@logicseek/hello-cc 1.0.2 → 1.1.0-rc.1

package/docs/web-handoff.zh-CN.md

@@ -16,7 +16,11 @@
 
 结构化界面提供消息、当前 turn 状态、追加指令、轮次中断、计划、差异和人工交互。命令/文件审批以及空表单 MCP 工具确认由当前控制窗口明确批准本次或拒绝。文件与网络权限可逐项勾选，并明确选择本轮或会话有效期；只能授予原请求的子集。问题支持选项、其他/自由输入和敏感答案，需逐题明确填写。接管控制本身不会批准工具。
 
-表单输入与焦点会跨状态刷新保留，直接答案不写入 HCC 状态、事件、回执或浏览器存储。原 turn 完成、中断成功、provider 解决请求或执行器关闭后，请求卡片失效；旧控制窗口不能用过期 epoch 应答。参数被截断时只能拒绝或取消。任意 MCP 表单字段、URL 登录、动态工具及账号 token 刷新尚未接入。
+表单输入与焦点会跨状态刷新保留，直接答案不写入 HCC 状态、事件、回执或浏览器存储。原 turn 完成、中断成功、provider 解决请求或执行器关闭后，请求卡片失效；旧控制窗口不能用过期 epoch 应答。参数被截断时只能拒绝或取消。MCP 支持下述标准表单和带原 thread/turn 标识的 URL 请求；嵌套对象、任意数组等复杂结构、动态工具及账号 token 刷新尚未接入。
+
+MCP URL 请求显示授权目标，当前控制窗口点击“打开授权页面”后，原执行器接受请求才跳转。弹窗被拦截时不提交请求；过期请求不会打开授权地址。仅允许 HTTPS 或 loopback HTTP，链接带用户名/密码、其他协议、请求标识缺失或参数截断时保留拒绝/取消入口。loopback 地址需在执行器所在电脑打开，其他设备无法通过 HCC 代理本地授权页。
+
+打开页面只表示同意发起外部流程，不表示认证成功。请在外部页面完成操作，再返回关注原任务结果；新页面不保留 opener/referrer。URL、设备码消息和元数据不进入 HCC 交互事件或浏览器存储，实时待处理请求仍可供控制窗口查看。账号登录、token 刷新和 OpenAI 用户验证扩展不包含在此能力内。
 
 运行中发消息使用 steer；空闲时开始新 turn。中断当前轮与终止执行器是不同操作。turn 完成不自动把 hcc task 标记为验收完成。
 
@@ -26,6 +30,10 @@
 
 关闭浏览器后 App Server 仍由 hello-cc runtime 管理；停止 runtime 会关闭它。新 runtime 不会自动重启 App Server 或重放未确认消息，可以从已保存 thread 显式恢复。
 
+MCP 标准表单可以直接在 Web 填写文本、数值、是/否和单选/多选；两种执行器共用校验，答复仍回到同一请求。状态刷新保留页面内的填写内容，可选项不自动发送默认值；页面重载会清空答复。未支持的模式或结构会说明原因，保留拒绝/取消入口。实现和验收范围见 `docs/verification/2026-10-02-mcp-form-web-validation.md`。
+
+真实模型复现脚本为 `scripts/web-mcp-form-live-acceptance.mjs --run-live`：先由本地 Codex 实际发起 MCP 交互，再从桌面/手机 Web 提交，核对同一 native 执行器继续完成和交回本地；另覆盖 Web-owned App Server。环境变量与隔离/账号范围见 `docs/native.zh-CN.md` 的真实模型与浏览器验收说明。成功以该次回执为准，默认运行只打印帮助，不调用模型。
+
 ## 本地 native worker 接手
 
 先用 `hcc native start --peer codex-worker --provider codex` 启动后台任务，再打开 Web 的同一项目。Web 自动发现实际仍由 native runtime 持有的 worker，显示其原 peer/session、事件和投递回执；发送、中断和明确关闭都通过原 runtime 执行，不新建 provider 子进程。Claude/dsh worker 也走这条路径，按实际能力显示中断操作。
@@ -42,12 +50,12 @@
 
 Web 专用 Codex App Server，以及由 HCC 托管的 Codex/Claude/dsh native worker，自动接入 [项目与 peer 受限的 MCP 协作工具](mcp.zh-CN.md)。配置只传给对应执行器或 worker，不写全局 provider 配置；关闭 worker 前撤销其临时权限。模型可查询任务与 inbox、领取任务、发送消息、写 handoff、获取/释放自己的资源锁和记录本地证据；不替用户执行发布或业务验收。
 
