@logicseek/hello-cc 1.0.5 → 1.1.0-rc.3

package/lib/web/codex-sessions.mjs

@@ -8,15 +8,32 @@ import { childSessionEnv } from '../core/sessions/launch.mjs';
 import { createCodexAppServer } from './codex-app-server.mjs';
 import { waitForLiveProcessIdentity } from '../process/identity.mjs';
 import { createScopedMcpConfig } from '../mcp/scope.mjs';
+import { sameSelectedCwdIdentity } from '../process/selected-cwd-identity.mjs';
 
 // Each structured session owns one executor. Existing TUI sessions are never
 // silently resumed here: provider identity and live-owner evidence fence that.
 export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId,
   connectWebProject, upsertPeer, upsertCanonicalPeerBinding, observePeerEvidence,
   broadcast, closeSessionClients, now, addEvent, adapterFactory = createCodexAppServer,
-  waitForOwnerIdentity = waitForLiveProcessIdentity, mcpConfigFactory = createScopedMcpConfig }) {
+  waitForOwnerIdentity = waitForLiveProcessIdentity, mcpConfigFactory = createScopedMcpConfig,
+  isStopping = () => false }) {
   const startingThreads = new Set();
 
+  function assertSelectedProject(pctx) {
+    if (isStopping()) throw new CliError('RUNTIME_STOPPING', 'Web runtime is stopping');
+    pctx.rootIdentity?.assertUnchanged();
+  }
+
+  function managedSessionMatchesProject(session, pctx) {
+    if (session.root !== pctx.root ||
+        (session.ctx?.dbPath && pctx.dbPath && path.resolve(session.ctx.dbPath) !== path.resolve(pctx.dbPath))) return false;
+    const owner = session.ctx?.rootIdentity;
+    const requested = pctx.rootIdentity;
+    return owner || requested
+      ? Boolean(owner && requested && sameSelectedCwdIdentity(owner, requested))
+      : true;
+  }
+
   function event(session, type, payload) {
     const db = connectWebProject(session.ctx);
     try { addEvent(db, type, session.peerId, null, payload); } finally { db.close(); }
@@ -28,6 +45,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       throw new CliError('BAD_REQUEST', 'App Server uses the local Codex executable and runtime environment');
     }
     const pctx = input.projectCtx;
+    assertSelectedProject(pctx);
     const cwd = pctx.root;
     const mode = input.mode || 'new';
     if (!['new', 'resume'].includes(mode)) throw new CliError('BAD_REQUEST', 'App Server supports new or explicit resume');
@@ -70,19 +88,21 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     let closeScheduled = false;
     let adapter;
     let ownerIdentity = null;
-    try { adapter = adapterFactory({ cwd, env: childSessionEnv({
+    try { adapter = adapterFactory({ cwd, expectedCwdIdentity: pctx.rootIdentity || pctx.initialRootIdentity,
+      changeView: true, env: childSessionEnv({
       HCC_PEER: id, HCC_ROOT: pctx.root, HCC_DB: pctx.dbPath, HCC_SHIM_NO_ATTACH: '1'
-    }, process.env), async onSpawn({ pid, executorId }) {
+    }, process.env, { rootIdentity: pctx.rootIdentity || pctx.initialRootIdentity }), async onSpawn({ pid, executorId }) {
       const owner = await waitForOwnerIdentity(pid);
       if (owner.state !== 'live' || !owner.identity) throw new CliError('CODEX_OWNER_IDENTITY_UNKNOWN', 'Executor ownership could not be verified');
+      assertSelectedProject(pctx);
       ownerIdentity = owner.identity;
       session.mcpCapability = mcpConfigFactory({ root: pctx.root, dbPath: pctx.dbPath,
         peer: id, executorId, ownerIdentity,
         binding: { transport: 'app-server', runtimeSessionId: id } });
       return { mcp_servers: { hello_cc_scoped: session.mcpCapability.config } };
-    }, onChange(state) {
+    }, onChange(state, event, metadata) {
       session.executorId ||= state.executorId;
-      broadcast(session, { type: 'codex_state', state });
+      broadcast(session, { type: 'codex_state', state }, event, metadata);
       if (state.status === 'disconnected' && !closeScheduled) {
         closeScheduled = true;
