@logicseek/hello-cc 1.0.2 → 1.1.0-rc.1

package/lib/runtime/state.mjs

@@ -5,6 +5,8 @@ import { compareProcessIdentity, inspectProcessIdentity } from '../process/ident
 import { CliError } from '../shared/errors.mjs';
 import { withFileLock } from '../shared/file-lock.mjs';
 import { writeJsonSafe } from '../shared/json-file.mjs';
+import { readPrivateTextFile } from './private-file.mjs';
+import { resolveProjectDatabase, secureExistingProjectStateDirectory } from './project-path.mjs';
 import {
   globalRuntimePath,
   runtimePath
@@ -196,9 +198,10 @@ function runtimeMetadataMatchesPointer(runtime, metadata) {
 
 export function readGlobalRuntimeFile() {
   const file = globalRuntimePath();
-  if (!fs.existsSync(file)) return null;
+  const raw = readPrivateTextFile(file);
+  if (raw === null) return null;
   try {
-    return JSON.parse(fs.readFileSync(file, 'utf8'));
+    return JSON.parse(raw);
   } catch {
     // Do not delete on a parse failure: a torn/partial write must not orphan a
     // healthy runtime pointer. Leave it for health probing / restart to reclaim.
@@ -213,6 +216,8 @@ export function writeGlobalRuntime(runtime) {
 }
 
 export function writeRuntime(ctx, runtime) {
+  // Path derivation alone does not validate the root-to-private-store binding.
+  resolveProjectDatabase({ root: ctx.root, createStateDir: true });
   const file = runtimePath(ctx);
   withFileLock(file, (lockedFile) => writeJsonSafe(lockedFile, runtime, { mode: 0o600 }));
   return file;
@@ -231,10 +236,12 @@ export function readRuntime(ctx, opts = {}) {
       source: 'env'
     };
   }
+  secureExistingProjectStateDirectory(ctx.root);
   const file = runtimePath(ctx);
-  if (fs.existsSync(file)) {
+  const raw = readPrivateTextFile(file);
+  if (raw !== null) {
     try {
-      const runtime = JSON.parse(fs.readFileSync(file, 'utf8'));
+      const runtime = JSON.parse(raw);
       if (!runtime.base_url) throw new Error('missing base_url');
       if (!runtimePointerMatchesCurrentProcess(runtime, { inspect: inspectRuntimeProcessIdentity })) {
         throw new Error('runtime process identity does not match');
@@ -260,9 +267,10 @@ export function readRuntime(ctx, opts = {}) {
 }
 
 export function readRuntimeFile(ctx) {
+  secureExistingProjectStateDirectory(ctx.root);
   const file = runtimePath(ctx);
-  if (!fs.existsSync(file)) return null;
-  return JSON.parse(fs.readFileSync(file, 'utf8'));
+  const raw = readPrivateTextFile(file);
+  return raw === null ? null : JSON.parse(raw);
 }
 
 export async function probeRuntime(runtime) {
@@ -303,12 +311,14 @@ export async function readHealthyGlobalRuntime() {
 }
 
 export function clearRuntime(ctx, pid = process.pid) {
-  const file = runtimePath(ctx);
   try {
+    secureExistingProjectStateDirectory(ctx.root);
+    const file = runtimePath(ctx);
     withFileLock(file, (lockedFile) => {
-      if (!fs.existsSync(lockedFile)) return;
+      const raw = readPrivateTextFile(lockedFile);
+      if (raw === null) return;
       try {
-        const runtime = JSON.parse(fs.readFileSync(lockedFile, 'utf8'));
+        const runtime = JSON.parse(raw);
         if (runtime.pid === pid) fs.rmSync(lockedFile, { force: true });
       } catch {
         // Leave an unparseable pointer in place: only remove when we can confirm
@@ -319,9 +329,10 @@ export function clearRuntime(ctx, pid = process.pid) {
   const globalFile = globalRuntimePath();
   try {
     withFileLock(globalFile, (lockedFile) => {
-      if (!fs.existsSync(lockedFile)) return;
+      const raw = readPrivateTextFile(lockedFile);
+      if (raw === null) return;
       try {
-        const runtime = JSON.parse(fs.readFileSync(lockedFile, 'utf8'));
+        const runtime = JSON.parse(raw);
         if (runtime.pid === pid) fs.rmSync(lockedFile, { force: true });
       } catch {
         // Same as above: do not blind-delete a torn global runtime pointer.

