@logicseek/hello-cc 1.0.2 → 1.0.4

package/lib/shared/socket-lock-worker.mjs

@@ -139,14 +139,14 @@ export function runSocketLockWorker(workerData) {
     let received = '';
     let settled = false;
     let socket;
-    const settle = (matching) => {
+    const settle = (matching, legacy = false) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
       try { socket?.destroy(); } catch {}
-      callback(matching);
+      callback(matching, legacy);
     };
-    const timer = setTimeout(() => settle(false), PROBE_TIMEOUT_MS);
+    const timer = setTimeout(() => settle(false, received.length === 0), PROBE_TIMEOUT_MS);
     try {
       socket = net.createConnection({ host: '127.0.0.1', port });
       socket.setEncoding('utf8');
@@ -156,7 +156,10 @@ export function runSocketLockWorker(workerData) {
           settle(received === expected);
         }
       });
-      socket.once('end', () => settle(received === expected));
+      // The previous native runtime owner accepted and immediately ended the
+      // connection with no banner. Native leases must not treat it as an
+      // unrelated service and start a second runtime on another candidate.
+      socket.once('end', () => settle(received === expected, received.length === 0));
       socket.once('error', () => settle(false));
     } catch {
       settle(false);
@@ -184,9 +187,15 @@ export function runSocketLockWorker(workerData) {
           requestTerminalFailure();
           return;
         }
-        probeOccupant(port, target.identity, (matching) => {
+        probeOccupant(port, target.identity, (matching, legacy) => {
           if (finished || attemptGeneration !== generation) return;
-          if (matching) retryCleanly(attemptGeneration);
+          if (legacy && workerData.rejectLegacyOwner) {
+            generation += 1;
+            closeServers((error) => {
+              if (error) requestTerminalFailure();
+              else finish(states.BUSY, 2);
+            });
+          } else if (matching) retryCleanly(attemptGeneration);
           else bindCandidate(targetIndex, candidateIndex + 1, boundForTarget, attemptGeneration);
         });
       };

package/lib/web/codex-app-server.mjs

@@ -10,6 +10,7 @@ const APPROVAL_METHODS = CODEX_INTERACTION_METHODS;
 const TERMINAL_TURNS = new Set(['completed', 'interrupted', 'failed']);
 const MAX_LINE_BYTES = 8 * 1024 * 1024;
 const MAX_TEXT = 65536;
+const STREAM_UPDATE_MS = 50;
 
 export class CodexAppServerError extends Error {
   constructor(code, message, extra = {}) {
@@ -70,6 +71,8 @@ export function createCodexAppServer({
   let buffer = '';
   let truncated = false;
   let closePromise = null;
+  let streamTimer = null;
+  let streamEvent = null;
   const threads = new Map();
   const pending = new Map();
   const approvals = new Map();
@@ -111,11 +114,26 @@ export function createCodexAppServer({
     });
   }
 
+  function publishChange(event) {
+    clearTimeout(streamTimer); streamTimer = null; streamEvent = null;
+    try { onChange(snapshot(), structuredClone(event)); } catch { /* UI observers do not own transport. */ }
+  }
+
   function changed(method, params = {}) {
     const event = { method, params: bounded(params, 8192), at: Date.now() };
     events.push(event);
     if (events.length > 100) events.shift();
-    try { onChange(snapshot(), structuredClone(event)); } catch { /* UI observers do not own transport. */ }
+    // Keep protocol state current on every token, but copy/broadcast its complete
+    // retained history at most once per interval during a text-only burst.
+    // Approval, completion, error and connection changes publish immediately;
+    // their snapshot includes all pending text and cancels the trailing timer.
+    if (method === 'item/agentMessage/delta') {
+      streamEvent = event;
+      if (!streamTimer) {
+        streamTimer = setTimeout(() => publishChange(streamEvent), STREAM_UPDATE_MS);
+        streamTimer.unref?.();
+      }
+    } else publishChange(event);
   }
 
   function ensureThread(id) {

package/lib/web/codex-sessions.mjs

@@ -81,6 +81,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
         binding: { transport: 'app-server', runtimeSessionId: id } });
       return { mcp_servers: { hello_cc_scoped: session.mcpCapability.config } };
     }, onChange(state) {
+      session.executorId ||= state.executorId;
       broadcast(session, { type: 'codex_state', state });
       if (state.status === 'disconnected' && !closeScheduled) {
         closeScheduled = true;
@@ -114,6 +115,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
         throw new CliError('CODEX_DISCONNECTED', 'Executor disconnected while opening its thread; no session was registered');
       }
       session.pid = executorState.pid || null;
+      session.executorId = executorState.executorId;
       const save = connectWebProject(pctx);
       try {
         tx(save, () => {