         queueMicrotask(() => { if (adapter) void adapter.close(); });
@@ -90,6 +110,8 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       if (!registered) return;
       const ended = ['disconnected', 'closed'].includes(state.status);
       if (ended) { session.status = 'exited'; session.exitedAt = now(); session.mcpCapability?.dispose(); }
+      if (!ended && session.lastHeartbeatWrite === now()) return;
+      session.lastHeartbeatWrite = now();
       const update = connectWebProject(pctx);
       try {
         if (ended) update.prepare("UPDATE peers SET status = 'exited' WHERE id = ?").run(session.peerId);
@@ -106,7 +128,9 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
         const source = await adapter.peekThread(threadId);
         assertProjectThread(pctx, source.thread, threadId);
       }
+      assertSelectedProject(pctx);
       const response = threadId ? await adapter.resumeThread(threadId, params) : await adapter.startThread(params);
+      assertSelectedProject(pctx);
       const thread = response.thread;
       if (!thread?.id) throw new CliError('CODEX_PROTOCOL_ERROR', 'App Server returned no thread identity');
       if (threadId && thread.id !== threadId) throw new CliError('CODEX_PROTOCOL_ERROR', 'Resumed thread identity changed');
@@ -118,6 +142,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       session.executorId = executorState.executorId;
       const save = connectWebProject(pctx);
       try {
+        assertSelectedProject(pctx);
         tx(save, () => {
           const owners = save.prepare(`SELECT p.*, b.transport, b.runtime_target FROM peer_bindings b
             JOIN peers p ON p.id = b.peer WHERE b.provider = 'codex' AND b.provider_session_id = ?`).all(thread.id);
@@ -154,13 +179,18 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     if (session.type !== 'app-server' || session.status !== 'running') {
       throw new CliError('SESSION_NOT_RUNNING', 'A running App Server session is required');
     }
+    assertSelectedProject(session.ctx);
     const adapter = session.adapter;
     const threadId = session.binding.provider_session_id;
     if (action === 'read') return adapter.readThread(threadId, { includeTurns: true });
+    if (action === 'account') {
+      if (input.executorId !== adapter.snapshot().executorId) throw new CliError('CODEX_EXECUTOR_MISMATCH', 'Account view belongs to another executor');
+      return adapter.readAccount();
+    }
     if (action === 'interrupt') return adapter.interrupt(threadId, String(input.turnId || ''));
     if (action === 'approve') return adapter.approve({ executorId: input.executorId,
       threadId, turnId: input.turnId, requestId: input.requestId, decision: input.decision,
-      permissions: input.permissions, scope: input.scope, answers: input.answers });
+      permissions: input.permissions, scope: input.scope, answers: input.answers, content: input.content });
     if (!['turn', 'steer'].includes(action)) throw new CliError('BAD_REQUEST', 'Unsupported Codex action');
     const text = String(input.text || '').trim();
     if (!text || text.length > 100000) throw new CliError('BAD_REQUEST', 'A message of 1 to 100000 characters is required');
@@ -204,8 +234,10 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     closeSessionClients(session);
   }
   function assertProjectThread(pctx, thread, expectedId = null) {
+    assertSelectedProject(pctx);
     let matches = false;
     try { matches = typeof thread?.cwd === 'string' && fs.realpathSync(thread.cwd) === fs.realpathSync(pctx.root); } catch {}
+    assertSelectedProject(pctx);
     if (!matches || typeof thread?.id !== 'string' || (expectedId && thread.id !== expectedId)) {
       throw new CliError('PROJECT_PATH_FORBIDDEN', 'Codex thread does not belong to this project');
     }
@@ -220,12 +252,22 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
   }
 