package/lib/shared/automatic-result-key.mjs

@@ -0,0 +1,6 @@
+import { createHash } from 'node:crypto';
+
+export function automaticResultKey({ executorId, threadId, turnId, kind, itemId = null }) {
+  const identity = [executorId, threadId, turnId, kind, itemId];
+  return `automatic:${kind}:${createHash('sha256').update(JSON.stringify(identity)).digest('hex')}`;
+}

package/lib/shared/json-file.mjs

@@ -1,3 +1,4 @@
+import { randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -8,11 +9,59 @@ export function readJsonSafe(filePath) {
 
 export function writeJsonSafe(filePath, data, opts = {}) {
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  const tmpPath = filePath + '.tmp.' + process.pid;
-  const writeOpts = opts.mode !== undefined ? { mode: opts.mode } : undefined;
-  fs.writeFileSync(tmpPath, JSON.stringify(data, null, 2) + '\n', writeOpts);
-  fs.renameSync(tmpPath, filePath);
-  if (opts.mode !== undefined) {
-    try { fs.chmodSync(filePath, opts.mode); } catch {}
+  const tmpPath = `${filePath}.tmp.${process.pid}.${randomBytes(16).toString('hex')}`;
+  const contents = JSON.stringify(data, null, 2) + '\n';
+  let fd = null;
+  let opened = null;
+  let renamed = false;
+  try {
+    fd = fs.openSync(tmpPath, fs.constants.O_WRONLY | fs.constants.O_CREAT |
+      fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0), 0o600);
+    opened = fs.fstatSync(fd);
+    if (!opened.isFile() || opened.nlink !== 1 ||
+        (typeof process.geteuid === 'function' && opened.uid !== process.geteuid())) {
+      throw new Error(`unsafe JSON temporary file: ${tmpPath}`);
+    }
+    if (process.platform !== 'win32') fs.fchmodSync(fd, 0o600);
+    const privateStat = fs.fstatSync(fd);
+    if (!privateStat.isFile() || privateStat.nlink !== 1 ||
+        privateStat.dev !== opened.dev || privateStat.ino !== opened.ino ||
+        (typeof process.geteuid === 'function' && privateStat.uid !== process.geteuid()) ||
+        (process.platform !== 'win32' && (privateStat.mode & 0o777) !== 0o600)) {
+      throw new Error(`unsafe JSON temporary file: ${tmpPath}`);
+    }
+    fs.writeFileSync(fd, contents, 'utf8');
+    if (opts.mode !== undefined && opts.mode !== 0o600 && process.platform !== 'win32') {
+      fs.fchmodSync(fd, opts.mode);
+    }
+    const ready = fs.fstatSync(fd);
+    if (!ready.isFile() || ready.nlink !== 1 ||
+        ready.dev !== opened.dev || ready.ino !== opened.ino ||
+        (typeof process.geteuid === 'function' && ready.uid !== process.geteuid()) ||
+        (process.platform !== 'win32' && (ready.mode & 0o777) !== (opts.mode ?? 0o600))) {
+      throw new Error(`unsafe JSON temporary file: ${tmpPath}`);
+    }
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = null;
+    const current = fs.lstatSync(tmpPath);
+    if (!current.isFile() || current.nlink !== 1 ||
+        current.dev !== opened.dev || current.ino !== opened.ino ||
+        (typeof process.geteuid === 'function' && current.uid !== process.geteuid()) ||
+        (process.platform !== 'win32' && (current.mode & 0o777) !== (opts.mode ?? 0o600))) {
+      throw new Error(`JSON temporary file changed before rename: ${tmpPath}`);
+    }
+    fs.renameSync(tmpPath, filePath);
+    renamed = true;
+  } finally {
+    if (fd !== null) fs.closeSync(fd);
+    if (!renamed && opened) {
+      try {
+        const current = fs.lstatSync(tmpPath);
+        if (current.dev === opened.dev && current.ino === opened.ino) fs.unlinkSync(tmpPath);
+      } catch {
+        // Preserve the write failure. Any remaining temp file is private.
+      }
+    }
   }
 }

