@logicseek/hello-cc 1.0.2 → 1.1.0-rc.1

package/CHANGELOG.md

@@ -16,38 +16,126 @@ the release description from the current changelog section. Use
 `npm run release:github` with `GH_TOKEN` or `GITHUB_TOKEN` only for local
 backfills.
 
-## 1.0.2
+## 1.1.0-rc.1
 
 ### Summary
 
-DeepSeek Harness now joins hello-cc through project hooks, a Cordis collaboration
-bundle, and owned ACP workers. This release promotes the runtime verified in
-`1.0.2-dsh.3` to the normal npm `latest` channel. Runtime code is unchanged from
-that candidate; version metadata and release documentation identify this release.
+hello-cc 1.1.0-rc.1 brings project and session navigation, structured
+conversations, recoverable split panes, and bounded rendering to the Web
+workbench. It also brings HCC-owned Codex, Claude and DeepSeek Harness workers
+into the same task, message, handoff and result-review workflow, with explicit
+permissions and delivery receipts. This release is intended for the npm
+`preview` dist-tag and a GitHub prerelease.
 
 ### Highlights
 
-- Harness Agents use their exact session and project identity for task, message,
-  lock, result, and handoff operations. Context acknowledgements follow committed
-  model input, and permission decisions retain the Harness policy chain.
-- Owned ACP workers support queued prompts, scoped MCP tools, approvals,
-  interruption, session resume, and shutdown through the CLI and Web interface.
-- Managed project configuration migrates verified paths from source checkouts to
-  installed packages while preserving user edits.
-- Cordis sessions recover after a verified owner process exits; transient
-  database failures during retirement remain retryable while old tool authority
-  is revoked immediately.
-- Node.js 24+ and official Harness `0.2.0-rc.2` are required. Supported hosts are
-  macOS and Linux; Windows uses WSL. Native Windows shells are not supported.
+- Switch between English, Chinese or the system language; choose system,
+  light or dark interface and terminal themes, comfortable or compact spacing,
+  terminal font size and focus mode. Settings apply without replacing active
+  terminal connections or discarding drafts, and remain reachable on mobile.
+- Search sessions by name, task, provider, path or command; combine keywords
+  and provider/activity filters. Project changes clear old session state
+  immediately and ignore delayed responses from the previous project.
+- Read Codex conversations by turn with focused user, assistant, command,
+  file-change and status cards. Preserve reading position, drafts, expanded
+  details and keyboard focus during updates. Keep approvals visible
+  independently of the conversation page.
+- Use the keyboard command palette for project, session and workbench
+  navigation. Search the current terminal scrollback locally with match counts,
+  previous/next navigation, case sensitivity and whole-word matching. The search
+  addon is served locally.
+- Restore a project-specific two-pane workspace with horizontal or vertical
+  layout, adjustable proportions and a saved secondary session. Each pane
+  retains its own connection and draft; viewing the same session twice leaves
+  the secondary pane read-only until an explicit control handoff.
+- Page long Codex timelines and large output segments while keeping all
+  retained content accessible. Copy the complete original text, including
+  content outside the visible segment. Preserve Unicode characters, scroll
+  anchors, tool expansion and drafts across streaming updates.
+- Coalesce Codex text-delta notifications within a bounded 50 ms window while
+  updating internal state immediately. Approvals, completion, errors and
+  connection changes publish promptly. Unchanged native snapshots avoid
+  redundant broadcasts without skipping ownership checks.
+- Manage owned native workers through `hcc native`: Codex App Server, the
+  optional Claude Agent SDK and DeepSeek Harness ACP share HCC coordination
+  while retaining their provider-specific lifecycle and session identity. Web
+  can discover and control an existing native worker without creating a second
+  provider process.
+- Distinguish queued, submitted, provider-accepted, completed, failed and
+  uncertain delivery states. Uncertain submissions are not automatically
+  replayed; runtime restarts preserve the uncertainty needed to avoid duplicate
+  work.
+- Handle supported Codex permission requests, questions and common MCP form
+  fields from Web or the local CLI. Claude responses approve the original tool
+  input once, and ACP approval selects a provider-offered one-time option.
+  Responses remain bound to the current worker, session, turn, request and
+  controller.
+- Give hosted executors a temporary MCP capability scoped to the project,
+  database, peer and live runtime. Coordination tools support tasks, inbox,
+  messages, handoff, owned locks and local result records. Executor shutdown
+  revokes the capability without rewriting global provider configuration.
+- Review local command results, explicitly submitted evidence and manual
+  acceptance records with separate local-validation, publication and
+  business-acceptance categories. A completed model turn or successful command
+  does not automatically complete an HCC task.
+- Include DeepSeek Harness hooks, the Cordis bundle and owned ACP workers,
+  with identity-bound crash recovery and retryable cleanup after temporary
+  database failures.
+- Use macOS `kern.bootsessionuuid` for the boot component of process identity
+  instead of wall-clock boot time. Clock adjustments no longer make the same
+  process appear replaced, while a different boot UUID still identifies a
+  reboot. Missing or malformed boot identity remains unknown.
+- Publish private-state binding manifests atomically, reject legacy-state
+  takeover during interrupted initialization, and recheck the project identity
+  before reading, writing or clearing its runtime state. A reused directory
+  path does not silently inherit the previous project's private state.
+- Validate existing SQLite files without opening and closing an additional
+  descriptor, preserving locks held by another SQLite connection in the same
+  process. File ownership, permissions, identity and sidecar checks remain in
+  place.
+
+### Compatibility Notes
+
+- Projects under shared or writable ancestors use per-user private state.
+  Existing legacy state in those projects requires an explicit offline
+  `migrate-state --offline --yes` after stopping all writers; it is not silently
+  copied or discarded. Back up both the private store and its authority marker
+  before manual recovery of a replaced project directory.
+- Node.js 24 or newer is required. Linux and macOS are supported host
+  environments; Windows users use WSL. Native Windows shells are outside the
+  supported host contract.
+- Browser-controllable terminals require tmux where documented. `node-pty`
+  remains pinned to `1.2.0-beta.15`; the terminal search addon is pinned to
+  `0.16.0`.
+- Native workers require an installed and authenticated provider. Claude's
+  Agent SDK remains optional and is loaded when a Claude worker starts; HCC
+  does not install it automatically. DeepSeek Harness integration targets
+  `0.2.0-rc.2`.
+- Closing a browser page does not stop a hosted executor. An independent
+  native runtime also survives Web-runtime shutdown; explicitly closing its
+  worker terminates that worker. Web-owned App Server executors remain owned
+  by their Web runtime.
+- Saved-session resume creates a newly owned provider connection and requires
+  the prior owner to be confirmed stopped. It does not migrate an arbitrary
+  live TUI or desktop process, and uncertain owners remain protected.
+- Existing schema v7, Runtime API v2 and provider authentication boundaries
+  continue to apply. Browser control handoff never approves a provider operation
+  by itself. Persisted macOS identities using the older boot-token format remain
+  unknown across the format transition, rather than being treated as confirmed
+  dead.
 
