@logicseek/hello-cc 1.0.5 → 1.1.0-rc.3

package/lib/integrations/codex-account.mjs

@@ -0,0 +1,143 @@
+// Read-only projection of official App Server account and quota data. Never
+// forward emails, credential identifiers, tokens, raw errors or unknown fields.
+const PLANS = new Set(['free', 'go', 'plus', 'pro', 'prolite', 'team',
+  'self_serve_business_usage_based', 'business', 'enterprise_cbp_usage_based', 'enterprise', 'edu', 'unknown']);
+const TYPES = new Set(['apiKey', 'chatgpt', 'amazonBedrock']);
+const REASONS = new Set(['rate_limit_reached', 'workspace_owner_credits_depleted', 'workspace_member_credits_depleted',
+  'workspace_owner_usage_limit_reached', 'workspace_member_usage_limit_reached']);
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const finite = value => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+const integer = value => Number.isSafeInteger(value) && value >= 0;
+const bucketId = value => typeof value === 'string' && /^[A-Za-z0-9_.-]{1,80}$/.test(value) ? value : null;
+
+function windowValue(value) {
+  if (!record(value) || !finite(value.usedPercent)) return null;
+  return { usedPercent: value.usedPercent,
+    resetsAt: integer(value.resetsAt) ? value.resetsAt : null,
+    windowDurationMins: integer(value.windowDurationMins) && value.windowDurationMins > 0 ? value.windowDurationMins : null };
+}
+function bucketValue(value, id = null) {
+  if (!record(value)) return null;
+  const primary = windowValue(value.primary), secondary = windowValue(value.secondary);
+  const credits = record(value.credits) && typeof value.credits.hasCredits === 'boolean' && typeof value.credits.unlimited === 'boolean'
+    ? { hasCredits: value.credits.hasCredits, unlimited: value.credits.unlimited } : null;
+  if (!primary && !secondary && !credits && !REASONS.has(value.rateLimitReachedType)) return null;
+  return { id: bucketId(id) || bucketId(value.limitId), primary, secondary, credits,
+    planType: PLANS.has(value.planType) ? value.planType : null,
+    reached: REASONS.has(value.rateLimitReachedType) ? value.rateLimitReachedType : null };
+}
+function unavailableReason(error) {
+  return error?.code === -32601 || (error?.extra?.rpcCode ?? error?.extra?.rpc_code) === -32601 ? 'unsupported' : 'unavailable';
+}
+function accountValue(value) {
+  if (!record(value) || typeof value.requiresOpenaiAuth !== 'boolean' ||
+      (value.account != null && (!record(value.account) || !TYPES.has(value.account.type)))) return null;
+  const type = value.account?.type || null;
+  return { requiresOpenaiAuth: value.requiresOpenaiAuth, type,
+    planType: type === 'chatgpt' && PLANS.has(value.account.planType) ? value.account.planType : null,
+    authentication: value.requiresOpenaiAuth === false ? 'providerManaged' : type ? 'authenticated' : 'required' };
+}
+
+export function createCodexAccountState({ request, onChange = () => {}, now = Date.now } = {}) {
+  let state = { status: 'unknown', stale: false, reason: null, type: null, planType: null,
+    authentication: 'unknown', requiresOpenaiAuth: null, checkedAt: null,
+    rateLimits: { status: 'unknown', stale: false, reason: null, checkedAt: null, buckets: [] } };
+  let accountRevision = 0, limitsRevision = 0, inFlight = null, closed = false, recheck = false;
+  const snapshot = () => structuredClone(state);
+  const publish = () => { try { onChange(snapshot()); } catch {} };
+  function relevantLimits() { return state.status === 'ready' && state.type === 'chatgpt' && state.requiresOpenaiAuth === true; }
+  function notification(method, params = {}) {
+    if (!['account/updated', 'account/rateLimits/updated', 'account/login/completed'].includes(method)) return false;
+    if (closed) return true;
+    if (method !== 'account/rateLimits/updated') {
+      // Account changes can precede a read reply. That older response cannot
+      // reattach the previous account's quotas to the current executor.
+      accountRevision++; limitsRevision++; recheck = true;
+      state = { ...state, status: 'unknown', stale: true, reason: null, type: null, planType: null,
+        authentication: 'unknown', requiresOpenaiAuth: null,
+        rateLimits: { status: 'unknown', stale: false, reason: null, checkedAt: null, buckets: [] } };
+      publish();
+      queueMicrotask(() => { if (!closed && !inFlight) void refresh(); });