   async function withHistoryAdapter(pctx, action, fresh = false) {
+    assertSelectedProject(pctx);
     const managed = !fresh && [...sessions.values()].find(session => session.type === 'app-server' &&
-      session.root === pctx.root && session.status === 'running' && session.adapter.snapshot().status === 'ready');
-    if (managed) return action(managed.adapter);
+      managedSessionMatchesProject(session, pctx) && session.status === 'running' && session.adapter.snapshot().status === 'ready');
+    if (managed) {
+      const result = await action(managed.adapter);
+      assertSelectedProject(pctx);
+      return result;
+    }
     const adapter = adapterFactory({ cwd: pctx.root,
-      env: childSessionEnv({ HCC_ROOT: pctx.root, HCC_DB: pctx.dbPath, HCC_SHIM_NO_ATTACH: '1' }, process.env) });
-    try { return await action(adapter); } finally {
+      env: childSessionEnv({ HCC_ROOT: pctx.root, HCC_DB: pctx.dbPath, HCC_SHIM_NO_ATTACH: '1' },
+        process.env, { rootIdentity: pctx.rootIdentity || pctx.initialRootIdentity }) });
+    try {
+      const result = await action(adapter);
+      assertSelectedProject(pctx);
+      return result;
+    } finally {
       await adapter.close();
       const state = adapter.snapshot();
       if (state.pid && !state.processExited) {
@@ -240,13 +282,19 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       throw new CliError('BAD_REQUEST', 'History limit must be 1 to 100 and cursor must be bounded text');
     }
     const result = await withHistoryAdapter(pctx, adapter => adapter.listThreads({ cwd: pctx.root, limit, cursor }));
+    assertSelectedProject(pctx);
     const threads = (result.data || []).filter(thread => {
-      try { assertProjectThread(pctx, thread); return true; } catch { return false; }
+      try { assertProjectThread(pctx, thread); return true; }
+      catch (error) {
+        if (error?.code === 'PROJECT_PATH_CHANGED') throw error;
+        return false;
+      }
     }).map(thread => {
-      const managed = [...sessions.values()].find(session => session.root === pctx.root &&
+      const managed = [...sessions.values()].find(session => managedSessionMatchesProject(session, pctx) &&
         session.binding?.provider_session_id === thread.id && session.status === 'running');
       return { ...thread, managedSessionId: managed?.id || null };
     });
+    assertSelectedProject(pctx);
     return { threads, nextCursor: result.nextCursor || null };
   }
 
@@ -270,6 +318,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     const result = await withHistoryAdapter(pctx, async adapter => {
       const source = await adapter.peekThread(threadId);
       assertProjectThread(pctx, source.thread, threadId);
+      assertSelectedProject(pctx);
       const forked = await adapter.forkThread(threadId, input.lastTurnId ? { lastTurnId: input.lastTurnId } : {}, input.authorizeMutation);
       assertProjectThread(pctx, forked.thread);
       if (forked.thread.id === threadId) throw new CliError('CODEX_PROTOCOL_ERROR', 'Fork did not create a new thread');

