@logicseek/hello-cc 1.0.5 → 1.1.0-rc.3

package/lib/web/session-state-sync.mjs

@@ -0,0 +1,98 @@
+import { randomUUID } from 'node:crypto';
+import { applyStateOperations, SESSION_SYNC_PROTOCOL } from './browser/session-sync.mjs';
+
+export const STATE_HIGH_WATER_BYTES = 1024 * 1024;
+export const STATE_MAX_FRAME_BYTES = 16 * 1024 * 1024;
+const wireClone = value => value === undefined ? null : JSON.parse(JSON.stringify(value));
+
+/** Immutable patch construction; retained text is appended without recopying historical turns. */
+export function diffSessionState(previous, next, metadata = {}) {
+  const operations = [];
+  const set = (path, value) => operations.push({ op: 'set', path, value: wireClone(value) });
+  function diff(before, after, path) {
+    if (Object.is(before, after)) return;
+    if (typeof before === 'string' && typeof after === 'string' && after.startsWith(before)) {
+      operations.push({ op: 'append', path, value: after.slice(before.length) }); return;
+    }
+    if (!before || !after || typeof before !== 'object' || typeof after !== 'object' || Array.isArray(before) !== Array.isArray(after)) { set(path, after); return; }
+    if (Array.isArray(before)) {
+      if (before.length !== after.length) { set(path, after); return; }
+      for (let index = 0; index < before.length; index++) diff(before[index], after[index], [...path, index]);
+      return;
+    }
+    const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
+    if ([...keys].some(key => ['__proto__', 'prototype', 'constructor'].includes(key))) { set(path, after); return; }
+    for (const key of keys) {
+      if (!Object.hasOwn(after, key) || after[key] === undefined) {
+        if (Object.hasOwn(before, key)) operations.push({ op: 'delete', path: [...path, key] });
+      }
+      else if (!Object.hasOwn(before, key)) set([...path, key], after[key]);
+      else diff(before[key], after[key], [...path, key]);
+    }
+  }
+  // Adapter-supplied hints cover every delta in the 50ms batch. Validate layout
+  // identities before indexing; newly created/evicted items take the full diff.
+  const paths = [];
+  const textOnly = metadata.textOnly === true && Array.isArray(metadata.textItems) &&
+    previous?.threads?.length === next?.threads?.length && metadata.textItems.every(({ threadId, turnId, itemId }) => {
+      const ti = next.threads.findIndex(thread => thread.id === threadId), thread = next.threads[ti], oldThread = previous.threads[ti];
+      if (!thread || oldThread?.id !== threadId || oldThread.turns.length !== thread.turns.length) return false;
+      const ui = thread.turns.findIndex(turn => turn.id === turnId), turn = thread.turns[ui], oldTurn = oldThread.turns[ui];
+      if (!turn || oldTurn?.id !== turnId || turn.items.length !== oldTurn.items.length) return false;
+      const ii = turn.items.findIndex(item => item.id === itemId), item = turn.items[ii];
+      if (!item || oldTurn.items[ii]?.id !== itemId || item.type !== 'agentMessage') return false;
+      paths.push(['threads', ti, 'turns', ui, 'items', ii, 'text']); return true;
+    });
+  if (textOnly) {
+    for (const path of paths) {
+      const read = object => path.reduce((value, key) => value?.[key], object);
+      diff(read(previous), read(next), path);
+    }
+    diff(previous.truncated, next.truncated, ['truncated']);
+    diff(previous.updateSequence, next.updateSequence, ['updateSequence']);
+    const count = next.updateSequence - previous.updateSequence;
+    if (Number.isSafeInteger(count) && count > 0 && count <= 100 && Array.isArray(previous.events) && Array.isArray(next.events)) {
+      const values = wireClone(next.events.slice(-count));
+      operations.push({ op: 'splice', path: ['events'], start: 0, deleteCount: Math.max(0, previous.events.length + values.length - 100), values: [] });
+      operations.push({ op: 'splice', path: ['events'], start: Math.min(previous.events.length, 100 - values.length), deleteCount: 0, values });
+    } else diff(previous.events, next.events, ['events']);
+  } else diff(previous, next, []);
+  return operations;
+}
+
+/** One server-side revision stream per session, independent of observer count. */
+export function createSessionStateStream({ root, sessionId, channel, state, generation = randomUUID() }) {
+  let current = wireClone(state), revision = 0;
+  const executorId = String(state.executorId || state.owner || '');
+  const envelope = () => ({ type: 'state_sync', protocol: SESSION_SYNC_PROTOCOL, root, sessionId, channel, executorId, generation, revision });
+  const api = {
+    snapshot(requestId) { return { ...envelope(), mode: 'snapshot', state: current, ...(requestId ? { requestId } : {}) }; },
+    update(next, metadata) {
+      if (String(next.executorId || next.owner || '') !== executorId) return { replaced: true };
+      const operations = diffSessionState(current, next, metadata);
+      if (!operations.length) return null;
+      const baseRevision = revision++;
+      current = operations.length > 2048 ? wireClone(next) : applyStateOperations(current, operations);
+      // A huge structural replacement is a snapshot; ordinary text stays delta.
+      if (operations.length > 2048) return { ...envelope(), mode: 'snapshot', state: current, replacement: true };
+      return { ...envelope(), mode: 'patch', baseRevision, operations };
+    }
+  };
+  Object.defineProperties(api, { executorId: { get: () => executorId }, state: { get: () => current } });
+  return api;
+}
+
+/** Slow structured observers disconnect and recover from a new snapshot. No work is replayed. */
+export function sendStructuredFrame(client, text) {
+  if (client.hccStateClosing || client.readyState !== client.OPEN) return false;
+  const bytes = Buffer.byteLength(text);
+  if ((client.bufferedAmount || 0) > STATE_HIGH_WATER_BYTES || bytes > STATE_MAX_FRAME_BYTES) {
+    client.hccStateClosing = true;
+    try { client.close(bytes > STATE_MAX_FRAME_BYTES ? 1009 : 1013, 'state stream requires snapshot recovery'); } catch { client.terminate?.(); }
+    // close() itself may be queued behind a slow reader. Bound that lifetime.
+    const timer = setTimeout(() => { if (client.readyState !== client.CLOSED) client.terminate?.(); }, 1000);
+    timer.unref?.(); client.once?.('close', () => clearTimeout(timer));
+    return false;
+  }
+  client.send(text); return true;
+}

