Codex calls a disposable stdio MCP tool; actual Web interactions accept the tool confirmation and submit the field form. The harness checks typed responses, model-written results, continuation on the same native executor after Web shuts down, and a Web-owned App Server form. It injects neither model output nor App Server requests.
+
+The HCC user directory, Codex home, project, tmux socket and browser profile are disposable. A configured external credential helper can retain its original user home for read-only credential retrieval; the original provider/model, login and configuration remain intact. Receipts include source hashes, checks, cleanup results and original config/auth/shell-config hash checks. Output paths must be new so existing receipts are preserved. Fixture logs contain synthetic form values only.
+
 
 The local validation receipt (source checkout: `docs/verification/2026-10-02-native-live-validation.json`)
 records the unit suite (785 passed, one platform-dependent skip), a 63-module
@@ -286,10 +303,67 @@ acceptance remains a separate check.
 
 For real model and browser interactions, use
 `scripts/web-native-interaction-acceptance.mjs`. It defaults to help; only
-`--run-live --provider codex|claude|all` invokes models. Set
+`--run-live --provider codex|claude|dsh|all` invokes models. Set
 `HCC_ACCEPTANCE_PLAYWRIGHT` and optionally `HCC_ACCEPTANCE_CHROME`.
 `--claude-package DIR` links an installed SDK package into the isolated worker
 project for default resolution, without injecting its query function. The
 harness checks explicit approval and rejection and continuing the original
 session. It uses existing authentication/quota, cleans test provider homes and
 processes, and never attaches to existing user conversations.
+
+
+`--provider dsh --dsh-bin /absolute/path/to/dsh` uses the installed public launcher
+and existing `DEEPSEEK_API_KEY`. The harness adds an official `tools/pre-execute`
+ask policy to a private ACP profile for only two acceptance-owned target files.
+Permission requests come from real model tool calls; no ACP request injection is
+used. It verifies an approved write, absence of a declined target, local return
+to the same session, and desktop and 390px mobile approval controls. See the
+dsh Web interaction receipt (source checkout: `docs/verification/2026-10-02-native-web-dsh-final-snapshot-interactions.json`).
+
+
+## Installed-package acceptance
+
+`scripts/native-installed-acceptance.mjs` tests an already installed HCC archive
+through the public `hcc native` commands. Install the archive and the optional
+Claude SDK into the same isolated npm prefix before running it. The script uses
+the SDK's default package resolver; it does not inject an adapter or query
+function. Running it without `--run-live` prints help and makes no model calls.
+
+```sh
+npm install --prefix /absolute/path/to/acceptance-prefix \
+  /absolute/path/to/hello-cc.tgz @anthropic-ai/claude-agent-sdk
+
+HCC_ACCEPTANCE_PLAYWRIGHT=file:///absolute/path/to/playwright/index.mjs \
+HCC_ACCEPTANCE_CHROME=/absolute/path/to/chrome \
+node /absolute/path/to/acceptance-prefix/node_modules/@logicseek/hello-cc/scripts/native-installed-acceptance.mjs \
+  --run-live --codex-bin /absolute/path/to/codex \
+  --dsh-bin /absolute/path/to/dsh --archive /absolute/path/to/hello-cc.tgz \
+  --browser --task --output /absolute/path/to/receipt.json
+```
+
+The checks cover correlated replies and ACKs, duplicate submission, continuing
+context, owned close/resume and interruption for all three installed providers.
+A separate Codex check explicitly rejects a write outside the allowed sandbox. Each worker first receives a bounded task through the local user controls.
+Models then send messages through MCP along `Codex → Claude → dsh → Codex`. The browser check verifies default SDK
+loading, an explicit approved write, desktop/mobile rendering, released control
+and local continuation of the same session after closing Web. `--task` adds an
+independent file collaboration example: Codex implements invoice arithmetic,
+five contract tests run, and Claude receives the model-authored handoff and
+writes its review. This example is separate from stakeholder acceptance of a
+production workflow.
+
+Existing authentication and provider quota are used. HCC's global HOME, provider
+homes, tmux server and project are private acceptance directories. A copied
+Codex credential command preserves the caller's HOME only while retrieving
+existing credentials; the original configuration is unchanged. Owned processes
+and credential copies are removed on exit. The receipt records the archive
+SHA-256, provider versions, source hashes, browser evidence and cleanup results.