-会话栏“结果审阅”汇总结构化 command 的退出码与输出、turn 差异、模型通过 MCP 提交的本地证据，以及人工添加的验收记录。命令退出成功仅说明该命令成功；人工填写“通过”必须附证据引用。界面分别展示本地验证、发布部署、业务验收，并注明记录来源。turn 完成、测试记录或人工验收均不自动改变 hcc task 状态。记录保存于项目数据库 events 中，`gc --history` 保留结果审计记录和最小提交去重凭据。
+会话栏“结果审阅”汇总结构化 command 的执行状态与退出码、是否有 turn 差异、模型通过 MCP 明确提交的本地证据，以及人工添加的验收记录。自动结果仅在实时观察到新 turn 开始后归属当前任务；缺失该事件时，不会从历史快照补认任务证据。自动结果在项目数据库 events 中只保存中性标题、状态、退出码和来源 ID，不保存命令、输出或差异正文；正文仍可在可用的执行器会话或 provider 历史中查看。命令退出成功仅说明该命令成功；人工填写“通过”必须附证据引用。界面分别展示本地验证、发布部署、业务验收，并注明记录来源。turn 完成、测试记录或人工验收均不自动改变 hcc task 状态。`gc --history` 保留结果审计记录和最小提交去重凭据。
 
 ## 验收边界
 
 本地验证包含真实 SQLite/HTTP、模拟交互请求、隔离 tmux 与桌面/手机浏览器。安装版 Codex 0.144.6 的协议验收另行覆盖 initialize、thread/start/list、10 个 MCP 工具发现和实际 `hcc_state` 读回；此协议检查不调用模型，可用 `node scripts/web-handoff-installed-acceptance.mjs` 重现。
 
-真实模型验收已在隔离项目和 Codex home 中完成“本地 → Web → 本地”三段文件任务，全程保持原 Codex 进程和 thread；关闭 Web runtime 后仍可继续。可用 `scripts/web-native-model-acceptance.mjs` 在明确需要真实模型调用时重现。三种 provider 的真实生命周期、模型 MCP 发信、回复/ACK 和无回复循环另有独立回执。交互表单另有 11 项模拟 provider 浏览器检查。真实 Codex 已经完成“提问 → Web 答复 → 指定文件权限 → 本轮授权 → 写入所选答案 → 后续请求拒绝 → 本地继续”的验收；默认加载的 Claude SDK 已完成真实 Write 工具批准、拒绝和本地续接。dsh 的真实权限弹窗尚无本轮浏览器验收。完整结果与运行条件见 本地验收记录 (源码目录: `docs/verification/2026-10-02-web-local-task-handoff.md`)。
+真实模型验收已在隔离项目和 Codex home 中完成“本地 → Web → 本地”三段文件任务，全程保持原 Codex 进程和 thread；关闭 Web runtime 后仍可继续。可用 `scripts/web-native-model-acceptance.mjs` 在明确需要真实模型调用时重现。三种 provider 的真实生命周期、模型 MCP 发信、回复/ACK 和无回复循环另有独立回执。交互表单另有 11 项模拟 provider 浏览器检查。真实 Codex 已经完成“提问 → Web 答复 → 指定文件权限 → 本轮授权 → 写入所选答案 → 后续请求拒绝 → 本地继续”的验收；默认加载的 Claude SDK 已完成真实 Write 工具批准、拒绝和本地续接。dsh 已完成真实 ACP 写入的 Web 批准、拒绝和原 session 本地续接，审批卡片另通过桌面与 390px 手机检查；仅在隔离 profile 中对指定验收文件设置公开审批策略。完整结果与运行条件见 本地验收记录 (源码目录: `docs/verification/2026-10-02-web-local-task-handoff.md`)。
 
 任意未托管 TUI/普通终端的活动执行器迁移、私有 daemon endpoint、任意协议版本的完整兼容矩阵，以及发布安装和真实业务验收仍在本次证据范围之外。

package/lib/cli/app.mjs

@@ -89,6 +89,9 @@ import { assignTeamWorkers, expandTeamWorkers, inferTeamItems } from '../core/co
 import { autoPeerBasis, autoPeerKind, autoPeerProviderSession, autoPeerResumeId, autoPeerSessionId, readAncestorCliInfo, resolveCurrentPeer, resumeIdFromArgs, shortHash } from '../integrations/peers/identity.mjs';
 import { inspectProviderProcess } from '../integrations/peers/processes.mjs';
 import { registerProjectActivity } from '../runtime/projects.mjs';
+import { migrateLegacyProjectState } from '../runtime/state-migration.mjs';
+import { projectDbPath } from '../runtime/paths.mjs';
+import { ensureDshIntegration } from '../integrations/dsh.mjs';
 
 // Lazy-load lib modules (they may import node-pty which needs to be optional)
 const _libDir = path.resolve(fileURLToPath(import.meta.url), '..', '..');
@@ -303,7 +306,7 @@ const { cmdInit, cmdRegister, cmdEnv, cmdJoin } = createLifecycleCommands({
   connect, now, tx, addEvent, printResult, CliError, parseOpts, intOpt,
   registerProjectActivity, resolveCurrentPeer, resolveTargetPeer,
   upsertPeer, upsertCanonicalPeerBinding, storedPeerIdentity, detectBranch,
-  writeGuidance, helpEnv, helpJoin, shellExports, path, process
+  readAncestorCliInfo, writeGuidance, helpEnv, helpJoin, shellExports, path, process
 });
 
 const { cmdTeam } = createTeamCommands({
@@ -580,6 +583,43 @@ function removeGuidanceBlocks(ctx) {
   return removeGuidanceBlocksForRoot(ctx.root);
 }
 