package/lib/web/cookie-auth.mjs

@@ -99,7 +99,7 @@ export function createCookieAuth({
   }
 
   function webAuthMode(url, req) {
-    if (authOk(url, req, token)) return 'token';
+    if (authOk(url, req, token, { trustProxy, proxyOrigin })) return 'token';
     return cookieSessionOk(req) ? 'cookie' : null;
   }
 

package/lib/web/http-routes.mjs

@@ -7,12 +7,12 @@ import process from 'node:process';
 import { URL } from 'node:url';
 import { publicCliFailure, CliError } from '../shared/errors.mjs';
 import { required } from '../cli-args.mjs';
-import { packageRoot } from '../cli-runtime.mjs';
+import { terminalAssetPath } from './terminal-assets.mjs';
 import { projectRecord } from '../runtime/projects.mjs';
 import { writeRuntime } from '../runtime/state.mjs';
 import { normalizeStateResources } from '../ui/state-render.mjs';
 import { requestUrl, runtimeBaseUrl } from '../web/runtime.mjs';
-import { authOk, readJsonRequest, requestMatchesProxyOrigin, requestOriginMatches, sendFile, sendJson, tokenMatches } from '../web/http.mjs';
+import { authOk, readJsonRequest, requestMatchesProxyOrigin, requestOriginMatches, sendFile, sendJson, tokenMatches, tokenlessRequestAllowed } from '../web/http.mjs';
 import { API_VERSION, apiVersionUnsupportedBody, readHttpApiVersion } from '../web/api-version.mjs';
 import { isDshHookBinding } from '../core/peers/bindings.mjs';
 import { writeAdoptionState } from './adoption-state.mjs';
@@ -48,8 +48,12 @@ export function createHttpRoutes(deps) {
   }
 
   const handleWebRequest = async (req, res) => {
-    const url = requestUrl(req);
     try {
+      const url = requestUrl(req);
+      if (!token && !tokenlessRequestAllowed(req, { trustProxy, proxyOrigin })) {
+        sendJson(res, 403, { ok: false, error: { code: 'UNTRUSTED_HOST', message: 'Tokenless access requires a trusted local Host' } });
+        return;
+      }
       if (req.method === 'GET' && url.pathname === '/') {
         const accept = req.headers.accept || '';
         const isBrowserNav = req.headers['sec-fetch-mode'] === 'navigate' || accept.includes('text/html');
@@ -85,19 +89,19 @@ export function createHttpRoutes(deps) {
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/xterm.js') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'xterm', 'lib', 'xterm.js'), 'application/javascript; charset=utf-8');
+        sendFile(res, terminalAssetPath('xterm.js'), 'application/javascript; charset=utf-8');
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/xterm.css') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'xterm', 'css', 'xterm.css'), 'text/css; charset=utf-8');
+        sendFile(res, terminalAssetPath('xterm.css'), 'text/css; charset=utf-8');
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/addon-fit.js') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'addon-fit', 'lib', 'addon-fit.js'), 'application/javascript; charset=utf-8');
+        sendFile(res, terminalAssetPath('addon-fit.js'), 'application/javascript; charset=utf-8');
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/addon-search.js') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'addon-search', 'lib', 'addon-search.js'), 'application/javascript; charset=utf-8');
+        sendFile(res, terminalAssetPath('addon-search.js'), 'application/javascript; charset=utf-8');
         return;
       }
       if (req.method === 'POST' && url.pathname === '/login') {

package/lib/web/http.mjs

@@ -84,6 +84,24 @@ export function isLoopbackRemote(req) {
   return addr === '::1' || addr.startsWith('127.') || addr.startsWith('::ffff:127.');
 }
 