package/lib/ui/help.mjs

@@ -21,7 +21,8 @@ Commands:
   down                         Stop the running hello-cc web runtime
   update                       Update the global npm install of hello-cc
   uninstall                    Remove hooks, shims, and optional project data
-  init                         Initialize .hello-cc/mesh.db and guidance
+  init                         Initialize private managed mesh.db and guidance
+  migrate-state --offline --yes Copy stopped legacy state to private per-user storage
   register --peer ID           Register or update a peer session identity
   join --peer ID               Register this shell and print eval-able env
   env --peer ID                Print eval-able HCC_PEER/HCC_ROOT/HCC_DB exports
@@ -405,9 +406,10 @@ Usage:
 Stops the current project runtime and removes user-level hello-cc integrations:
 Claude/Codex hooks, claude/codex shims, and the shell PATH entry for shims.
 
-With --purge --yes, also removes current project data:
-  .hello-cc/
-  hello-cc blocks from CLAUDE.md and AGENTS.md
+With --purge --yes, also removes the selected managed project state directory
+(project-local for stable roots, otherwise under ~/.hello-cc/projects/) and
+hello-cc blocks from CLAUDE.md and AGENTS.md. An old directory retained by
+offline migration is not removed.
 `);
     },
 

package/lib/web/codex-app-server.mjs

@@ -1,5 +1,6 @@
 import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
+import { redactMcpUrlInteraction } from '../integrations/mcp-url-elicitation.mjs';
 import path from 'node:path';
 import { CODEX_INTERACTION_METHODS, codexInteractionKind, codexInteractionResponse, cancelCodexInteraction, codexInteractiveConfig } from '../integrations/codex-interactions.mjs';
 
@@ -10,6 +11,7 @@ const APPROVAL_METHODS = CODEX_INTERACTION_METHODS;
 const TERMINAL_TURNS = new Set(['completed', 'interrupted', 'failed']);
 const MAX_LINE_BYTES = 8 * 1024 * 1024;
 const MAX_TEXT = 65536;
+const STREAM_UPDATE_MS = 50;
 
 export class CodexAppServerError extends Error {
   constructor(code, message, extra = {}) {
@@ -70,6 +72,8 @@ export function createCodexAppServer({
   let buffer = '';
   let truncated = false;
   let closePromise = null;
+  let streamTimer = null;
+  let streamEvent = null;
   const threads = new Map();
   const pending = new Map();
   const approvals = new Map();
@@ -111,11 +115,26 @@ export function createCodexAppServer({
     });
   }
 
+  function publishChange(event) {
+    clearTimeout(streamTimer); streamTimer = null; streamEvent = null;
+    try { onChange(snapshot(), structuredClone(event)); } catch { /* UI observers do not own transport. */ }
+  }
+
   function changed(method, params = {}) {
-    const event = { method, params: bounded(params, 8192), at: Date.now() };
+    const event = { method, params: bounded(redactMcpUrlInteraction(params), 8192), at: Date.now() };
     events.push(event);
     if (events.length > 100) events.shift();
-    try { onChange(snapshot(), structuredClone(event)); } catch { /* UI observers do not own transport. */ }
+    // Keep protocol state current on every token, but copy/broadcast its complete
+    // retained history at most once per interval during a text-only burst.
+    // Approval, completion, error and connection changes publish immediately;
+    // their snapshot includes all pending text and cancels the trailing timer.
+    if (method === 'item/agentMessage/delta') {
+      streamEvent = event;
+      if (!streamTimer) {
+        streamTimer = setTimeout(() => publishChange(streamEvent), STREAM_UPDATE_MS);
+        streamTimer.unref?.();
+      }
+    } else publishChange(event);
   }
 