+function cmdMigrateState(ctx, args) {
+  if (wantsHelp(args)) {
+    console.log(`${CLI_NAME} migrate-state --offline --yes\n\n` +
+      'Stop all old hello-cc Web, Native, PTY, tmux, hook and external database writers first. ' +
+      'This command verifies known process evidence, snapshots SQLite including WAL, and leaves the old directory untouched.');
+    return;
+  }
+  const opts = parseOpts(args, { booleans: ['offline', 'yes'] });
+  validateOpts('migrate-state', opts, ['offline', 'yes']);
+  if (opts.offline !== true || opts.yes !== true) {
+    throw new CliError('STATE_MIGRATION_OFFLINE_REQUIRED',
+      'Stop every old project-state writer, then acknowledge downtime with migrate-state --offline --yes');
+  }
+  const result = migrateLegacyProjectState(ctx.root, {
+    confirmedOffline: true,
+    // The operator's explicit --offline assertion covers external writers
+    // that cannot be discovered reliably across supported platforms. The
+    // migrator still checks known runtime, PTY and SQLite peer evidence.
+    assertOffline: () => true
+  });
+  let dshRebuilt = false;
+  if (result.dsh) {
+    try {
+      ensureDshIntegration({ ...ctx, dbPath: projectDbPath(ctx.root) }, { mode: result.dsh.mode });
+      dshRebuilt = true;
+    } catch (error) {
+      throw new CliError('STATE_MIGRATION_DSH_REBUILD_REQUIRED',
+        `Project state migrated to ${result.stateDir}, but DSH configuration needs rebuilding. ` +
+        `Run ${result.dsh.rebuildCommand}. Original data remains at ${result.sourceDir}.`,
+        { cause: error });
+    }
+  }
+  printResult(ctx, { ...result, dsh_rebuilt: dshRebuilt },
+    () => `project state migrated: ${result.stateDir}\nlegacy source kept: ${result.sourceDir}` +
+      (dshRebuilt ? '\nDSH integration rebuilt for the new private path' : ''));
+}
+
 // ─── hcc doctor ─────────────────────────────────────────────────────────────
 // Health self-check: SQLite integrity, schema version, WAL/DB size, row counts.
 async function dispatch(ctx, rest) {
@@ -592,6 +632,7 @@ async function dispatch(ctx, rest) {
   if (command === 'update') return cmdUpdate(ctx, args);
   if (command === 'uninstall') return cmdUninstall(ctx, args);
   if (command === 'init') return cmdInit(ctx, args);
+  if (command === 'migrate-state') return cmdMigrateState(ctx, args);
   if (command === 'register') return cmdRegister(ctx, args);
   if (command === 'join') return cmdJoin(ctx, args);
   if (command === 'env') return cmdEnv(ctx, args);

package/lib/cli/commands/coordination.mjs

@@ -184,8 +184,13 @@ export function createCoordinationCommands(deps) {
     const kind = opts.kind || 'broadcast';
     const runtime = opts.inject ? readRuntime(ctx) : null;
     const db = connect(ctx);
-    touchCurrentPeer(db, ctx, identity, null, 'shell');
-    const id = sendMessage(db, sender, 'all', taskId, kind, body);
+    let id;
+    try {
+      touchCurrentPeer(db, ctx, identity, null, 'shell');
+      id = sendMessage(db, sender, 'all', taskId, kind, body);
+    } finally {
+      db.close();
+    }
     let injected = 0;
     let skipped = 0;
     if (opts.inject) {

package/lib/cli/commands/dsh.mjs

@@ -14,7 +14,7 @@ function defaultHelp() {
     '       hcc dsh status [--dsh-bin PATH]',
     '       hcc dsh web [--mode hooks|cordis|off] [--dsh-bin PATH] [--dsh-home PATH] -- [dsh web arguments]',
     '',
-    'Setup writes project-local configuration under .hello-cc/dsh/. Modes: hooks (default), cordis (native tools), off.',
+    'Setup writes managed configuration under the selected private state directory. Modes: hooks (default), cordis (native tools), off.',
     'Web starts the official dsh web runtime; its real sessions join hello-cc through the selected integration.',
     'Pass runtime arguments after --, for example: hcc dsh web -- --port 8080',
     'Show dsh web help: hcc dsh web -- --help',

