@logicseek/hello-cc 1.0.2 → 1.0.3

package/lib/runtime/native/store.mjs

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import process from 'node:process';
 import { DatabaseSync } from 'node:sqlite';
 import { randomBytes } from 'node:crypto';
 import { CliError } from '../../shared/errors.mjs';
@@ -11,12 +12,62 @@ function statOrMissing(file) {
 
 function directory(file, create) {
   let stat = statOrMissing(file);
-  if (!stat && create) { fs.mkdirSync(file, { mode: 0o700 }); stat = fs.lstatSync(file); }
+  if (!stat && create) {
+    try { fs.mkdirSync(file, { mode: 0o700 }); }
+    catch (error) { if (error?.code !== 'EEXIST') throw error; }
+    stat = fs.lstatSync(file);
+  }
   if (!stat) return false;
   if (!stat.isDirectory() || stat.isSymbolicLink()) throw new CliError('NATIVE_STATE_UNSAFE', `Native state must be a real directory: ${file}`);
+  if (create) {
+    if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+      throw new CliError('NATIVE_STATE_UNSAFE', `Native state must be owned by the current user: ${file}`);
+    }
+    const fd = fs.openSync(file, fs.constants.O_RDONLY |
+      (fs.constants.O_DIRECTORY || 0) | (fs.constants.O_NOFOLLOW || 0));
+    try {
+      const opened = fs.fstatSync(fd);
+      if (!opened.isDirectory() || opened.dev !== stat.dev || opened.ino !== stat.ino) {
+        throw new CliError('NATIVE_STATE_UNSAFE', `Native state directory changed: ${file}`);
+      }
+      if (process.platform !== 'win32' && (opened.mode & 0o777) !== 0o700) fs.fchmodSync(fd, 0o700);
+      const current = fs.lstatSync(file);
+      if (current.isSymbolicLink() || current.dev !== stat.dev || current.ino !== stat.ino) {
+        throw new CliError('NATIVE_STATE_UNSAFE', `Native state directory changed: ${file}`);
+      }
+    } finally { fs.closeSync(fd); }
+  }
   return true;
 }
 
+function privateDatabase(file) {
+  let stat = statOrMissing(file);
+  if (!stat) {
+    try {
+      const fd = fs.openSync(file, fs.constants.O_RDWR | fs.constants.O_CREAT |
+        fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0), 0o600);
+      fs.closeSync(fd);
+    } catch (error) { if (error?.code !== 'EEXIST') throw error; }
+    stat = fs.lstatSync(file);
+  }
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 ||
+      (typeof process.getuid === 'function' && stat.uid !== process.getuid())) {
+    throw new CliError('NATIVE_STATE_UNSAFE', `Native database must be an owned regular file: ${file}`);
+  }
+  const fd = fs.openSync(file, fs.constants.O_RDWR | (fs.constants.O_NOFOLLOW || 0));
+  try {
+    const opened = fs.fstatSync(fd);
+    if (!opened.isFile() || opened.dev !== stat.dev || opened.ino !== stat.ino) {
+      throw new CliError('NATIVE_STATE_UNSAFE', `Native database changed during validation: ${file}`);
+    }
+    if (process.platform !== 'win32' && (opened.mode & 0o777) !== 0o600) fs.fchmodSync(fd, 0o600);
+    const current = fs.lstatSync(file);
+    if (current.isSymbolicLink() || current.dev !== stat.dev || current.ino !== stat.ino) {
+      throw new CliError('NATIVE_STATE_UNSAFE', `Native database changed during validation: ${file}`);
+    }
+  } finally { fs.closeSync(fd); }
+}
+
 export function nativePaths(ctx, { create = false } = {}) {
   const root = fs.realpathSync(ctx.root);
   const parent = path.join(root, '.hello-cc');
@@ -60,8 +111,8 @@ export function readNativePointer(ctx) {
 