+The script neither publishes npm packages nor deploys to employee devices.
+
+Requests submitted through authenticated native CLI/Web controls are recorded
+as local user requests. Messages arriving through the shared HCC bus remain
+peer coordination data, even if the sender calls itself `web` or `shell`.
+Legacy deliveries retain peer origin during migration. This distinction does
+not grant tool permissions: writes and other gated tools still require approval.
+For delegated file work, first authorize the receiving agent's bounded task,
+then send the peer handoff.

package/docs/native.zh-CN.md

@@ -80,7 +80,7 @@ hcc msg inbox --peer coordinator
 | `hcc native deliveries` | 可选 `--peer NAME`，查看投递回执 |
 | `hcc native events` | 必须 `--peer NAME`；可选 `--after ID`，查看有界事件历史 |
 | `hcc native requests` | 必须 `--peer NAME`；查看与该执行器、会话、turn 绑定的待处理请求 |
-| `hcc native respond` | 必须 `--peer NAME --request ID --decision accept\|decline\|cancel`；权限子集或问题答案通过 `--response-file JSON` 提交 |
+| `hcc native respond` | 必须 `--peer NAME --request ID --decision accept\|decline\|cancel`；权限子集、问题答案或 MCP 表单内容通过 `--response-file JSON` 提交 |
 | `hcc native interrupt` | 必须 `--peer NAME`；可选 `--turn ID`，请求中断活动 turn |
 | `hcc native close` | 必须 `--peer NAME`，关闭该 worker 持有的连接或进程 |
 | `hcc native down` | 请求关闭 worker 和停止 runtime，返回停止请求回执 |
@@ -147,12 +147,16 @@ ID。观察窗口不能应答，控制权切换后旧窗口的 epoch 失效。
 
 | Provider | 已接入的人工交互 |
 | --- | --- |
-| Codex | 命令/文件审批、所请求文件与网络权限的子集、明确的 turn/session 有效期、选项/自由输入/敏感问题，以及单次空表单 MCP 工具确认 |
+| Codex | 命令/文件审批、所请求文件与网络权限的子集、明确的 turn/session 有效期、选项/自由输入/敏感问题，以及单次空表单 MCP 工具确认与常用 MCP 表单字段 |
 | Claude | SDK 工具权限 callback，批准原始输入本次执行，不改写工具参数 |
 | dsh ACP | 选择 provider 提供的 `allow_once`，不自动选择 `allow_always` |
 
 rc.2 的 ACP 审批可能只携带工具 ID。适配器会关联同一 session/turn 的工具更新以展示操作输入；等待后仍缺输入或输入被截断时可以拒绝，允许会返回 `NATIVE_APPROVAL_CONTEXT_MISSING`。实际安装与拒绝证明见 dsh 验收 (源码目录: `docs/verification/2026-10-02-dsh-cordis-native.md`)。
 
+Native 审批卡片先显示工具、命令或文件路径和内容预览，并明确本次授权范围。
+完整操作详情可以展开，状态刷新保留展开状态；ACP 缺少操作输入或单次批准选项
+时禁用批准按钮，仍可拒绝。长内容预览会明确提示缩短，完整参数继续可查看。
+
 Codex 交互会话在 thread start/resume 的私有配置中显式开启
 `features.default_mode_request_user_input` 和 `features.request_permissions_tool`，
 使执行模式下的模型能够调用提问和权限请求工具。Web 专用 App Server 的 start、resume、