package/lib/cli/commands/gc.mjs

@@ -26,6 +26,7 @@ import {
 import { runOptimisticEvidenceMutation } from '../../core/coordination/optimistic-evidence.mjs';
 import { peerEvidenceAllowsReap } from '../../core/peers/evidence.mjs';
 import { runtimePath, globalRuntimePath } from '../../runtime/paths.mjs';
+import { resolveProjectDatabase } from '../../runtime/project-path.mjs';
 import { readRuntime, reclaimRuntimePointerFiles } from '../../runtime/state.mjs';
 import { runtimeRequest, runtimeBufferGcUnavailable } from '../../runtime/client.mjs';
 import { collectBufferEvidence } from '../../runtime/buffer-evidence.mjs';
@@ -263,12 +264,16 @@ function captureRequiredBufferDirectoryComponent(component, description) {
 function captureOptionalBufferDirectory(root, directoryName) {
   const requestedRoot = path.resolve(root);
   const canonicalRoot = fs.realpathSync.native(requestedRoot);
-  const stateDirectory = path.join(canonicalRoot, '.hello-cc');
+  const stateDirectory = resolveProjectDatabase({ root: canonicalRoot, createStateDir: false }).stateDir;
   const directory = path.join(stateDirectory, directoryName);
   const components = [
-    captureRequiredBufferDirectoryComponent(canonicalRoot, 'Project root'),
-    captureRequiredBufferDirectoryComponent(stateDirectory, 'Project state directory')
+    captureRequiredBufferDirectoryComponent(canonicalRoot, 'Project root')
   ];
+  try {
+    components.push(captureRequiredBufferDirectoryComponent(stateDirectory, 'Project state directory'));
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
 
   let stat;
   try {
@@ -624,7 +629,7 @@ function runGcWithHistorySnapshot(ctx, db, {
 }
 
 function bufferDirectory(ctx) {
-  return path.resolve(path.join(ctx.root, '.hello-cc', BUFS_DIR_NAME));
+  return path.join(resolveProjectDatabase({ root: ctx.root, createStateDir: false }).stateDir, BUFS_DIR_NAME);
 }
 
 function bufferDirectoryPaths(directory) {

package/lib/cli/commands/hook.mjs

@@ -4,6 +4,7 @@
 import { parseOpts, validateOpts } from '../../cli-args.mjs';
 import { tx } from '../../db/schema.mjs';
 import { resolveProjectDatabase } from '../../runtime/project-path.mjs';
+import { projectDbPath } from '../../runtime/paths.mjs';
 
 export function createHookCommand(deps) {
   const {
@@ -89,13 +90,17 @@ async function cmdHook(ctx, args) {
   const dshProject = isDsh && !nativeOwner ? resolveProjectDatabase({ root: hccRoot, createStateDir: false }) : null;
   const nativeProject = nativeOwner ? resolveProjectDatabase({ root: hccRoot,
     db: process.env.HCC_DB, createStateDir: false }) : null;
+  const ordinaryDb = (ctx.root && path.resolve(ctx.root) === hccRoot ? ctx.dbPath : null) ||
+    process.env.HCC_DB;
   if (nativeProject && !fs.existsSync(nativeProject.db)) {
     throw new CliError('NATIVE_HOOK_OWNERSHIP_MISMATCH', 'Native hook database must already be owned by its runtime');
   }
+  const ordinaryDefaultDb = !dshProject && !nativeProject && !ordinaryDb
+    ? projectDbPath(hccRoot) : null;
   const hookCtx = {
     ...ctx,
     root: nativeProject?.root || dshProject?.root || hccRoot,
-    dbPath: nativeProject?.db || dshProject?.db || path.join(hccRoot, '.hello-cc', 'mesh.db')
+    dbPath: nativeProject?.db || dshProject?.db || ordinaryDefaultDb || path.resolve(ordinaryDb)
   };
   if (!nativeOwner) registerProjectActivity(hookCtx);
 

package/lib/cli/commands/install.mjs

@@ -1,6 +1,10 @@
 // Install/setup/update/uninstall/shim commands extracted from bin/hcc.mjs.
 
 import { execFileSync, spawnSync } from 'node:child_process';
+import { secureExistingProjectStateDirectory } from '../../runtime/project-path.mjs';
+import { legacyProjectStateDir, projectStateDir } from '../../runtime/paths.mjs';
+import { privateProjectStateDir, inspectPrivateProjectAuthority,
+  purgePrivateProjectState } from '../../runtime/private-state.mjs';
 
 export function createInstallCommands(deps) {
   const {
@@ -236,14 +240,33 @@ async function cmdUninstall(ctx, args) {
   if (opts.purge && !opts.yes) {
     throw new CliError('CONFIRM_REQUIRED', 'Refusing to purge project data without --yes');
   }
+  // Resolve before changing hooks, guidance, or runtime state. An unsafe root
+  // with unmigrated legacy data must not be treated as an empty private store.
+  let purgeStateDir = null;
+  let missingPrivateState = false;
+  if (opts.purge) {
+    try {
+      purgeStateDir = secureExistingProjectStateDirectory(ctx.root).stateDir;
+    } catch (error) {
+      if (projectStateDir(ctx.root) !== privateProjectStateDir(ctx.root)) throw error;
+      const recoverablePending = error?.code === 'STATE_MIGRATION_REQUIRED' &&
+        inspectPrivateProjectAuthority(ctx.root) === 'pending';
+      if (!['STATE_AUTHORITY_MISSING', 'STATE_PURGE_INCOMPLETE'].includes(error?.code) &&
+          !recoverablePending) throw error;
+      purgeStateDir = privateProjectStateDir(ctx.root);
+      missingPrivateState = true;
+    }
+  }
 
