@logicseek/hello-cc 1.0.2-dsh.3 → 1.1.0-rc.1

package/lib/cli/app.mjs

@@ -89,6 +89,9 @@ import { assignTeamWorkers, expandTeamWorkers, inferTeamItems } from '../core/co
 import { autoPeerBasis, autoPeerKind, autoPeerProviderSession, autoPeerResumeId, autoPeerSessionId, readAncestorCliInfo, resolveCurrentPeer, resumeIdFromArgs, shortHash } from '../integrations/peers/identity.mjs';
 import { inspectProviderProcess } from '../integrations/peers/processes.mjs';
 import { registerProjectActivity } from '../runtime/projects.mjs';
+import { migrateLegacyProjectState } from '../runtime/state-migration.mjs';
+import { projectDbPath } from '../runtime/paths.mjs';
+import { ensureDshIntegration } from '../integrations/dsh.mjs';
 
 // Lazy-load lib modules (they may import node-pty which needs to be optional)
 const _libDir = path.resolve(fileURLToPath(import.meta.url), '..', '..');
@@ -303,7 +306,7 @@ const { cmdInit, cmdRegister, cmdEnv, cmdJoin } = createLifecycleCommands({
   connect, now, tx, addEvent, printResult, CliError, parseOpts, intOpt,
   registerProjectActivity, resolveCurrentPeer, resolveTargetPeer,
   upsertPeer, upsertCanonicalPeerBinding, storedPeerIdentity, detectBranch,
-  writeGuidance, helpEnv, helpJoin, shellExports, path, process
+  readAncestorCliInfo, writeGuidance, helpEnv, helpJoin, shellExports, path, process
 });
 
 const { cmdTeam } = createTeamCommands({
@@ -580,6 +583,43 @@ function removeGuidanceBlocks(ctx) {
   return removeGuidanceBlocksForRoot(ctx.root);
 }
 
+function cmdMigrateState(ctx, args) {
+  if (wantsHelp(args)) {
+    console.log(`${CLI_NAME} migrate-state --offline --yes\n\n` +
+      'Stop all old hello-cc Web, Native, PTY, tmux, hook and external database writers first. ' +
+      'This command verifies known process evidence, snapshots SQLite including WAL, and leaves the old directory untouched.');
+    return;
+  }
+  const opts = parseOpts(args, { booleans: ['offline', 'yes'] });
+  validateOpts('migrate-state', opts, ['offline', 'yes']);
+  if (opts.offline !== true || opts.yes !== true) {
+    throw new CliError('STATE_MIGRATION_OFFLINE_REQUIRED',
+      'Stop every old project-state writer, then acknowledge downtime with migrate-state --offline --yes');
+  }
+  const result = migrateLegacyProjectState(ctx.root, {
+    confirmedOffline: true,
+    // The operator's explicit --offline assertion covers external writers
+    // that cannot be discovered reliably across supported platforms. The
+    // migrator still checks known runtime, PTY and SQLite peer evidence.
+    assertOffline: () => true
+  });
+  let dshRebuilt = false;
+  if (result.dsh) {
+    try {
+      ensureDshIntegration({ ...ctx, dbPath: projectDbPath(ctx.root) }, { mode: result.dsh.mode });
+      dshRebuilt = true;
+    } catch (error) {
+      throw new CliError('STATE_MIGRATION_DSH_REBUILD_REQUIRED',
+        `Project state migrated to ${result.stateDir}, but DSH configuration needs rebuilding. ` +
+        `Run ${result.dsh.rebuildCommand}. Original data remains at ${result.sourceDir}.`,
+        { cause: error });
+    }
+  }
+  printResult(ctx, { ...result, dsh_rebuilt: dshRebuilt },
+    () => `project state migrated: ${result.stateDir}\nlegacy source kept: ${result.sourceDir}` +
+      (dshRebuilt ? '\nDSH integration rebuilt for the new private path' : ''));
+}
+
 // ─── hcc doctor ─────────────────────────────────────────────────────────────
 // Health self-check: SQLite integrity, schema version, WAL/DB size, row counts.
 async function dispatch(ctx, rest) {
@@ -592,6 +632,7 @@ async function dispatch(ctx, rest) {
   if (command === 'update') return cmdUpdate(ctx, args);
   if (command === 'uninstall') return cmdUninstall(ctx, args);
   if (command === 'init') return cmdInit(ctx, args);
+  if (command === 'migrate-state') return cmdMigrateState(ctx, args);
   if (command === 'register') return cmdRegister(ctx, args);
   if (command === 'join') return cmdJoin(ctx, args);
   if (command === 'env') return cmdEnv(ctx, args);