+      return true;
+    }
+    if (!relevantLimits()) return true;
+    const next = bucketValue(params.rateLimits);
+    if (!next) return true;
+    limitsRevision++;
+    const buckets = state.rateLimits.buckets.slice();
+    if (next.id === null && buckets.length === 1) next.id = buckets[0].id;
+    if (next.id === null && buckets.length > 1 && !buckets.some(entry => entry.id === null)) return true;
+    const index = buckets.findIndex(entry => entry.id === next.id);
+    if (index < 0) { if (buckets.length < 16) buckets.push(next); }
+    else {
+      const previous = buckets[index];
+      // Rolling updates are sparse. Null metadata/windows mean unavailable in
+      // this update, not a quota of zero or a request to erase the prior value.
+      buckets[index] = Object.fromEntries(Object.keys(next).map(key => [key,
+        ['primary', 'secondary'].includes(key) && next[key] && previous[key]
+          ? Object.fromEntries(Object.keys(next[key]).map(field => [field, next[key][field] ?? previous[key][field]]))
+          : next[key] ?? previous[key]]));
+    }
+    state.rateLimits = { status: 'ready', stale: false, reason: null, checkedAt: now(), buckets };
+    publish(); return true;
+  }
+  async function read() {
+    const revision = accountRevision;
+    recheck = false;
+    let value;
+    try { value = accountValue(await request('account/read', { refreshToken: false }));
+      if (!value) throw Object.assign(new Error('Invalid account response'), { code: 'CODEX_ACCOUNT_PROTOCOL_ERROR' });
+    } catch (error) {
+      if (!closed && revision === accountRevision) {
+        state.status = 'unavailable'; state.stale = state.checkedAt !== null; state.reason = unavailableReason(error);
+        state.authentication = 'unknown';
+        state.rateLimits = { ...state.rateLimits, status: 'unavailable', stale: state.rateLimits.checkedAt !== null, reason: 'unavailable' };
+        publish();
+      }
+      return snapshot();
+    }
+    if (closed || revision !== accountRevision) return snapshot();
+    state = { ...state, ...value, status: 'ready', stale: false, reason: null, checkedAt: now() };
+    if (!relevantLimits()) {
+      state.rateLimits = { status: 'notApplicable', stale: false, reason: null, checkedAt: null, buckets: [] };
+      publish(); return snapshot();
+    }
+    publish();
+    const quotaRevision = limitsRevision;
+    try {
+      const response = await request('account/rateLimits/read', {});
+      if (!record(response) || !record(response.rateLimits)) throw new Error('Invalid quota response');
+      const entries = record(response.rateLimitsByLimitId) ? Object.entries(response.rateLimitsByLimitId)
+        .filter(([id]) => bucketId(id)).slice(0, 16).map(([id, bucket]) => bucketValue(bucket, id)).filter(Boolean) : [];
+      const legacy = bucketValue(response.rateLimits);
+      const buckets = entries.length ? entries : legacy ? [legacy] : [];
+      if (!closed && revision === accountRevision && quotaRevision === limitsRevision) {
+        state.rateLimits = { status: buckets.length ? 'ready' : 'unavailable', stale: false,
+          reason: buckets.length ? null : 'unavailable', checkedAt: buckets.length ? now() : null, buckets };
+        publish();
+      }
+    } catch (error) {
+      if (!closed && revision === accountRevision && quotaRevision === limitsRevision) {
+        state.rateLimits = { ...state.rateLimits, status: 'unavailable', stale: state.rateLimits.checkedAt !== null, reason: unavailableReason(error) };
+        publish();
+      }
+    }
+    return snapshot();
+  }
+  function refresh() {
+    if (closed) return Promise.resolve(snapshot());
+    if (inFlight) return inFlight;
+    inFlight = read().finally(() => {
+      inFlight = null;
+      if (recheck && !closed) queueMicrotask(() => { if (!inFlight && !closed) void refresh(); });
+    });
+    return inFlight;
+  }
+  function close() {
+    closed = true; accountRevision++; limitsRevision++;
+    state.status = 'unavailable'; state.stale = state.checkedAt !== null; state.reason = 'disconnected';
+    state.authentication = 'unknown';
+    state.rateLimits = { ...state.rateLimits, status: 'unavailable', stale: state.rateLimits.checkedAt !== null, reason: 'disconnected' };
+  }
+  return { snapshot, refresh, notification, close };
+}