package/lib/web/shutdown-diagnostics.mjs

@@ -0,0 +1,38 @@
+import { performance } from 'node:perf_hooks';
+
+const PREFIX = 'HCC_SHUTDOWN_PHASE ';
+const PHASES = new Set(['request_received', 'stop_accepted', 'response_finished',
+  'cleanup_begin', 'pollers_closed', 'state_cleaned', 'sessions_cleaned', 'http_closed', 'cleanup_end']);
+const COUNTS = ['sessions', 'running', 'tmux', 'appServer', 'native', 'external', 'pty'];
+const bounded = value => Number.isSafeInteger(value) && value >= 0 && value <= 86400000;
+
+// Opt-in fixture telemetry only: fixed phases and counts, no identifiers,
+// paths, command arguments, request fields, messages or environment values.
+export function createShutdownDiagnostics({ enabled = false, pid = process.pid,
+  now = () => performance.now(), write = line => console.error(line) } = {}) {
+  const started = enabled ? now() : 0;
+  return (phase, counts = {}) => {
+    if (!enabled || !PHASES.has(phase)) return;
+    try {
+      const elapsedMs = Math.max(0, Math.round(now() - started));
+      if (!bounded(elapsedMs)) return;
+      write(PREFIX + JSON.stringify({ pid, phase, elapsedMs,
+        ...Object.fromEntries(COUNTS.filter(key => bounded(counts[key])).map(key => [key, counts[key]])) }));
+    } catch { /* Diagnostics must never change shutdown behavior. */ }
+  };
+}
+
+export function parseShutdownDiagnostics(text, pid) {
+  if (typeof text !== 'string' || Buffer.byteLength(text) > 65536 || !Number.isSafeInteger(pid) || pid <= 0) return [];
+  const result = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.startsWith(PREFIX) || line.length > 2048) continue;
+    try {
+      const value = JSON.parse(line.slice(PREFIX.length));
+      if (value?.pid !== pid || !PHASES.has(value.phase) || !bounded(value.elapsedMs)) continue;
+      result.push({ phase: value.phase, elapsedMs: value.elapsedMs,
+        ...Object.fromEntries(COUNTS.filter(key => bounded(value[key])).map(key => [key, value[key]])) });
+    } catch {}
+  }
+  return result.slice(-16);
+}

