@logicseek/hello-cc 1.0.2 → 1.1.0-rc.1

package/lib/web/peer-actions.mjs

@@ -3,10 +3,12 @@ import process from 'node:process';
 import { intOpt, positiveSafeIntOpt, required } from '../cli-args.mjs';
 import { CliError } from '../shared/errors.mjs';
 import {
+  findRequestedLock,
   lockLabel,
   lockScope,
   locksConflict,
-  scopedLockResource
+  scopedLockResource,
+  upsertRequestedLock
 } from '../core/coordination/locks.mjs';
 import { normalizeStateResources } from '../ui/state-render.mjs';
 import {
@@ -103,23 +105,31 @@ export function createWebPeerActions(deps = {}) {
   function webPeerRegister(projectCtx, peer, input = {}) {
     webMutationPeer(peer, input);
     const db = connect(projectCtx);
-    const row = {
-      id: peer,
-      kind: input.kind || 'other',
-      role: input.role || 'peer',
-      worktree: path.resolve(input.worktree || projectCtx.cwd),
-      branch: input.branch || detectBranch(projectCtx.cwd),
-      pid: intOpt(input, 'pid', process.ppid),
-      status: input.status || 'idle',
-      capabilities: Array.isArray(input.cap) ? input.cap.join(',') : (input.cap || input.capabilities || 'web')
-    };
     try {
+      const existing = db.prepare('SELECT * FROM peers WHERE id = ?').get(peer) || null;
+      const explicitPid = Object.hasOwn(input, 'pid');
+      const row = {
+        id: peer,
+        kind: input.kind || existing?.kind || 'other',
+        role: input.role || existing?.role || 'peer',
+        worktree: path.resolve(input.worktree || existing?.worktree || projectCtx.cwd),
+        branch: input.branch || existing?.branch || detectBranch(projectCtx.cwd),
+        pid: explicitPid ? intOpt(input, 'pid') : (existing?.pid ?? null),
+        ...(!explicitPid ? { processIdentity: existing ? {
+          pid: existing.pid,
+          startToken: existing.pid_start_token,
+          commandHash: existing.pid_command_hash
+        } : null } : {}),
+        status: input.status || existing?.status || 'idle',
+        capabilities: Array.isArray(input.cap) ? input.cap.join(',') :
+          (input.cap || input.capabilities || existing?.capabilities || 'web')
+      };
       upsertPeer(db, row);
       addEvent(db, 'peer.registered', peer, null, webAuditPayload(peer, input, row));
+      return { peer: row, summary: `registered ${row.id} (${row.kind}${row.role ? `, ${row.role}` : ''})` };
     } finally {
       db.close();
     }
-    return { peer: row, summary: `registered ${row.id} (${row.kind}${row.role ? `, ${row.role}` : ''})` };
   }
 
   function webPeerHeartbeat(projectCtx, peer, input = {}) {
@@ -294,21 +304,11 @@ export function createWebPeerActions(deps = {}) {
         }
         const existing = subject.locks.find((row) => row.resource === requested.resource) || null;
         const expiresAt = leaseDeadline(t, ttl);
-        db.prepare(`
-          INSERT INTO locks(resource, base_resource, scope, owner, task_id, reason, expires_at, created_at, ttl_sec)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-          ON CONFLICT(resource) DO UPDATE SET
-            base_resource = excluded.base_resource,
-            scope = excluded.scope,
-            owner = excluded.owner,
-            task_id = excluded.task_id,
-            reason = excluded.reason,
-            expires_at = excluded.expires_at,
-            created_at = excluded.created_at,
-            ttl_sec = excluded.ttl_sec
-        `).run(requested.resource, requested.base_resource, requested.scope, peer, taskId, reason, expiresAt, t, ttl);
+        const acquired = upsertRequestedLock(db, requested, {
+          owner: peer, task_id: taskId, reason, expires_at: expiresAt, created_at: t, ttl_sec: ttl
+        });
         addEvent(db, 'lock.acquired', peer, taskId, webAuditPayload(peer, input, { resource: requested.base_resource, lock_resource: requested.resource, scope: requested.scope, ttl, previous_owner: existing ? existing.owner : null }));
-        return { lock: db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource) };
+        return { lock: acquired };
         }
       });
       if (outcome.error) throw outcome.error;
@@ -327,7 +327,7 @@ export function createWebPeerActions(deps = {}) {
     try {
       touchPeer(db, peer, null);
       const result = tx(db, () => {
-        const existing = db.prepare('SELECT * FROM locks WHERE resource = ?').get(requested.resource);
+        const existing = findRequestedLock(db, requested);
         if (!existing) return { released: false, ...requested };
         if (existing.owner !== peer) {
           throw new CliError('LOCK_OWNED', `Lock is owned by ${existing.owner}`, { owner: existing.owner });

package/lib/web/project-contexts.mjs

@@ -3,11 +3,10 @@
 // fail-closed path re-resolution, per-project DB connections, and
 // session/peer lookup helpers used by the HTTP and WS layers.
 