 export function createNativeStore(ctx) {
   const paths = nativePaths(ctx, { create: true });
+  privateDatabase(paths.db);
   const db = new DatabaseSync(paths.db, { timeout: 5000 });
-  fs.chmodSync(paths.db, 0o600);
   db.exec(`PRAGMA journal_mode = WAL;
     PRAGMA busy_timeout = 5000;
     PRAGMA foreign_keys = ON;
@@ -72,11 +123,16 @@ export function createNativeStore(ctx) {
     CREATE TABLE IF NOT EXISTS deliveries (
       id INTEGER PRIMARY KEY, peer TEXT NOT NULL, message_id INTEGER NOT NULL,
       submission_id TEXT NOT NULL UNIQUE, state TEXT NOT NULL, turn_id TEXT,
-      detail TEXT, updated_at INTEGER NOT NULL, UNIQUE(peer, message_id)
+      detail TEXT, origin TEXT NOT NULL DEFAULT 'peer', updated_at INTEGER NOT NULL, UNIQUE(peer, message_id)
     );
     CREATE TABLE IF NOT EXISTS provider_events (
       id INTEGER PRIMARY KEY, peer TEXT NOT NULL, payload TEXT NOT NULL, created_at INTEGER NOT NULL
     );`);
+  // Existing deliveries came from the shared message bus. Migration must not
+  // promote a stored sender name into user authority.
+  if (!db.prepare('PRAGMA table_info(deliveries)').all().some(column => column.name === 'origin')) {
+    db.exec("ALTER TABLE deliveries ADD COLUMN origin TEXT NOT NULL DEFAULT 'peer'");
+  }
   const now = () => Date.now();
   return {
     db,
@@ -88,9 +144,10 @@ export function createNativeStore(ctx) {
         cwd=excluded.cwd, status=excluded.status, updated_at=excluded.updated_at`)
         .run(worker.peer, worker.provider, worker.sessionId || null, worker.cwd, worker.status, now());
     },
-    queue(peer, messageId, submissionId) {
-      db.prepare(`INSERT OR IGNORE INTO deliveries(peer,message_id,submission_id,state,updated_at) VALUES (?,?,?,'queued',?)`)
-        .run(peer, messageId, submissionId, now());
+    queue(peer, messageId, submissionId, origin = 'peer') {
+      if (!['peer', 'user'].includes(origin)) throw new CliError('BAD_ARGS', 'Unknown native message origin');
+      db.prepare(`INSERT OR IGNORE INTO deliveries(peer,message_id,submission_id,state,origin,updated_at) VALUES (?,?,?,'queued',?,?)`)
+        .run(peer, messageId, submissionId, origin, now());
       return this.delivery(peer, messageId);
     },
     delivery(peer, messageId) { return db.prepare('SELECT * FROM deliveries WHERE peer=? AND message_id=?').get(peer, messageId) || null; },

package/lib/runtime/project-path.mjs

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import process from 'node:process';
 import { CliError } from '../shared/errors.mjs';
 
 function pathIsWithin(parent, candidate) {
@@ -22,7 +23,40 @@ function canonicalProjectRoot(root) {
   }
 }
 
-function ensureStateDirectory(root, createStateDir) {
+function privateDirectory(directory, description) {
+  let stat;
+  try { stat = fs.lstatSync(directory); }
+  catch { throw projectPathForbidden(`Cannot inspect ${description}: ${directory}`); }
+  if (stat.isSymbolicLink() || !stat.isDirectory() ||
+      (typeof process.getuid === 'function' && stat.uid !== process.getuid())) {
+    throw projectPathForbidden(`${description} must be an owned real directory: ${directory}`);
+  }
+
+  let fd;
+  try {
+    fd = fs.openSync(directory, fs.constants.O_RDONLY |
+      (fs.constants.O_DIRECTORY || 0) | (fs.constants.O_NOFOLLOW || 0));
+    const opened = fs.fstatSync(fd);
+    if (!opened.isDirectory() || opened.dev !== stat.dev || opened.ino !== stat.ino) {
+      throw projectPathForbidden(`${description} changed during validation: ${directory}`);
+    }
+    if (process.platform !== 'win32' && (opened.mode & 0o777) !== 0o700) {
+      fs.fchmodSync(fd, 0o700);
+    }
+    const current = fs.lstatSync(directory);
+    if (current.isSymbolicLink() || current.dev !== stat.dev || current.ino !== stat.ino) {
+      throw projectPathForbidden(`${description} changed during validation: ${directory}`);
+    }
+    return fs.realpathSync(directory);
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    throw projectPathForbidden(`Cannot secure ${description}: ${directory}`);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+function ensureStateDirectory(root, createStateDir, secureExisting = createStateDir) {
   const stateDir = path.join(root, '.hello-cc');
   let stateStat;
   try {
@@ -35,8 +69,9 @@ function ensureStateDirectory(root, createStateDir) {
     try {
       fs.mkdirSync(stateDir, { mode: 0o700 });
       stateStat = fs.lstatSync(stateDir);
-    } catch {
-      throw projectPathForbidden(`Cannot create project state directory: ${stateDir}`);
+    } catch (error) {
+      if (error?.code === 'EEXIST') stateStat = fs.lstatSync(stateDir);
+      else throw projectPathForbidden(`Cannot create project state directory: ${stateDir}`);
     }
   }
 