+function localHostAuthority(req) {
+  const host = req?.headers?.host;
+  if (typeof host !== 'string') return false;
+  const match = /^(?:localhost|127\.0\.0\.1|\[::1\])(?::(\d{1,5}))?$/i.exec(host);
+  if (!match) return false;
+  return !match[1] || (Number(match[1]) > 0 && Number(match[1]) <= 65535);
+}
+
+export function tokenlessRequestAllowed(req, options = {}) {
+  if (!isLoopbackRemote(req)) return false;
+  if (localHostAuthority(req)) return true;
+  if (!options.trustProxy || !requestMatchesProxyOrigin(req, options)) return false;
+  const expected = normalizedProxyOrigin(options.proxyOrigin);
+  const actual = normalizedOriginAuthority(req?.headers?.host, expected?.protocol);
+  return Boolean(expected && actual && actual.hostname === expected.authority.hostname &&
+    actual.port === expected.authority.port);
+}
+
 export function tokenMatches(provided, expected) {
   if (!provided || !expected || provided.length !== expected.length) return false;
   try {
@@ -174,10 +192,10 @@ export function requestOriginMatches(req, options = {}) {
   }
 }
 
-export function authOk(url, req, token) {
+export function authOk(url, req, token, options = {}) {
   // No token configured: only trust loopback clients. A tokenless runtime is
   // refused on non-loopback binds at startup, so this is defense-in-depth.
-  if (!token) return isLoopbackRemote(req);
+  if (!token) return tokenlessRequestAllowed(req, options);
   // v1-token-query-csrf-bypass: the query token is accepted ONLY on the cookie
   // exchange paths (the console page and the login endpoint). Everywhere else
   // — including all API routes and the WS upgrade — a leaked ?token= URL must

package/lib/web/native-sessions.mjs

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 import { CliError } from '../shared/errors.mjs';
 import { redactSecrets } from '../shared/redact.mjs';
 import { tx } from '../db/schema.mjs';
@@ -29,10 +30,17 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
     return redactSecrets({ code: error.code || 'NATIVE_RUNTIME_OFFLINE',
       message: error.message || 'Native runtime is disconnected' });
   }
+  function publishState(session, state) {
+    // Event cursors do not cover approvals, delivery receipts or capabilities.
+    // Compare the complete normalized state; validation and lease revocation
+    // still run on every read, including reads that need no new UI frame.
+    const changed = !isDeepStrictEqual(session.nativeState, state);
+    session.nativeState = state;
+    if (changed) broadcast(session, { type: 'native_state', state: session.nativeSnapshot() });
+  }
   function disconnect(session, error, retire = false) {
     session.status = 'disconnected';
-    session.nativeState = { ...session.nativeState, connected: false, status: 'disconnected', error: errorInfo(error) };
-    broadcast(session, { type: 'native_state', state: session.nativeSnapshot() });
+    publishState(session, { ...session.nativeState, connected: false, status: 'disconnected', error: errorInfo(error) });
     if (retire && !session.nativeRetired) {
       session.nativeRetired = true;
       closeSessionClients(session);
@@ -100,7 +108,7 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
     const turnId = value.snapshot.turnId || value.snapshot.activeTurnId || value.active_delivery?.turn_id || null;
     session.binding = binding;
     session.cwd = value.cwd;
-    session.nativeState = redactSecrets({ backend: 'native', connected: true, root: value.root,
+    const state = redactSecrets({ backend: 'native', connected: true, root: value.root,
       peer: value.peer, provider: value.provider, generation: value.generation, owner: value.owner,
       executorId: value.owner, sessionId: value.snapshot.sessionId || null, turnId,
       status: value.snapshot.status, cwd: value.cwd, capabilities: value.snapshot.capabilities || {}, pendingApprovals: value.snapshot.pendingApprovals || [],
@@ -111,7 +119,7 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
     session.status = CLOSED.has(value.snapshot.status) ? 'exited'
       : value.snapshot.status === 'disconnected' ? 'disconnected' : 'running';
     if (session.status === 'exited') session.exitedAt = now();
-    broadcast(session, { type: 'native_state', state: session.nativeSnapshot() });
+    publishState(session, state);
     return session.nativeSnapshot();
   }
   function makeSession(ctx, checked) {
@@ -261,8 +269,7 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
       if (action === 'respond') { await readState(session); current(session); }
       if (action === 'close') {
         session.status = 'exited'; session.exitedAt = now();
-        session.nativeState = { ...session.nativeState, connected: false, status: 'closed', closing: false };
-        broadcast(session, { type: 'native_state', state: session.nativeSnapshot() });
+        publishState(session, { ...session.nativeState, connected: false, status: 'closed', closing: false });
         closeSessionClients(session);
         session.actionTokens.clear();
       }