package/lib/web/shutdown-response.mjs

@@ -0,0 +1,21 @@
+// Stop accepting work before calling this helper. Cleanup starts after the
+// reply is flushed or disconnected, with a bound for an unfinished response.
+export function scheduleResponseShutdown(response, shutdown, {
+  fallbackMs = 250, schedule = setTimeout, cancel = clearTimeout
+} = {}) {
+  let started = false;
+  let timer;
+  function finish() {
+    if (started) return;
+    started = true;
+    response.removeListener('finish', finish);
+    response.removeListener('close', finish);
+    if (timer !== undefined) cancel(timer);
+    shutdown();
+  }
+  response.once('finish', finish);
+  response.once('close', finish);
+  timer = schedule(finish, fallbackMs);
+  timer?.unref?.();
+  if (response.writableFinished || response.destroyed) finish();
+}

package/lib/web/shutdown-state.mjs

@@ -0,0 +1,91 @@
+import path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { contextForProject } from '../runtime/paths.mjs';
+import { clearRuntime } from '../runtime/state.mjs';
+import { readProjectRegistry } from '../runtime/projects.mjs';
+
+// This budget bounds work admitted between synchronous operations. Nonblocking
+// leases avoid contention waits; their worker startup/release and filesystem
+// validation retain their own bounds. This is not a total shutdown deadline.
+export function cleanupRuntimeState({
+  ctx, sessions, connectWebProject, now, ownerIdentity,
+  budgetMs = 1000, monotonicNow = () => performance.now(),
+  readProjects = readProjectRegistry, clearPointers = clearRuntime
+}) {
+  const deadline = monotonicNow() + budgetMs;
+  const expired = () => monotonicNow() >= deadline;
+  const result = { detachedProjects: 0, skippedProjects: 0 };
+  const pointerOptions = { nonblocking: true, expectedIdentity: ownerIdentity, deadline, monotonicNow };
+  // Only this process instance may clear its pointers. A missing identity is
+  // left for the normal stale-pointer recovery path after the owner exits.
+  if (ownerIdentity) {
+    try { clearPointers(ctx, ownerIdentity.pid, pointerOptions); } catch {}
+    const seen = new Set([path.resolve(ctx.root)]);
+    try {
+      if (!expired()) for (const project of readProjects()) {
+        if (expired()) break;
+        const root = path.resolve(project.root);
+        if (seen.has(root)) continue;
+        seen.add(root);
+        clearPointers({ root }, ownerIdentity.pid, { ...pointerOptions, clearGlobal: false });
+      }
+    } catch {}
+  }
+
+  const byProject = new Map();
+  for (const session of sessions.values()) {
+    if (expired()) return result;
+    // The PTY factory predates explicit session.type; serialization uses the
+    // same PTY default. Require its actual handle before accepting that shape.
+    const type = session.type ?? (session.pty && typeof session.pty === 'object' ? 'pty' : null);
+    if (session.status !== 'running' || !['tmux', 'pty'].includes(type)) continue;
+    const peer = session.peerId || session.id;
+    if (!peer) continue;
+    try {
+      const projectCtx = session.ctx || contextForProject(path.resolve(session.root || ctx.root), null, { json: ctx.json });
+      const identity = projectCtx.rootIdentity?.identity;
+      const key = [projectCtx.root, projectCtx.dbPath, identity?.dev, identity?.ino, identity?.birthtimeNs].join('\0');
+      if (!byProject.has(key)) byProject.set(key, { projectCtx, sessions: [] });
+      byProject.get(key).sessions.push({ peer, id: session.id, type,
+        pane: session.pane, pid: session.pid });
+    } catch { result.skippedProjects++; }
+  }
+  for (const { projectCtx, sessions: owned } of byProject.values()) {
+    if (expired()) break;
+    let db;
+    try {
+      db = connectWebProject(projectCtx, { create: false, existingSchema: true });
+      if (expired()) continue;
+      // Do not use tx(): its normal write path retries busy writers. Both
+      // advisory changes either commit together now or are left for recovery.
+      db.exec('BEGIN IMMEDIATE');
+      try {
+        projectCtx.rootIdentity?.assertUnchanged();
+        const ids = [];
+        const binding = db.prepare(`SELECT p.pid, b.transport, b.runtime_session_id, b.runtime_target
+          FROM peers p JOIN peer_bindings b ON b.peer = p.id WHERE p.id = ?`);
+        for (const session of owned) {
+          if (expired()) break;
+          const row = binding.get(session.peer);
+          if (!row || row.transport !== (session.type === 'tmux' ? 'tmux' : 'web-pty') ||
+              row.runtime_session_id !== session.id ||
+              (session.type === 'tmux' && row.runtime_target !== session.pane) ||
+              (Number.isInteger(session.pid) && row.pid !== session.pid)) continue;
+          ids.push(session.peer);
+        }
+        if (ids.length && !expired()) {
+          const placeholders = ids.map(() => '?').join(',');
+          db.prepare(`UPDATE peers SET status = 'detached' WHERE id IN (${placeholders}) AND status IN ('running','working','busy')`).run(...ids);
+          db.prepare(`UPDATE peer_bindings SET runtime_target = NULL, updated_at = ? WHERE peer IN (${placeholders})`).run(now(), ...ids);
+        }
+        if (expired()) db.exec('ROLLBACK');
+        else { db.exec('COMMIT'); result.detachedProjects++; }
+      } catch (error) {
+        if (db.isTransaction) db.exec('ROLLBACK');
+        throw error;
+      }
+    } catch { result.skippedProjects++; }
+    finally { try { db?.close(); } catch {} }
+  }
+  return result;
+}