   const lines = [];
 
   let runtime = null;
-  try {
-    runtime = readRuntime(ctx);
-  } catch (err) {
-    if (!(err instanceof CliError && err.code === 'RUNTIME_NOT_RUNNING')) throw err;
+  if (!missingPrivateState) {
+    try {
+      runtime = readRuntime(ctx);
+    } catch (err) {
+      if (!(err instanceof CliError && err.code === 'RUNTIME_NOT_RUNNING')) throw err;
+    }
   }
   if (runtime) {
     try {
@@ -273,9 +296,28 @@ async function cmdUninstall(ctx, args) {
   if (opts.purge) {
     guidance = removeGuidanceBlocks(ctx);
     try {
-      fs.rmSync(path.join(ctx.root, '.hello-cc'), { recursive: true, force: true });
+      if (path.resolve(purgeStateDir) === path.resolve(privateProjectStateDir(ctx.root))) {
+        // Revalidate and delete under the same transition lock used by init
+        // and migration. An interrupted deletion remains marked purging.
+        purgeStateDir = purgePrivateProjectState(ctx.root);
+      } else {
+        // Async shutdown and hook removal happened after the initial lookup.
+        // Refuse a stale legacy target if project-state routing changed.
+        const current = secureExistingProjectStateDirectory(ctx.root).stateDir;
+        if (path.resolve(current) !== path.resolve(purgeStateDir)) {
+          throw new CliError('PROJECT_PATH_FORBIDDEN', 'Project state route changed during uninstall');
+        }
+        fs.rmSync(purgeStateDir, { recursive: true, force: true });
+      }
       purged = true;
-      lines.push(`project data removed: ${path.join(ctx.root, '.hello-cc')}`);
+      lines.push(`project data removed: ${purgeStateDir}`);
+      const legacyDir = legacyProjectStateDir(ctx.root);
+      if (path.resolve(legacyDir) !== path.resolve(purgeStateDir) && fs.existsSync(legacyDir)) {
+        lines.push(`legacy project data kept: ${legacyDir}`);
+        lines.push('private authority kept; future use requires an explicit offline migration of the legacy source');
+      } else if (path.resolve(legacyDir) !== path.resolve(purgeStateDir)) {
+        lines.push('private authority kept; a fresh init can now create new private state');
+      }
     } catch (err) {
       throw new CliError('PURGE_FAILED', `Could not remove .hello-cc: ${err.message}`);
     }

package/lib/cli/commands/lifecycle.mjs

@@ -4,10 +4,21 @@ export function createLifecycleCommands(deps) {
   const {
     connect, now, addEvent, printResult, CliError, parseOpts, intOpt,
     registerProjectActivity, resolveCurrentPeer, resolveTargetPeer,
-    upsertPeer, upsertCanonicalPeerBinding, detectBranch,
+    upsertPeer, upsertCanonicalPeerBinding, detectBranch, readAncestorCliInfo,
     writeGuidance, helpEnv, helpJoin, shellExports, path, process
   } = deps;
 
+  function registrationPid(opts) {
+    if (opts.pid !== undefined) return intOpt(opts, 'pid', process.ppid);
+    const ancestor = readAncestorCliInfo();
+    if (['claude', 'codex'].includes(ancestor?.kind) &&
+        (!opts.kind || opts.kind === ancestor.kind) &&
+        Number.isSafeInteger(ancestor.pid) && ancestor.pid > 1) {
+      return ancestor.pid;
+    }
+    return process.ppid;
+  }
+
   async function cmdInit(ctx, args) {
     registerProjectActivity(ctx);
     const opts = parseOpts(args, { booleans: ['no-guidance'] });
@@ -34,7 +45,7 @@ export function createLifecycleCommands(deps) {
       role: opts.role || '',
       worktree: path.resolve(opts.worktree || ctx.cwd),
       branch: opts.branch || detectBranch(ctx.cwd),
-      pid: intOpt(opts, 'pid', process.ppid),
+      pid: registrationPid(opts),
       status: opts.status || 'idle',
       capabilities: Array.isArray(opts.cap) ? opts.cap.join(',') : (opts.cap || opts.capabilities || '')
     };
@@ -67,7 +78,7 @@ export function createLifecycleCommands(deps) {
       role: opts.role || 'peer',
       worktree: path.resolve(opts.worktree || ctx.cwd),
       branch: opts.branch || detectBranch(ctx.cwd),
-      pid: intOpt(opts, 'pid', process.ppid),
+      pid: registrationPid(opts),
       status: opts.status || 'working',
       capabilities: Array.isArray(opts.cap) ? opts.cap.join(',') : (opts.cap || opts.capabilities || 'manual-shell')
     };