@@ -44,7 +79,9 @@ function ensureStateDirectory(root, createStateDir) {
     throw projectPathForbidden(`Project state directory must be a real directory: ${stateDir}`);
   }
   try {
-    const canonical = fs.realpathSync(stateDir);
+    const canonical = secureExisting
+      ? privateDirectory(stateDir, 'Project state directory')
+      : fs.realpathSync(stateDir);
     if (canonical !== stateDir || !pathIsWithin(root, canonical)) {
       throw projectPathForbidden(`Project state directory escapes its project root: ${stateDir}`);
     }
@@ -55,13 +92,26 @@ function ensureStateDirectory(root, createStateDir) {
   }
 }
 
-function validateDatabaseParent(stateDir, db) {
+export function secureExistingProjectStateDirectory(root) {
+  const canonicalRoot = canonicalProjectRoot(root);
+  return ensureStateDirectory(canonicalRoot, false, true);
+}
+
+function validateDatabaseParent(stateDir, db, createParents = false) {
   const parent = path.dirname(db);
   const relative = path.relative(stateDir, parent);
   const segments = relative === '' ? [] : relative.split(path.sep);
   let current = stateDir;
   for (const segment of segments) {
     current = path.join(current, segment);
+    if (createParents) {
+      try { fs.mkdirSync(current, { mode: 0o700 }); }
+      catch (error) {
+        if (error?.code !== 'EEXIST') {
+          throw projectPathForbidden(`Cannot create database parent directory: ${current}`);
+        }
+      }
+    }
     let stat;
     try {
       stat = fs.lstatSync(current);
@@ -71,6 +121,9 @@ function validateDatabaseParent(stateDir, db) {
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
       throw projectPathForbidden(`Database parent must contain only real directories: ${current}`);
     }
+    if (createParents && privateDirectory(current, 'Database parent directory') !== current) {
+      throw projectPathForbidden(`Database parent directory changed: ${current}`);
+    }
   }
 
   try {
@@ -107,7 +160,7 @@ function validateDatabaseTarget(stateDir, db) {
   }
 }
 
-export function resolveProjectDatabase({ root, db, createStateDir = false }) {
+export function resolveProjectDatabase({ root, db, createStateDir = false, createDatabaseParents = false }) {
   const requestedRoot = path.resolve(String(root || ''));
   const canonicalRoot = canonicalProjectRoot(requestedRoot);
   const rawDb = path.resolve(String(db || path.join(requestedRoot, '.hello-cc', 'mesh.db')));
@@ -130,10 +183,40 @@ export function resolveProjectDatabase({ root, db, createStateDir = false }) {
     return { root: canonicalRoot, stateDir: state.stateDir, db: requestedDb };
   }
 
-  validateDatabaseParent(state.stateDir, requestedDb);
+  validateDatabaseParent(state.stateDir, requestedDb, Boolean(createDatabaseParents));
   return {
     root: canonicalRoot,
     stateDir: state.stateDir,
     db: validateDatabaseTarget(state.stateDir, requestedDb)
   };
 }
+
+export function ensurePrivateProjectBufferDirectory(root, directoryName = 'bufs', { create = true } = {}) {
+  if (!directoryName || directoryName !== path.basename(directoryName) ||
+      directoryName === '.' || directoryName === '..') {
+    throw projectPathForbidden(`Invalid buffer directory name: ${directoryName}`);
+  }
+  const canonicalRoot = canonicalProjectRoot(root);
+  const state = ensureStateDirectory(canonicalRoot, create, true);
+  if (!state.exists) return null;
+  const { stateDir } = state;
+  const directory = path.join(stateDir, directoryName);
+  if (create) {
+    try { fs.mkdirSync(directory, { mode: 0o700 }); }
+    catch (error) {
+      if (error?.code !== 'EEXIST') {
+        throw projectPathForbidden(`Cannot create buffer directory: ${directory}`);
+      }
+    }
+  } else {
+    try { fs.lstatSync(directory); }
+    catch (error) {
+      if (error?.code === 'ENOENT') return null;
+      throw projectPathForbidden(`Cannot inspect buffer directory: ${directory}`);
+    }
+  }
+  if (privateDirectory(directory, 'Buffer directory') !== directory) {
+    throw projectPathForbidden(`Buffer directory escapes project state directory: ${directory}`);
+  }
+  return directory;
+}