package/lib/cli/commands/coordination.mjs

@@ -184,8 +184,13 @@ export function createCoordinationCommands(deps) {
     const kind = opts.kind || 'broadcast';
     const runtime = opts.inject ? readRuntime(ctx) : null;
     const db = connect(ctx);
-    touchCurrentPeer(db, ctx, identity, null, 'shell');
-    const id = sendMessage(db, sender, 'all', taskId, kind, body);
+    let id;
+    try {
+      touchCurrentPeer(db, ctx, identity, null, 'shell');
+      id = sendMessage(db, sender, 'all', taskId, kind, body);
+    } finally {
+      db.close();
+    }
     let injected = 0;
     let skipped = 0;
     if (opts.inject) {

package/lib/cli/commands/dsh.mjs

@@ -14,7 +14,7 @@ function defaultHelp() {
     '       hcc dsh status [--dsh-bin PATH]',
     '       hcc dsh web [--mode hooks|cordis|off] [--dsh-bin PATH] [--dsh-home PATH] -- [dsh web arguments]',
     '',
-    'Setup writes project-local configuration under .hello-cc/dsh/. Modes: hooks (default), cordis (native tools), off.',
+    'Setup writes managed configuration under the selected private state directory. Modes: hooks (default), cordis (native tools), off.',
     'Web starts the official dsh web runtime; its real sessions join hello-cc through the selected integration.',
     'Pass runtime arguments after --, for example: hcc dsh web -- --port 8080',
     'Show dsh web help: hcc dsh web -- --help',

package/lib/cli/commands/gc.mjs

@@ -26,6 +26,7 @@ import {
 import { runOptimisticEvidenceMutation } from '../../core/coordination/optimistic-evidence.mjs';
 import { peerEvidenceAllowsReap } from '../../core/peers/evidence.mjs';
 import { runtimePath, globalRuntimePath } from '../../runtime/paths.mjs';
+import { resolveProjectDatabase } from '../../runtime/project-path.mjs';
 import { readRuntime, reclaimRuntimePointerFiles } from '../../runtime/state.mjs';
 import { runtimeRequest, runtimeBufferGcUnavailable } from '../../runtime/client.mjs';
 import { collectBufferEvidence } from '../../runtime/buffer-evidence.mjs';
@@ -263,12 +264,16 @@ function captureRequiredBufferDirectoryComponent(component, description) {
 function captureOptionalBufferDirectory(root, directoryName) {
   const requestedRoot = path.resolve(root);
   const canonicalRoot = fs.realpathSync.native(requestedRoot);
-  const stateDirectory = path.join(canonicalRoot, '.hello-cc');
+  const stateDirectory = resolveProjectDatabase({ root: canonicalRoot, createStateDir: false }).stateDir;
   const directory = path.join(stateDirectory, directoryName);
   const components = [
-    captureRequiredBufferDirectoryComponent(canonicalRoot, 'Project root'),
-    captureRequiredBufferDirectoryComponent(stateDirectory, 'Project state directory')
+    captureRequiredBufferDirectoryComponent(canonicalRoot, 'Project root')
   ];
+  try {
+    components.push(captureRequiredBufferDirectoryComponent(stateDirectory, 'Project state directory'));
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
 