package/lib/cli/commands/native.mjs

@@ -7,6 +7,7 @@ import { parseOpts, validateOpts, wantsHelp, intOpt } from '../../cli-args.mjs';
 import { printResult } from '../../format.mjs';
 import { commandPath } from '../../cli-runtime.mjs';
 import { nativePaths, readNativePointer } from '../../runtime/native/store.mjs';
+import { openPrivateAppendFile } from '../../runtime/private-file.mjs';
 import { nativeRequest } from '../../runtime/native/client.mjs';
 import { startNativeService } from '../../runtime/native/service.mjs';
 
@@ -37,15 +38,21 @@ export function createNativeCommands(deps) {
       }
     }
     const paths = nativePaths(ctx, { create: true });
-    const log = fs.openSync(paths.log, fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | (fs.constants.O_NOFOLLOW || 0), 0o600);
-    if (!fs.fstatSync(log).isFile() || fs.fstatSync(log).nlink !== 1) {
-      fs.closeSync(log);
-      throw new CliError('NATIVE_STATE_UNSAFE', 'Native runtime log must be a private regular file');
+    let log;
+    let child;
+    try {
+      log = openPrivateAppendFile(paths.log);
+      child = spawn(process.execPath, [commandPath(), '--root', fs.realpathSync(ctx.root), '--db', path.resolve(ctx.dbPath), 'native', 'serve'], {
+        cwd: ctx.root, env: process.env, detached: true, stdio: ['ignore', log, log]
+      });
+    } catch (error) {
+      if (error?.code === 'PROJECT_PATH_FORBIDDEN') {
+        throw new CliError('NATIVE_STATE_UNSAFE', error.message);
+      }
+      throw error;
+    } finally {
+      if (log !== undefined) fs.closeSync(log);
     }
-    const child = spawn(process.execPath, [commandPath(), '--root', fs.realpathSync(ctx.root), '--db', path.resolve(ctx.dbPath), 'native', 'serve'], {
-      cwd: ctx.root, env: process.env, detached: true, stdio: ['ignore', log, log]
-    });
-    fs.closeSync(log);
     let failed;
     child.on('error', (error) => { failed = error; });
     child.unref();
@@ -113,7 +120,7 @@ export function createNativeCommands(deps) {
           const data = fs.readFileSync(path.resolve(ctx.cwd, opts['response-file']), 'utf8');
           if (data.length > 100000) throw new CliError('BAD_ARGS', 'Response file exceeds the limit');
           try { response = JSON.parse(data); } catch { throw new CliError('BAD_ARGS', 'Response file must contain JSON'); }
-          if (!response || typeof response !== 'object' || Array.isArray(response) || Object.keys(response).some(key => !['permissions','scope','answers'].includes(key))) throw new CliError('BAD_ARGS', 'Response file accepts permissions, scope and answers only');
+          if (!response || typeof response !== 'object' || Array.isArray(response) || Object.keys(response).some(key => !['permissions','scope','answers','content'].includes(key))) throw new CliError('BAD_ARGS', 'Response file accepts permissions, scope, answers and MCP content only');
         }
         const request = pending[0];
         result = await nativeRequest(ctx, 'POST', '/respond', { peer: opts.peer, generation: state.generation,

package/lib/cli/commands/query.mjs

@@ -1,5 +1,7 @@
 // Coordination query commands extracted from bin/hcc.mjs: peers, status, state, prompt.
 
+import { shellQuoteArg } from '../../format.mjs';
+
 export function createQueryCommands(deps) {
   const {
     connect, now, printResult, table, CliError, ACTIVE_PEER_TTL,
@@ -63,7 +65,10 @@ export function createQueryCommands(deps) {
     const peer = required(opts, 'peer', 'HCC_PEER');
     const kind = opts.kind || 'codex';
     const role = opts.role || 'peer';
-    const cmd = `node ${commandPath()} --root ${JSON.stringify(ctx.root)}`;
+    const cmd = ['node', commandPath(), '--root', ctx.root, '--db', ctx.dbPath].map(shellQuoteArg).join(' ');
+    const quotedPeer = shellQuoteArg(peer);
+    const quotedKind = shellQuoteArg(kind);
+    const quotedRole = shellQuoteArg(role);
     const text = `You are ${peer}, a ${kind} ${role} session working in this project.
 
 Use hcc as the shared coordination bus for this terminal session. This
@@ -71,23 +76,23 @@ project uses a flat peer mesh: there is no required main/worker hierarchy.
 