@@ -184,13 +188,26 @@ hcc native respond --peer codex-reviewer --request REQUEST_ID --decision accept
 hcc native respond --peer codex-reviewer --request REQUEST_ID --decision cancel
 ```
 
-响应文件只允许 `permissions`、`scope`、`answers`。不能添加原请求没有的路径或
+响应文件只允许 `permissions`、`scope`、`answers`、`content`；MCP 表单用 `content` 对象提交原字段名和类型，例如 `{"content":{"project":"demo","count":2,"enabled":false}}`。不能添加原请求没有的路径或
 网络权限；授予文件权限时必须保留原请求的 deny 条目。所有问题都需明确回答；
 请求参数被截断时，只能拒绝或取消。动态工具与账号 token 刷新尚未接入。
 
 Codex MCP 工具审批使用 `mcpServer/elicitation/request`，与命令/文件审批的返回结构
 不同。HCC 对显式 MCP 工具确认提交单次 action/content，不写入 session/always 授权。
-任意表单字段和 URL 身份认证尚不支持批准，可明确拒绝或取消。
+标准 `form` 模式支持字符串、数值/整数、布尔值、单选和字符串枚举多选，包含标题、说明、默认建议值、必填项、长度/数值/选择数量范围及常用邮箱/URI/date/date-time 格式校验。可选字段只在勾选填写后发送；布尔值需明确选择是或否。字段数量上限 50、单字段选项上限 100、字符串上限 8192 个 UTF-16 单元，表单结构与应答内容各限 65536 字符。
+
+Web 刷新执行状态时在页面内存中保留填写内容；提交、请求消失或切换会话后清除，不写入浏览器存储、HCC 事件或投递回执。页面整体重载不会恢复这些答复。此约束针对 HCC 的交互应答路径；provider 自身记录及模型输出继续按其原有行为处理。服务端重复校验内容，审批继续绑定原 executor/session/turn/request；错误输入保留请求供修正。嵌套对象、任意数组、未知约束和 OpenAI 扩展表单模式仍不可批准，页面显示原因并提供拒绝/取消。此能力未改变动态工具或 token 刷新的接入边界。
+
+带原 thread/turn 标识的 MCP `url` 请求现在可在 Web 打开授权页面。界面显示 MCP 服务和目标域名，当前控制者明确点击后先保留空白标签页；原执行器接受同一个请求后才跳转，过期或被拒绝的请求会关闭空白页。弹窗被拦截时保留待处理请求，允许弹窗后可重试。仅允许 HTTPS 或 loopback HTTP，拒绝带用户名/密码的 URL、其他协议、缺少 elicitation 标识或被截断的请求；拒绝/取消始终可用。新标签页不保留 opener 或 referrer。loopback 地址需在执行器所在电脑的浏览器访问，HCC 不把本地授权回调代理到另一台设备。
+
+打开只回传 `{ "action": "accept" }`，不代表身份认证完成。需在外部页面完成操作，再返回查看原任务的 provider 结果。HCC 不推测授权完成事件，也不在表单中收集凭证；授权 URL、设备码消息、elicitation 标识和元数据仅存在于实时待处理请求，不留在 HCC 交互事件或浏览器存储中。provider 自身日志/历史和外部授权浏览器仍按各自规则处理。账号登录、token 刷新、`openai/userVerification` 与外部授权完成 API 属于独立的未接入能力。
+
+浏览器复现：设置 `HCC_ACCEPTANCE_PLAYWRIGHT` 指向 Playwright 模块，再执行 `node scripts/web-mcp-form-acceptance.mjs --run-browser`；`HCC_ACCEPTANCE_CHROME` 可指定 Chrome 路径。该脚本用模拟 provider、真实 HTTP/SQLite/native runtime 和隔离浏览器，不调用模型。表单验收见 `docs/verification/2026-10-02-mcp-form-web-validation.md`。
+
+真实模型与浏览器验收使用 `node scripts/web-mcp-form-live-acceptance.mjs --run-live`，同样需要设置 `HCC_ACCEPTANCE_PLAYWRIGHT`，可选 `HCC_ACCEPTANCE_CHROME`、`HCC_ACCEPTANCE_TMUX`、`--codex-bin PATH` 与 `--output NEW_FILE`。默认只打印帮助；显式运行会使用当前模型和账号的额度。脚本让安装版 Codex 调用隔离 stdio MCP 工具，通过实际 Web 操作完成工具确认、字段填写和提交，核对原类型答复、模型文件落盘，以及 Web 关闭后原 native 执行器继续执行；另覆盖 Web-owned App Server 路径，没有注入模型输出或 App Server 请求。