   function ensureThread(id) {
@@ -315,7 +334,8 @@ export function createCodexAppServer({
     if (approvals.has(key)) throw new CodexAppServerError('CODEX_PROTOCOL_ERROR', 'server reused an unresolved request id');
     if (approvals.size >= 64) throw new CodexAppServerError('CODEX_PROTOCOL_ERROR', 'too many unresolved approvals');
     thread.activeTurnId = turnId;
-    thread.status = { type: 'active', activeFlags: [codexInteractionKind(message.method) === 'userInput' ? 'waitingOnUserInput' : 'waitingOnApproval'] };
+    const inputRequired = codexInteractionKind(message.method) === 'userInput' || (message.method === 'mcpServer/elicitation/request' && params.mode === 'form' && Object.keys(params.requestedSchema?.properties || {}).length > 0);
+    thread.status = { type: 'active', activeFlags: [inputRequired ? 'waitingOnUserInput' : 'waitingOnApproval'] };
     const preview = bounded(params);
     approvals.set(key, {
       executorId, requestId: message.id, threadId, turnId, itemId: params.itemId || null,
@@ -533,7 +553,7 @@ export function createCodexAppServer({
       assertActiveTurn(threadId, turnId);
       return call('turn/interrupt', { threadId, turnId }, true).then(result => { expireApprovals(threadId, turnId); changed('approval.expired', { threadId, turnId }); return result; });
     },
-    async approve({ executorId: submittedExecutorId, threadId, turnId, requestId, decision, permissions, scope, answers } = {}) {
+    async approve({ executorId: submittedExecutorId, threadId, turnId, requestId, decision, permissions, scope, answers, content } = {}) {
       if (submittedExecutorId !== executorId) throw new CodexAppServerError('CODEX_APPROVAL_MISMATCH', 'approval identity or decision is invalid');
       assertActiveTurn(threadId, turnId);
       const approval = approvals.get(rpcKey(requestId));
@@ -543,13 +563,14 @@ export function createCodexAppServer({
       if (approval.truncated && decision === 'accept') {
         throw new CodexAppServerError('CODEX_APPROVAL_TRUNCATED', 'approval details exceed the preview limit; decline or cancel instead');
       }
-      const result = codexInteractionResponse({ ...approval, kind: approval.kind || codexInteractionKind(approval.method) }, { decision, permissions, scope, answers });
+      const result = codexInteractionResponse({ ...approval, kind: approval.kind || codexInteractionKind(approval.method) }, { decision, permissions, scope, answers, content });
       await initialize();
       // No await between checking a live request and replying to its exact RPC id.
       assertActiveTurn(threadId, turnId);
       if (approvals.get(rpcKey(requestId)) !== approval) throw new CodexAppServerError('CODEX_APPROVAL_MISMATCH', 'approval was resolved');
       write({ id: requestId, result });
       approval.status = 'submitted';
+      approval.params = redactMcpUrlInteraction(approval).params;
       changed('approval.submitted', { executorId, threadId, turnId, requestId, decision });
       return { executorId, threadId, turnId, requestId, decision, status: 'submitted' };
     }