-import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import WebSocket from 'ws';
 import { CliError } from '../shared/errors.mjs';
-import { contextForProject } from '../runtime/paths.mjs';
+import { contextForProject, projectDbPath } from '../runtime/paths.mjs';
 import { resolveProjectDatabase } from '../runtime/project-path.mjs';
 import {
   projectRecord,
@@ -101,7 +100,7 @@ export function createProjectContexts(deps) {
       ctx.root;
     const requestedDb = url.searchParams.get('db') ||
       req.headers['x-hcc-db'] ||
-      path.join(requestedRoot, '.hello-cc', 'mesh.db');
+      projectDbPath(requestedRoot);
     return rememberProject(
       resolveWebProjectContext(requestedRoot, requestedDb),
       { activity: true }

package/lib/web/runtime-main.mjs

@@ -97,7 +97,8 @@ import {
   requestOriginMatches,
   sendFile,
   sendJson,
-  tokenMatches
+  tokenMatches,
+  tokenlessRequestAllowed
 } from '../web/http.mjs';
 import {
   API_VERSION,
@@ -433,9 +434,9 @@ const {
     listCodexThreads, readCodexThread, forkCodexThread } = createCodexSessions({
     sessions, sessionKey, nextProjectSessionId, connectWebProject, upsertPeer,
     upsertCanonicalPeerBinding, observePeerEvidence,
-    broadcast: (session, payload) => {
+    broadcast: (session, payload, event) => {
       if (payload.type === 'codex_state') {
-        try { observeCodexResults(session, payload.state); }
+        try { observeCodexResults(session, payload.state, event); }
         catch (error) { console.error(redactedLogText(`Result evidence could not be saved: ${error.code || 'UNKNOWN'}`)); }
       }
       broadcast(session, payload);
@@ -488,14 +489,30 @@ const {
     ACTIVE_PEER_TTL, DETECTED_PEER_MAX_AGE, PRODUCT_NAME, VERSION
   });
 
+  const dispatchHttp = (req, res) => {
+    void handleWebRequest(req, res).catch((error) => {
+      try {
+        console.error(redactedLogText(`HTTP request failed: ${error.code || 'UNKNOWN'}`));
+        if (!res.headersSent) sendJson(res, 500, { ok: false, error: { code: 'SERVER_ERROR', message: 'internal server error' } });
+        else res.destroy();
+      } catch {
+        try { res.destroy(); } catch {}
+      }
+    });
+  };
   const server = useTls
-    ? https.createServer({ key: tlsCredentials.key, cert: tlsCredentials.cert }, handleWebRequest)
-    : http.createServer(handleWebRequest);
+    ? https.createServer({ key: tlsCredentials.key, cert: tlsCredentials.cert }, dispatchHttp)
+    : http.createServer(dispatchHttp);
 
   const wss = new WebSocketServer({ noServer: true });
   server.on('upgrade', (req, socket, head) => {
     try {
     const url = requestUrl(req);
+    if (!token && !tokenlessRequestAllowed(req, { trustProxy, proxyOrigin })) {
+      socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+      socket.destroy();
+      return;
+    }
     if (!readWebSocketApiVersion(url).ok) {
       const body = JSON.stringify(apiVersionUnsupportedBody());
       socket.end([

package/lib/web/runtime.mjs

@@ -14,8 +14,12 @@ export function runtimeConnectHost(host) {
   return host;
 }
 
+function urlHost(host) {
+  return host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+}
+
 export function runtimeBaseUrl(host, port, tls = false) {
-  return `${tls ? 'https' : 'http'}://${runtimeConnectHost(host)}:${port}`;
+  return `${tls ? 'https' : 'http'}://${urlHost(runtimeConnectHost(host))}:${port}`;
 }
 