package/lib/web/startup.mjs

@@ -7,7 +7,7 @@ import path from 'node:path';
 import process from 'node:process';
 import { createHash, randomUUID } from 'node:crypto';
 import { URL } from 'node:url';
-import { spawn, spawnSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { CliError } from '../shared/errors.mjs';
 import { redactCliArgs } from '../shared/redact.mjs';
@@ -15,8 +15,13 @@ import { intOpt, parseOpts, splitGlobalArgs, validateOpts } from '../cli-args.mj
 import { printResult } from '../format.mjs';
 import { commandPath, tailFile } from '../cli-runtime.mjs';
 import { compareProcessIdentity, inspectProcessIdentity } from '../process/identity.mjs';
+import { spawnPinnedCwdProcess } from '../process/pinned-cwd.mjs';
+import { assertSelectedCwdSnapshot, captureSelectedCwdSnapshot } from '../process/selected-cwd-identity.mjs';
 import { registerProject } from '../runtime/projects.mjs';
 import { runtimePath, globalRuntimePath, globalStateDir, webLogPath } from '../runtime/paths.mjs';
+import { resolveProjectDatabase, secureExistingProjectStateDirectory } from '../runtime/project-path.mjs';
+import { privateProjectStateDir } from '../runtime/private-state.mjs';
+import { openPrivateAppendFile } from '../runtime/private-file.mjs';
 import { readHealthyGlobalRuntime, writeRuntime } from '../runtime/state.mjs';
 import { runtimeRequest } from '../runtime/client.mjs';
 import { withFileLock } from '../shared/file-lock.mjs';
@@ -234,29 +239,74 @@ async function startWebBackground(ctx, args) {
 }
 