 ### Validation
 
-The byte-identical preview runtime passed macOS real-model installation checks
-(11), Linux container installation and deterministic collaboration checks (8 + 7),
-and frozen-package recovery tests (17). Its registry download and all 216
-installed files matched the candidate. This stable package receives independent
-release, installation, and registry readback checks. Other-device and genuine
-business acceptance remain separate stages.
+Feature-specific records cover controlled browser interactions, real PTY/tmux
+behavior, provider protocols and selected authenticated model workflows. Each
+record applies to its recorded inputs and scope. The final release record
+identifies the frozen package, platform installations and checks that apply to
+this combined candidate; performance samples are controlled observations, not
+production capacity or long-term memory guarantees.
+
+Publication readback, registry installation, employee-device acceptance and
+genuine business acceptance remain distinct evidence categories. No result in
+one category automatically establishes another.
 
 ## 1.0.2-dsh.3
 

package/README.md

@@ -43,11 +43,20 @@ grace. `hcc gc` retains history unless `--history` is explicit. `--tls` encrypts
 the console; `--trust-proxy` requires a fixed `--proxy-origin`. Two risks remain
 intentional: the default listener is plaintext HTTP on `0.0.0.0` for trusted
 LANs, and an authenticated browser may select any existing server directory.
+Managed `.hello-cc` state is private to the current OS user. Keep project roots
+behind cross-user-stable paths for project-local storage. For a root that
+another OS user could replace, hello-cc stores managed state under
+`~/.hello-cc/projects/<root-hash>/` instead. An existing project-local state
+must be migrated explicitly while every old writer is stopped:
+`hcc --root DIR migrate-state --offline --yes`. Migration keeps the original
+directory for recovery. If you set `--db` or `HCC_DB` outside managed state,
+secure that database and its parent directory yourself.
 
 ## Highlights
 
 - **Shared project memory**: peers, tasks, messages, locks, handoffs, and
-  events are stored in `<project>/.hello-cc/mesh.db`.
+  events are stored in a private managed `mesh.db` (project-local for stable
+  roots, otherwise under the current user's home directory).
 - **Real terminal control**: Web attaches to the same local tmux pane as your
   terminal, not a separate browser-only shell.
 - **Claude/Codex awareness**: hooks inject live `hcc` state before model turns,

package/README.zh-CN.md

@@ -37,10 +37,17 @@ unknown 证据获得最长 120 秒宽限。`hcc gc` 默认保留历史，必须
 `--history`。`--tls` 提供传输加密；`--trust-proxy` 必须固定
 `--proxy-origin`。两项风险是有意保留的：默认在可信内网以明文 HTTP 监听
 `0.0.0.0`，且已认证浏览器可以选择服务器上任意已存在目录。
+默认的 `.hello-cc` 状态目录仅允许当前系统用户访问。不要把项目根目录放在
+不可信系统用户可写的位置；如果其他系统用户可替换项目路径，受管状态会改存于
+`~/.hello-cc/projects/<项目根路径哈希>/`。已有项目本地状态不会自动丢弃或迁移：
+先停止所有旧进程及外部数据库写入者，再运行
+`hcc --root 目录 migrate-state --offline --yes`；原目录保留供恢复。
+若通过 `--db` 或 `HCC_DB` 将数据库放在受管状态目录之外，请自行保护数据库及其
+父目录的权限。
 
 ## 特色
 
-- **项目本地共享状态**：peers、tasks、messages、locks、handoffs 和 events 写入 `<project>/.hello-cc/mesh.db`。
+- **项目共享状态**：peers、tasks、messages、locks、handoffs 和 events 写入私有的 `mesh.db`；路径稳定时保留项目本地目录，否则存于当前用户的 home 目录。
 - **Web 控制真实终端**：浏览器 attach 到和本地终端相同的 tmux pane，不是浏览器里另开的临时 shell。
 - **Claude/Codex 感知项目状态**：hooks 会在模型回答前注入实时 `hcc` 状态。
 - **减少编辑冲突**：通过 advisory lock 和 handoff 显式协调多 agent 修改。

package/docs/commands.md

@@ -14,12 +14,36 @@ authenticated access to any existing server directory are accepted risks.
 
 ```text
 hcc update [--tag TAG] [--registry URL] [--dry-run]
+hcc --root DIR migrate-state --offline --yes
 hcc uninstall [--purge --yes]
 ```
 