 export function runtimeApiUrl(runtime, route) {
@@ -24,7 +28,17 @@ export function runtimeApiUrl(runtime, route) {
 }
 
 export function requestUrl(req) {
-  return new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+  try {
+    const base = new URL(`http://${req.headers.host || 'localhost'}`);
+    if (base.username || base.password || base.pathname !== '/' || base.search || base.hash) {
+      throw new Error('Invalid Host authority');
+    }
+    const url = new URL(req.url || '/', base);
+    if (url.origin !== base.origin) throw new Error('Request target changes authority');
+    return url;
+  } catch {
+    throw new CliError('BAD_REQUEST', 'Invalid request URL or Host header');
+  }
 }
 
 export function isLoopbackHost(host) {
@@ -84,13 +98,13 @@ export function publicRuntimeUrl(runtime, projectRoot = null) {
     ? '<machine-ip>'
     : runtime.host || runtimeConnectHost(runtime.host || '127.0.0.1');
   const scheme = runtime.tls ? 'https' : 'http';
-  return `${scheme}://${host}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
+  return `${scheme}://${urlHost(host)}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
 }
 
 export function localRuntimeUrl(runtime, projectRoot = null) {
   const host = runtimeConnectHost(runtime.host || '127.0.0.1');
   const scheme = runtime.tls ? 'https' : 'http';
-  return `${scheme}://${host}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
+  return `${scheme}://${urlHost(host)}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
 }
 
 // Issue a request to a runtime API route. Returns { ok, status, text }.

package/lib/web/session-serialize.mjs

@@ -105,7 +105,7 @@ export function createSessionSerialize({
         : session.type === 'native' ? ['chat', 'delivery-receipts', 'results',
           ...(session.nativeState?.capabilities?.interrupt ? ['turn-control'] : [])] : ['terminal', 'results'],
       local_clients: session.type === 'tmux' ? localClientObservation(session) : null,
-      executor_id: session.adapter?.snapshot().executorId || session.nativeState?.executorId || null,
+      executor_id: session.executorId || session.adapter?.snapshot().executorId || session.nativeState?.executorId || null,
       native_connected: session.type === 'native' ? Boolean(session.nativeState?.connected) : null,
       created_at: session.createdAt,
       exited_at: session.exitedAt || null,

package/lib/web/startup.mjs

@@ -5,6 +5,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
+import { createHash, randomUUID } from 'node:crypto';
 import { URL } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
 import { setTimeout as sleep } from 'node:timers/promises';
@@ -13,10 +14,15 @@ import { redactCliArgs } from '../shared/redact.mjs';
 import { intOpt, parseOpts, splitGlobalArgs, validateOpts } from '../cli-args.mjs';
 import { printResult } from '../format.mjs';
 import { commandPath, tailFile } from '../cli-runtime.mjs';
+import { compareProcessIdentity, inspectProcessIdentity } from '../process/identity.mjs';
 import { registerProject } from '../runtime/projects.mjs';
-import { runtimePath, globalRuntimePath, webLogPath } from '../runtime/paths.mjs';
+import { runtimePath, globalRuntimePath, globalStateDir, webLogPath } from '../runtime/paths.mjs';
+import { secureExistingProjectStateDirectory } from '../runtime/project-path.mjs';
+import { openPrivateAppendFile } from '../runtime/private-file.mjs';
 import { readHealthyGlobalRuntime, writeRuntime } from '../runtime/state.mjs';
 import { runtimeRequest } from '../runtime/client.mjs';
+import { withFileLock } from '../shared/file-lock.mjs';
+import { writeJsonSafe } from '../shared/json-file.mjs';
 import {
   expectedWebHost,
   isLoopbackHost,
@@ -32,6 +38,56 @@ import { API_VERSION } from '../web/api-version.mjs';
 import { ensureTmuxAvailable } from '../tmux.mjs';
 