+
+此验收分别隔离 HCC 的用户目录、Codex home、项目、tmux socket 和浏览器 profile。已配置的外部认证辅助程序可在原用户目录下只读运行，以保持当前账号的正常凭据获取；不更改原 provider、模型、登录状态或原配置。回执记录源码摘要、实际检查、清理结果及原配置/认证/shell 配置摘要核对，`--output` 必须使用新路径，既有回执不会覆盖。验收工具日志只包含合成表单值，直接答复不应被误当成真实业务数据。
+
 
 ## 当前边界
 
@@ -246,8 +263,52 @@ Web 验证覆盖服务与 bridge 控制接口，尚不等于完整浏览器操
 
 
 真实模型与浏览器人工交互可使用 `scripts/web-native-interaction-acceptance.mjs`。
-默认只显示帮助；`--run-live --provider codex|claude|all` 才调用模型。
+默认只显示帮助；`--run-live --provider codex|claude|dsh|all` 才调用模型。
 设置 `HCC_ACCEPTANCE_PLAYWRIGHT`，以及按需设置 `HCC_ACCEPTANCE_CHROME`。
 `--claude-package DIR` 可将已经安装的 SDK 包链接到隔离 worker 项目，由默认加载器
 解析，不注入 query 函数。脚本验证明确批准与拒绝、原会话续接，退出后关闭测试
 进程并清理临时 provider home；使用现有认证和调用额度。它不连接现有用户会话。
+
+`--provider dsh --dsh-bin /absolute/path/to/dsh` 使用已安装的公开 launcher 和现有
+`DEEPSEEK_API_KEY`。脚本在私有 ACP profile 中通过公开 `tools/pre-execute` 策略
+让两个指定验收文件的写入请求审批；审批请求来自真实模型工具调用，不注入 ACP 请求。
+验证批准后写入、拒绝后文件不存在、释放 Web 控制后原 session 本地续接，另检查
+桌面和 390px 手机审批卡片。真实结果见 dsh Web 交互回执 (源码目录: `docs/verification/2026-10-02-native-web-dsh-final-snapshot-interactions.json`)。
+
+
+## 安装包验收
+
+`scripts/native-installed-acceptance.mjs` 对已经安装的 HCC 包执行验收，通过公开
+`hcc native` 命令启动 daemon 和三个 provider。先把本地包与可选的 Claude SDK
+安装在同一个独立 npm prefix；脚本使用 SDK 默认包解析，不注入 adapter 或 query
+函数。不加 `--run-live` 只显示帮助，不调用模型。
+
+```sh
+npm install --prefix /absolute/path/to/acceptance-prefix \
+  /absolute/path/to/hello-cc.tgz @anthropic-ai/claude-agent-sdk
+
+HCC_ACCEPTANCE_PLAYWRIGHT=file:///absolute/path/to/playwright/index.mjs \
+HCC_ACCEPTANCE_CHROME=/absolute/path/to/chrome \
+node /absolute/path/to/acceptance-prefix/node_modules/@logicseek/hello-cc/scripts/native-installed-acceptance.mjs \
+  --run-live --codex-bin /absolute/path/to/codex \
+  --dsh-bin /absolute/path/to/dsh --archive /absolute/path/to/hello-cc.tgz \
+  --browser --task --output /absolute/path/to/receipt.json
+```
+
+验收覆盖三个已安装 provider 的关联回复与 ACK、重复提交、连续上下文、owned
+close/resume、中断，以及一次明确拒绝 Codex 越界写入审批。先通过人工控制入口给每个 worker 授权限定任务，再由模型通过 MCP 沿
+`Codex → Claude → dsh → Codex` 发消息并消费回复。浏览器检查 SDK 默认加载、
+明确批准文件写入、桌面和手机渲染、释放控制权，以及关闭 Web 后原会话本地续接。