package/lib/shared/file-lock.mjs

@@ -23,6 +23,7 @@ const PORT_CANDIDATE_COUNT = 4;
 const STARTUP_GRACE_MS = 5000;
 const RELEASE_GRACE_MS = 5000;
 const WORKER_URL = new URL('./socket-lock-worker.mjs', import.meta.url);
+const leaseResources = new WeakMap();
 const WORKER_BOOTSTRAP = String.raw`
   import('node:worker_threads').then(({ parentPort, workerData }) => {
     const state = new Int32Array(workerData.stateBuffer);
@@ -224,7 +225,14 @@ function terminateWorker(worker, primary, key) {
 }
 
 function acquisitionError(status, resources) {
-  if (status === STATE.BUSY) return busyError(resources.location.key);
+  if (status === STATE.BUSY) {
+    if (Atomics.load(resources.state, DETAIL_INDEX) === 2) {
+      const error = new Error(`A listener without an identity handshake may own the legacy lock: ${resources.location.key}`);
+      error.code = 'ERR_FILE_LOCK_LEGACY_OWNER';
+      return error;
+    }
+    return busyError(resources.location.key);
+  }
   if (status === STATE.TIMEOUT) return timeoutError(resources.location.key);
   if (status === STATE.FAILED) {
     return injectedFailure(resources.worker, resources.state, 'startup', resources.location.key);
@@ -250,7 +258,8 @@ function acquireWorker(location, options, workerFactory) {
         moduleUrl: WORKER_URL.href,
         timeoutMs: options.timeoutMs,
         retryMs: options.retryMs,
-        nonblocking: options.nonblocking
+        nonblocking: options.nonblocking,
+        rejectLegacyOwner: options.rejectLegacyOwner
       },
       state,
       states: STATE
@@ -264,7 +273,13 @@ function acquireWorker(location, options, workerFactory) {
       // A module-load failure happens before the Worker can publish FAILED.
       // Suppress the otherwise-unhandled event; the bounded startup wait below
       // converts this path to ERR_FILE_LOCK_WORKER_START_TIMEOUT.
-      resources.worker.on('error', () => {});
+      const lost = () => {
+        if (Atomics.compareExchange(state, STATE_INDEX, STATE.ACQUIRED, STATE.FAILED) === STATE.ACQUIRED) {
+          Atomics.notify(state, STATE_INDEX);
+        }
+      };
+      resources.worker.on('error', lost);
+      resources.worker.on('exit', lost);
     }
     resources.worker.unref();
     const waitMs = STARTUP_GRACE_MS +
@@ -323,20 +338,18 @@ function releaseWorker(resources, primary) {
     : error;
 }
 