   let stat;
   try {
@@ -624,7 +629,7 @@ function runGcWithHistorySnapshot(ctx, db, {
 }
 
 function bufferDirectory(ctx) {
-  return path.resolve(path.join(ctx.root, '.hello-cc', BUFS_DIR_NAME));
+  return path.join(resolveProjectDatabase({ root: ctx.root, createStateDir: false }).stateDir, BUFS_DIR_NAME);
 }
 
 function bufferDirectoryPaths(directory) {

package/lib/cli/commands/hook.mjs

@@ -4,6 +4,7 @@
 import { parseOpts, validateOpts } from '../../cli-args.mjs';
 import { tx } from '../../db/schema.mjs';
 import { resolveProjectDatabase } from '../../runtime/project-path.mjs';
+import { projectDbPath } from '../../runtime/paths.mjs';
 
 export function createHookCommand(deps) {
   const {
@@ -89,13 +90,17 @@ async function cmdHook(ctx, args) {
   const dshProject = isDsh && !nativeOwner ? resolveProjectDatabase({ root: hccRoot, createStateDir: false }) : null;
   const nativeProject = nativeOwner ? resolveProjectDatabase({ root: hccRoot,
     db: process.env.HCC_DB, createStateDir: false }) : null;
+  const ordinaryDb = (ctx.root && path.resolve(ctx.root) === hccRoot ? ctx.dbPath : null) ||
+    process.env.HCC_DB;
   if (nativeProject && !fs.existsSync(nativeProject.db)) {
     throw new CliError('NATIVE_HOOK_OWNERSHIP_MISMATCH', 'Native hook database must already be owned by its runtime');
   }
+  const ordinaryDefaultDb = !dshProject && !nativeProject && !ordinaryDb
+    ? projectDbPath(hccRoot) : null;
   const hookCtx = {
     ...ctx,
     root: nativeProject?.root || dshProject?.root || hccRoot,
-    dbPath: nativeProject?.db || dshProject?.db || path.join(hccRoot, '.hello-cc', 'mesh.db')
+    dbPath: nativeProject?.db || dshProject?.db || ordinaryDefaultDb || path.resolve(ordinaryDb)
   };
   if (!nativeOwner) registerProjectActivity(hookCtx);
 

package/lib/cli/commands/install.mjs

@@ -1,6 +1,10 @@
 // Install/setup/update/uninstall/shim commands extracted from bin/hcc.mjs.
 
 import { execFileSync, spawnSync } from 'node:child_process';
+import { secureExistingProjectStateDirectory } from '../../runtime/project-path.mjs';
+import { legacyProjectStateDir, projectStateDir } from '../../runtime/paths.mjs';
+import { privateProjectStateDir, inspectPrivateProjectAuthority,
+  purgePrivateProjectState } from '../../runtime/private-state.mjs';
 
 export function createInstallCommands(deps) {
   const {
@@ -236,14 +240,33 @@ async function cmdUninstall(ctx, args) {
   if (opts.purge && !opts.yes) {
     throw new CliError('CONFIRM_REQUIRED', 'Refusing to purge project data without --yes');
   }
+  // Resolve before changing hooks, guidance, or runtime state. An unsafe root
+  // with unmigrated legacy data must not be treated as an empty private store.
+  let purgeStateDir = null;
+  let missingPrivateState = false;
+  if (opts.purge) {
+    try {
+      purgeStateDir = secureExistingProjectStateDirectory(ctx.root).stateDir;
+    } catch (error) {
+      if (projectStateDir(ctx.root) !== privateProjectStateDir(ctx.root)) throw error;
+      const recoverablePending = error?.code === 'STATE_MIGRATION_REQUIRED' &&
+        inspectPrivateProjectAuthority(ctx.root) === 'pending';
+      if (!['STATE_AUTHORITY_MISSING', 'STATE_PURGE_INCOMPLETE'].includes(error?.code) &&
+          !recoverablePending) throw error;
+      purgeStateDir = privateProjectStateDir(ctx.root);
+      missingPrivateState = true;
+    }
+  }
 