+`--task` 增加独立文件协作样例：Codex 实现金额计算，通过五个合同测试，再通过
+模型发出的交接消息让 Claude 写出审查文件。这个样例与生产业务的用户验收分开。
+
+脚本使用现有认证和调用额度。HCC 全局 HOME、provider home、tmux server 和项目
+使用私有验收目录；复制到私有配置中的 Codex 凭据命令，仅在读取现有凭据时保留
+原 HOME，原配置保持不变。退出后清理自有进程与临时凭据。回执记录包 SHA-256、
+provider 版本、源码摘要、浏览器证据和清理结果；脚本不会发布 npm 包或部署到
+员工设备。
+
+通过已认证的 native CLI/Web 控制入口提交的任务，持久记录为人工请求；共享 HCC
+消息总线送达的内容保持 peer 消息身份，即使发送方自称 `web` 或 `shell`。旧回执
+迁移后仍按 peer 消息处理。来源区分不授予工具权限，写入等受控操作仍需审批。
+委派文件任务时，先由用户明确授权接收 agent 的限定任务，再发送 peer 交接。

package/docs/web-handoff.zh-CN.md

@@ -16,7 +16,11 @@
 
 结构化界面提供消息、当前 turn 状态、追加指令、轮次中断、计划、差异和人工交互。命令/文件审批以及空表单 MCP 工具确认由当前控制窗口明确批准本次或拒绝。文件与网络权限可逐项勾选，并明确选择本轮或会话有效期；只能授予原请求的子集。问题支持选项、其他/自由输入和敏感答案，需逐题明确填写。接管控制本身不会批准工具。
 
-表单输入与焦点会跨状态刷新保留，直接答案不写入 HCC 状态、事件、回执或浏览器存储。原 turn 完成、中断成功、provider 解决请求或执行器关闭后，请求卡片失效；旧控制窗口不能用过期 epoch 应答。参数被截断时只能拒绝或取消。任意 MCP 表单字段、URL 登录、动态工具及账号 token 刷新尚未接入。
+表单输入与焦点会跨状态刷新保留，直接答案不写入 HCC 状态、事件、回执或浏览器存储。原 turn 完成、中断成功、provider 解决请求或执行器关闭后，请求卡片失效；旧控制窗口不能用过期 epoch 应答。参数被截断时只能拒绝或取消。MCP 支持下述标准表单和带原 thread/turn 标识的 URL 请求；嵌套对象、任意数组等复杂结构、动态工具及账号 token 刷新尚未接入。
+
+MCP URL 请求显示授权目标，当前控制窗口点击“打开授权页面”后，原执行器接受请求才跳转。弹窗被拦截时不提交请求；过期请求不会打开授权地址。仅允许 HTTPS 或 loopback HTTP，链接带用户名/密码、其他协议、请求标识缺失或参数截断时保留拒绝/取消入口。loopback 地址需在执行器所在电脑打开，其他设备无法通过 HCC 代理本地授权页。
+
+打开页面只表示同意发起外部流程，不表示认证成功。请在外部页面完成操作，再返回关注原任务结果；新页面不保留 opener/referrer。URL、设备码消息和元数据不进入 HCC 交互事件或浏览器存储，实时待处理请求仍可供控制窗口查看。账号登录、token 刷新和 OpenAI 用户验证扩展不包含在此能力内。
 
 运行中发消息使用 steer；空闲时开始新 turn。中断当前轮与终止执行器是不同操作。turn 完成不自动把 hcc task 标记为验收完成。
 
@@ -26,6 +30,10 @@
 
 关闭浏览器后 App Server 仍由 hello-cc runtime 管理；停止 runtime 会关闭它。新 runtime 不会自动重启 App Server 或重放未确认消息，可以从已保存 thread 显式恢复。
 
+MCP 标准表单可以直接在 Web 填写文本、数值、是/否和单选/多选；两种执行器共用校验，答复仍回到同一请求。状态刷新保留页面内的填写内容，可选项不自动发送默认值；页面重载会清空答复。未支持的模式或结构会说明原因，保留拒绝/取消入口。实现和验收范围见 `docs/verification/2026-10-02-mcp-form-web-validation.md`。
+
+真实模型复现脚本为 `scripts/web-mcp-form-live-acceptance.mjs --run-live`：先由本地 Codex 实际发起 MCP 交互，再从桌面/手机 Web 提交，核对同一 native 执行器继续完成和交回本地；另覆盖 Web-owned App Server。环境变量与隔离/账号范围见 `docs/native.zh-CN.md` 的真实模型与浏览器验收说明。成功以该次回执为准，默认运行只打印帮助，不调用模型。
+
 ## 本地 native worker 接手
 
 先用 `hcc native start --peer codex-worker --provider codex` 启动后台任务，再打开 Web 的同一项目。Web 自动发现实际仍由 native runtime 持有的 worker，显示其原 peer/session、事件和投递回执；发送、中断和明确关闭都通过原 runtime 执行，不新建 provider 子进程。Claude/dsh worker 也走这条路径，按实际能力显示中断操作。