package/lib/web/context-files.mjs

@@ -0,0 +1,82 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { CliError } from '../shared/errors.mjs';
+
+const ignored = new Set(['.git', 'node_modules', '.hcc', '.hello-cc', '.codex', '.claude', '.dsh', '.ssh', '.aws', 'dist', 'build', 'coverage', '.next']);
+const ignoredName = name => ignored.has(name) || name === '.env' || name.startsWith('.env.');
+
+function assertBoundRoot(rootIdentity, stat = null) {
+  if (!rootIdentity) return;
+  rootIdentity.assertUnchanged();
+  if (stat && (rootIdentity.identity.dev !== stat.dev.toString() ||
+      rootIdentity.identity.ino !== stat.ino.toString() ||
+      rootIdentity.identity.birthtimeNs !== (stat.birthtimeNs?.toString() || null))) {
+    throw new CliError('PROJECT_PATH_CHANGED', 'Selected project directory changed; select its current location again');
+  }
+}
+
+async function exactContextFile(base, query, rootIdentity) {
+  const parts = query.split('/');
+  if (!query || parts.some(part => !part || part === '.' || ignoredName(part))) return null;
+  let directory = base;
+  try {
+    for (let index = 0; index < parts.length; index++) {
+      assertBoundRoot(rootIdentity);
+      const target = path.join(directory, parts[index]), stat = await fs.lstat(target);
+      if (stat.isSymbolicLink() || (index < parts.length - 1 ? !stat.isDirectory() : !stat.isFile())) return null;
+      const resolved = await fs.realpath(target), relative = path.relative(base, resolved);
+      if (relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative) ||
+          relative.split(path.sep).some(ignoredName)) return null;
+      // Recheck the named entry after resolving it and discard any observed
+      // link or entry replacement before offering the filename.
+      const confirmed = await fs.lstat(target);
+      if (confirmed.isSymbolicLink() || confirmed.dev !== stat.dev || confirmed.ino !== stat.ino) return null;
+      directory = resolved;
+      if (index === parts.length - 1) return relative.split(path.sep).join('/');
+    }
+  } catch (error) { if (!['ENOENT', 'ENOTDIR', 'EACCES', 'EPERM'].includes(error.code)) throw error; }
+  return null;
+}
+
+/** List bounded project-relative filenames only. Never open or upload their contents. */
+export async function listContextFiles(root, query = '', { limit = 80, maxEntries = 10000, timeBudgetMs = 150, now = Date.now, rootIdentity = null } = {}) {
+  if (typeof query !== 'string' || query.length > 256 || /[\0\r\n]/.test(query) || path.isAbsolute(query) || query.includes('\\') || query.split('/').includes('..')) {
+    throw new CliError('INVALID_CONTEXT_QUERY', 'Use a project-relative filename query');
+  }
+  if (!Number.isSafeInteger(limit) || limit < 1 || !Number.isSafeInteger(maxEntries) || maxEntries < 1 || !Number.isFinite(timeBudgetMs) || timeBudgetMs < 0 || typeof now !== 'function') {
+    throw new TypeError('Invalid context file listing budget');
+  }
+  assertBoundRoot(rootIdentity);
+  const base = await fs.realpath(root), pending = [''], paths = [], needle = query.toLocaleLowerCase();
+  if (rootIdentity) assertBoundRoot(rootIdentity, await fs.lstat(base, { bigint: true }));
+  // An explicit filename remains usable even if an unrelated directory read
+  // consumes the scan budget. Keep the bounded substring scan for other hits.
+  const exact = await exactContextFile(base, query, rootIdentity);
+  if (exact) paths.push(exact);
+  let seen = 0, truncated = false;
+  const deadline = now() + timeBudgetMs;
+  outer: while (pending.length) {
+    if (now() >= deadline || seen >= maxEntries || paths.length >= limit) { truncated = true; break; }
+    assertBoundRoot(rootIdentity);
+    const relative = pending.shift(), directory = path.join(base, relative);
+    try {
+      if ((await fs.lstat(directory)).isSymbolicLink()) continue;
+      const resolved = await fs.realpath(directory), fromRoot = path.relative(base, resolved);
+      if (fromRoot === '..' || fromRoot.startsWith('..' + path.sep) || path.isAbsolute(fromRoot)) continue;
+      const handle = await fs.opendir(directory);
+      for await (const item of handle) {
+        seen++;
+        if (seen > maxEntries || now() >= deadline) { truncated = true; break outer; }
+        if (item.isSymbolicLink() || ignoredName(item.name)) continue;
+        const name = relative ? relative + '/' + item.name : item.name;
+        if (item.isDirectory()) pending.push(name);
+        else if (item.isFile() && name.toLocaleLowerCase().includes(needle) && name !== exact) {
+          paths.push(name);
+          if (paths.length >= limit) { truncated = true; break outer; }
+        }
+      }
+    } catch (error) { if (!['ENOENT', 'ENOTDIR', 'EACCES', 'EPERM'].includes(error.code)) throw error; }
+  }
+  assertBoundRoot(rootIdentity);
+  return { paths: paths.sort(), truncated };
+}