-`hcc update` updates the global npm install. `hcc uninstall` removes local
-hooks, shims, and the shell PATH entry; add `--purge --yes` only when you also want to remove the
-current project's `.hello-cc` data and guidance blocks.
+`hcc update` updates the global npm install. If another OS user can replace a
+project path, managed state is kept in a private directory under the current
+user's home. Existing project-local `.hello-cc` data requires an explicit
+offline migration: stop all hello-cc and external writers first, then run
+`migrate-state --offline --yes`. It copies SQLite snapshots (including WAL
+contents) and other validated state, keeps the old directory untouched, and
+rebuilds managed DSH path-bound configuration. Do not restart an old writer
+against the retained directory. `hcc uninstall` removes local hooks, shims,
+and the shell PATH entry; add `--purge --yes` only when you also want to remove
+the selected current project's managed data and guidance blocks. A retained
+legacy migration source is not deleted by purge.
+Private-state creation and purge leave a durable authority marker so a retained
+or newly written project-local database cannot silently become active again.
+After purge, a remaining legacy directory still requires an explicit offline
+`migrate-state --offline --yes`; if no legacy directory remains, a fresh `init`
+creates new private state. If a private store disappears without an explicit
+purge, restore it from backup or use `uninstall --purge --yes` to deliberately
+discard the missing state before starting fresh.
+An interrupted private purge stays marked `purging`; normal access fails closed.
+After confirming old writers are stopped, repeat `uninstall --purge --yes` to
+finish deleting that private store. If the project root is replaced by a new
+directory at the same path, its inode no longer matches the old private binding.
+The CLI intentionally refuses automatic purge or rebinding: preserve and back
+up both the old private store and its `.authority.json` marker, stop all writers,
+and have an operator compare the old and new root identities before a manual
+recovery. Do not delete the marker alone or point the new root at the old data.
 
 ## Read-only Diagnostics
 
@@ -54,7 +78,7 @@ Use `--local` to bind only `127.0.0.1`, `--token` or `HCC_WEB_TOKEN` to set an
 explicit token, `HCC_RUNTIME_CA` to trust a private HTTPS Runtime API CA, and
 `--no-token` only in trusted local/test environments. Use `hcc up` only when you
 want coordination without the Web console or shims. Provider shims only join
-projects with a local `.hello-cc/runtime.json` from `hcc web`; they do not use a
+projects with a managed `runtime.json` from `hcc web`; they do not use a
 global runtime to manage arbitrary directories.
 
 ## Native Workers

package/docs/commands.zh-CN.md

@@ -12,12 +12,28 @@ unknown 证据获得 120 秒宽限；历史清理必须显式使用 `gc --histor
 
 ```text
 hcc update [--tag TAG] [--registry URL] [--dry-run]
+hcc --root 目录 migrate-state --offline --yes
 hcc uninstall [--purge --yes]
 ```
 
-`hcc update` 更新全局 npm 安装。`hcc uninstall` 移除本机 hooks、shims 和 shell PATH 配置；
-只有在确定也要删除当前项目的 `.hello-cc` 数据和指导块时，才加
-`--purge --yes`。
+`hcc update` 更新全局 npm 安装。如果其他系统用户可替换项目路径，受管状态会放在
+当前用户 home 下的私有目录。已有项目本地 `.hello-cc` 必须离线迁移：先停止
+所有 hello-cc 进程和外部写入者，再显式执行 `migrate-state --offline --yes`。
+迁移会复制包含 WAL 内容的 SQLite 快照和其他经检查的状态，保留原目录，
+并重建由 hello-cc 管理且绑定旧绝对路径的 DSH 配置。不要让旧版写入者继续写原目录。
+`hcc uninstall` 移除本机 hooks、shims 和 shell PATH 配置；只有在确定也要删除
+当前项目选定的受管数据和指导块时，才加 `--purge --yes`。迁移后保留的旧目录
+不会被 purge 删除。
+新建或 purge 私有数据后仍保留持久的权威标记，防止保留或后来写入的项目本地数据库
+自动重新生效。purge 后若旧目录仍在，必须停止所有旧写入者并显式执行
+`migrate-state --offline --yes`；若旧目录已不存在，可重新运行 `init` 创建新的私有
+状态。如果私有目录未经 purge 就丢失，请从备份恢复，或通过
+`uninstall --purge --yes` 明确放弃已丢失的状态后重新初始化。
+私有状态的 purge 若中断，会保留 `purging` 标记并拒绝正常访问。确认旧写入者均已停止后，
+再次运行 `uninstall --purge --yes` 完成删除。若项目根目录在同一路径被新目录替换，
+新 inode 与旧私有绑定不符；CLI 会拒绝自动 purge 或重绑。请先保留并备份旧私有状态目录
+及其 `.authority.json` 标记，停止所有写入者，由管理员核对新旧根目录身份后再人工恢复。
+不要只删除标记，也不要让新根目录直接使用旧数据。
 
 ## 只读诊断
 
@@ -48,7 +64,7 @@ runtime 生成 URL token。用 `--local` 可只绑定 `127.0.0.1`，用 `--token
 `HCC_WEB_TOKEN` 可设置显式 token；私有 HTTPS Runtime API CA 用
 `HCC_RUNTIME_CA` 指定。只有在可信本地/测试环境才使用 `--no-token`。
 只想使用本地协作、不需要 Web 或 shims 时，再使用 `hcc up`。provider shim 只会加入
-已经由 `hcc web` 生成本地 `.hello-cc/runtime.json` 的项目，不会使用全局 runtime
+已经由 `hcc web` 生成受管 `runtime.json` 的项目，不会使用全局 runtime
 去管理任意目录。
 
 ## Native 后台 worker

package/docs/dsh.md

@@ -8,7 +8,7 @@ The tested runtime is `@deepseek-ai/dsh@0.2.0-rc.2`, with matching plugin versio
 
 Supported hosts are Linux and macOS; on Windows use WSL. Native Windows shells are not supported. Device acceptance must be recorded separately from container verification.
 