package/lib/integrations/codex-interactions.mjs

@@ -1,3 +1,7 @@
+import { createMcpFormValidator } from './mcp-elicitation.mjs';
+import { createMcpUrlValidator } from './mcp-url-elicitation.mjs';
+
+const mcpForms = createMcpFormValidator(), mcpUrls = createMcpUrlValidator();
 // Shared validation for the official App Server command/file/permissions/input
 // server requests. Human responses may narrow a request, never widen it.
 export const CODEX_INTERACTION_METHODS = new Set([
@@ -37,20 +41,18 @@ function subset(selected, requested) {
     fail('Granted permissions must be an exact subset of the requested permissions');
   }
 }
-// Codex 0.144.6 hosts MCP tool approvals as an empty form elicitation.
-// Return the official action/content shape. Do not persist permission in _meta,
-// and do not pretend arbitrary form fields or URL authentication were answered.
+// Reply only to the correlated request. URL acceptance has no form content or
+// authentication result; the MCP server owns completion of the external flow.
 function mcpResponse(request, input) {
-  if (!['accept', 'decline', 'cancel'].includes(input.decision)) fail('An MCP approval decision is required');
+  if (!['accept', 'decline', 'cancel'].includes(input.decision)) fail('An MCP decision is required');
   if (input.decision !== 'accept') return { action: input.decision };
-  const params = request.params, schema = params?.requestedSchema;
-  if (params?.mode !== 'form' || params?._meta?.codex_approval_kind !== 'mcp_tool_call' ||
-      !object(schema) || schema.type !== 'object' || !object(schema.properties) ||
-      Object.keys(schema.properties).length || (schema.required?.length || 0) ||
-      Object.keys(schema).some(key => !['type', 'properties', 'required', 'additionalProperties'].includes(key))) {
-    fail('Only an explicit empty-form MCP tool approval is supported; decline or cancel other elicitations');
+  if (request.params?.mode === 'url') {
+    mcpUrls.describe(request.params);
+    if (input.content !== undefined || input.answers !== undefined || input.permissions !== undefined) fail('MCP URL responses cannot contain form content or permissions');
+    return { action: 'accept' };
   }
-  return { action: 'accept', content: {} };
+  const { fields } = mcpForms.describe(request.params);
+  return { action: 'accept', content: mcpForms.validate(request.params, input.content === undefined && !fields.length ? {} : input.content) };
 }
 
 function permissionsResponse(request, input) {

package/lib/integrations/dsh-collaboration.mjs

@@ -152,18 +152,12 @@ export function createDshCollaboration({ sessionId, cwd, maxContextChars = 16000
     dispose() {
       if (disposed) return;
       retiring = true;
-      try {
-        owned(db => {
-          peers.touchPeer(db, peer, 'exited');
-          db.prepare('UPDATE peer_bindings SET runtime_target = NULL, updated_at = ? WHERE peer = ? AND runtime_target = ?').run(now(), peer, owner);
-          addEvent(db, 'dsh.cordis.closed', peer, null, { session_id: sessionId });
-        }, true, true);
-        disposed = true;
-      } catch (error) {
-        // A lost generation cannot be retried; storage failures can be.
-        if (error?.code === 'DSH_COLLABORATION_CONFLICT') disposed = true;
-        throw error;
-      }
+      owned(db => {
+        peers.touchPeer(db, peer, 'exited');
+        db.prepare('UPDATE peer_bindings SET runtime_target = NULL, updated_at = ? WHERE peer = ? AND runtime_target = ?').run(now(), peer, owner);
+        addEvent(db, 'dsh.cordis.closed', peer, null, { session_id: sessionId });
+      }, true, true);
+      disposed = true;
     }
   };
 }

package/lib/integrations/dsh-cordis.mjs

@@ -10,8 +10,20 @@ export const name = 'hello-cc-dsh-collaboration';
 export const inject = ['agents', 'tools', 'sessions'];
 export const DSH_CORDIS_VERSION = '0.2.0-rc.2';
 