 export const WEB_RUNTIME_START_TIMEOUT_MS = 60_000;
+const WEB_START_LOCK_WAIT_MS = WEB_RUNTIME_START_TIMEOUT_MS + 30_000;
+
+function webStartOwnerAlive(owner) {
+  const pid = owner?.pid;
+  if (!Number.isInteger(pid) || pid <= 0) return true;
+  const observed = inspectProcessIdentity(pid);
+  if (observed.state === 'dead') return false;
+  if (owner.process_identity && observed.state === 'live') {
+    return compareProcessIdentity(owner.process_identity, observed.identity) !== 'dead';
+  }
+  return true;
+}
+
+async function withWebStartLock(fn) {
+  const lockFile = path.join(globalStateDir(), 'web-start.lock');
+  const owner = {
+    pid: process.pid,
+    process_identity: inspectProcessIdentity(process.pid).identity,
+    nonce: randomUUID()
+  };
+  const deadline = performance.now() + WEB_START_LOCK_WAIT_MS;
+  while (true) {
+    const acquired = withFileLock(lockFile, (lockedFile) => {
+      if (fs.existsSync(lockedFile)) {
+        let previous = null;
+        try { previous = JSON.parse(fs.readFileSync(lockedFile, 'utf8')); } catch {}
+        if (!previous || webStartOwnerAlive(previous)) return false;
+      }
+      writeJsonSafe(lockedFile, owner, { mode: 0o600 });
+      return true;
+    });
+    if (acquired) break;
+    if (performance.now() >= deadline) {
+      throw new CliError('WEB_START_LOCK_TIMEOUT',
+        'Timed out waiting for another web startup to finish.');
+    }
+    await sleep(100);
+  }
+  try {
+    return await fn();
+  } finally {
+    withFileLock(lockFile, (lockedFile) => {
+      let current = null;
+      try { current = JSON.parse(fs.readFileSync(lockedFile, 'utf8')); } catch {}
+      if (current?.nonce === owner.nonce && current.pid === owner.pid) {
+        fs.rmSync(lockedFile, { force: true });
+      }
+    });
+  }
+}
 
 export function createWebStartup(deps) {
   const {
@@ -84,25 +140,41 @@ async function stopOrphanWebRuntimes(ctx, keepPid = null) {
     const ppid = Number.parseInt(match[2], 10);
     if (!Number.isFinite(pid)) continue;
     if (Number.isFinite(ppid)) ppidByPid.set(pid, ppid);
-    rows.push({ pid, args: match[3] });
+    rows.push({ pid, ppid, args: match[3] });
   }
 
   const ancestorPids = currentProcessAncestorPids(ppidByPid);
-  const pids = [];
+  const candidates = [];
   for (const row of rows) {
+    // A live parent still owns its web command. In particular, another CLI
+    // invocation waiting for the startup lock is not an orphan runtime.
+    if (row.ppid !== 1) continue;
     if (row.pid === process.pid || row.pid === keepPid || ancestorPids.has(row.pid)) continue;
-    if (hccWebProcessMatches(row.args, ctx)) pids.push(row.pid);
+    if (!hccWebProcessMatches(row.args, ctx)) continue;
+    const observed = inspectProcessIdentity(row.pid);
+    if (observed.state === 'live' &&
+        observed.identity.commandHash === createHash('sha256').update(row.args.trim()).digest('hex')) {
+      candidates.push(observed.identity);
+    }
   }
-  if (!pids.length) return;
+  if (!candidates.length) return;
+
+  const stillSameProcess = (identity) => {
+    const observed = inspectProcessIdentity(identity.pid);
+    return observed.state === 'live' &&
+      compareProcessIdentity(identity, observed.identity) === 'live' &&
+      identity.commandHash === observed.identity.commandHash;
+  };
 
-  for (const pid of pids) {
-    try { process.kill(pid, 'SIGTERM'); } catch {}
+  for (const identity of candidates) {
+    if (!stillSameProcess(identity)) continue;
+    try { process.kill(identity.pid, 'SIGTERM'); } catch {}
   }
   await sleep(250);
-  for (const pid of pids) {
+  for (const identity of candidates) {
+    if (!stillSameProcess(identity)) continue;
     try {
-      process.kill(pid, 0);
-      process.kill(pid, 'SIGKILL');
+      process.kill(identity.pid, 'SIGKILL');
     } catch {}
   }
 }
@@ -160,10 +232,15 @@ async function startWebBackground(ctx, args) {
   assertWebTokenForHost(requestedHost, !opts['no-token']);
   if (!isLoopbackHost(requestedHost)) console.error(redactedLogText(webExposureWarning(requestedHost, intOpt(opts, 'port', 8787)) + (opts.tls ? '' : ' Consider --tls to encrypt this connection.')));
   ensureTmuxAvailable({ autoInstall: true });
+  return withWebStartLock(() => startWebBackgroundLocked(ctx, args, opts));
+}
+
+async function startWebBackgroundLocked(ctx, args, opts) {
   const setup = await prepareLocalBus(ctx, {
     ...opts,
     installShims: process.env.HCC_SKIP_SHIM_INSTALL === '1' ? false : true
   });
+  secureExistingProjectStateDirectory(ctx.root);
   registerProject(ctx);
 