 Run these commands before changing files:
 
-${cmd} register --peer ${peer} --kind ${kind} --role ${role}
-${cmd} state --peer ${peer}
-${cmd} msg inbox --peer ${peer}
-${cmd} task next --peer ${peer}
+${cmd} register --peer ${quotedPeer} --kind ${quotedKind} --role ${quotedRole}
+${cmd} state --peer ${quotedPeer}
+${cmd} msg inbox --peer ${quotedPeer}
+${cmd} task next --peer ${quotedPeer}
 
 Coordination rules:
 - Claim exactly one task before editing.
 - If state shows a current task for ${peer}, continue that task before claiming another pending task.
 - Before editing a file, directory, module, or shared test resource, run:
-  ${cmd} lock acquire --peer ${peer} --resource <path-or-module> [--scope <scope>] --task <task-id>
+  ${cmd} lock acquire --peer ${quotedPeer} --resource <path-or-module> [--scope <scope>] --task <task-id>
 - If a lock is held by another peer, message that peer instead of editing:
-  ${cmd} msg send --from ${peer} --to <peer-id> --body "<question>"
+  ${cmd} msg send --from ${quotedPeer} --to <peer-id> --body "<question>"
 - Report progress or requests through msg send.
 - Before stopping, run tests, create a handoff, and release locks:
-  ${cmd} handoff create --from ${peer} --task <task-id> --summary "<what changed>" --tests "<commands/results>" --risks "<known risks>"
-  ${cmd} task done --peer ${peer} --id <task-id> --summary "<done summary>"
-  ${cmd} lock release --peer ${peer} --resource <path-or-module> [--scope <scope>]
+  ${cmd} handoff create --from ${quotedPeer} --task <task-id> --summary "<what changed>" --tests "<commands/results>" --risks "<known risks>"
+  ${cmd} task done --peer ${quotedPeer} --id <task-id> --summary "<done summary>"
+  ${cmd} lock release --peer ${quotedPeer} --resource <path-or-module> [--scope <scope>]
 `;
     printResult(ctx, { prompt: text }, () => text);
   }

package/lib/cli/commands/run.mjs

@@ -11,6 +11,7 @@ import { CliError } from '../../shared/errors.mjs';
 import { tx } from '../../db/schema.mjs';
 import { parseOpts, validateOpts } from '../../cli-args.mjs';
 import { runtimeProcessIdentity } from '../../runtime/state.mjs';
+import { ensurePrivateProjectBufferDirectory } from '../../runtime/project-path.mjs';
 import { withBufferDirectoryLease } from '../../runtime/buffer-directory-lease.mjs';
 import {
   externalBufferEvidence,
@@ -178,8 +179,7 @@ async function cmdRunWebManaged(ctx, { id, kind, role, cwd, command, commandArgs
   const ptyModule = await import('node-pty');
   const pty = ptyModule.default || ptyModule;
 
-  const bufsDir = path.join(ctx.root, '.hello-cc', BUFS_DIR_NAME);
-  fs.mkdirSync(bufsDir, { recursive: true });
+  const bufsDir = ensurePrivateProjectBufferDirectory(ctx.root, BUFS_DIR_NAME);
   const outFile = path.join(bufsDir, `${id}.out`);
   const inFile  = path.join(bufsDir, `${id}.in`);
   const resizeFile = path.join(bufsDir, `${id}.resize`);
@@ -219,8 +219,8 @@ async function cmdRunWebManaged(ctx, { id, kind, role, cwd, command, commandArgs
       }
       for (const file of bufferFiles) fs.rmSync(file, { force: true });
     }
-    fs.writeFileSync(inFile, '');
-    fs.writeFileSync(resizeFile, '');
+    fs.writeFileSync(inFile, '', { flag: 'wx', mode: 0o600 });
+    fs.writeFileSync(resizeFile, '', { flag: 'wx', mode: 0o600 });
     fs.writeFileSync(metaFile, JSON.stringify({
       id,
       generation: bufferGeneration,
@@ -231,7 +231,7 @@ async function cmdRunWebManaged(ctx, { id, kind, role, cwd, command, commandArgs
       wrapper_pid: process.pid,
       ...(publishingWrapperIdentity ? { wrapper_identity: publishingWrapperIdentity } : {}),
       publishing: true
-    }));
+    }), { flag: 'wx', mode: 0o600 });
 
     const db = connect(ctx);
     try {
@@ -359,7 +359,8 @@ async function cmdRunWebManaged(ctx, { id, kind, role, cwd, command, commandArgs
       if (!ownsExternalBufferGroup()) {
         throw new CliError('EXTERNAL_SESSION_SUPERSEDED', `External session ${id} was replaced during startup`);
       }
-      outFd = fs.openSync(outFile, 'w');
+      outFd = fs.openSync(outFile, fs.constants.O_WRONLY | fs.constants.O_CREAT |
+        fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0), 0o600);
     });
   } catch (error) {
     await failStartup(error?.code || 'external_buffer_open_failed');

package/lib/core/coordination/results.mjs

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { tx } from '../../db/schema.mjs';
+import { automaticResultKey } from '../../shared/automatic-result-key.mjs';
 import { CliError } from '../../shared/errors.mjs';
 
 export const RESULT_EVENT = 'task.result.recorded';
@@ -18,7 +19,7 @@ function text(value, field, max, required = false) {
 