package/lib/web/cookie-auth.mjs

@@ -4,23 +4,71 @@
 
 import { randomBytes } from 'node:crypto';
 
+// Cookies are shared across ports on one hostname, while the session Map is
+// private to a runtime. Scope the name to the configured public endpoint so
+// ordinary logins to another local runtime cannot replace this runtime's SID.
+// Hostnames remain isolated by the browser's host-only cookie rules. This is
+// coexistence isolation, not an authority boundary between same-host servers.
+export function createCookieNameForRequest({ useTls = false, trustProxy = false, proxyOrigin = '' } = {}) {
+  let protocol = useTls ? 'https' : 'http';
+  let proxyPort;
+  if (trustProxy) {
+    let parsed;
+    try { parsed = new URL(proxyOrigin); } catch {}
+    if (!parsed || !['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password ||
+        parsed.pathname !== '/' || parsed.search || parsed.hash) {
+      throw new TypeError('Web cookie naming requires a valid configured proxy origin');
+    }
+    protocol = parsed.protocol.slice(0, -1);
+    proxyPort = Number(parsed.port || (protocol === 'https' ? 443 : 80));
+    if (!Number.isInteger(proxyPort) || proxyPort < 1 || proxyPort > 65535) {
+      throw new TypeError('Web cookie naming requires a valid configured proxy port');
+    }
+  } else if (proxyOrigin) {
+    throw new TypeError('Web cookie proxy origin requires trustProxy');
+  }
+  return (req) => {
+    // The socket reports the port actually bound (including --port 0 and
+    // auto-increment). Do not use Host or forwarded request headers here.
+    const port = proxyPort ?? req?.socket?.localPort;
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      throw new TypeError('Web cookie naming requires a valid listener port');
+    }
+    return `hcc_sid_v2_${protocol}_${port}`;
+  };
+}
+
 export function createCookieAuth({
   now,
   ttlSec,
   maxSessions,
+  cookieNameForRequest,
   requestIsSecure,
   trustProxy,
   proxyOrigin,
   authOk,
   token
 }) {
+  if (typeof cookieNameForRequest !== 'function') {
+    throw new TypeError('Web cookie authentication requires cookieNameForRequest');
+  }
   const webSessions = new Map();
 
+  function cookieName(req) {
+    const name = cookieNameForRequest(req);
+    if (typeof name !== 'string' || !/^hcc_sid_v2_(?:http|https)_[1-9]\d{0,4}$/.test(name) ||
+        Number(name.slice(name.lastIndexOf('_') + 1)) > 65535) {
+      throw new TypeError('Web cookie authentication requires a scoped cookie name');
+    }
+    return name;
+  }
+
   function parseCookieSid(req) {
+    const name = cookieName(req);
     const header = req.headers.cookie || '';
     for (const part of header.split(';')) {
       const [k, ...rest] = part.trim().split('=');
-      if (k === 'hcc_sid') {
+      if (k === name) {
         const raw = rest.join('=');
         if (raw.length > 128) return '';
         try { return decodeURIComponent(raw); } catch { return ''; }
@@ -57,13 +105,13 @@ export function createCookieAuth({
   }
 
   function sessionCookieHeader(sid, req) {
-    const parts = [`hcc_sid=${sid}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${ttlSec}`];
+    const parts = [`${cookieName(req)}=${sid}`, 'Path=/', 'HttpOnly', 'SameSite=Lax', `Max-Age=${ttlSec}`];
     if (requestIsSecure(req, { trustProxy, proxyOrigin })) parts.push('Secure');
     return parts.join('; ');
   }
 