   const lines = [];
 
   let runtime = null;
-  try {
-    runtime = readRuntime(ctx);
-  } catch (err) {
-    if (!(err instanceof CliError && err.code === 'RUNTIME_NOT_RUNNING')) throw err;
+  if (!missingPrivateState) {
+    try {
+      runtime = readRuntime(ctx);
+    } catch (err) {
+      if (!(err instanceof CliError && err.code === 'RUNTIME_NOT_RUNNING')) throw err;
+    }
   }
   if (runtime) {
     try {
@@ -273,9 +296,28 @@ async function cmdUninstall(ctx, args) {
   if (opts.purge) {
     guidance = removeGuidanceBlocks(ctx);
     try {
-      fs.rmSync(path.join(ctx.root, '.hello-cc'), { recursive: true, force: true });
+      if (path.resolve(purgeStateDir) === path.resolve(privateProjectStateDir(ctx.root))) {
+        // Revalidate and delete under the same transition lock used by init
+        // and migration. An interrupted deletion remains marked purging.
+        purgeStateDir = purgePrivateProjectState(ctx.root);
+      } else {
+        // Async shutdown and hook removal happened after the initial lookup.
+        // Refuse a stale legacy target if project-state routing changed.
+        const current = secureExistingProjectStateDirectory(ctx.root).stateDir;
+        if (path.resolve(current) !== path.resolve(purgeStateDir)) {
+          throw new CliError('PROJECT_PATH_FORBIDDEN', 'Project state route changed during uninstall');
+        }
+        fs.rmSync(purgeStateDir, { recursive: true, force: true });
+      }
       purged = true;
-      lines.push(`project data removed: ${path.join(ctx.root, '.hello-cc')}`);
+      lines.push(`project data removed: ${purgeStateDir}`);
+      const legacyDir = legacyProjectStateDir(ctx.root);
+      if (path.resolve(legacyDir) !== path.resolve(purgeStateDir) && fs.existsSync(legacyDir)) {
+        lines.push(`legacy project data kept: ${legacyDir}`);
+        lines.push('private authority kept; future use requires an explicit offline migration of the legacy source');
+      } else if (path.resolve(legacyDir) !== path.resolve(purgeStateDir)) {
+        lines.push('private authority kept; a fresh init can now create new private state');
+      }
     } catch (err) {
       throw new CliError('PURGE_FAILED', `Could not remove .hello-cc: ${err.message}`);
     }

package/lib/cli/commands/lifecycle.mjs

@@ -4,10 +4,21 @@ export function createLifecycleCommands(deps) {
   const {
     connect, now, addEvent, printResult, CliError, parseOpts, intOpt,
     registerProjectActivity, resolveCurrentPeer, resolveTargetPeer,
-    upsertPeer, upsertCanonicalPeerBinding, detectBranch,
+    upsertPeer, upsertCanonicalPeerBinding, detectBranch, readAncestorCliInfo,
     writeGuidance, helpEnv, helpJoin, shellExports, path, process
   } = deps;
 