-const failedRetirements = new Map();
-const disposedAgents = new WeakSet();
+// A failed retirement is retried only after exact Agent disposal, or by that
+// same Agent after its previous plugin context has been disposed.
+const retirementRegistryKey = Symbol.for('@logicseek/hello-cc/dsh-cordis/retirements/v1');
+if (!Object.hasOwn(globalThis, retirementRegistryKey)) {
+  Object.defineProperty(globalThis, retirementRegistryKey, {
+    value: Object.freeze({ failedRetirements: new Map(), disposedAgents: new WeakSet() })
+  });
+}
+const retirementRegistry = globalThis[retirementRegistryKey];
+if (!(retirementRegistry?.failedRetirements instanceof Map) ||
+    !(retirementRegistry?.disposedAgents instanceof WeakSet)) {
+  throw new Error('Invalid hello-cc Cordis retirement registry');
+}
+const { failedRetirements, disposedAgents } = retirementRegistry;
 
 function retire(agent, state, { agentDisposed = false, contextDisposed = false }, forget) {
   let entry = failedRetirements.get(agent);
@@ -22,17 +34,9 @@ function retire(agent, state, { agentDisposed = false, contextDisposed = false }
     if (agentDisposed) entry.agentDisposed = true;
     if (contextDisposed) entry.contextDisposed = true;
   }
-  try {
-    entry.state.dispose();
-    entry.forget();
-    failedRetirements.delete(agent);
-  } catch (error) {
-    if (error?.code === 'DSH_COLLABORATION_CONFLICT') {
-      entry.forget();
-      failedRetirements.delete(agent);
-    }
-    throw error;
-  }
+  entry.state.dispose();
+  entry.forget();
+  failedRetirements.delete(agent);
 }
 
 function retryRetirements(candidate) {

package/lib/integrations/dsh.mjs

@@ -2,12 +2,14 @@ import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
 import { createHash, randomUUID } from 'node:crypto';
-import { spawn } from 'node:child_process';
+import { spawnPinnedCwdProcess } from '../process/pinned-cwd.mjs';
 import { fileURLToPath } from 'node:url';
 import { CliError } from '../shared/errors.mjs';
 import { withFileLock } from '../shared/file-lock.mjs';
 import { commandPath } from '../cli-runtime.mjs';
 import { shellQuoteArg } from '../format.mjs';
+import { resolveProjectDatabase, ensurePrivateProjectStateSubdirectory } from '../runtime/project-path.mjs';
+import { unsafeDirectoryAcl } from '../runtime/project-trust.mjs';
 
 export const DSH_BASELINE_VERSION = '0.2.0-rc.2';
 export const DSH_INSTALL_HINT = `npm install -g @deepseek-ai/dsh@${DSH_BASELINE_VERSION}`;
@@ -42,16 +44,14 @@ function integrationPaths(ctx, create = false) {
   try { root = fs.realpathSync(ctx.root); }
   catch { throw new CliError('BAD_ARGS', `Project root does not exist: ${ctx.root}`); }
   if (!fs.statSync(root).isDirectory()) throw new CliError('BAD_ARGS', `Project root is not a directory: ${root}`);
-  const stateDir = path.join(root, '.hello-cc');
+  const stateDir = resolveProjectDatabase({ root, createStateDir: create }).stateDir;
   const directory = path.join(stateDir, 'dsh');
+  // DSH artifacts are opened and renamed by pathname. Their parent must be
+  // owned and non-rebindable by another OS user before either operation.
+  ensurePrivateProjectStateSubdirectory(root, 'dsh', { create });
   const parents = [];
   for (const dir of [root, stateDir, directory]) {
-    let stat = lstat(dir);
-    if (!stat && create) {
-      try { fs.mkdirSync(dir, { mode: 0o700 }); }
-      catch (error) { if (error.code !== 'EEXIST') throw error; }
-      stat = lstat(dir);
-    }
+    const stat = lstat(dir);
     if (stat && (!stat.isDirectory() || stat.isSymbolicLink())) {
       throw forbidden(dir, 'expected an ordinary directory, found a symlink or other object');
     }
@@ -75,8 +75,11 @@ function readArtifact(paths, name) {
   const file = path.join(paths.directory, name);
   const stat = lstat(file);
   if (!stat) return null;
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
-    throw forbidden(file, 'expected an ordinary file with no symlink or hard-link alias');
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 ||
+      (typeof process.getuid === 'function' && stat.uid !== process.getuid()) ||
+      (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600) ||
+      unsafeDirectoryAcl(file, stat)) {
+    throw forbidden(file, 'expected an owned private file with no symlink or hard-link alias');
   }
   const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
   try {
@@ -268,7 +271,9 @@ export async function launchDshWeb(ctx, options = {}) {
   const env = createDshEnvironment(options.env || process.env, { dshHome: options.dshHome, cwd: ctx.cwd });
   const args = ['web', '--patch', setup.patchPath, ...(options.args || [])];
   return new Promise((resolve, reject) => {
-    const child = spawn(binary, args, { cwd: setup.root, env, stdio: options.stdio || 'inherit' });
+    const child = spawnPinnedCwdProcess(binary, args, {
+      cwd: setup.root, env, stdio: options.stdio || 'inherit'
+    });
     const handlers = new Map();
     const cleanup = () => {
       for (const signal of handlers.keys()) process.removeListener(signal, handlers.get(signal));