-export function createFileLock({ workerFactory = defaultWorkerFactory } = {}) {
+// A lease may span asynchronous work. Its caller must release it only after all
+// work protected by the ownership boundary has conclusively stopped.
+export function createFileLockLease({ workerFactory = defaultWorkerFactory } = {}) {
   if (typeof workerFactory !== 'function') {
     throw new TypeError('file lock workerFactory must be a function');
   }
-  return function withConfiguredFileLock(
-    target,
-    fn,
-    options = {}
-  ) {
+  return function (target, options = {}) {
     const timeoutMs = options.timeoutMs === undefined ? 5000 : options.timeoutMs;
     const retryMs = options.retryMs === undefined ? 25 : options.retryMs;
     const nonblocking = options.nonblocking === undefined ? false : options.nonblocking;
     const createParent = options.createParent === undefined ? true : options.createParent;
-    if (typeof fn !== 'function') throw new TypeError('file lock callback must be a function');
+    const rejectLegacyOwner = options.rejectLegacyOwner === undefined ? false : options.rejectLegacyOwner;
     if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
       throw new RangeError('file lock timeoutMs must be a non-negative finite number');
     }
@@ -349,18 +362,51 @@ export function createFileLock({ workerFactory = defaultWorkerFactory } = {}) {
     if (typeof createParent !== 'boolean') {
       throw new TypeError('file lock createParent must be a boolean');
     }
-    if (fn.constructor?.name === 'AsyncFunction') {
-      throw new TypeError('withFileLock requires a synchronous callback');
+    if (typeof rejectLegacyOwner !== 'boolean') {
+      throw new TypeError('file lock rejectLegacyOwner must be a boolean');
     }
-
     const location = canonicalTarget(target, { createParent });
-    const resources = acquireWorker(location, { timeoutMs, retryMs, nonblocking }, workerFactory);
+    const resources = acquireWorker(location, { timeoutMs, retryMs, nonblocking, rejectLegacyOwner }, workerFactory);
+    const lease = Object.freeze({
+      canonicalTarget: location.canonicalTarget,
+      assertHeld() {
+        if (Atomics.load(resources.state, STATE_INDEX) !== STATE.ACQUIRED || leaseResources.get(lease).finished) {
+          const error = new Error(`file lock ownership is no longer confirmed: ${location.key}`);
+          error.code = 'ERR_FILE_LOCK_LOST';
+          throw error;
+        }
+      },
+      release() { finishLease(lease, NO_ERROR); }
+    });
+    leaseResources.set(lease, { resources, finished: false, error: NO_ERROR });
+    return lease;
+  };
+}
+
+function finishLease(lease, primary) {
+  const entry = leaseResources.get(lease);
+  if (!entry.finished) {
+    entry.finished = true;
+    entry.error = releaseWorker(entry.resources, primary);
+  }
+  if (entry.error !== NO_ERROR) throw entry.error;
+  if (primary !== NO_ERROR) throw primary;
+}
+
+export const acquireFileLock = createFileLockLease();
+
+export function createFileLock(options = {}) {
+  const acquire = createFileLockLease(options);
+  return function withConfiguredFileLock(target, fn, lockOptions = {}) {
+    if (typeof fn !== 'function') throw new TypeError('file lock callback must be a function');
+    if (fn.constructor?.name === 'AsyncFunction') throw new TypeError('withFileLock requires a synchronous callback');
+    const lease = acquire(target, lockOptions);
     let result;
     let primary = NO_ERROR;
     try {
       // Protected I/O must use this fixed path. The supplied parent alias may
       // be retargeted after acquisition and belongs to a different lock domain.
-      result = fn(location.canonicalTarget);
+      result = fn(lease.canonicalTarget);
       if (result && typeof result.then === 'function') {
         Promise.resolve(result).catch(() => {});
         throw new TypeError('withFileLock requires a synchronous callback');
@@ -368,8 +414,7 @@ export function createFileLock({ workerFactory = defaultWorkerFactory } = {}) {
     } catch (error) {
       primary = error;
     }
-    const finalError = releaseWorker(resources, primary);
-    if (finalError !== NO_ERROR) throw finalError;
+    finishLease(lease, primary);
     return result;
   };
 }

package/lib/shared/socket-lock-worker.mjs

@@ -139,14 +139,14 @@ export function runSocketLockWorker(workerData) {
     let received = '';
     let settled = false;
     let socket;
-    const settle = (matching) => {
+    const settle = (matching, legacy = false) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
       try { socket?.destroy(); } catch {}
-      callback(matching);
+      callback(matching, legacy);
     };
-    const timer = setTimeout(() => settle(false), PROBE_TIMEOUT_MS);
+    const timer = setTimeout(() => settle(false, received.length === 0), PROBE_TIMEOUT_MS);
     try {
       socket = net.createConnection({ host: '127.0.0.1', port });
       socket.setEncoding('utf8');
@@ -156,7 +156,10 @@ export function runSocketLockWorker(workerData) {
           settle(received === expected);
         }
       });
-      socket.once('end', () => settle(received === expected));
+      // The previous native runtime owner accepted and immediately ended the
+      // connection with no banner. Native leases must not treat it as an
+      // unrelated service and start a second runtime on another candidate.
+      socket.once('end', () => settle(received === expected, received.length === 0));
       socket.once('error', () => settle(false));
     } catch {
       settle(false);
@@ -184,9 +187,15 @@ export function runSocketLockWorker(workerData) {
           requestTerminalFailure();
           return;
         }
-        probeOccupant(port, target.identity, (matching) => {
+        probeOccupant(port, target.identity, (matching, legacy) => {
           if (finished || attemptGeneration !== generation) return;
-          if (matching) retryCleanly(attemptGeneration);
+          if (legacy && workerData.rejectLegacyOwner) {
+            generation += 1;
+            closeServers((error) => {
+              if (error) requestTerminalFailure();
+              else finish(states.BUSY, 2);
+            });
+          } else if (matching) retryCleanly(attemptGeneration);
           else bindCandidate(targetIndex, candidateIndex + 1, boundForTarget, attemptGeneration);
         });
       };