+  function registrationPid(opts) {
+    if (opts.pid !== undefined) return intOpt(opts, 'pid', process.ppid);
+    const ancestor = readAncestorCliInfo();
+    if (['claude', 'codex'].includes(ancestor?.kind) &&
+        (!opts.kind || opts.kind === ancestor.kind) &&
+        Number.isSafeInteger(ancestor.pid) && ancestor.pid > 1) {
+      return ancestor.pid;
+    }
+    return process.ppid;
+  }
+
   async function cmdInit(ctx, args) {
     registerProjectActivity(ctx);
     const opts = parseOpts(args, { booleans: ['no-guidance'] });
@@ -34,7 +45,7 @@ export function createLifecycleCommands(deps) {
       role: opts.role || '',
       worktree: path.resolve(opts.worktree || ctx.cwd),
       branch: opts.branch || detectBranch(ctx.cwd),
-      pid: intOpt(opts, 'pid', process.ppid),
+      pid: registrationPid(opts),
       status: opts.status || 'idle',
       capabilities: Array.isArray(opts.cap) ? opts.cap.join(',') : (opts.cap || opts.capabilities || '')
     };
@@ -67,7 +78,7 @@ export function createLifecycleCommands(deps) {
       role: opts.role || 'peer',
       worktree: path.resolve(opts.worktree || ctx.cwd),
       branch: opts.branch || detectBranch(ctx.cwd),
-      pid: intOpt(opts, 'pid', process.ppid),
+      pid: registrationPid(opts),
       status: opts.status || 'working',
       capabilities: Array.isArray(opts.cap) ? opts.cap.join(',') : (opts.cap || opts.capabilities || 'manual-shell')
     };

package/lib/cli/commands/native.mjs

@@ -7,6 +7,7 @@ import { parseOpts, validateOpts, wantsHelp, intOpt } from '../../cli-args.mjs';
 import { printResult } from '../../format.mjs';
 import { commandPath } from '../../cli-runtime.mjs';
 import { nativePaths, readNativePointer } from '../../runtime/native/store.mjs';
+import { openPrivateAppendFile } from '../../runtime/private-file.mjs';
 import { nativeRequest } from '../../runtime/native/client.mjs';
 import { startNativeService } from '../../runtime/native/service.mjs';
 
@@ -37,15 +38,21 @@ export function createNativeCommands(deps) {
       }
     }
     const paths = nativePaths(ctx, { create: true });
-    const log = fs.openSync(paths.log, fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | (fs.constants.O_NOFOLLOW || 0), 0o600);
-    if (!fs.fstatSync(log).isFile() || fs.fstatSync(log).nlink !== 1) {
-      fs.closeSync(log);
-      throw new CliError('NATIVE_STATE_UNSAFE', 'Native runtime log must be a private regular file');
+    let log;
+    let child;
+    try {
+      log = openPrivateAppendFile(paths.log);
+      child = spawn(process.execPath, [commandPath(), '--root', fs.realpathSync(ctx.root), '--db', path.resolve(ctx.dbPath), 'native', 'serve'], {
+        cwd: ctx.root, env: process.env, detached: true, stdio: ['ignore', log, log]
+      });
+    } catch (error) {
+      if (error?.code === 'PROJECT_PATH_FORBIDDEN') {
+        throw new CliError('NATIVE_STATE_UNSAFE', error.message);
+      }
+      throw error;
+    } finally {
+      if (log !== undefined) fs.closeSync(log);
     }
-    const child = spawn(process.execPath, [commandPath(), '--root', fs.realpathSync(ctx.root), '--db', path.resolve(ctx.dbPath), 'native', 'serve'], {
-      cwd: ctx.root, env: process.env, detached: true, stdio: ['ignore', log, log]
-    });
-    fs.closeSync(log);
     let failed;
     child.on('error', (error) => { failed = error; });
     child.unref();
@@ -113,7 +120,7 @@ export function createNativeCommands(deps) {
           const data = fs.readFileSync(path.resolve(ctx.cwd, opts['response-file']), 'utf8');
           if (data.length > 100000) throw new CliError('BAD_ARGS', 'Response file exceeds the limit');
           try { response = JSON.parse(data); } catch { throw new CliError('BAD_ARGS', 'Response file must contain JSON'); }
-          if (!response || typeof response !== 'object' || Array.isArray(response) || Object.keys(response).some(key => !['permissions','scope','answers'].includes(key))) throw new CliError('BAD_ARGS', 'Response file accepts permissions, scope and answers only');
+          if (!response || typeof response !== 'object' || Array.isArray(response) || Object.keys(response).some(key => !['permissions','scope','answers','content'].includes(key))) throw new CliError('BAD_ARGS', 'Response file accepts permissions, scope, answers and MCP content only');
         }
         const request = pending[0];
         result = await nativeRequest(ctx, 'POST', '/respond', { peer: opts.peer, generation: state.generation,