package/lib/web/codex-sessions.mjs

@@ -80,8 +80,9 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
         peer: id, executorId, ownerIdentity,
         binding: { transport: 'app-server', runtimeSessionId: id } });
       return { mcp_servers: { hello_cc_scoped: session.mcpCapability.config } };
-    }, onChange(state) {
-      broadcast(session, { type: 'codex_state', state });
+    }, onChange(state, event) {
+      session.executorId ||= state.executorId;
+      broadcast(session, { type: 'codex_state', state }, event);
       if (state.status === 'disconnected' && !closeScheduled) {
         closeScheduled = true;
         queueMicrotask(() => { if (adapter) void adapter.close(); });
@@ -114,6 +115,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
         throw new CliError('CODEX_DISCONNECTED', 'Executor disconnected while opening its thread; no session was registered');
       }
       session.pid = executorState.pid || null;
+      session.executorId = executorState.executorId;
       const save = connectWebProject(pctx);
       try {
         tx(save, () => {
@@ -158,7 +160,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     if (action === 'interrupt') return adapter.interrupt(threadId, String(input.turnId || ''));
     if (action === 'approve') return adapter.approve({ executorId: input.executorId,
       threadId, turnId: input.turnId, requestId: input.requestId, decision: input.decision,
-      permissions: input.permissions, scope: input.scope, answers: input.answers });
+      permissions: input.permissions, scope: input.scope, answers: input.answers, content: input.content });
     if (!['turn', 'steer'].includes(action)) throw new CliError('BAD_REQUEST', 'Unsupported Codex action');
     const text = String(input.text || '').trim();
     if (!text || text.length > 100000) throw new CliError('BAD_REQUEST', 'A message of 1 to 100000 characters is required');

package/lib/web/cookie-auth.mjs

@@ -99,7 +99,7 @@ export function createCookieAuth({
   }
 
   function webAuthMode(url, req) {
-    if (authOk(url, req, token)) return 'token';
+    if (authOk(url, req, token, { trustProxy, proxyOrigin })) return 'token';
     return cookieSessionOk(req) ? 'cookie' : null;
   }
 

package/lib/web/external-sessions.mjs

@@ -5,6 +5,8 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import process from 'node:process';
+import { ensurePrivateProjectBufferDirectory } from '../runtime/project-path.mjs';
 import { withBufferDirectoryLease } from '../runtime/buffer-directory-lease.mjs';
 import {
   externalBufferEvidence,
@@ -13,19 +15,50 @@ import {
   readExternalBufferMetadata
 } from '../runtime/buffer-evidence.mjs';
 import { inspectProcessIdentity } from '../process/identity.mjs';
+import { unsafeDirectoryAcl } from '../runtime/project-trust.mjs';
+
+function secureExistingBridgeFile(file) {
+  let stat;
+  try { stat = fs.lstatSync(file); }
+  catch (error) {
+    if (error?.code === 'ENOENT') return false;
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 ||
+      (typeof process.getuid === 'function' && stat.uid !== process.getuid()) ||
+      (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600) ||
+      unsafeDirectoryAcl(file, stat)) {
+    throw new Error(`Unsafe external buffer file: ${file}`);
+  }
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+  try {
+    const opened = fs.fstatSync(fd);
+    if (!opened.isFile() || opened.dev !== stat.dev || opened.ino !== stat.ino) {
+      throw new Error(`External buffer file changed: ${file}`);
+    }
+    if ((process.platform !== 'win32' && (opened.mode & 0o777) !== 0o600) ||
+        unsafeDirectoryAcl(file, opened)) {
+      throw new Error(`External buffer file lost private permissions: ${file}`);
+    }
+    const current = fs.lstatSync(file);
+    if (current.isSymbolicLink() || current.dev !== stat.dev || current.ino !== stat.ino) {
+      throw new Error(`External buffer file changed: ${file}`);
+    }
+    return true;
+  } finally { fs.closeSync(fd); }
+}
 
 export function createExternalSessions(deps) {
   const {
     ctx, sessions,
     sessionKey, broadcast,
     now, tx, connectWebProject,
-    bufferDirectory, runtimeProjectContexts,
+    runtimeProjectContexts,
     refreshPeerIoHeartbeat, redactedLogText, BUFS_DIR_NAME
   } = deps;
 