package/lib/web/codex-app-server.mjs

@@ -10,6 +10,7 @@ const APPROVAL_METHODS = CODEX_INTERACTION_METHODS;
 const TERMINAL_TURNS = new Set(['completed', 'interrupted', 'failed']);
 const MAX_LINE_BYTES = 8 * 1024 * 1024;
 const MAX_TEXT = 65536;
+const STREAM_UPDATE_MS = 50;
 
 export class CodexAppServerError extends Error {
   constructor(code, message, extra = {}) {
@@ -70,6 +71,8 @@ export function createCodexAppServer({
   let buffer = '';
   let truncated = false;
   let closePromise = null;
+  let streamTimer = null;
+  let streamEvent = null;
   const threads = new Map();
   const pending = new Map();
   const approvals = new Map();
@@ -111,11 +114,26 @@ export function createCodexAppServer({
     });
   }
 
+  function publishChange(event) {
+    clearTimeout(streamTimer); streamTimer = null; streamEvent = null;
+    try { onChange(snapshot(), structuredClone(event)); } catch { /* UI observers do not own transport. */ }
+  }
+
   function changed(method, params = {}) {
     const event = { method, params: bounded(params, 8192), at: Date.now() };
     events.push(event);
     if (events.length > 100) events.shift();
-    try { onChange(snapshot(), structuredClone(event)); } catch { /* UI observers do not own transport. */ }
+    // Keep protocol state current on every token, but copy/broadcast its complete
+    // retained history at most once per interval during a text-only burst.
+    // Approval, completion, error and connection changes publish immediately;
+    // their snapshot includes all pending text and cancels the trailing timer.
+    if (method === 'item/agentMessage/delta') {
+      streamEvent = event;
+      if (!streamTimer) {
+        streamTimer = setTimeout(() => publishChange(streamEvent), STREAM_UPDATE_MS);
+        streamTimer.unref?.();
+      }
+    } else publishChange(event);
   }
 
   function ensureThread(id) {

package/lib/web/codex-sessions.mjs

@@ -81,6 +81,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
         binding: { transport: 'app-server', runtimeSessionId: id } });
       return { mcp_servers: { hello_cc_scoped: session.mcpCapability.config } };
     }, onChange(state) {
+      session.executorId ||= state.executorId;
       broadcast(session, { type: 'codex_state', state });
       if (state.status === 'disconnected' && !closeScheduled) {
         closeScheduled = true;
@@ -114,6 +115,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
         throw new CliError('CODEX_DISCONNECTED', 'Executor disconnected while opening its thread; no session was registered');
       }
       session.pid = executorState.pid || null;
+      session.executorId = executorState.executorId;
       const save = connectWebProject(pctx);
       try {
         tx(save, () => {

package/lib/web/cookie-auth.mjs

@@ -99,7 +99,7 @@ export function createCookieAuth({
   }
 
   function webAuthMode(url, req) {
-    if (authOk(url, req, token)) return 'token';
+    if (authOk(url, req, token, { trustProxy, proxyOrigin })) return 'token';
     return cookieSessionOk(req) ? 'cookie' : null;
   }
 