package/lib/cli/commands/query.mjs

@@ -1,5 +1,7 @@
 // Coordination query commands extracted from bin/hcc.mjs: peers, status, state, prompt.
 
+import { shellQuoteArg } from '../../format.mjs';
+
 export function createQueryCommands(deps) {
   const {
     connect, now, printResult, table, CliError, ACTIVE_PEER_TTL,
@@ -63,7 +65,10 @@ export function createQueryCommands(deps) {
     const peer = required(opts, 'peer', 'HCC_PEER');
     const kind = opts.kind || 'codex';
     const role = opts.role || 'peer';
-    const cmd = `node ${commandPath()} --root ${JSON.stringify(ctx.root)}`;
+    const cmd = ['node', commandPath(), '--root', ctx.root, '--db', ctx.dbPath].map(shellQuoteArg).join(' ');
+    const quotedPeer = shellQuoteArg(peer);
+    const quotedKind = shellQuoteArg(kind);
+    const quotedRole = shellQuoteArg(role);
     const text = `You are ${peer}, a ${kind} ${role} session working in this project.
 
 Use hcc as the shared coordination bus for this terminal session. This
@@ -71,23 +76,23 @@ project uses a flat peer mesh: there is no required main/worker hierarchy.
 
 Run these commands before changing files:
 
-${cmd} register --peer ${peer} --kind ${kind} --role ${role}
-${cmd} state --peer ${peer}
-${cmd} msg inbox --peer ${peer}
-${cmd} task next --peer ${peer}
+${cmd} register --peer ${quotedPeer} --kind ${quotedKind} --role ${quotedRole}
+${cmd} state --peer ${quotedPeer}
+${cmd} msg inbox --peer ${quotedPeer}
+${cmd} task next --peer ${quotedPeer}
 
 Coordination rules:
 - Claim exactly one task before editing.
 - If state shows a current task for ${peer}, continue that task before claiming another pending task.
 - Before editing a file, directory, module, or shared test resource, run:
-  ${cmd} lock acquire --peer ${peer} --resource <path-or-module> [--scope <scope>] --task <task-id>
+  ${cmd} lock acquire --peer ${quotedPeer} --resource <path-or-module> [--scope <scope>] --task <task-id>
 - If a lock is held by another peer, message that peer instead of editing:
-  ${cmd} msg send --from ${peer} --to <peer-id> --body "<question>"
+  ${cmd} msg send --from ${quotedPeer} --to <peer-id> --body "<question>"
 - Report progress or requests through msg send.
 - Before stopping, run tests, create a handoff, and release locks:
-  ${cmd} handoff create --from ${peer} --task <task-id> --summary "<what changed>" --tests "<commands/results>" --risks "<known risks>"
-  ${cmd} task done --peer ${peer} --id <task-id> --summary "<done summary>"
-  ${cmd} lock release --peer ${peer} --resource <path-or-module> [--scope <scope>]
+  ${cmd} handoff create --from ${quotedPeer} --task <task-id> --summary "<what changed>" --tests "<commands/results>" --risks "<known risks>"
+  ${cmd} task done --peer ${quotedPeer} --id <task-id> --summary "<done summary>"
+  ${cmd} lock release --peer ${quotedPeer} --resource <path-or-module> [--scope <scope>]
 `;
     printResult(ctx, { prompt: text }, () => text);
   }