 async function startWebBackgroundLocked(ctx, args, opts) {
-  const setup = await prepareLocalBus(ctx, {
+  // `prepareLocalBus` opens the database and may write guidance before its
+  // first await. Resolve both paths before handing it a context that can be
+  // redirected by a symlink alias while setup is in progress.
+  if (!fs.existsSync(ctx.root)) fs.mkdirSync(ctx.root, { recursive: true });
+  const expectedRootIdentity = ctx.initialRootIdentity || captureSelectedCwdSnapshot(ctx.root);
+  assertSelectedCwdSnapshot(expectedRootIdentity);
+  const requestedRuntimeFile = path.join(path.resolve(ctx.root), '.hello-cc', 'runtime.json');
+  const bound = resolveProjectDatabase({
+    root: ctx.root, db: requestedRuntimeFile, createStateDir: true
+  });
+  const boundRoot = bound.root;
+  const requestedDb = path.resolve(ctx.dbPath);
+  const managedDb = [
+    path.join(path.resolve(ctx.root), '.hello-cc'),
+    path.join(boundRoot, '.hello-cc'),
+    privateProjectStateDir(boundRoot)
+  ].some((stateDir) => {
+    const relative = path.relative(stateDir, requestedDb);
+    return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) &&
+      !path.isAbsolute(relative));
+  });
+  // External --db/HCC_DB paths are a documented caller-managed option. Only
+  // project-managed DBs need this canonicalization (including alias-spelled
+  // nested paths whose parent has not been created yet).
+  const boundDb = managedDb
+    ? resolveProjectDatabase({
+      root: ctx.root, db: requestedDb, createStateDir: true, createDatabaseParents: true
+    }).db
+    : requestedDb;
+  const boundCtx = { ...ctx, root: boundRoot, dbPath: boundDb };
+  const boundStateDir = bound.stateDir;
+  const runtimeFile = path.join(boundStateDir, 'runtime.json');
+  const logFile = path.join(boundStateDir, 'web.log');
+  const assertBoundProject = () => {
+    assertSelectedCwdSnapshot(expectedRootIdentity);
+    const current = resolveProjectDatabase({ root: ctx.root, db: requestedRuntimeFile });
+    if (current.root !== boundRoot || current.stateDir !== boundStateDir ||
+        (managedDb && resolveProjectDatabase({ root: ctx.root, db: requestedDb }).db !== boundDb)) {
+      throw new CliError('PROJECT_PATH_FORBIDDEN', 'Project state route changed during Web startup');
+    }
+    secureExistingProjectStateDirectory(boundRoot);
+  };
+  assertBoundProject();
+  const setup = await prepareLocalBus(boundCtx, {
     ...opts,
     installShims: process.env.HCC_SKIP_SHIM_INSTALL === '1' ? false : true
   });
-  registerProject(ctx);
+  assertBoundProject();
+  registerProject(boundCtx);
 
   const existing = await readHealthyGlobalRuntime();
   if (existing) {
     if (webRuntimeMatchesRequest(existing, opts)) {
-      await stopOrphanWebRuntimes(ctx, existing.pid || null);
+      await stopOrphanWebRuntimes(boundCtx, existing.pid || null);
       rememberRuntimeToken(existing, opts);
       try {
-        await runtimeRequest(ctx, 'POST', '/api/projects', { root: ctx.root, db: ctx.dbPath }, existing);
+        await runtimeRequest(boundCtx, 'POST', '/api/projects', { root: boundRoot, db: boundCtx.dbPath }, existing);
       } catch {}
-      writeRuntime(ctx, {
+      assertBoundProject();
+      writeRuntime(boundCtx, {
         ...existing,
         api_version: API_VERSION,
-        root: ctx.root,
-        db: ctx.dbPath,
-        project_root: ctx.root,
+        root: boundRoot,
+        db: boundCtx.dbPath,
+        project_root: boundRoot,
         global_runtime: true
       });
-      return printWebRuntime(ctx, existing, { already: true, logFile: webLogPath(ctx), setup });
+      return printWebRuntime(boundCtx, existing, { already: true, logFile, runtimeFile, setup });
     }
     // TLS-2: an idempotent `hcc web` must not silently stop a TLS runtime and
     // downgrade to plaintext (or vice versa) when only --tls/--trust-proxy
@@ -272,48 +322,66 @@ async function startWebBackgroundLocked(ctx, args, opts) {
         `A ${runtimeTls ? 'TLS' : 'plaintext'} web runtime is already running${existing.trust_proxy ? ' with --trust-proxy' : ''} on port ${existing.port}. ` +
         `Run ${CLI_NAME} down first, or re-run with matching flags (${opts.tls ? '--tls' : 'no --tls'}${opts['trust-proxy'] ? ', --trust-proxy' : ''}).`);
     }
-    try { await runtimeRequest(ctx, 'POST', '/api/runtime/stop', {}, existing); } catch {}
+    try { await runtimeRequest(boundCtx, 'POST', '/api/runtime/stop', {}, existing); } catch {}
     await sleep(250);
   }
-  await stopOrphanWebRuntimes(ctx);
+  assertBoundProject();
+  await stopOrphanWebRuntimes(boundCtx);
 
-  try { fs.rmSync(runtimePath(ctx), { force: true }); } catch {}
+  // A project path can be reused for a different directory after setup. Do
+  // not remove its old private runtime pointer or append to its old Web log.
+  assertBoundProject();
+  try { fs.rmSync(runtimeFile, { force: true }); } catch {}
   try { fs.rmSync(globalRuntimePath(), { force: true }); } catch {}
 