   const existing = await readHealthyGlobalRuntime();
@@ -201,26 +278,42 @@ async function startWebBackground(ctx, args) {
     try { await runtimeRequest(ctx, 'POST', '/api/runtime/stop', {}, existing); } catch {}
     await sleep(250);
   }
+  secureExistingProjectStateDirectory(ctx.root);
   await stopOrphanWebRuntimes(ctx);
 
+  // A project path can be reused for a different directory after setup. Do
+  // not remove its old private runtime pointer or append to its old Web log.
+  secureExistingProjectStateDirectory(ctx.root);
   try { fs.rmSync(runtimePath(ctx), { force: true }); } catch {}
   try { fs.rmSync(globalRuntimePath(), { force: true }); } catch {}
 
   const logFile = webLogPath(ctx);
-  fs.mkdirSync(path.dirname(logFile), { recursive: true });
-  // bg-05: rotate web.log once it grows past 5 MB (keep the previous .1).
+  let logFd = openPrivateAppendFile(logFile);
   try {
-    if (fs.statSync(logFile).size > 5 * 1024 * 1024) {
-      try { fs.rmSync(`${logFile}.1`, { force: true }); } catch {}
-      try { fs.renameSync(logFile, `${logFile}.1`); } catch {}
+    // bg-05: rotate web.log once it grows past 5 MB (keep the previous .1).
+    if (fs.fstatSync(logFd).size > 5 * 1024 * 1024) {
+      const previous = `${logFile}.1`;
+      try {
+        const stat = fs.lstatSync(previous);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 ||
+            (typeof process.getuid === 'function' && stat.uid !== process.getuid())) {
+          throw new CliError('PROJECT_PATH_FORBIDDEN', `Rotated Web log is not owned: ${previous}`);
+        }
+        fs.unlinkSync(previous);
+      } catch (error) {
+        if (error?.code !== 'ENOENT') throw error;
+      }
+      fs.closeSync(logFd);
+      logFd = null;
+      fs.renameSync(logFile, previous);
+      logFd = openPrivateAppendFile(logFile);
     }
-  } catch {}
-  const redactedStart = redactedLogText(`${CLI_NAME} web ${redactCliArgs(args).join(' ')}`);
-  fs.appendFileSync(logFile, `\n[${new Date().toISOString()}] ${redactedStart}\n`, { mode: 0o600 });
-  // The runtime echoes token-bearing URLs into web.log; keep it owner-only so a
-  // co-tenant on the machine cannot read the token (net-02).
-  try { fs.chmodSync(logFile, 0o600); } catch {}
-  const logFd = fs.openSync(logFile, 'a');
+    const redactedStart = redactedLogText(`${CLI_NAME} web ${redactCliArgs(args).join(' ')}`);
+    fs.writeSync(logFd, `\n[${new Date().toISOString()}] ${redactedStart}\n`);
+  } catch (error) {
+    if (logFd !== null) fs.closeSync(logFd);
+    throw error;
+  }
 