-This integration is included in hello-cc 1.0.2 on the normal npm `latest` channel. With Node.js 24+, install it using `npm install -g @logicseek/hello-cc`. To test a source checkout instead, use:
+The source and real DeepSeek model acceptance are complete locally; no new npm release has been published. Use this checkout's CLI when testing:
 
 ```bash
 node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh setup --mode cordis
@@ -123,7 +123,7 @@ allowBuilds:
   node-pty@1.2.0-beta.15: true
 ```
 
-Harness selects bundles through the profile's `dsh.profile.bundles`; do not also load the project Cordis/hooks overlay. Actual npm installation, official add/repeated add/remove, profile resolution and real-model collaboration calls have passed. The actual macOS desktop profile was installed and hot-loaded on 2026-10-02. Its paired ACP worker completed real collaboration calls using the existing DeepSeek route. The initially configured desktop sub2api model returned HTTP 403 because that account only accepts official Codex clients. After the desktop default was observed to have changed to official DeepSeek, a new session completed hcc_state, hcc_message_send and a real completed turn with that existing selection. The original sub2api route restriction remains. The 1.0.2 release uses the normal npm latest channel. Harness manages profile package removal; project-overlay integration is disabled with `setup --mode off`.
+Harness selects bundles through the profile's `dsh.profile.bundles`; do not also load the project Cordis/hooks overlay. Actual npm installation, official add/repeated add/remove, profile resolution and real-model collaboration calls have passed. The actual macOS desktop profile was installed and hot-loaded on 2026-10-02. Its paired ACP worker completed real collaboration calls using the existing DeepSeek route. The initially configured desktop sub2api model returned HTTP 403 because that account only accepts official Codex clients. After the desktop default was observed to have changed to official DeepSeek, a new session completed hcc_state, hcc_message_send and a real completed turn with that existing selection. The original sub2api route restriction remains. npm publication was not performed. Harness manages profile package removal; project-overlay integration is disabled with `setup --mode off`.
 
 See Cordis/native acceptance (source checkout: `docs/verification/2026-10-02-dsh-cordis-native.md`), bridge acceptance (source checkout: `docs/verification/2026-10-02-dsh-official-bridge.md`), and the integration plan (source checkout: `docs/plans/2026-10-02-dsh-integration.md`). Real-model checks used temporary projects and owned processes, without replacing existing user sessions. The isolated order fixture passed artifact/evidence/handoff/lock-release/task-completion checks. See the Mac device receipt (source checkout: `docs/verification/2026-10-02-dsh-device-install.md`). Publication, deployment, other-device installation and genuine business acceptance remain separate delivery stages.
 

package/docs/dsh.zh-CN.md

@@ -8,7 +8,7 @@ DeepSeek Harness（`dsh`）可以与 Claude Code、Codex 共用 hello-cc 的项
 
 支持 Linux 和 macOS；Windows 使用 WSL，不支持原生 Windows shell。容器验证与实际设备验收分别记录。
 
-此接入包含在 hello-cc 1.0.2，沿用 npm 的 latest 标签。在 Node.js 24+ 环境执行 `npm install -g @logicseek/hello-cc` 安装。验证源码时，用本仓库的 CLI：
+代码已在本地实现并做真实 DeepSeek 模型验收，尚未发布新的 npm 版本。验证源码时，用本仓库的 CLI：
 
 ```bash
 node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh setup --mode cordis
@@ -125,9 +125,9 @@ allowBuilds:
   node-pty@1.2.0-beta.15: true
 ```
 
-安装后由 Harness profile 的 `dsh.profile.bundles` 选择包；不要再同时加载项目 Cordis/hooks overlay。bundle 已通过实际 npm 安装、官方 add/重复 add/remove、隔离 profile 加载和真实模型工具调用。2026-10-02 已安装到本机真实 desktop profile 并热加载，配套 ACP 使用既有 DeepSeek 路由完成真实工具调用；初次桌面 sub2api 模型返回账户仅允许 Codex 官方客户端的 403；随后桌面默认模型已变为官方 DeepSeek，沿用当时配置的新建会话完成 hcc_state、hcc_message_send 和真实 completed 回合。原 sub2api 路由限制仍存在。1.0.2 沿用 npm latest 标签发布。profile 插件安装/移除由 Harness 管理，项目 overlay 则使用 `setup --mode off` 关闭。
+安装后由 Harness profile 的 `dsh.profile.bundles` 选择包；不要再同时加载项目 Cordis/hooks overlay。bundle 已通过实际 npm 安装、官方 add/重复 add/remove、隔离 profile 加载和真实模型工具调用。2026-10-02 已安装到本机真实 desktop profile 并热加载，配套 ACP 使用既有 DeepSeek 路由完成真实工具调用；初次桌面 sub2api 模型返回账户仅允许 Codex 官方客户端的 403；随后桌面默认模型已变为官方 DeepSeek，沿用当时配置的新建会话完成 hcc_state、hcc_message_send 和真实 completed 回合。原 sub2api 路由限制仍存在。npm 尚未发布。profile 插件安装/移除由 Harness 管理，项目 overlay 则使用 `setup --mode off` 关闭。
 
-验证记录见 Cordis/native 验收 (源码目录: `docs/verification/2026-10-02-dsh-cordis-native.md`)、兼容桥记录 (源码目录: `docs/verification/2026-10-02-dsh-official-bridge.md`) 和详细接入计划 (源码目录: `docs/plans/2026-10-02-dsh-integration.md`)。真实模型验收在临时项目和自有进程中完成；既有会话与模型凭据保留；本机实际安装记录见 Mac 接入验收 (源码目录: `docs/verification/2026-10-02-dsh-device-install.md`)。Linux 容器已验证，实际 WSL/员工设备和真实业务签收尚未完成；隔离订单样例已完成报告、证据、交接、解锁与任务结束验证。
+验证记录见 Cordis/native 验收 (源码目录: `docs/verification/2026-10-02-dsh-cordis-native.md`)、兼容桥记录 (源码目录: `docs/verification/2026-10-02-dsh-official-bridge.md`) 和详细接入计划 (源码目录: `docs/plans/2026-10-02-dsh-integration.md`)。真实模型验收在临时项目和自有进程中完成；既有会话与模型凭据保留；本机实际安装记录见 Mac 接入验收 (源码目录: `docs/verification/2026-10-02-dsh-device-install.md`)。尚未发布/部署，也没有跨设备验收或真实业务签收；隔离订单样例已完成报告、证据、交接、解锁与任务结束验证。
 