package/lib/integrations/mcp-elicitation.mjs

@@ -0,0 +1,116 @@
+// Bounded MCP 2025-11-25 form schemas. This factory is also embedded in the Web
+// responder so the UI and owning executor apply the same constraints.
+export function createMcpFormValidator() {
+  const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+  const own = (value, key) => Object.hasOwn(value, key);
+  function fail(message) { throw Object.assign(new Error(message), { code: 'INTERACTION_RESPONSE_INVALID' }); }
+  function shape(value, allowed) {
+    if (!object(value) || Object.keys(value).some(key => !allowed.includes(key))) fail('Unsupported MCP form schema');
+  }
+  function text(value) { return typeof value === 'string' && value.length <= 8192; }
+  function bound(value) { return Number.isSafeInteger(value) && value >= 0; }
+  function options(schema, titledKey, legacy = false) {
+    let values;
+    if (own(schema, 'enum')) {
+      if (!Array.isArray(schema.enum) || schema.enum.some(value => !text(value))) fail('Invalid MCP form options');
+      if (legacy && own(schema, 'enumNames') && (!Array.isArray(schema.enumNames) || schema.enumNames.length !== schema.enum.length || schema.enumNames.some(value => !text(value)))) fail('Invalid MCP option labels');
+      values = schema.enum.map((value, i) => ({ value, label: schema.enumNames?.[i] ?? value }));
+    } else {
+      if (!Array.isArray(schema[titledKey])) fail('Invalid MCP form options');
+      values = schema[titledKey].map(entry => {
+        shape(entry, ['const', 'title']);
+        if (!text(entry.const) || !text(entry.title)) fail('Invalid MCP form options');
+        return { value: entry.const, label: entry.title };
+      });
+    }
+    if (!values.length || values.length > 100 || new Set(values.map(entry => entry.value)).size !== values.length) fail('Invalid or excessive MCP form options');
+    return values;
+  }
+  function date(value) {
+    return (/^\d{4}-\d{2}-\d{2}$/).test(value) && Number.isFinite(Date.parse(value + 'T00:00:00Z')) && new Date(value + 'T00:00:00Z').toISOString().slice(0, 10) === value;
+  }
+  function formatted(value, format) {
+    if (format === 'email') {
+      const at = value.lastIndexOf('@'), local = value.slice(0, at), domain = value.slice(at + 1);
+      // Common dot-atom/quoted mailbox syntax and DNS labels; no network lookup.
+      const mailbox = (/^(?:[A-Za-z0-9!#$%&'*+\/=?^_`{|}~-]+(?:\.[A-Za-z0-9!#$%&'*+\/=?^_`{|}~-]+)*|"(?:[^"\\\r\n]|\\[^\r\n])*")$/).test(local);
+      const host = (/^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)*$/).test(domain);
+      return at > 0 && mailbox && host && domain.split('.').every(label => label.length <= 63);
+    }
+    if (format === 'uri') {
+      if (/[^\x21-\x7e]|["<>`{}|\\^]|%(?![\da-fA-F]{2})/.test(value)) return false;
+      try { return Boolean(new URL(value).protocol); } catch { return false; }
+    }
+    if (format === 'date') return date(value);
+    if (format === 'date-time') {
+      const match = /^(\d{4}-\d{2}-\d{2})[tT](\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:[zZ]|[+-](\d{2}):(\d{2}))$/.exec(value);
+      return Boolean(match && date(match[1]) && Number(match[2]) < 24 && Number(match[3]) < 60 && Number(match[4]) <= 60 && (!match[5] || (Number(match[5]) < 24 && Number(match[6]) < 60)));
+    }
+    return true;
+  }
+  function validateValue(field, value) {
+    const error = () => fail('Invalid value for MCP field: ' + field.key);
+    if (field.kind === 'multi') {
+      if (!Array.isArray(value) || value.length > 100 || value.length < (field.minItems ?? 0) || value.length > (field.maxItems ?? 100) || new Set(value).size !== value.length || value.some(entry => !field.options.some(option => option.value === entry))) error();
+    } else if (field.kind === 'enum') {
+      if (!field.options.some(option => option.value === value)) error();
+    } else if (field.type === 'boolean') {
+      if (typeof value !== 'boolean') error();
+    } else if (field.type === 'number' || field.type === 'integer') {
+      if (typeof value !== 'number' || !Number.isFinite(value) || (field.type === 'integer' && !Number.isSafeInteger(value)) || (field.minimum != null && value < field.minimum) || (field.maximum != null && value > field.maximum)) error();
+    } else {
+      if (!text(value) || Array.from(value).length < (field.minLength ?? 0) || Array.from(value).length > (field.maxLength ?? 8192) || !formatted(value, field.format)) error();