package/lib/web/peer-actions.mjs

@@ -3,10 +3,12 @@ import process from 'node:process';
 import { intOpt, positiveSafeIntOpt, required } from '../cli-args.mjs';
 import { CliError } from '../shared/errors.mjs';
 import {
+  findRequestedLock,
   lockLabel,
   lockScope,
   locksConflict,
-  scopedLockResource
+  scopedLockResource,
+  upsertRequestedLock
 } from '../core/coordination/locks.mjs';
 import { normalizeStateResources } from '../ui/state-render.mjs';
 import {
@@ -103,23 +105,31 @@ export function createWebPeerActions(deps = {}) {
   function webPeerRegister(projectCtx, peer, input = {}) {
     webMutationPeer(peer, input);
     const db = connect(projectCtx);
-    const row = {
-      id: peer,
-      kind: input.kind || 'other',
-      role: input.role || 'peer',
-      worktree: path.resolve(input.worktree || projectCtx.cwd),
-      branch: input.branch || detectBranch(projectCtx.cwd),
-      pid: intOpt(input, 'pid', process.ppid),
-      status: input.status || 'idle',
-      capabilities: Array.isArray(input.cap) ? input.cap.join(',') : (input.cap || input.capabilities || 'web')
-    };
     try {
+      const existing = db.prepare('SELECT * FROM peers WHERE id = ?').get(peer) || null;
+      const explicitPid = Object.hasOwn(input, 'pid');
+      const row = {
+        id: peer,
+        kind: input.kind || existing?.kind || 'other',
+        role: input.role || existing?.role || 'peer',
+        worktree: path.resolve(input.worktree || existing?.worktree || projectCtx.cwd),
+        branch: input.branch || existing?.branch || detectBranch(projectCtx.cwd),
+        pid: explicitPid ? intOpt(input, 'pid') : (existing?.pid ?? null),
+        ...(!explicitPid ? { processIdentity: existing ? {
+          pid: existing.pid,
+          startToken: existing.pid_start_token,
+          commandHash: existing.pid_command_hash
+        } : null } : {}),
+        status: input.status || existing?.status || 'idle',
+        capabilities: Array.isArray(input.cap) ? input.cap.join(',') :
+          (input.cap || input.capabilities || existing?.capabilities || 'web')
+      };
       upsertPeer(db, row);
       addEvent(db, 'peer.registered', peer, null, webAuditPayload(peer, input, row));
+      return { peer: row, summary: `registered ${row.id} (${row.kind}${row.role ? `, ${row.role}` : ''})` };
     } finally {
       db.close();
     }
-    return { peer: row, summary: `registered ${row.id} (${row.kind}${row.role ? `, ${row.role}` : ''})` };
   }
 
   function webPeerHeartbeat(projectCtx, peer, input = {}) {
@@ -294,21 +304,11 @@ export function createWebPeerActions(deps = {}) {
         }
         const existing = subject.locks.find((row) => row.resource === requested.resource) || null;
         const expiresAt = leaseDeadline(t, ttl);
-        db.prepare(`
-          INSERT INTO locks(resource, base_resource, scope, owner, task_id, reason, expires_at, created_at, ttl_sec)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-          ON CONFLICT(resource) DO UPDATE SET
-            base_resource = excluded.base_resource,
-            scope = excluded.scope,
-            owner = excluded.owner,
-            task_id = excluded.task_id,
-            reason = excluded.reason,
-            expires_at = excluded.expires_at,
-            created_at = excluded.created_at,
-            ttl_sec = excluded.ttl_sec
-        `).run(requested.resource, requested.base_resource, requested.scope, peer, taskId, reason, expiresAt, t, ttl);
+        const acquired = upsertRequestedLock(db, requested, {
+          owner: peer, task_id: taskId, reason, expires_at: expiresAt, created_at: t, ttl_sec: ttl
+        });
         addEvent(db, 'lock.acquired', peer, taskId, webAuditPayload(peer, input, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, ttl, previous_owner: existing ? existing.owner : null }));
-        return { lock: db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource) };
+        return { lock: acquired };
         }
       });
       if (outcome.error) throw outcome.error;
@@ -327,7 +327,7 @@ export function createWebPeerActions(deps = {}) {
     try {
       touchPeer(db, peer, null);
       const result = tx(db, () => {
-        const existing = db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
+        const existing = findRequestedLock(db, requested);
         if (!existing) return { released: false, ...requested };
         if (existing.owner !== peer) {
           throw new CliError('LOCK_OWNED', `Lock is owned by ${existing.owner}`, { owner: existing.owner });