package/lib/web/http-routes.mjs

@@ -7,12 +7,12 @@ import process from 'node:process';
 import { URL } from 'node:url';
 import { publicCliFailure, CliError } from '../shared/errors.mjs';
 import { required } from '../cli-args.mjs';
-import { packageRoot } from '../cli-runtime.mjs';
+import { terminalAssetPath } from './terminal-assets.mjs';
 import { projectRecord } from '../runtime/projects.mjs';
 import { writeRuntime } from '../runtime/state.mjs';
 import { normalizeStateResources } from '../ui/state-render.mjs';
 import { requestUrl, runtimeBaseUrl } from '../web/runtime.mjs';
-import { authOk, readJsonRequest, requestMatchesProxyOrigin, requestOriginMatches, sendFile, sendJson, tokenMatches } from '../web/http.mjs';
+import { authOk, readJsonRequest, requestMatchesProxyOrigin, requestOriginMatches, sendFile, sendJson, tokenMatches, tokenlessRequestAllowed } from '../web/http.mjs';
 import { API_VERSION, apiVersionUnsupportedBody, readHttpApiVersion } from '../web/api-version.mjs';
 import { isDshHookBinding } from '../core/peers/bindings.mjs';
 import { writeAdoptionState } from './adoption-state.mjs';
@@ -48,8 +48,12 @@ export function createHttpRoutes(deps) {
   }
 
   const handleWebRequest = async (req, res) => {
-    const url = requestUrl(req);
     try {
+      const url = requestUrl(req);
+      if (!token && !tokenlessRequestAllowed(req, { trustProxy, proxyOrigin })) {
+        sendJson(res, 403, { ok: false, error: { code: 'UNTRUSTED_HOST', message: 'Tokenless access requires a trusted local Host' } });
+        return;
+      }
       if (req.method === 'GET' && url.pathname === '/') {
         const accept = req.headers.accept || '';
         const isBrowserNav = req.headers['sec-fetch-mode'] === 'navigate' || accept.includes('text/html');
@@ -85,19 +89,19 @@ export function createHttpRoutes(deps) {
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/xterm.js') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'xterm', 'lib', 'xterm.js'), 'application/javascript; charset=utf-8');
+        sendFile(res, terminalAssetPath('xterm.js'), 'application/javascript; charset=utf-8');
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/xterm.css') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'xterm', 'css', 'xterm.css'), 'text/css; charset=utf-8');
+        sendFile(res, terminalAssetPath('xterm.css'), 'text/css; charset=utf-8');
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/addon-fit.js') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'addon-fit', 'lib', 'addon-fit.js'), 'application/javascript; charset=utf-8');
+        sendFile(res, terminalAssetPath('addon-fit.js'), 'application/javascript; charset=utf-8');
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/addon-search.js') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'addon-search', 'lib', 'addon-search.js'), 'application/javascript; charset=utf-8');
+        sendFile(res, terminalAssetPath('addon-search.js'), 'application/javascript; charset=utf-8');
         return;
       }
       if (req.method === 'POST' && url.pathname === '/login') {

package/lib/web/http.mjs

@@ -84,6 +84,24 @@ export function isLoopbackRemote(req) {
   return addr === '::1' || addr.startsWith('127.') || addr.startsWith('::ffff:127.');
 }
 
+function localHostAuthority(req) {
+  const host = req?.headers?.host;
+  if (typeof host !== 'string') return false;
+  const match = /^(?:localhost|127\.0\.0\.1|\[::1\])(?::(\d{1,5}))?$/i.exec(host);
+  if (!match) return false;
+  return !match[1] || (Number(match[1]) > 0 && Number(match[1]) <= 65535);
+}
+
+export function tokenlessRequestAllowed(req, options = {}) {
+  if (!isLoopbackRemote(req)) return false;
+  if (localHostAuthority(req)) return true;
+  if (!options.trustProxy || !requestMatchesProxyOrigin(req, options)) return false;
+  const expected = normalizedProxyOrigin(options.proxyOrigin);
+  const actual = normalizedOriginAuthority(req?.headers?.host, expected?.protocol);
+  return Boolean(expected && actual && actual.hostname === expected.authority.hostname &&
+    actual.port === expected.authority.port);
+}
+
 export function tokenMatches(provided, expected) {
   if (!provided || !expected || provided.length !== expected.length) return false;
   try {
@@ -174,10 +192,10 @@ export function requestOriginMatches(req, options = {}) {
   }
 }
 
-export function authOk(url, req, token) {
+export function authOk(url, req, token, options = {}) {
   // No token configured: only trust loopback clients. A tokenless runtime is
   // refused on non-loopback binds at startup, so this is defense-in-depth.
-  if (!token) return isLoopbackRemote(req);
+  if (!token) return tokenlessRequestAllowed(req, options);
   // v1-token-query-csrf-bypass: the query token is accepted ONLY on the cookie
   // exchange paths (the console page and the login endpoint). Everywhere else
   // — including all API routes and the WS upgrade — a leaked ?token= URL must