   // ── Optional external buffer-file session adoption ───────────────────────
-  const bufsDir = path.join(ctx.root, '.hello-cc', BUFS_DIR_NAME);
-  fs.mkdirSync(bufsDir, { recursive: true });
+  const bufsDir = ensurePrivateProjectBufferDirectory(ctx.root, BUFS_DIR_NAME);
 
   function removeExternalBufferFiles(id, directory = bufsDir) {
     for (const suffix of ['out', 'in', 'resize', 'meta']) {
@@ -34,6 +67,15 @@ export function createExternalSessions(deps) {
   }
 
   function adoptExternalSession(id, pctx = ctx, directory = bufsDir) {
+    let privateDirectory;
+    let suppliedDirectory;
+    try {
+      privateDirectory = ensurePrivateProjectBufferDirectory(pctx.root, BUFS_DIR_NAME, { create: false });
+      suppliedDirectory = fs.realpathSync.native(directory);
+    }
+    catch { return; }
+    if (!privateDirectory || suppliedDirectory !== privateDirectory) return;
+    directory = privateDirectory;
     const key = sessionKey(pctx, id);
     if (sessions.has(key)) return;
     const outFile  = path.join(directory, `${id}.out`);
@@ -44,6 +86,9 @@ export function createExternalSessions(deps) {
     try {
       adopted = withBufferDirectoryLease(directory, () => {
         if (!fs.existsSync(outFile) || !fs.existsSync(metaFile)) return null;
+        for (const file of [outFile, inFile, resizeFile, metaFile]) {
+          secureExistingBridgeFile(file);
+        }
         let meta;
         try { meta = readExternalBufferMetadata(metaFile); } catch { return null; }
         // The producer publishes wrapper evidence before the PTY child identity
@@ -211,7 +256,10 @@ export function createExternalSessions(deps) {
   // Adopt any already-running external sessions
   function scanExternalSessions() {
     for (const projectCtx of runtimeProjectContexts()) {
-      const directory = bufferDirectory(projectCtx);
+      let directory;
+      try { directory = ensurePrivateProjectBufferDirectory(projectCtx.root, BUFS_DIR_NAME, { create: false }); }
+      catch { continue; }
+      if (!directory) continue;
       for (const id of externalBufferSessionIds(directory)) {
         adoptExternalSession(id, projectCtx, directory);
       }
@@ -230,8 +278,9 @@ export function createExternalSessions(deps) {
     for (const projectCtx of runtimeProjectContexts()) {
       const root = path.resolve(projectCtx.root);
       if (bufsWatchers.has(root)) continue;
-      const directory = bufferDirectory(projectCtx);
       try {
+        const directory = ensurePrivateProjectBufferDirectory(projectCtx.root, BUFS_DIR_NAME, { create: false });
+        if (!directory) continue;
         const watcher = fs.watch(directory, { persistent: false }, (event, filename) => {
           if (filename?.endsWith('.out')) {
             setTimeout(() => adoptExternalSession(path.basename(filename, '.out'), projectCtx, directory), 300);

package/lib/web/http-routes.mjs

@@ -2,17 +2,17 @@
 // The single handleWebRequest dispatcher: auth/cookie exchange, static UI,
 // projects, sessions, peers, tmux/buffer-GC endpoints, and the status APIs.
 
-import path from 'node:path';
 import process from 'node:process';
 import { URL } from 'node:url';
 import { publicCliFailure, CliError } from '../shared/errors.mjs';
 import { required } from '../cli-args.mjs';
-import { packageRoot } from '../cli-runtime.mjs';
+import { terminalAssetPath } from './terminal-assets.mjs';
 import { projectRecord } from '../runtime/projects.mjs';
+import { projectDbPath } from '../runtime/paths.mjs';
 import { writeRuntime } from '../runtime/state.mjs';
 import { normalizeStateResources } from '../ui/state-render.mjs';
 import { requestUrl, runtimeBaseUrl } from '../web/runtime.mjs';
-import { authOk, readJsonRequest, requestMatchesProxyOrigin, requestOriginMatches, sendFile, sendJson, tokenMatches } from '../web/http.mjs';
+import { authOk, readJsonRequest, requestMatchesProxyOrigin, requestOriginMatches, sendFile, sendJson, tokenMatches, tokenlessRequestAllowed } from '../web/http.mjs';
 import { API_VERSION, apiVersionUnsupportedBody, readHttpApiVersion } from '../web/api-version.mjs';
 import { isDshHookBinding } from '../core/peers/bindings.mjs';
 import { writeAdoptionState } from './adoption-state.mjs';
@@ -48,8 +48,12 @@ export function createHttpRoutes(deps) {
   }
 