 可用下面的安装验收脚本重现 npm 安装、官方 `plugin add` / 重复 add / remove，以及安装后的公共 CLI。`--run-live` 会沿用已有 DeepSeek 认证，验证 ACP 权限拒绝和一个隔离订单汇总任务；没有该参数时不调用真实模型。脚本只使用本次创建的 HOME、DSH_HOME、项目和进程。
 

package/docs/native.md

@@ -87,7 +87,7 @@ or dsh executable. Claude uses the SDK and rejects `--binary`.
 | `hcc native deliveries` | Optional `--peer NAME`; inspect delivery receipts |
 | `hcc native events` | Required `--peer NAME`; optional `--after ID`; inspect a bounded event history |
 | `hcc native requests` | Requires `--peer NAME`; inspect pending requests bound to this executor, session and turn |
-| `hcc native respond` | Requires `--peer NAME --request ID --decision accept\|decline\|cancel`; use `--response-file JSON` for permission subsets or answers |
+| `hcc native respond` | Requires `--peer NAME --request ID --decision accept\|decline\|cancel`; use `--response-file JSON` for permission subsets, answers or MCP form content |
 | `hcc native interrupt` | Required `--peer NAME`; optional `--turn ID`; request interruption of the active turn |
 | `hcc native close` | Required `--peer NAME`; close that worker's owned connection/process |
 | `hcc native down` | Request worker closure and runtime shutdown; returns a stop-request receipt |
@@ -170,12 +170,18 @@ hosted responder retain conservative denial.
 
 | Provider | Hosted interaction |
 | --- | --- |
-| Codex | Command/file approval, requested filesystem/network permission subsets with explicit turn/session duration, questions including freeform/secret input, and one-call empty-form MCP tool approvals |
+| Codex | Command/file approval, requested filesystem/network permission subsets with explicit turn/session duration, questions including freeform/secret input, one-call empty-form MCP tool approvals and common MCP form fields |
 | Claude | SDK tool permission callback; approval grants the original tool input once without rewriting it |
 | dsh ACP | Offered permission choices; approval selects only `allow_once`, never `allow_always` |
 
 rc.2 may send only a tool-call ID in an ACP approval request. The adapter correlates same-session/turn tool updates to show the operation input. Missing or truncated input still allows rejection; acceptance returns `NATIVE_APPROVAL_CONTEXT_MISSING`. See dsh installed acceptance (source checkout: `docs/verification/2026-10-02-dsh-cordis-native.md`).
 