 // Evidence records do not mutate task status. The owner is checked in the same
 // transaction as the insert, including after a concurrent task takeover.
-export function recordTaskResult(db, input, { now = () => Math.floor(Date.now() / 1000), addEvent } = {}) {
+export function recordTaskResult(db, input, { now = () => Math.floor(Date.now() / 1000), addEvent, automatic = false } = {}) {
   if (!input || typeof input !== 'object' || Array.isArray(input)) throw new CliError('BAD_REQUEST', 'A result object is required');
   const peer = text(input.peer, 'peer', 200, true);
   const taskId = input.taskId;
@@ -29,21 +30,35 @@ export function recordTaskResult(db, input, { now = () => Math.floor(Date.now()
     throw new CliError('BAD_REQUEST', 'Unsupported result stage, status, kind or source');
   }
   if (source === 'executor' && stage !== 'local') throw new CliError('BAD_REQUEST', 'Executor records can only report local evidence');
+  if (automatic && (source !== 'executor' || !['command', 'diff'].includes(kind))) {
+    throw new CliError('BAD_REQUEST', 'Automatic results must be local executor commands or diffs');
+  }
   const evidence = input.evidence || [];
   if (!Array.isArray(evidence) || evidence.length > 20) throw new CliError('BAD_REQUEST', 'evidence must contain up to 20 text references');
   const references = evidence.map((entry) => text(entry, 'evidence', 2000, true));
   if (source === 'user' && status === 'passed' && !references.length) {
     throw new CliError('BAD_REQUEST', 'A passed verification needs an evidence reference');
   }
+  const executorId = text(input.executorId, 'executorId', 512) || null;
+  const threadId = text(input.threadId, 'threadId', 512) || null;
+  const turnId = text(input.turnId, 'turnId', 512) || null;
+  const itemId = text(input.itemId, 'itemId', 512) || null;
+  if (automatic && (!executorId || !threadId || !turnId || (kind === 'command' && !itemId))) {
+    throw new CliError('BAD_REQUEST', 'Automatic results require executor, thread, turn and command item identities');
+  }
+  const resultKey = automatic
+    ? automaticResultKey({ executorId, threadId, turnId, kind, itemId: kind === 'command' ? itemId : null })
+    : input.resultKey;
   const record = {
-    result_id: randomUUID(), result_key: text(input.resultKey, 'resultKey', 700) || randomUUID(),
+    result_id: randomUUID(), result_key: text(resultKey, 'resultKey', 700) || randomUUID(),
     peer, task_id: taskId, stage, status, kind, source,
-    title: text(input.title, 'title', 300, true), details: text(input.details, 'details', 64000), evidence: references,
-    command: text(input.command, 'command', 64000), diff: text(input.diff, 'diff', 64000),
-    executor_id: text(input.executorId, 'executorId', 512) || null,
-    thread_id: text(input.threadId, 'threadId', 512) || null,
-    turn_id: text(input.turnId, 'turnId', 512) || null,
-    item_id: text(input.itemId, 'itemId', 512) || null,
+    title: automatic ? (kind === 'command' ? 'Command execution' : 'Turn changes awaiting review')
+      : text(input.title, 'title', 300, true),
+    details: automatic ? '' : text(input.details, 'details', 64000),
+    evidence: automatic ? [] : references,
+    command: automatic ? '' : text(input.command, 'command', 64000),
+    diff: automatic ? '' : text(input.diff, 'diff', 64000),
+    executor_id: executorId, thread_id: threadId, turn_id: turnId, item_id: itemId,
     exit_code: Number.isSafeInteger(input.exitCode) ? input.exitCode : null,
     created_at: now()
   };
@@ -55,8 +70,10 @@ export function recordTaskResult(db, input, { now = () => Math.floor(Date.now()
       AND task_id = ? AND actor = ? AND json_valid(payload) AND json_extract(payload, '$.result_key') = ?
       ORDER BY id DESC LIMIT 1`).get(RESULT_EVENT, taskId, peer, record.result_key);
     if (previous) return { ...JSON.parse(previous.payload), id: previous.id, created_at: previous.created_at };
-    record.task_title = task.title;
-    record.task_status = task.status;
+    if (!automatic) {
+      record.task_title = task.title;
+      record.task_status = task.status;
+    }
     if (addEvent) addEvent(db, RESULT_EVENT, peer, taskId, record);
     else db.prepare('INSERT INTO events(type,actor,task_id,payload,created_at) VALUES(?,?,?,?,?)')
       .run(RESULT_EVENT, peer, taskId, JSON.stringify(record), record.created_at);