   const childArgs = [
     commandPath(),

package/lib/web/task-results.mjs

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { selectCurrentTask } from '../core/coordination/automation.mjs';
 import { listTaskResults, recordTaskResult, summarizeTaskResults } from '../core/coordination/results.mjs';
 import { CliError } from '../shared/errors.mjs';
@@ -30,8 +29,8 @@ export function createTaskResults({ connectWebProject, resolveSessionPeerId, now
       return { result };
     } finally { db.close(); }
   }
-  function observeCodexResults(session, state) {
-    if (!session.binding?.provider_session_id || state.executorId !== session.adapter?.snapshot().executorId) return;
+  function observeCodexResults(session, state, event) {
+    if (!session.binding?.provider_session_id || state.executorId !== (session.executorId || session.adapter?.snapshot().executorId)) return;
     const thread = state.threads?.find(t => t.id === session.binding.provider_session_id);
     if (!thread?.turns?.length) return;
     const db = connectWebProject(session.ctx);
@@ -39,9 +38,17 @@ export function createTaskResults({ connectWebProject, resolveSessionPeerId, now
       const peer = resolveSessionPeerId(db, session);
       let scopes = turnScopes.get(session);
       if (!scopes) { scopes = new Map(); turnScopes.set(session, scopes); }
-      for (const event of state.events || []) {
-        if (event.method === 'turn/started' && event.params?.threadId === thread.id && event.params.turn?.id && !scopes.has(event.params.turn.id)) {
-          scopes.set(event.params.turn.id, currentTask(db, peer)?.id || null);
+      // The snapshot retains old events. Only the adapter's fresh event may bind
+      // a turn to the task that is current at this instant.
+      if (event?.method === 'turn/started' && event.params?.threadId === thread.id &&
+          event.params.turn?.id && !scopes.has(event.params.turn.id)) {
+        scopes.set(event.params.turn.id, currentTask(db, peer)?.id || null);
+      }
+      function recordAutomatic(input) {
+        try { recordTaskResult(db, input, { now, addEvent, automatic: true }); return true; }
+        catch (error) {
+          if (error instanceof CliError && ['TASK_OWNER_MISMATCH', 'NOT_FOUND'].includes(error.code)) return false;
+          throw error;
         }
       }
       for (const turn of thread.turns) {
@@ -49,27 +56,23 @@ export function createTaskResults({ connectWebProject, resolveSessionPeerId, now
         if (!taskId) continue;
         const common = { peer, taskId, executorId: state.executorId, threadId: thread.id,
           turnId: turn.id, source: 'executor', stage: 'local' };
+        let taskUnavailable = false;
         for (const item of turn.items || []) {
           if (item.type !== 'commandExecution' || !['completed', 'failed', 'declined'].includes(item.status)) continue;
           const exitCode = item.exitCode;
           const status = exitCode === 0 && item.status === 'completed' ? 'passed'
             : item.status === 'failed' || item.status === 'declined' || (Number.isSafeInteger(exitCode) && exitCode !== 0) ? 'failed' : 'pending';
-          recordTaskResult(db, { ...common, itemId: item.id, kind: 'command', status, exitCode,
-            resultKey: `${state.executorId}:${turn.id}:${item.id}:command`,
-            title: String(item.command || 'Command execution').slice(0, 300),
-            command: String(item.command || '').slice(0, 64000),
-            details: String(item.aggregatedOutput || '').slice(0, 64000), evidence: [] }, { now, addEvent });
+          if (!recordAutomatic({ ...common, itemId: item.id, kind: 'command', status, exitCode })) {
+            taskUnavailable = true;
+            break;
+          }
         }
+        if (taskUnavailable) continue;
         if (turn.diff && ['completed', 'failed', 'interrupted'].includes(turn.status)) {
-          const diff = String(turn.diff).slice(0, 64000);
-          recordTaskResult(db, { ...common, kind: 'diff', status: 'pending', title: 'Turn changes awaiting review', diff,
-            resultKey: `${state.executorId}:${turn.id}:diff:${createHash('sha256').update(diff).digest('hex')}` }, { now, addEvent });
+          recordAutomatic({ ...common, kind: 'diff', status: 'pending' });
         }
       }
       while (scopes.size > 100) scopes.delete(scopes.keys().next().value);
-    } catch (error) {
-      // A delayed executor result must not attach to a task after ownership changed.
-      if (!(error instanceof CliError) || !['TASK_OWNER_MISMATCH', 'NOT_FOUND'].includes(error.code)) throw error;
     } finally { db.close(); }
   }
   return { readSessionResults, writeSessionResult, observeCodexResults };

package/lib/web/terminal-assets.mjs

@@ -0,0 +1,18 @@
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const packages = Object.freeze({
+  'xterm.js': '@xterm/xterm',
+  'xterm.css': '@xterm/xterm',
+  'addon-fit.js': '@xterm/addon-fit',
+  'addon-search.js': '@xterm/addon-search'
+});
+
+// npm may place dependencies above the HCC package directory. Resolve from
+// this module's installation rather than assuming a nested node_modules.
+export function terminalAssetPath(name) {
+  if (!Object.hasOwn(packages, name)) throw new TypeError('Unknown terminal asset');
+  const entry = require.resolve(packages[name]);
+  return name === 'xterm.css' ? path.resolve(path.dirname(entry), '..', 'css', name) : entry;
+}