+Native approval cards show the tool, command or target path and a content
+preview before the decision. Full operation details can be expanded and stay
+expanded across state refreshes. ACP approval is disabled when operation input
+or a one-time option is missing; rejection remains available. Shortened
+previews are identified, with complete parameters still available.
+
 Hosted interactive Codex threads explicitly enable
 `features.default_mode_request_user_input` and `features.request_permissions_tool`
 in their private start/resume configuration. Web-owned start/resume/fork uses
@@ -209,12 +215,10 @@ hcc native respond --peer codex-reviewer --request REQUEST_ID --decision accept
 hcc native respond --peer codex-reviewer --request REQUEST_ID --decision cancel
 ```
 
-Only `permissions`, `scope` and `answers` are accepted in that file. Permissions
+Only `permissions`, `scope`, `answers` and `content` are accepted in that file. For MCP forms, use the original field names and types, for example `{"content":{"project":"demo","count":2,"enabled":false}}`. Permissions
 can narrow the request but cannot add paths or network access; requested deny
 entries must be retained when granting filesystem access. Answer every question
-explicitly. Truncated requests can only be declined or cancelled. Arbitrary MCP
-forms, URL authentication, dynamic tools and account-token refresh requests are
-outside this responder's supported interaction set.
+explicitly. Truncated requests can only be declined or cancelled. Nested schemas, dynamic tools and account-token refresh requests remain unsupported. Correlated MCP `url` requests are supported through the Web authorization entry described below.
 
 ## Current boundaries
 
@@ -234,7 +238,8 @@ outside this responder's supported interaction set.
   task's business acceptance.
 - Adapter tests cover protocol and interaction boundaries. The authenticated
   checks below provide separate evidence for model execution and scoped MCP;
-  packaged-client installation and business acceptance remain unverified.
+  the installed-package harness below checks installation separately.
+  Stakeholder acceptance of a production workflow remains a separate step.
 
 
 ## Authenticated acceptance on October 2, 2026
@@ -255,8 +260,20 @@ survival after closing that bridge. These receipts are separate source snapshots
 
 Codex MCP tool approvals use `mcpServer/elicitation/request`. HCC submits the
 official action/content response for explicit tool confirmations without
-persisting session/always authorization. Approving arbitrary form fields or URL
-authentication is unsupported; decline and cancel remain available.
+persisting session/always authorization. Standard `form` requests support strings, numbers/integers, booleans, single-select and string-enum multi-select fields, with titles, descriptions, suggested defaults, required fields, length/numeric/selection limits and common mailbox/URI/date/date-time format checks. Optional fields are sent only when explicitly included, and booleans require a yes/no choice. Limits are 50 fields, 100 options per field, 8192 UTF-16 units per string and 65536 characters each for schema and response content.
+
+Correlated MCP `url` requests display the authorization destination and an **Open authorization page** action. Only the current controller can submit it. HCC reserves a blank tab on the explicit click and navigates after the original executor accepts the exact request; stale requests close the blank tab. Popup blocking leaves the request pending. HTTPS and loopback HTTP are allowed; credentials in the URL, other schemes, missing elicitation identities and truncated requests block acceptance while retaining decline/cancel. The new tab has no opener or referrer. Loopback destinations require a browser on the executor computer; HCC does not proxy local login callbacks to another device.
+
+Opening sends only `{ "action": "accept" }` and is not proof of successful authentication. Complete the external flow, then return to the task and follow the provider result. HCC does not invent a completion event or collect credentials in its form. URLs, device messages, opaque elicitation ids and metadata remain in the live pending request only; HCC interaction events and browser storage do not retain them. Provider-owned logs/history and the destination browser retain their existing behavior. Account login, token refresh, `openai/userVerification` and external-flow completion APIs remain separate unsupported capabilities.
+
+State refresh keeps edits in page memory. Submission, request removal or session changes clear them; a full page reload does not recover answers. HCC browser storage, events and delivery receipts do not retain form responses through the interaction-response path. Provider-owned history and model output retain their existing behavior. The owning server revalidates types and constraints and preserves executor/session/turn/request fencing. Nested objects, unrestricted arrays, unknown constraints and OpenAI extended form modes remain visibly unsupported with decline/cancel available.
+
+To reproduce browser acceptance, set `HCC_ACCEPTANCE_PLAYWRIGHT` to a Playwright module and run `node scripts/web-mcp-form-acceptance.mjs --run-browser`; optionally set `HCC_ACCEPTANCE_CHROME`. This uses simulated providers with the production HTTP/SQLite/native runtime and isolated browsers; it makes no model calls. See the source-checkout report `docs/verification/2026-10-02-mcp-form-web-validation.md`.
+
+Installed-model acceptance uses `node scripts/web-mcp-form-live-acceptance.mjs --run-live` with `HCC_ACCEPTANCE_PLAYWRIGHT`; `HCC_ACCEPTANCE_CHROME`, `HCC_ACCEPTANCE_TMUX`, `--codex-bin PATH` and `--output NEW_FILE` are optional. Without the opt-in flag it only prints help. A live run consumes quota on the currently configured model/account. Installed Codex calls a disposable stdio MCP tool; actual Web interactions accept the tool confirmation and submit the field form. The harness checks typed responses, model-written results, continuation on the same native executor after Web shuts down, and a Web-owned App Server form. It injects neither model output nor App Server requests.
+
+The HCC user directory, Codex home, project, tmux socket and browser profile are disposable. A configured external credential helper can retain its original user home for read-only credential retrieval; the original provider/model, login and configuration remain intact. Receipts include source hashes, checks, cleanup results and original config/auth/shell-config hash checks. Output paths must be new so existing receipts are preserved. Fixture logs contain synthetic form values only.
+
 
 The local validation receipt (source checkout: `docs/verification/2026-10-02-native-live-validation.json`)
 records the unit suite (785 passed, one platform-dependent skip), a 63-module
@@ -286,10 +303,67 @@ acceptance remains a separate check.
 
 For real model and browser interactions, use
 `scripts/web-native-interaction-acceptance.mjs`. It defaults to help; only
-`--run-live --provider codex|claude|all` invokes models. Set
+`--run-live --provider codex|claude|dsh|all` invokes models. Set
 `HCC_ACCEPTANCE_PLAYWRIGHT` and optionally `HCC_ACCEPTANCE_CHROME`.
 `--claude-package DIR` links an installed SDK package into the isolated worker
 project for default resolution, without injecting its query function. The
 harness checks explicit approval and rejection and continuing the original
 session. It uses existing authentication/quota, cleans test provider homes and
 processes, and never attaches to existing user conversations.
+
+
+`--provider dsh --dsh-bin /absolute/path/to/dsh` uses the installed public launcher
+and existing `DEEPSEEK_API_KEY`. The harness adds an official `tools/pre-execute`
+ask policy to a private ACP profile for only two acceptance-owned target files.
+Permission requests come from real model tool calls; no ACP request injection is
+used. It verifies an approved write, absence of a declined target, local return
+to the same session, and desktop and 390px mobile approval controls. See the
+dsh Web interaction receipt (source checkout: `docs/verification/2026-10-02-native-web-dsh-final-snapshot-interactions.json`).
+
+
+## Installed-package acceptance
+
+`scripts/native-installed-acceptance.mjs` tests an already installed HCC archive
+through the public `hcc native` commands. Install the archive and the optional
+Claude SDK into the same isolated npm prefix before running it. The script uses
+the SDK's default package resolver; it does not inject an adapter or query
+function. Running it without `--run-live` prints help and makes no model calls.
+
+```sh
+npm install --prefix /absolute/path/to/acceptance-prefix \
+  /absolute/path/to/hello-cc.tgz @anthropic-ai/claude-agent-sdk
+
+HCC_ACCEPTANCE_PLAYWRIGHT=file:///absolute/path/to/playwright/index.mjs \
+HCC_ACCEPTANCE_CHROME=/absolute/path/to/chrome \
+node /absolute/path/to/acceptance-prefix/node_modules/@logicseek/hello-cc/scripts/native-installed-acceptance.mjs \
+  --run-live --codex-bin /absolute/path/to/codex \
+  --dsh-bin /absolute/path/to/dsh --archive /absolute/path/to/hello-cc.tgz \
+  --browser --task --output /absolute/path/to/receipt.json
+```
+
+The checks cover correlated replies and ACKs, duplicate submission, continuing
+context, owned close/resume and interruption for all three installed providers.
+A separate Codex check explicitly rejects a write outside the allowed sandbox. Each worker first receives a bounded task through the local user controls.
+Models then send messages through MCP along `Codex → Claude → dsh → Codex`. The browser check verifies default SDK
+loading, an explicit approved write, desktop/mobile rendering, released control
+and local continuation of the same session after closing Web. `--task` adds an
+independent file collaboration example: Codex implements invoice arithmetic,
+five contract tests run, and Claude receives the model-authored handoff and
+writes its review. This example is separate from stakeholder acceptance of a
+production workflow.
+
+Existing authentication and provider quota are used. HCC's global HOME, provider
+homes, tmux server and project are private acceptance directories. A copied
+Codex credential command preserves the caller's HOME only while retrieving
+existing credentials; the original configuration is unchanged. Owned processes
+and credential copies are removed on exit. The receipt records the archive
+SHA-256, provider versions, source hashes, browser evidence and cleanup results.
+The script neither publishes npm packages nor deploys to employee devices.
+
+Requests submitted through authenticated native CLI/Web controls are recorded
+as local user requests. Messages arriving through the shared HCC bus remain
+peer coordination data, even if the sender calls itself `web` or `shell`.
+Legacy deliveries retain peer origin during migration. This distinction does
+not grant tool permissions: writes and other gated tools still require approval.
+For delegated file work, first authorize the receiving agent's bounded task,
+then send the peer handoff.

package/docs/native.zh-CN.md

@@ -80,7 +80,7 @@ hcc msg inbox --peer coordinator
 | `hcc native deliveries` | 可选 `--peer NAME`，查看投递回执 |
 | `hcc native events` | 必须 `--peer NAME`；可选 `--after ID`，查看有界事件历史 |
 | `hcc native requests` | 必须 `--peer NAME`；查看与该执行器、会话、turn 绑定的待处理请求 |
-| `hcc native respond` | 必须 `--peer NAME --request ID --decision accept\|decline\|cancel`；权限子集或问题答案通过 `--response-file JSON` 提交 |
+| `hcc native respond` | 必须 `--peer NAME --request ID --decision accept\|decline\|cancel`；权限子集、问题答案或 MCP 表单内容通过 `--response-file JSON` 提交 |
 | `hcc native interrupt` | 必须 `--peer NAME`；可选 `--turn ID`，请求中断活动 turn |
 | `hcc native close` | 必须 `--peer NAME`，关闭该 worker 持有的连接或进程 |
 | `hcc native down` | 请求关闭 worker 和停止 runtime，返回停止请求回执 |
@@ -147,12 +147,16 @@ ID。观察窗口不能应答，控制权切换后旧窗口的 epoch 失效。
 
 | Provider | 已接入的人工交互 |
 | --- | --- |
-| Codex | 命令/文件审批、所请求文件与网络权限的子集、明确的 turn/session 有效期、选项/自由输入/敏感问题，以及单次空表单 MCP 工具确认 |
+| Codex | 命令/文件审批、所请求文件与网络权限的子集、明确的 turn/session 有效期、选项/自由输入/敏感问题，以及单次空表单 MCP 工具确认与常用 MCP 表单字段 |
 | Claude | SDK 工具权限 callback，批准原始输入本次执行，不改写工具参数 |
 | dsh ACP | 选择 provider 提供的 `allow_once`，不自动选择 `allow_always` |
 
 rc.2 的 ACP 审批可能只携带工具 ID。适配器会关联同一 session/turn 的工具更新以展示操作输入；等待后仍缺输入或输入被截断时可以拒绝，允许会返回 `NATIVE_APPROVAL_CONTEXT_MISSING`。实际安装与拒绝证明见 dsh 验收 (源码目录: `docs/verification/2026-10-02-dsh-cordis-native.md`)。
 
+Native 审批卡片先显示工具、命令或文件路径和内容预览，并明确本次授权范围。
+完整操作详情可以展开，状态刷新保留展开状态；ACP 缺少操作输入或单次批准选项
+时禁用批准按钮，仍可拒绝。长内容预览会明确提示缩短，完整参数继续可查看。
+
 Codex 交互会话在 thread start/resume 的私有配置中显式开启
 `features.default_mode_request_user_input` 和 `features.request_permissions_tool`，
 使执行模式下的模型能够调用提问和权限请求工具。Web 专用 App Server 的 start、resume、
@@ -184,13 +188,26 @@ hcc native respond --peer codex-reviewer --request REQUEST_ID --decision accept
 hcc native respond --peer codex-reviewer --request REQUEST_ID --decision cancel
 ```
 