+    }
+  }
+  function describe(params) {
+    if (params?.mode !== 'form') fail('This MCP request mode cannot be answered in Web; decline or cancel');
+    const schema = params.requestedSchema;
+    shape(schema, ['$schema', 'type', 'properties', 'required', 'additionalProperties']);
+    if (schema.type !== 'object' || !object(schema.properties) || (own(schema, '$schema') && !text(schema.$schema)) || (own(schema, 'additionalProperties') && typeof schema.additionalProperties !== 'boolean') || JSON.stringify(schema).length > 65536) fail('Unsupported MCP form schema');
+    const entries = Object.entries(schema.properties), required = own(schema, 'required') ? schema.required : [];
+    if (entries.length > 50 || !Array.isArray(required) || new Set(required).size !== required.length || required.some(key => typeof key !== 'string' || !own(schema.properties, key))) fail('Invalid or excessive MCP form fields');
+    const fields = entries.map(([key, definition]) => {
+      if (!key || key.length > 512 || !object(definition)) fail('Invalid MCP field identity');
+      const type = definition.type;
+      let allowed, kind = type;
+      if (type === 'string') {
+        kind = own(definition, 'enum') || own(definition, 'oneOf') ? 'enum' : 'string';
+        allowed = kind === 'enum' ? (own(definition, 'enum') ? ['enum', 'enumNames'] : ['oneOf']) : ['minLength', 'maxLength', 'format'];
+      } else if (type === 'array') { kind = 'multi'; allowed = ['items', 'minItems', 'maxItems']; }
+      else if (type === 'boolean') allowed = [];
+      else if (type === 'number' || type === 'integer') allowed = ['minimum', 'maximum'];
+      else fail('Nested objects or unsupported MCP field types cannot be answered in Web');
+      shape(definition, ['type', 'title', 'description', 'default', ...allowed]);
+      for (const property of ['title', 'description']) if (own(definition, property) && !text(definition[property])) fail('Invalid MCP field label');
+      const field = { ...definition, key, kind, required: required.includes(key) };
+      for (const property of ['minLength', 'maxLength', 'minItems', 'maxItems']) if (own(definition, property) && !bound(definition[property])) fail('Invalid MCP field bounds');
+      for (const property of ['minimum', 'maximum']) if (own(definition, property) && (typeof definition[property] !== 'number' || !Number.isFinite(definition[property]))) fail('Invalid MCP numeric bounds');
+      if ((definition.minLength ?? 0) > Math.min(definition.maxLength ?? 8192, 8192) || (definition.minimum != null && definition.maximum != null && definition.minimum > definition.maximum) || (own(definition, 'format') && !['email', 'uri', 'date', 'date-time'].includes(definition.format))) fail('Unsupported or unsatisfiable MCP field constraints');
+      if (kind === 'enum') field.options = options(definition, 'oneOf', true);
+      if (kind === 'multi') {
+        const items = definition.items;
+        if (own(items || {}, 'enum')) { shape(items, ['type', 'enum']); if (items.type !== 'string') fail('Unsupported MCP array items'); }
+        else shape(items, [own(items || {}, 'anyOf') ? 'anyOf' : 'oneOf']);
+        field.options = options(items, own(items, 'anyOf') ? 'anyOf' : 'oneOf');
+        if ((definition.minItems ?? 0) > Math.min(definition.maxItems ?? 100, field.options.length)) fail('Unsatisfiable MCP selection constraints');
+      }
+      if (own(definition, 'default')) validateValue(field, definition.default);
+      return field;
+    });
+    return { fields };
+  }
+  function validate(params, content) {
+    const { fields } = describe(params);
+    if (!object(content) || Object.keys(content).some(key => !fields.some(field => field.key === key))) fail('MCP form content must contain only requested fields');
+    const result = {};
+    for (const field of fields) {
+      if (!own(content, field.key)) { if (field.required) fail('Required MCP field is missing: ' + field.key); continue; }
+      validateValue(field, content[field.key]);
+      // Field names are untrusted. Define own properties without invoking setters.
+      Object.defineProperty(result, field.key, { value: Array.isArray(content[field.key]) ? [...content[field.key]] : content[field.key], enumerable: true, configurable: true, writable: true });
+    }
+    if (JSON.stringify(result).length > 65536) fail('MCP form content exceeds the response limit');
+    return result;
+  }
+  return { describe, validate };
+}