   const handleWebRequest = async (req, res) => {
-    const url = requestUrl(req);
     try {
+      const url = requestUrl(req);
+      if (!token && !tokenlessRequestAllowed(req, { trustProxy, proxyOrigin })) {
+        sendJson(res, 403, { ok: false, error: { code: 'UNTRUSTED_HOST', message: 'Tokenless access requires a trusted local Host' } });
+        return;
+      }
       if (req.method === 'GET' && url.pathname === '/') {
         const accept = req.headers.accept || '';
         const isBrowserNav = req.headers['sec-fetch-mode'] === 'navigate' || accept.includes('text/html');
@@ -85,19 +89,19 @@ export function createHttpRoutes(deps) {
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/xterm.js') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'xterm', 'lib', 'xterm.js'), 'application/javascript; charset=utf-8');
+        sendFile(res, terminalAssetPath('xterm.js'), 'application/javascript; charset=utf-8');
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/xterm.css') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'xterm', 'css', 'xterm.css'), 'text/css; charset=utf-8');
+        sendFile(res, terminalAssetPath('xterm.css'), 'text/css; charset=utf-8');
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/addon-fit.js') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'addon-fit', 'lib', 'addon-fit.js'), 'application/javascript; charset=utf-8');
+        sendFile(res, terminalAssetPath('addon-fit.js'), 'application/javascript; charset=utf-8');
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/addon-search.js') {
-        sendFile(res, path.join(packageRoot(), 'node_modules', '@xterm', 'addon-search', 'lib', 'addon-search.js'), 'application/javascript; charset=utf-8');
+        sendFile(res, terminalAssetPath('addon-search.js'), 'application/javascript; charset=utf-8');
         return;
       }
       if (req.method === 'POST' && url.pathname === '/login') {
@@ -163,7 +167,7 @@ export function createHttpRoutes(deps) {
         const requestedRoot = input.root || reqCtx.root;
         const projectCtx = rememberProject(resolveWebProjectContext(
           requestedRoot,
-          input.db || path.join(requestedRoot, '.hello-cc', 'mesh.db')
+          input.db || projectDbPath(requestedRoot)
         ), { register: true, nonblocking: true });
         const db = connectWebProject(projectCtx);
         db.close();

package/lib/web/http.mjs

@@ -84,6 +84,24 @@ export function isLoopbackRemote(req) {
   return addr === '::1' || addr.startsWith('127.') || addr.startsWith('::ffff:127.');
 }
 
+function localHostAuthority(req) {
+  const host = req?.headers?.host;
+  if (typeof host !== 'string') return false;
+  const match = /^(?:localhost|127\.0\.0\.1|\[::1\])(?::(\d{1,5}))?$/i.exec(host);
+  if (!match) return false;
+  return !match[1] || (Number(match[1]) > 0 && Number(match[1]) <= 65535);
+}
+
+export function tokenlessRequestAllowed(req, options = {}) {
+  if (!isLoopbackRemote(req)) return false;
+  if (localHostAuthority(req)) return true;
+  if (!options.trustProxy || !requestMatchesProxyOrigin(req, options)) return false;
+  const expected = normalizedProxyOrigin(options.proxyOrigin);
+  const actual = normalizedOriginAuthority(req?.headers?.host, expected?.protocol);
+  return Boolean(expected && actual && actual.hostname === expected.authority.hostname &&
+    actual.port === expected.authority.port);
+}
+
 export function tokenMatches(provided, expected) {
   if (!provided || !expected || provided.length !== expected.length) return false;
   try {
@@ -174,10 +192,10 @@ export function requestOriginMatches(req, options = {}) {
   }
 }
 