-响应文件只允许 `permissions`、`scope`、`answers`。不能添加原请求没有的路径或
+响应文件只允许 `permissions`、`scope`、`answers`、`content`；MCP 表单用 `content` 对象提交原字段名和类型，例如 `{"content":{"project":"demo","count":2,"enabled":false}}`。不能添加原请求没有的路径或
 网络权限；授予文件权限时必须保留原请求的 deny 条目。所有问题都需明确回答；
 请求参数被截断时，只能拒绝或取消。动态工具与账号 token 刷新尚未接入。
 
 Codex MCP 工具审批使用 `mcpServer/elicitation/request`，与命令/文件审批的返回结构
 不同。HCC 对显式 MCP 工具确认提交单次 action/content，不写入 session/always 授权。
-任意表单字段和 URL 身份认证尚不支持批准，可明确拒绝或取消。
+标准 `form` 模式支持字符串、数值/整数、布尔值、单选和字符串枚举多选，包含标题、说明、默认建议值、必填项、长度/数值/选择数量范围及常用邮箱/URI/date/date-time 格式校验。可选字段只在勾选填写后发送；布尔值需明确选择是或否。字段数量上限 50、单字段选项上限 100、字符串上限 8192 个 UTF-16 单元，表单结构与应答内容各限 65536 字符。
+
+Web 刷新执行状态时在页面内存中保留填写内容；提交、请求消失或切换会话后清除，不写入浏览器存储、HCC 事件或投递回执。页面整体重载不会恢复这些答复。此约束针对 HCC 的交互应答路径；provider 自身记录及模型输出继续按其原有行为处理。服务端重复校验内容，审批继续绑定原 executor/session/turn/request；错误输入保留请求供修正。嵌套对象、任意数组、未知约束和 OpenAI 扩展表单模式仍不可批准，页面显示原因并提供拒绝/取消。此能力未改变动态工具或 token 刷新的接入边界。
+
+带原 thread/turn 标识的 MCP `url` 请求现在可在 Web 打开授权页面。界面显示 MCP 服务和目标域名，当前控制者明确点击后先保留空白标签页；原执行器接受同一个请求后才跳转，过期或被拒绝的请求会关闭空白页。弹窗被拦截时保留待处理请求，允许弹窗后可重试。仅允许 HTTPS 或 loopback HTTP，拒绝带用户名/密码的 URL、其他协议、缺少 elicitation 标识或被截断的请求；拒绝/取消始终可用。新标签页不保留 opener 或 referrer。loopback 地址需在执行器所在电脑的浏览器访问，HCC 不把本地授权回调代理到另一台设备。
+
+打开只回传 `{ "action": "accept" }`，不代表身份认证完成。需在外部页面完成操作，再返回查看原任务的 provider 结果。HCC 不推测授权完成事件，也不在表单中收集凭证；授权 URL、设备码消息、elicitation 标识和元数据仅存在于实时待处理请求，不留在 HCC 交互事件或浏览器存储中。provider 自身日志/历史和外部授权浏览器仍按各自规则处理。账号登录、token 刷新、`openai/userVerification` 与外部授权完成 API 属于独立的未接入能力。
+
+浏览器复现：设置 `HCC_ACCEPTANCE_PLAYWRIGHT` 指向 Playwright 模块，再执行 `node scripts/web-mcp-form-acceptance.mjs --run-browser`；`HCC_ACCEPTANCE_CHROME` 可指定 Chrome 路径。该脚本用模拟 provider、真实 HTTP/SQLite/native runtime 和隔离浏览器，不调用模型。表单验收见 `docs/verification/2026-10-02-mcp-form-web-validation.md`。
+
+真实模型与浏览器验收使用 `node scripts/web-mcp-form-live-acceptance.mjs --run-live`，同样需要设置 `HCC_ACCEPTANCE_PLAYWRIGHT`，可选 `HCC_ACCEPTANCE_CHROME`、`HCC_ACCEPTANCE_TMUX`、`--codex-bin PATH` 与 `--output NEW_FILE`。默认只打印帮助；显式运行会使用当前模型和账号的额度。脚本让安装版 Codex 调用隔离 stdio MCP 工具，通过实际 Web 操作完成工具确认、字段填写和提交，核对原类型答复、模型文件落盘，以及 Web 关闭后原 native 执行器继续执行；另覆盖 Web-owned App Server 路径，没有注入模型输出或 App Server 请求。
+
+此验收分别隔离 HCC 的用户目录、Codex home、项目、tmux socket 和浏览器 profile。已配置的外部认证辅助程序可在原用户目录下只读运行，以保持当前账号的正常凭据获取；不更改原 provider、模型、登录状态或原配置。回执记录源码摘要、实际检查、清理结果及原配置/认证/shell 配置摘要核对，`--output` 必须使用新路径，既有回执不会覆盖。验收工具日志只包含合成表单值，直接答复不应被误当成真实业务数据。
+
 