package/lib/integrations/mcp-url-elicitation.mjs

@@ -0,0 +1,25 @@
+// The same bounded URL contract runs in the responder and browser. Acceptance
+// acknowledges an out-of-band flow; it never proves authentication succeeded.
+export function createMcpUrlValidator() {
+  function fail() {
+    throw Object.assign(new Error('MCP authorization needs a valid HTTPS URL (or loopback HTTP) and elicitation identity'), { code: 'INTERACTION_RESPONSE_INVALID' });
+  }
+  function describe(params) {
+    if (!params || params.mode !== 'url' || typeof params.elicitationId !== 'string' ||
+        !params.elicitationId.trim() || params.elicitationId.length > 512 || /[\u0000-\u001f\u007f]/.test(params.elicitationId) ||
+        typeof params.url !== 'string' || !params.url || params.url.length > 8192 || /[\\\s\u0000-\u001f\u007f]/.test(params.url)) fail();
+    let url;
+    try { url = new URL(params.url); } catch { fail(); }
+    if (url.username || url.password || !url.hostname || !['http:', 'https:'].includes(url.protocol) ||
+        (url.protocol === 'http:' && !['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))) fail();
+    return { href: url.href, origin: url.origin, loopback: ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname) };
+  }
+  return { describe };
+}
+
+// Pending request parameters exist in live memory only. Event histories must
+// not retain authorization URLs, device codes, opaque ids, messages or metadata.
+export function redactMcpUrlInteraction(request) {
+  if (request?.method !== 'mcpServer/elicitation/request' || request.params?.mode !== 'url') return request;
+  return { ...request, params: { mode: 'url', serverName: request.params.serverName } };
+}

package/lib/integrations/native/claude.mjs

@@ -4,6 +4,8 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { createNativeInteractions } from './interactions.mjs';
 import { CliError } from '../../shared/errors.mjs';
+import { claudeUsage } from './telemetry.mjs';
+import { captureSelectedCwdIdentity } from '../../process/selected-cwd-identity.mjs';
 
 const SESSION_MARKERS = new Set([
   'CLAUDECODE', 'CLAUDE_CODE_SESSION_ID', 'CLAUDE_CODE_PARENT_SESSION_ID',
@@ -84,6 +86,7 @@ function withTimeout(promise, timeoutMs, operation) {
 