-export function authOk(url, req, token) {
+export function authOk(url, req, token, options = {}) {
   // No token configured: only trust loopback clients. A tokenless runtime is
   // refused on non-loopback binds at startup, so this is defense-in-depth.
-  if (!token) return isLoopbackRemote(req);
+  if (!token) return tokenlessRequestAllowed(req, options);
   // v1-token-query-csrf-bypass: the query token is accepted ONLY on the cookie
   // exchange paths (the console page and the login endpoint). Everywhere else
   // — including all API routes and the WS upgrade — a leaked ?token= URL must

package/lib/web/native-sessions.mjs

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 import { CliError } from '../shared/errors.mjs';
 import { redactSecrets } from '../shared/redact.mjs';
 import { tx } from '../db/schema.mjs';
@@ -29,10 +30,17 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
     return redactSecrets({ code: error.code || 'NATIVE_RUNTIME_OFFLINE',
       message: error.message || 'Native runtime is disconnected' });
   }
+  function publishState(session, state) {
+    // Event cursors do not cover approvals, delivery receipts or capabilities.
+    // Compare the complete normalized state; validation and lease revocation
+    // still run on every read, including reads that need no new UI frame.
+    const changed = !isDeepStrictEqual(session.nativeState, state);
+    session.nativeState = state;
+    if (changed) broadcast(session, { type: 'native_state', state: session.nativeSnapshot() });
+  }
   function disconnect(session, error, retire = false) {
     session.status = 'disconnected';
-    session.nativeState = { ...session.nativeState, connected: false, status: 'disconnected', error: errorInfo(error) };
-    broadcast(session, { type: 'native_state', state: session.nativeSnapshot() });
+    publishState(session, { ...session.nativeState, connected: false, status: 'disconnected', error: errorInfo(error) });
     if (retire && !session.nativeRetired) {
       session.nativeRetired = true;
       closeSessionClients(session);
@@ -100,7 +108,7 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
     const turnId = value.snapshot.turnId || value.snapshot.activeTurnId || value.active_delivery?.turn_id || null;
     session.binding = binding;
     session.cwd = value.cwd;
-    session.nativeState = redactSecrets({ backend: 'native', connected: true, root: value.root,
+    const state = redactSecrets({ backend: 'native', connected: true, root: value.root,
       peer: value.peer, provider: value.provider, generation: value.generation, owner: value.owner,
       executorId: value.owner, sessionId: value.snapshot.sessionId || null, turnId,
       status: value.snapshot.status, cwd: value.cwd, capabilities: value.snapshot.capabilities || {}, pendingApprovals: value.snapshot.pendingApprovals || [],
@@ -111,7 +119,7 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
     session.status = CLOSED.has(value.snapshot.status) ? 'exited'
       : value.snapshot.status === 'disconnected' ? 'disconnected' : 'running';
     if (session.status === 'exited') session.exitedAt = now();
-    broadcast(session, { type: 'native_state', state: session.nativeSnapshot() });
+    publishState(session, state);
     return session.nativeSnapshot();
   }
   function makeSession(ctx, checked) {
@@ -249,7 +257,7 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
         ...identity, ...(action === 'send' ? { from: 'web', body: text, submissionId }
           : action === 'interrupt' ? { turnId: input.turnId || session.nativeState.turnId || undefined }
           : action === 'respond' ? { executorId: input.executorId, requestId: input.requestId, turnId: input.turnId,
-            decision: input.decision, permissions: input.permissions, scope: input.scope, answers: input.answers } : {})
+            decision: input.decision, permissions: input.permissions, scope: input.scope, answers: input.answers, content: input.content } : {})
       });
       if (action === 'send') {
         if (!Number.isSafeInteger(result?.message_id) || result.submission_id !== submissionId || typeof result.state !== 'string') {
@@ -261,8 +269,7 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
       if (action === 'respond') { await readState(session); current(session); }
       if (action === 'close') {
         session.status = 'exited'; session.exitedAt = now();
-        session.nativeState = { ...session.nativeState, connected: false, status: 'closed', closing: false };
-        broadcast(session, { type: 'native_state', state: session.nativeSnapshot() });
+        publishState(session, { ...session.nativeState, connected: false, status: 'closed', closing: false });
         closeSessionClients(session);
         session.actionTokens.clear();
       }