package/lib/cli/commands/run.mjs

@@ -11,6 +11,7 @@ import { CliError } from '../../shared/errors.mjs';
 import { tx } from '../../db/schema.mjs';
 import { parseOpts, validateOpts } from '../../cli-args.mjs';
 import { runtimeProcessIdentity } from '../../runtime/state.mjs';
+import { ensurePrivateProjectBufferDirectory } from '../../runtime/project-path.mjs';
 import { withBufferDirectoryLease } from '../../runtime/buffer-directory-lease.mjs';
 import {
   externalBufferEvidence,
@@ -178,8 +179,7 @@ async function cmdRunWebManaged(ctx, { id, kind, role, cwd, command, commandArgs
   const ptyModule = await import('node-pty');
   const pty = ptyModule.default || ptyModule;
 
-  const bufsDir = path.join(ctx.root, '.hello-cc', BUFS_DIR_NAME);
-  fs.mkdirSync(bufsDir, { recursive: true });
+  const bufsDir = ensurePrivateProjectBufferDirectory(ctx.root, BUFS_DIR_NAME);
   const outFile = path.join(bufsDir, `${id}.out`);
   const inFile  = path.join(bufsDir, `${id}.in`);
   const resizeFile = path.join(bufsDir, `${id}.resize`);
@@ -219,8 +219,8 @@ async function cmdRunWebManaged(ctx, { id, kind, role, cwd, command, commandArgs
       }
       for (const file of bufferFiles) fs.rmSync(file, { force: true });
     }
-    fs.writeFileSync(inFile, '');
-    fs.writeFileSync(resizeFile, '');
+    fs.writeFileSync(inFile, '', { flag: 'wx', mode: 0o600 });
+    fs.writeFileSync(resizeFile, '', { flag: 'wx', mode: 0o600 });
     fs.writeFileSync(metaFile, JSON.stringify({
       id,
       generation: bufferGeneration,
@@ -231,7 +231,7 @@ async function cmdRunWebManaged(ctx, { id, kind, role, cwd, command, commandArgs
       wrapper_pid: process.pid,
       ...(publishingWrapperIdentity ? { wrapper_identity: publishingWrapperIdentity } : {}),
       publishing: true
-    }));
+    }), { flag: 'wx', mode: 0o600 });
 
     const db = connect(ctx);
     try {
@@ -359,7 +359,8 @@ async function cmdRunWebManaged(ctx, { id, kind, role, cwd, command, commandArgs
       if (!ownsExternalBufferGroup()) {
         throw new CliError('EXTERNAL_SESSION_SUPERSEDED', `External session ${id} was replaced during startup`);
       }
-      outFd = fs.openSync(outFile, 'w');
+      outFd = fs.openSync(outFile, fs.constants.O_WRONLY | fs.constants.O_CREAT |
+        fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0), 0o600);
     });
   } catch (error) {
     await failStartup(error?.code || 'external_buffer_open_failed');

package/lib/core/coordination/results.mjs

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { tx } from '../../db/schema.mjs';
+import { automaticResultKey } from '../../shared/automatic-result-key.mjs';
 import { CliError } from '../../shared/errors.mjs';
 
 export const RESULT_EVENT = 'task.result.recorded';
@@ -18,7 +19,7 @@ function text(value, field, max, required = false) {
 