package/lib/web/runtime-main.mjs

@@ -97,7 +97,8 @@ import {
   requestOriginMatches,
   sendFile,
   sendJson,
-  tokenMatches
+  tokenMatches,
+  tokenlessRequestAllowed
 } from '../web/http.mjs';
 import {
   API_VERSION,
@@ -122,6 +123,7 @@ import { createAutoAttach } from '../web/auto-attach.mjs';
 import { createPtySessions } from '../web/pty-sessions.mjs';
 import { createHttpRoutes } from '../web/http-routes.mjs';
 import { createSessionSerialize } from '../web/session-serialize.mjs';
+import { createTmuxClientSnapshot } from '../web/tmux-client-snapshot.mjs';
 import { createTmuxStream } from '../web/tmux-stream.mjs';
 import {
   ensureTmuxAvailable,
@@ -230,6 +232,7 @@ async function cmdWeb(ctx, args, startMeta = {}) {
   const { WebSocketServer } = await import('ws');
   const pty = ptyModule.default || ptyModule;
   const sessions = new Map();
+  const tmuxClientSnapshot = createTmuxClientSnapshot();
 
   const {
     sessionKey, sessionsForProject,
@@ -237,10 +240,7 @@ async function cmdWeb(ctx, args, startMeta = {}) {
     serializeBindingSummary, serializeSession,
     broadcast, hasOpenClients, closeSessionClients: closeSerializedSessionClients
   } = createSessionSerialize({ sessions, cookieSocketValid, ctx, sameResolvedPath,
-    localClientObservation: (session) => {
-      try { return tmuxClientObservation(tmuxSessionNameForPane(session.pane)); }
-      catch { return { state: 'unknown', count: null }; }
-    }
+    localClientObservation: tmuxClientSnapshot.observe
   });
   const controlLease = createControlLease({ broadcast: (session) => {
     for (const [actionToken, socket] of session.actionTokenSockets || []) {
@@ -488,14 +488,30 @@ const {
     ACTIVE_PEER_TTL, DETECTED_PEER_MAX_AGE, PRODUCT_NAME, VERSION
   });
 
+  const dispatchHttp = (req, res) => {
+    void handleWebRequest(req, res).catch((error) => {
+      try {
+        console.error(redactedLogText(`HTTP request failed: ${error.code || 'UNKNOWN'}`));
+        if (!res.headersSent) sendJson(res, 500, { ok: false, error: { code: 'SERVER_ERROR', message: 'internal server error' } });
+        else res.destroy();
+      } catch {
+        try { res.destroy(); } catch {}
+      }
+    });
+  };
   const server = useTls
-    ? https.createServer({ key: tlsCredentials.key, cert: tlsCredentials.cert }, handleWebRequest)
-    : http.createServer(handleWebRequest);
+    ? https.createServer({ key: tlsCredentials.key, cert: tlsCredentials.cert }, dispatchHttp)
+    : http.createServer(dispatchHttp);
 
   const wss = new WebSocketServer({ noServer: true });
   server.on('upgrade', (req, socket, head) => {
     try {
     const url = requestUrl(req);
+    if (!token && !tokenlessRequestAllowed(req, { trustProxy, proxyOrigin })) {
+      socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+      socket.destroy();
+      return;
+    }
     if (!readWebSocketApiVersion(url).ok) {
       const body = JSON.stringify(apiVersionUnsupportedBody());
       socket.end([
@@ -621,6 +637,7 @@ const {
   let cleanupPromise = null;
   let shutdownExitCode = 0;
   async function performRuntimeCleanup() {
+    tmuxClientSnapshot.close();
     clearRuntime(ctx);
     // rob-07: clear this runtime's per-project pointers for every registered
     // project, not just the primary ctx, so sibling projects don't keep

package/lib/web/runtime.mjs

@@ -14,8 +14,12 @@ export function runtimeConnectHost(host) {
   return host;
 }
 
+function urlHost(host) {
+  return host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+}
+
 export function runtimeBaseUrl(host, port, tls = false) {
-  return `${tls ? 'https' : 'http'}://${runtimeConnectHost(host)}:${port}`;
+  return `${tls ? 'https' : 'http'}://${urlHost(runtimeConnectHost(host))}:${port}`;
 }
 