   function expiredSessionCookieHeader(req) {
-    const parts = ['hcc_sid=', 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=0'];
+    const parts = [`${cookieName(req)}=`, 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=0'];
     if (requestIsSecure(req, { trustProxy, proxyOrigin })) parts.push('Secure');
     return parts.join('; ');
   }

package/lib/web/external-sessions.mjs

@@ -5,6 +5,8 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import process from 'node:process';
+import { ensurePrivateProjectBufferDirectory } from '../runtime/project-path.mjs';
 import { withBufferDirectoryLease } from '../runtime/buffer-directory-lease.mjs';
 import {
   externalBufferEvidence,
@@ -13,19 +15,59 @@ import {
   readExternalBufferMetadata
 } from '../runtime/buffer-evidence.mjs';
 import { inspectProcessIdentity } from '../process/identity.mjs';
+import { unsafeDirectoryAcl } from '../runtime/project-trust.mjs';
+
+function secureExistingBridgeFile(file) {
+  let stat;
+  try { stat = fs.lstatSync(file); }
+  catch (error) {
+    if (error?.code === 'ENOENT') return false;
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 ||
+      (typeof process.getuid === 'function' && stat.uid !== process.getuid()) ||
+      (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600) ||
+      unsafeDirectoryAcl(file, stat)) {
+    throw new Error(`Unsafe external buffer file: ${file}`);
+  }
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+  try {
+    const opened = fs.fstatSync(fd);
+    if (!opened.isFile() || opened.dev !== stat.dev || opened.ino !== stat.ino) {
+      throw new Error(`External buffer file changed: ${file}`);
+    }
+    if ((process.platform !== 'win32' && (opened.mode & 0o777) !== 0o600) ||
+        unsafeDirectoryAcl(file, opened)) {
+      throw new Error(`External buffer file lost private permissions: ${file}`);
+    }
+    const current = fs.lstatSync(file);
+    if (current.isSymbolicLink() || current.dev !== stat.dev || current.ino !== stat.ino) {
+      throw new Error(`External buffer file changed: ${file}`);
+    }
+    return true;
+  } finally { fs.closeSync(fd); }
+}
 
 export function createExternalSessions(deps) {
   const {
-    ctx, sessions,
+    ctx, sessions, isStopping = () => false,
     sessionKey, broadcast,
     now, tx, connectWebProject,
-    bufferDirectory, runtimeProjectContexts,
+    runtimeProjectContexts,
     refreshPeerIoHeartbeat, redactedLogText, BUFS_DIR_NAME
   } = deps;
 
   // ── Optional external buffer-file session adoption ───────────────────────
-  const bufsDir = path.join(ctx.root, '.hello-cc', BUFS_DIR_NAME);
-  fs.mkdirSync(bufsDir, { recursive: true });
+  const bufsDir = ensurePrivateProjectBufferDirectory(ctx.root, BUFS_DIR_NAME);
+  let stopped = false;
+  const pendingAdoptions = new Set();
+  const discoveryStopped = () => stopped || isStopping();
+
+  function stopExternalDiscovery() {
+    stopped = true;
+    for (const timer of pendingAdoptions) clearTimeout(timer);
+    pendingAdoptions.clear();
+  }
 
   function removeExternalBufferFiles(id, directory = bufsDir) {
     for (const suffix of ['out', 'in', 'resize', 'meta']) {
@@ -34,6 +76,16 @@ export function createExternalSessions(deps) {
   }
 