 // Evidence records do not mutate task status. The owner is checked in the same
 // transaction as the insert, including after a concurrent task takeover.
-export function recordTaskResult(db, input, { now = () => Math.floor(Date.now() / 1000), addEvent } = {}) {
+export function recordTaskResult(db, input, { now = () => Math.floor(Date.now() / 1000), addEvent, automatic = false } = {}) {
   if (!input || typeof input !== 'object' || Array.isArray(input)) throw new CliError('BAD_REQUEST', 'A result object is required');
   const peer = text(input.peer, 'peer', 200, true);
   const taskId = input.taskId;
@@ -29,21 +30,35 @@ export function recordTaskResult(db, input, { now = () => Math.floor(Date.now()
     throw new CliError('BAD_REQUEST', 'Unsupported result stage, status, kind or source');
   }
   if (source === 'executor' && stage !== 'local') throw new CliError('BAD_REQUEST', 'Executor records can only report local evidence');
+  if (automatic && (source !== 'executor' || !['command', 'diff'].includes(kind))) {
+    throw new CliError('BAD_REQUEST', 'Automatic results must be local executor commands or diffs');
+  }
   const evidence = input.evidence || [];
   if (!Array.isArray(evidence) || evidence.length > 20) throw new CliError('BAD_REQUEST', 'evidence must contain up to 20 text references');
   const references = evidence.map((entry) => text(entry, 'evidence', 2000, true));
   if (source === 'user' && status === 'passed' && !references.length) {
     throw new CliError('BAD_REQUEST', 'A passed verification needs an evidence reference');
   }
+  const executorId = text(input.executorId, 'executorId', 512) || null;
+  const threadId = text(input.threadId, 'threadId', 512) || null;
+  const turnId = text(input.turnId, 'turnId', 512) || null;
+  const itemId = text(input.itemId, 'itemId', 512) || null;
+  if (automatic && (!executorId || !threadId || !turnId || (kind === 'command' && !itemId))) {
+    throw new CliError('BAD_REQUEST', 'Automatic results require executor, thread, turn and command item identities');
+  }
+  const resultKey = automatic
+    ? automaticResultKey({ executorId, threadId, turnId, kind, itemId: kind === 'command' ? itemId : null })
+    : input.resultKey;
   const record = {
-    result_id: randomUUID(), result_key: text(input.resultKey, 'resultKey', 700) || randomUUID(),
+    result_id: randomUUID(), result_key: text(resultKey, 'resultKey', 700) || randomUUID(),
     peer, task_id: taskId, stage, status, kind, source,
-    title: text(input.title, 'title', 300, true), details: text(input.details, 'details', 64000), evidence: references,
-    command: text(input.command, 'command', 64000), diff: text(input.diff, 'diff', 64000),
-    executor_id: text(input.executorId, 'executorId', 512) || null,
-    thread_id: text(input.threadId, 'threadId', 512) || null,
-    turn_id: text(input.turnId, 'turnId', 512) || null,
-    item_id: text(input.itemId, 'itemId', 512) || null,
+    title: automatic ? (kind === 'command' ? 'Command execution' : 'Turn changes awaiting review')
+      : text(input.title, 'title', 300, true),
+    details: automatic ? '' : text(input.details, 'details', 64000),
+    evidence: automatic ? [] : references,
+    command: automatic ? '' : text(input.command, 'command', 64000),
+    diff: automatic ? '' : text(input.diff, 'diff', 64000),
+    executor_id: executorId, thread_id: threadId, turn_id: turnId, item_id: itemId,
     exit_code: Number.isSafeInteger(input.exitCode) ? input.exitCode : null,
     created_at: now()
   };
@@ -55,8 +70,10 @@ export function recordTaskResult(db, input, { now = () => Math.floor(Date.now()
       AND task_id = ? AND actor = ? AND json_valid(payload) AND json_extract(payload, '$.result_key') = ?
       ORDER BY id DESC LIMIT 1`).get(RESULT_EVENT, taskId, peer, record.result_key);
     if (previous) return { ...JSON.parse(previous.payload), id: previous.id, created_at: previous.created_at };
-    record.task_title = task.title;
-    record.task_status = task.status;
+    if (!automatic) {
+      record.task_title = task.title;
+      record.task_status = task.status;
+    }
     if (addEvent) addEvent(db, RESULT_EVENT, peer, taskId, record);
     else db.prepare('INSERT INTO events(type,actor,task_id,payload,created_at) VALUES(?,?,?,?,?)')
       .run(RESULT_EVENT, peer, taskId, JSON.stringify(record), record.created_at);