@@ -42,12 +50,12 @@
 
 Web 专用 Codex App Server，以及由 HCC 托管的 Codex/Claude/dsh native worker，自动接入 [项目与 peer 受限的 MCP 协作工具](mcp.zh-CN.md)。配置只传给对应执行器或 worker，不写全局 provider 配置；关闭 worker 前撤销其临时权限。模型可查询任务与 inbox、领取任务、发送消息、写 handoff、获取/释放自己的资源锁和记录本地证据；不替用户执行发布或业务验收。
 
-会话栏“结果审阅”汇总结构化 command 的退出码与输出、turn 差异、模型通过 MCP 提交的本地证据，以及人工添加的验收记录。命令退出成功仅说明该命令成功；人工填写“通过”必须附证据引用。界面分别展示本地验证、发布部署、业务验收，并注明记录来源。turn 完成、测试记录或人工验收均不自动改变 hcc task 状态。记录保存于项目数据库 events 中，`gc --history` 保留结果审计记录和最小提交去重凭据。
+会话栏“结果审阅”汇总结构化 command 的执行状态与退出码、是否有 turn 差异、模型通过 MCP 明确提交的本地证据，以及人工添加的验收记录。自动结果仅在实时观察到新 turn 开始后归属当前任务；缺失该事件时，不会从历史快照补认任务证据。自动结果在项目数据库 events 中只保存中性标题、状态、退出码和来源 ID，不保存命令、输出或差异正文；正文仍可在可用的执行器会话或 provider 历史中查看。命令退出成功仅说明该命令成功；人工填写“通过”必须附证据引用。界面分别展示本地验证、发布部署、业务验收，并注明记录来源。turn 完成、测试记录或人工验收均不自动改变 hcc task 状态。`gc --history` 保留结果审计记录和最小提交去重凭据。
 
 ## 验收边界
 
 本地验证包含真实 SQLite/HTTP、模拟交互请求、隔离 tmux 与桌面/手机浏览器。安装版 Codex 0.144.6 的协议验收另行覆盖 initialize、thread/start/list、10 个 MCP 工具发现和实际 `hcc_state` 读回；此协议检查不调用模型，可用 `node scripts/web-handoff-installed-acceptance.mjs` 重现。
 
-真实模型验收已在隔离项目和 Codex home 中完成“本地 → Web → 本地”三段文件任务，全程保持原 Codex 进程和 thread；关闭 Web runtime 后仍可继续。可用 `scripts/web-native-model-acceptance.mjs` 在明确需要真实模型调用时重现。三种 provider 的真实生命周期、模型 MCP 发信、回复/ACK 和无回复循环另有独立回执。交互表单另有 11 项模拟 provider 浏览器检查。真实 Codex 已经完成“提问 → Web 答复 → 指定文件权限 → 本轮授权 → 写入所选答案 → 后续请求拒绝 → 本地继续”的验收；默认加载的 Claude SDK 已完成真实 Write 工具批准、拒绝和本地续接。dsh 的真实权限弹窗尚无本轮浏览器验收。完整结果与运行条件见 本地验收记录 (源码目录: `docs/verification/2026-10-02-web-local-task-handoff.md`)。
+真实模型验收已在隔离项目和 Codex home 中完成“本地 → Web → 本地”三段文件任务，全程保持原 Codex 进程和 thread；关闭 Web runtime 后仍可继续。可用 `scripts/web-native-model-acceptance.mjs` 在明确需要真实模型调用时重现。三种 provider 的真实生命周期、模型 MCP 发信、回复/ACK 和无回复循环另有独立回执。交互表单另有 11 项模拟 provider 浏览器检查。真实 Codex 已经完成“提问 → Web 答复 → 指定文件权限 → 本轮授权 → 写入所选答案 → 后续请求拒绝 → 本地继续”的验收；默认加载的 Claude SDK 已完成真实 Write 工具批准、拒绝和本地续接。dsh 已完成真实 ACP 写入的 Web 批准、拒绝和原 session 本地续接，审批卡片另通过桌面与 390px 手机检查；仅在隔离 profile 中对指定验收文件设置公开审批策略。完整结果与运行条件见 本地验收记录 (源码目录: `docs/verification/2026-10-02-web-local-task-handoff.md`)。
 
 任意未托管 TUI/普通终端的活动执行器迁移、私有 daemon endpoint、任意协议版本的完整兼容矩阵，以及发布安装和真实业务验收仍在本次证据范围之外。