 ## 当前边界
 
@@ -246,8 +263,52 @@ Web 验证覆盖服务与 bridge 控制接口，尚不等于完整浏览器操
 
 
 真实模型与浏览器人工交互可使用 `scripts/web-native-interaction-acceptance.mjs`。
-默认只显示帮助；`--run-live --provider codex|claude|all` 才调用模型。
+默认只显示帮助；`--run-live --provider codex|claude|dsh|all` 才调用模型。
 设置 `HCC_ACCEPTANCE_PLAYWRIGHT`，以及按需设置 `HCC_ACCEPTANCE_CHROME`。
 `--claude-package DIR` 可将已经安装的 SDK 包链接到隔离 worker 项目，由默认加载器
 解析，不注入 query 函数。脚本验证明确批准与拒绝、原会话续接，退出后关闭测试
 进程并清理临时 provider home；使用现有认证和调用额度。它不连接现有用户会话。
+
+`--provider dsh --dsh-bin /absolute/path/to/dsh` 使用已安装的公开 launcher 和现有
+`DEEPSEEK_API_KEY`。脚本在私有 ACP profile 中通过公开 `tools/pre-execute` 策略
+让两个指定验收文件的写入请求审批；审批请求来自真实模型工具调用，不注入 ACP 请求。
+验证批准后写入、拒绝后文件不存在、释放 Web 控制后原 session 本地续接，另检查
+桌面和 390px 手机审批卡片。真实结果见 dsh Web 交互回执 (源码目录: `docs/verification/2026-10-02-native-web-dsh-final-snapshot-interactions.json`)。
+
+
+## 安装包验收
+
+`scripts/native-installed-acceptance.mjs` 对已经安装的 HCC 包执行验收，通过公开
+`hcc native` 命令启动 daemon 和三个 provider。先把本地包与可选的 Claude SDK
+安装在同一个独立 npm prefix；脚本使用 SDK 默认包解析，不注入 adapter 或 query
+函数。不加 `--run-live` 只显示帮助，不调用模型。
+
+```sh
+npm install --prefix /absolute/path/to/acceptance-prefix \
+  /absolute/path/to/hello-cc.tgz @anthropic-ai/claude-agent-sdk
+
+HCC_ACCEPTANCE_PLAYWRIGHT=file:///absolute/path/to/playwright/index.mjs \
+HCC_ACCEPTANCE_CHROME=/absolute/path/to/chrome \
+node /absolute/path/to/acceptance-prefix/node_modules/@logicseek/hello-cc/scripts/native-installed-acceptance.mjs \
+  --run-live --codex-bin /absolute/path/to/codex \
+  --dsh-bin /absolute/path/to/dsh --archive /absolute/path/to/hello-cc.tgz \
+  --browser --task --output /absolute/path/to/receipt.json
+```
+
+验收覆盖三个已安装 provider 的关联回复与 ACK、重复提交、连续上下文、owned
+close/resume、中断，以及一次明确拒绝 Codex 越界写入审批。先通过人工控制入口给每个 worker 授权限定任务，再由模型通过 MCP 沿
+`Codex → Claude → dsh → Codex` 发消息并消费回复。浏览器检查 SDK 默认加载、
+明确批准文件写入、桌面和手机渲染、释放控制权，以及关闭 Web 后原会话本地续接。
+`--task` 增加独立文件协作样例：Codex 实现金额计算，通过五个合同测试，再通过
+模型发出的交接消息让 Claude 写出审查文件。这个样例与生产业务的用户验收分开。
+
+脚本使用现有认证和调用额度。HCC 全局 HOME、provider home、tmux server 和项目
+使用私有验收目录；复制到私有配置中的 Codex 凭据命令，仅在读取现有凭据时保留
+原 HOME，原配置保持不变。退出后清理自有进程与临时凭据。回执记录包 SHA-256、
+provider 版本、源码摘要、浏览器证据和清理结果；脚本不会发布 npm 包或部署到
+员工设备。
+
+通过已认证的 native CLI/Web 控制入口提交的任务，持久记录为人工请求；共享 HCC
+消息总线送达的内容保持 peer 消息身份，即使发送方自称 `web` 或 `shell`。旧回执
+迁移后仍按 peer 消息处理。来源区分不授予工具权限，写入等受控操作仍需审批。
+委派文件任务时，先由用户明确授权接收 agent 的限定任务，再发送 peer 交接。