 // This adapter owns an SDK subprocess. It does not attach to a running TUI.
 export function createClaudeAdapter(options = {}) {
+  const cwdBinding = options.cwd ? captureSelectedCwdIdentity(options.cwd, options.expectedCwdIdentity) : null;
   const capabilities = Object.freeze({
     create: true, resume: true, send: true, observe: true,
     interrupt: true, close: true, steer: false, fork: false, approvals: Boolean(options.interactive), mcp: Boolean(options.mcpServers)
@@ -94,6 +97,7 @@ export function createClaudeAdapter(options = {}) {
   let sessionId = null;
   let requestedSessionId = null;
   let model;
+  let metrics = null, runtimeMetadata = {};
   let queryFunction = options.query;
   let sdkQuery = null;
   let pump = null;
@@ -113,6 +117,7 @@ export function createClaudeAdapter(options = {}) {
       provider: 'claude', status, sessionId,
       turnId: activeTurn?.id || null,
       submissionId: activeTurn?.submissionId || null,
+      metrics, runtimeMetadata: { ...runtimeMetadata },
       capabilities, executorId: interactions.executorId, pendingApprovals: interactions.snapshot()
     };
   }
@@ -180,6 +185,9 @@ export function createClaudeAdapter(options = {}) {
         return;
       }
       sessionId = initializedId;
+      runtimeMetadata = { ...(typeof message.model === 'string' ? { model: message.model } : {}),
+        ...(typeof message.permissionMode === 'string' ? { permissionMode: message.permissionMode } : {}) };
+      emit('metadata', { runtimeMetadata: { ...runtimeMetadata } });
       emit('status', { status, initialized: Boolean(sessionId) });
       return;
     }
@@ -207,6 +215,10 @@ export function createClaudeAdapter(options = {}) {
       return;
     }
     if (message.type !== 'result') return;
+    if (belongs) {
+      const reported = claudeUsage(message, turn.id);
+      if (reported) { metrics = reported; emit('usage', { metrics }, turn); }
+    }
     if (belongs) interactions.expire(turn.id);
     if (!belongs) {
       // Startup errors may precede input consumption and have no UUID echo.
@@ -242,6 +254,7 @@ export function createClaudeAdapter(options = {}) {
     const resumeId = request.sessionId;
     const selectedModel = request.model;
     if (closed) throw new CliError('NATIVE_CLOSED', 'Claude native session is closed');
+    cwdBinding?.assertUnchanged();
     if (opening) return opening;
     if (status !== 'created') {
       if ((resumeId && resumeId !== requestedSessionId) ||
@@ -307,6 +320,7 @@ export function createClaudeAdapter(options = {}) {
     // Assign before invoking the factory so close() can observe and await any
     // in-progress resource creation, including factories that resolve late.
     startupPromise = Promise.resolve().then(async () => {
+      cwdBinding?.assertUnchanged();
       sdkQuery = await queryFunction({
         prompt: inputs,
         options: {
@@ -372,6 +386,7 @@ export function createClaudeAdapter(options = {}) {
       'Claude native session is busy; steering is unsupported. Wait for completion or interrupt it.');
     if (expectedTurnId) throw new CliError('NATIVE_STALE_TURN', 'Claude native session has no active turn to steer');
     if (queryEnded) throw new CliError('NATIVE_SDK_ENDED', 'Claude SDK stream has ended; open a new adapter to resume');
+    cwdBinding?.assertUnchanged();
     const turn = {
       id: randomUUID(), inputId: randomUUID(),
       submissionId: submissionId || randomUUID(), consumed: false,
@@ -384,6 +399,7 @@ export function createClaudeAdapter(options = {}) {
       if (closed || queryEnded || activeTurn !== turn) {
         throw new CliError('NATIVE_SDK_ENDED', 'Claude SDK ended before accepting the submission');
       }
+      cwdBinding?.assertUnchanged();
       inputs.push({
         type: 'user', uuid: turn.inputId,
         ...(sessionId ? { session_id: sessionId } : {}),
@@ -431,12 +447,14 @@ export function createClaudeAdapter(options = {}) {
     // A deadline bounds callers, while the cleanup keeps waiting for a late
     // factory and tears down its resource even if the caller already timed out.
     const cleanup = (async () => {
-      if (opening) await opening.catch(() => {});
-      if (startupPromise) await startupPromise.catch(() => {});
-      await teardownQuery();
-      if (pump) await pump;
-      setStatus('closed', turn ? { cancelled: true } : {}, turn);
-      return snapshot();
+      try {
+        if (opening) await opening.catch(() => {});
+        if (startupPromise) await startupPromise.catch(() => {});
+        await teardownQuery();
+        if (pump) await pump;
+        setStatus('closed', turn ? { cancelled: true } : {}, turn);
+        return snapshot();
+      } finally { cwdBinding?.release(); }
     })();
     closePromise = withTimeout(cleanup, timeoutMs, 'close').catch((error) => {
       // A caller may retry shutdown after the deadline or a teardown failure.