   function adoptExternalSession(id, pctx = ctx, directory = bufsDir) {
+    if (discoveryStopped()) return;
+    let privateDirectory;
+    let suppliedDirectory;
+    try {
+      privateDirectory = ensurePrivateProjectBufferDirectory(pctx.root, BUFS_DIR_NAME, { create: false });
+      suppliedDirectory = fs.realpathSync.native(directory);
+    }
+    catch { return; }
+    if (!privateDirectory || suppliedDirectory !== privateDirectory) return;
+    directory = privateDirectory;
     const key = sessionKey(pctx, id);
     if (sessions.has(key)) return;
     const outFile  = path.join(directory, `${id}.out`);
@@ -44,6 +96,9 @@ export function createExternalSessions(deps) {
     try {
       adopted = withBufferDirectoryLease(directory, () => {
         if (!fs.existsSync(outFile) || !fs.existsSync(metaFile)) return null;
+        for (const file of [outFile, inFile, resizeFile, metaFile]) {
+          secureExistingBridgeFile(file);
+        }
         let meta;
         try { meta = readExternalBufferMetadata(metaFile); } catch { return null; }
         // The producer publishes wrapper evidence before the PTY child identity
@@ -116,6 +171,7 @@ export function createExternalSessions(deps) {
       outputOffset = fs.fstatSync(session.outputFd).size;
     } catch {}
     session.outputPoller = setInterval(() => {
+      if (discoveryStopped()) return;
       try {
         if (session.outputFd === null) return;
         const stat = fs.fstatSync(session.outputFd);
@@ -175,6 +231,7 @@ export function createExternalSessions(deps) {
     // producer. Owner changes detach only this stale in-memory view; they never
     // mark the replacement producer exited or remove its files.
     session.exitPoller = setInterval(() => {
+      if (discoveryStopped()) return;
       try {
         withBufferDirectoryLease(directory, () => {
           const outExists = fs.existsSync(outFile);
@@ -210,8 +267,12 @@ export function createExternalSessions(deps) {
 
   // Adopt any already-running external sessions
   function scanExternalSessions() {
+    if (discoveryStopped()) return;
     for (const projectCtx of runtimeProjectContexts()) {
-      const directory = bufferDirectory(projectCtx);
+      let directory;
+      try { directory = ensurePrivateProjectBufferDirectory(projectCtx.root, BUFS_DIR_NAME, { create: false }); }
+      catch { continue; }
+      if (!directory) continue;
       for (const id of externalBufferSessionIds(directory)) {
         adoptExternalSession(id, projectCtx, directory);
       }
@@ -227,14 +288,20 @@ export function createExternalSessions(deps) {
   // scanExternalSessions get their own watcher on the next scan tick.
   const bufsWatchers = new Map();
   function ensureBufsWatchers() {
+    if (discoveryStopped()) return;
     for (const projectCtx of runtimeProjectContexts()) {
       const root = path.resolve(projectCtx.root);
       if (bufsWatchers.has(root)) continue;
-      const directory = bufferDirectory(projectCtx);
       try {
+        const directory = ensurePrivateProjectBufferDirectory(projectCtx.root, BUFS_DIR_NAME, { create: false });
+        if (!directory) continue;
         const watcher = fs.watch(directory, { persistent: false }, (event, filename) => {
-          if (filename?.endsWith('.out')) {
-            setTimeout(() => adoptExternalSession(path.basename(filename, '.out'), projectCtx, directory), 300);
+          if (!discoveryStopped() && filename?.endsWith('.out')) {
+            const timer = setTimeout(() => {
+              pendingAdoptions.delete(timer);
+              adoptExternalSession(path.basename(filename, '.out'), projectCtx, directory);
+            }, 300);
+            pendingAdoptions.add(timer);
           }
         });
         watcher.on('error', (err) => {
@@ -249,6 +316,6 @@ export function createExternalSessions(deps) {
 
   return {
     bufsWatchers, externalScanPoller, bufsWatcherSyncPoller,
-    scanExternalSessions, adoptExternalSession, removeExternalBufferFiles
+    scanExternalSessions, adoptExternalSession, removeExternalBufferFiles, stopExternalDiscovery
   };
 }