 export function runtimeApiUrl(runtime, route) {
@@ -24,7 +28,17 @@ export function runtimeApiUrl(runtime, route) {
 }
 
 export function requestUrl(req) {
-  return new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+  try {
+    const base = new URL(`http://${req.headers.host || 'localhost'}`);
+    if (base.username || base.password || base.pathname !== '/' || base.search || base.hash) {
+      throw new Error('Invalid Host authority');
+    }
+    const url = new URL(req.url || '/', base);
+    if (url.origin !== base.origin) throw new Error('Request target changes authority');
+    return url;
+  } catch {
+    throw new CliError('BAD_REQUEST', 'Invalid request URL or Host header');
+  }
 }
 
 export function isLoopbackHost(host) {
@@ -84,13 +98,13 @@ export function publicRuntimeUrl(runtime, projectRoot = null) {
     ? '<machine-ip>'
     : runtime.host || runtimeConnectHost(runtime.host || '127.0.0.1');
   const scheme = runtime.tls ? 'https' : 'http';
-  return `${scheme}://${host}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
+  return `${scheme}://${urlHost(host)}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
 }
 
 export function localRuntimeUrl(runtime, projectRoot = null) {
   const host = runtimeConnectHost(runtime.host || '127.0.0.1');
   const scheme = runtime.tls ? 'https' : 'http';
-  return `${scheme}://${host}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
+  return `${scheme}://${urlHost(host)}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
 }
 
 // Issue a request to a runtime API route. Returns { ok, status, text }.

package/lib/web/session-serialize.mjs

@@ -105,7 +105,7 @@ export function createSessionSerialize({
         : session.type === 'native' ? ['chat', 'delivery-receipts', 'results',
           ...(session.nativeState?.capabilities?.interrupt ? ['turn-control'] : [])] : ['terminal', 'results'],
       local_clients: session.type === 'tmux' ? localClientObservation(session) : null,
-      executor_id: session.adapter?.snapshot().executorId || session.nativeState?.executorId || null,
+      executor_id: session.executorId || session.adapter?.snapshot().executorId || session.nativeState?.executorId || null,
       native_connected: session.type === 'native' ? Boolean(session.nativeState?.connected) : null,
       created_at: session.createdAt,
       exited_at: session.exitedAt || null,

package/lib/web/startup.mjs

@@ -5,6 +5,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
+import { createHash, randomUUID } from 'node:crypto';
 import { URL } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
 import { setTimeout as sleep } from 'node:timers/promises';
@@ -13,10 +14,13 @@ import { redactCliArgs } from '../shared/redact.mjs';
 import { intOpt, parseOpts, splitGlobalArgs, validateOpts } from '../cli-args.mjs';
 import { printResult } from '../format.mjs';
 import { commandPath, tailFile } from '../cli-runtime.mjs';
+import { compareProcessIdentity, inspectProcessIdentity } from '../process/identity.mjs';
 import { registerProject } from '../runtime/projects.mjs';
-import { runtimePath, globalRuntimePath, webLogPath } from '../runtime/paths.mjs';
+import { runtimePath, globalRuntimePath, globalStateDir, webLogPath } from '../runtime/paths.mjs';
 import { readHealthyGlobalRuntime, writeRuntime } from '../runtime/state.mjs';
 import { runtimeRequest } from '../runtime/client.mjs';
+import { withFileLock } from '../shared/file-lock.mjs';
+import { writeJsonSafe } from '../shared/json-file.mjs';
 import {
   expectedWebHost,
   isLoopbackHost,
@@ -32,6 +36,56 @@ import { API_VERSION } from '../web/api-version.mjs';
 import { ensureTmuxAvailable } from '../tmux.mjs';
 