-  const logFile = webLogPath(ctx);
-  fs.mkdirSync(path.dirname(logFile), { recursive: true });
-  // bg-05: rotate web.log once it grows past 5 MB (keep the previous .1).
+  assertBoundProject();
+  let logFd = openPrivateAppendFile(logFile);
   try {
-    if (fs.statSync(logFile).size > 5 * 1024 * 1024) {
-      try { fs.rmSync(`${logFile}.1`, { force: true }); } catch {}
-      try { fs.renameSync(logFile, `${logFile}.1`); } catch {}
+    // bg-05: rotate web.log once it grows past 5 MB (keep the previous .1).
+    if (fs.fstatSync(logFd).size > 5 * 1024 * 1024) {
+      const previous = `${logFile}.1`;
+      try {
+        const stat = fs.lstatSync(previous);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 ||
+            (typeof process.getuid === 'function' && stat.uid !== process.getuid())) {
+          throw new CliError('PROJECT_PATH_FORBIDDEN', `Rotated Web log is not owned: ${previous}`);
+        }
+        fs.unlinkSync(previous);
+      } catch (error) {
+        if (error?.code !== 'ENOENT') throw error;
+      }
+      fs.closeSync(logFd);
+      logFd = null;
+      fs.renameSync(logFile, previous);
+      logFd = openPrivateAppendFile(logFile);
     }
-  } catch {}
-  const redactedStart = redactedLogText(`${CLI_NAME} web ${redactCliArgs(args).join(' ')}`);
-  fs.appendFileSync(logFile, `\n[${new Date().toISOString()}] ${redactedStart}\n`, { mode: 0o600 });
-  // The runtime echoes token-bearing URLs into web.log; keep it owner-only so a
-  // co-tenant on the machine cannot read the token (net-02).
-  try { fs.chmodSync(logFile, 0o600); } catch {}
-  const logFd = fs.openSync(logFile, 'a');
+    const redactedStart = redactedLogText(`${CLI_NAME} web ${redactCliArgs(args).join(' ')}`);
+    assertBoundProject();
+    fs.writeSync(logFd, `\n[${new Date().toISOString()}] ${redactedStart}\n`);
+  } catch (error) {
+    if (logFd !== null) fs.closeSync(logFd);
+    throw error;
+  }
 
   const childArgs = [
     commandPath(),
-    '--root', ctx.root,
-    '--db', ctx.dbPath,
+    '--root', boundRoot,
+    '--db', boundCtx.dbPath,
     'web',
     ...args
   ];
   const childEnv = {
     ...process.env,
     [WEB_CHILD_ENV]: '1',
-    HCC_ROOT: ctx.root,
-    HCC_DB: ctx.dbPath
+    HCC_ROOT: boundRoot,
+    HCC_DB: boundCtx.dbPath
   };
 
   let child;
   try {
-    child = spawn(process.execPath, childArgs, {
-      cwd: ctx.cwd,
+    child = spawnPinnedCwdProcess(process.execPath, childArgs, {
+      cwd: boundRoot,
+      expectedIdentity: expectedRootIdentity,
       env: childEnv,
       detached: true,
       stdio: ['ignore', logFd, logFd]
@@ -322,9 +390,9 @@ async function startWebBackgroundLocked(ctx, args, opts) {
     try { fs.closeSync(logFd); } catch {}
   }
 
-  const runtime = await waitForStartedRuntime(ctx, child, logFile);
+  const runtime = await waitForStartedRuntime(boundCtx, child, logFile);
   child.unref();
-  return printWebRuntime(ctx, runtime, { already: false, logFile, setup });
+  return printWebRuntime(boundCtx, runtime, { already: false, logFile, runtimeFile, setup });
 }
 
 async function waitForStartedRuntime(ctx, child, logFile) {
@@ -370,7 +438,7 @@ function printWebRuntime(ctx, runtime, opts = {}) {
     port: runtime.port || null,
     url: publicRuntimeUrl(runtime, ctx.root),
     local_url: localRuntimeUrl(runtime, ctx.root),
-    runtime: runtimePath(ctx),
+    runtime: opts.runtimeFile || runtimePath(ctx),
     log: logFile,
     stop: `${CLI_NAME} down`
   };

package/lib/web/task-results.mjs

@@ -1,8 +1,6 @@
-import { createHash } from 'node:crypto';
 import { selectCurrentTask } from '../core/coordination/automation.mjs';
 import { listTaskResults, recordTaskResult, summarizeTaskResults } from '../core/coordination/results.mjs';
 import { CliError } from '../shared/errors.mjs';
-import { redactSecrets } from '../shared/redact.mjs';
 