 export const WEB_RUNTIME_START_TIMEOUT_MS = 60_000;
+const WEB_START_LOCK_WAIT_MS = WEB_RUNTIME_START_TIMEOUT_MS + 30_000;
+
+function webStartOwnerAlive(owner) {
+  const pid = owner?.pid;
+  if (!Number.isInteger(pid) || pid <= 0) return true;
+  const observed = inspectProcessIdentity(pid);
+  if (observed.state === 'dead') return false;
+  if (owner.process_identity && observed.state === 'live') {
+    return compareProcessIdentity(owner.process_identity, observed.identity) !== 'dead';
+  }
+  return true;
+}
+
+async function withWebStartLock(fn) {
+  const lockFile = path.join(globalStateDir(), 'web-start.lock');
+  const owner = {
+    pid: process.pid,
+    process_identity: inspectProcessIdentity(process.pid).identity,
+    nonce: randomUUID()
+  };
+  const deadline = performance.now() + WEB_START_LOCK_WAIT_MS;
+  while (true) {
+    const acquired = withFileLock(lockFile, (lockedFile) => {
+      if (fs.existsSync(lockedFile)) {
+        let previous = null;
+        try { previous = JSON.parse(fs.readFileSync(lockedFile, 'utf8')); } catch {}
+        if (!previous || webStartOwnerAlive(previous)) return false;
+      }
+      writeJsonSafe(lockedFile, owner, { mode: 0o600 });
+      return true;
+    });
+    if (acquired) break;
+    if (performance.now() >= deadline) {
+      throw new CliError('WEB_START_LOCK_TIMEOUT',
+        'Timed out waiting for another web startup to finish.');
+    }
+    await sleep(100);
+  }
+  try {
+    return await fn();
+  } finally {
+    withFileLock(lockFile, (lockedFile) => {
+      let current = null;
+      try { current = JSON.parse(fs.readFileSync(lockedFile, 'utf8')); } catch {}
+      if (current?.nonce === owner.nonce && current.pid === owner.pid) {
+        fs.rmSync(lockedFile, { force: true });
+      }
+    });
+  }
+}
 
 export function createWebStartup(deps) {
   const {
@@ -84,25 +138,41 @@ async function stopOrphanWebRuntimes(ctx, keepPid = null) {
     const ppid = Number.parseInt(match[2], 10);
     if (!Number.isFinite(pid)) continue;
     if (Number.isFinite(ppid)) ppidByPid.set(pid, ppid);
-    rows.push({ pid, args: match[3] });
+    rows.push({ pid, ppid, args: match[3] });
   }
 
   const ancestorPids = currentProcessAncestorPids(ppidByPid);
-  const pids = [];
+  const candidates = [];
   for (const row of rows) {
+    // A live parent still owns its web command. In particular, another CLI
+    // invocation waiting for the startup lock is not an orphan runtime.
+    if (row.ppid !== 1) continue;
     if (row.pid === process.pid || row.pid === keepPid || ancestorPids.has(row.pid)) continue;
-    if (hccWebProcessMatches(row.args, ctx)) pids.push(row.pid);
+    if (!hccWebProcessMatches(row.args, ctx)) continue;
+    const observed = inspectProcessIdentity(row.pid);
+    if (observed.state === 'live' &&
+        observed.identity.commandHash === createHash('sha256').update(row.args.trim()).digest('hex')) {
+      candidates.push(observed.identity);
+    }
   }
-  if (!pids.length) return;
+  if (!candidates.length) return;
+
+  const stillSameProcess = (identity) => {
+    const observed = inspectProcessIdentity(identity.pid);
+    return observed.state === 'live' &&
+      compareProcessIdentity(identity, observed.identity) === 'live' &&
+      identity.commandHash === observed.identity.commandHash;
+  };
 
-  for (const pid of pids) {
-    try { process.kill(pid, 'SIGTERM'); } catch {}
+  for (const identity of candidates) {
+    if (!stillSameProcess(identity)) continue;
+    try { process.kill(identity.pid, 'SIGTERM'); } catch {}
   }
   await sleep(250);
-  for (const pid of pids) {
+  for (const identity of candidates) {
+    if (!stillSameProcess(identity)) continue;
     try {
-      process.kill(pid, 0);
-      process.kill(pid, 'SIGKILL');
+      process.kill(identity.pid, 'SIGKILL');
     } catch {}
   }
 }
@@ -160,6 +230,10 @@ async function startWebBackground(ctx, args) {
   assertWebTokenForHost(requestedHost, !opts['no-token']);
   if (!isLoopbackHost(requestedHost)) console.error(redactedLogText(webExposureWarning(requestedHost, intOpt(opts, 'port', 8787)) + (opts.tls ? '' : ' Consider --tls to encrypt this connection.')));
   ensureTmuxAvailable({ autoInstall: true });
+  return withWebStartLock(() => startWebBackgroundLocked(ctx, args, opts));
+}
+
+async function startWebBackgroundLocked(ctx, args, opts) {
   const setup = await prepareLocalBus(ctx, {
     ...opts,
     installShims: process.env.HCC_SKIP_SHIM_INSTALL === '1' ? false : true