 export function createTaskResults({ connectWebProject, resolveSessionPeerId, now, addEvent }) {
   const turnScopes = new WeakMap();
@@ -31,7 +29,7 @@ export function createTaskResults({ connectWebProject, resolveSessionPeerId, now
       return { result };
     } finally { db.close(); }
   }
-  function observeCodexResults(session, state) {
+  function observeCodexResults(session, state, event) {
     if (!session.binding?.provider_session_id || state.executorId !== (session.executorId || session.adapter?.snapshot().executorId)) return;
     const thread = state.threads?.find(t => t.id === session.binding.provider_session_id);
     if (!thread?.turns?.length) return;
@@ -40,9 +38,17 @@ export function createTaskResults({ connectWebProject, resolveSessionPeerId, now
       const peer = resolveSessionPeerId(db, session);
       let scopes = turnScopes.get(session);
       if (!scopes) { scopes = new Map(); turnScopes.set(session, scopes); }
-      for (const event of state.events || []) {
-        if (event.method === 'turn/started' && event.params?.threadId === thread.id && event.params.turn?.id && !scopes.has(event.params.turn.id)) {
-          scopes.set(event.params.turn.id, currentTask(db, peer)?.id || null);
+      // The snapshot retains old events. Only the adapter's fresh event may bind
+      // a turn to the task that is current at this instant.
+      if (event?.method === 'turn/started' && event.params?.threadId === thread.id &&
+          event.params.turn?.id && !scopes.has(event.params.turn.id)) {
+        scopes.set(event.params.turn.id, currentTask(db, peer)?.id || null);
+      }
+      function recordAutomatic(input) {
+        try { recordTaskResult(db, input, { now, addEvent, automatic: true }); return true; }
+        catch (error) {
+          if (error instanceof CliError && ['TASK_OWNER_MISMATCH', 'NOT_FOUND'].includes(error.code)) return false;
+          throw error;
         }
       }
       for (const turn of thread.turns) {
@@ -50,29 +56,23 @@ export function createTaskResults({ connectWebProject, resolveSessionPeerId, now
         if (!taskId) continue;
         const common = { peer, taskId, executorId: state.executorId, threadId: thread.id,
           turnId: turn.id, source: 'executor', stage: 'local' };
+        let taskUnavailable = false;
         for (const item of turn.items || []) {
           if (item.type !== 'commandExecution' || !['completed', 'failed', 'declined'].includes(item.status)) continue;
           const exitCode = item.exitCode;
           const status = exitCode === 0 && item.status === 'completed' ? 'passed'
             : item.status === 'failed' || item.status === 'declined' || (Number.isSafeInteger(exitCode) && exitCode !== 0) ? 'failed' : 'pending';
-          const command = redactSecrets(String(item.command || ''));
-          const output = redactSecrets(String(item.aggregatedOutput || ''));
-          recordTaskResult(db, { ...common, itemId: item.id, kind: 'command', status, exitCode,
-            resultKey: `${state.executorId}:${turn.id}:${item.id}:command`,
-            title: (command || 'Command execution').slice(0, 300),
-            command: command.slice(0, 64000),
-            details: output.slice(0, 64000), evidence: [] }, { now, addEvent });
+          if (!recordAutomatic({ ...common, itemId: item.id, kind: 'command', status, exitCode })) {
+            taskUnavailable = true;
+            break;
+          }
         }
+        if (taskUnavailable) continue;
         if (turn.diff && ['completed', 'failed', 'interrupted'].includes(turn.status)) {
-          const diff = redactSecrets(String(turn.diff)).slice(0, 64000);
-          recordTaskResult(db, { ...common, kind: 'diff', status: 'pending', title: 'Turn changes awaiting review', diff,
-            resultKey: `${state.executorId}:${turn.id}:diff:${createHash('sha256').update(diff).digest('hex')}` }, { now, addEvent });
+          recordAutomatic({ ...common, kind: 'diff', status: 'pending' });
         }
       }
       while (scopes.size > 100) scopes.delete(scopes.keys().next().value);
-    } catch (error) {
-      // A delayed executor result must not attach to a task after ownership changed.
-      if (!(error instanceof CliError) || !['TASK_OWNER_MISMATCH', 'NOT_FOUND'].includes(error.code)) throw error;
     } finally { db.close(); }
   }
   return { readSessionResults, writeSessionResult, observeCodexResults };