@logicseek/hello-cc 1.1.0-rc.1 → 1.1.0-rc.3

package/lib/core/sessions/hook-root-identity.mjs

@@ -0,0 +1,47 @@
+import path from 'node:path';
+import {
+  assertSelectedCwdSnapshot,
+  captureSelectedCwdSnapshot,
+  sameSelectedCwdIdentity
+} from '../../process/selected-cwd-identity.mjs';
+import { CliError } from '../../shared/errors.mjs';
+
+export const HOOK_ROOT_IDENTITY_ENV = 'HCC_HOOK_ROOT_IDENTITY';
+
+function mismatch() {
+  return new CliError('HOOK_ROOT_IDENTITY_MISMATCH',
+    'Hook project root no longer matches the provider launch identity');
+}
+
+// Carry the launch-time directory identity into short-lived hook children.
+// A pathname alone cannot distinguish a moved project from another directory
+// subsequently installed at the same pathname.
+export function hookRootIdentityValue(root, original = null) {
+  const selected = captureSelectedCwdSnapshot(root);
+  if (original) {
+    if (typeof original.assertUnchanged === 'function') original.assertUnchanged();
+    else assertSelectedCwdSnapshot(original);
+    if (!sameSelectedCwdIdentity(selected, original)) throw mismatch();
+  }
+  return JSON.stringify({ version: 1, ...selected });
+}
+
+export function assertHookRootIdentity(root, value) {
+  if (value === undefined) return false; // Unmanaged and pre-upgrade hooks have no launch marker.
+  try {
+    if (typeof value !== 'string' || value.length > 4096) throw mismatch();
+    const snapshot = JSON.parse(value);
+    if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot) ||
+        snapshot.version !== 1 || snapshot.requested !== path.resolve(root) ||
+        typeof snapshot.canonical !== 'string' || !path.isAbsolute(snapshot.canonical) ||
+        !snapshot.identity || typeof snapshot.identity !== 'object' ||
+        !/^\d+$/.test(snapshot.identity.dev) || !/^\d+$/.test(snapshot.identity.ino) ||
+        (snapshot.identity.birthtimeNs !== null && !/^\d+$/.test(snapshot.identity.birthtimeNs))) {
+      throw mismatch();
+    }
+    assertSelectedCwdSnapshot(snapshot);
+    return snapshot;
+  } catch {
+    throw mismatch();
+  }
+}

package/lib/core/sessions/launch.mjs

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
 import { shortHash } from '../peers/format.mjs';
+import { HOOK_ROOT_IDENTITY_ENV, hookRootIdentityValue } from './hook-root-identity.mjs';
 
 export const WEB_CHILD_ENV = 'HCC_WEB_CHILD';
 export const LAUNCH_FINGERPRINT_ENV = 'HCC_LAUNCH_FINGERPRINT';
@@ -11,6 +12,7 @@ const LAUNCH_ENV_IGNORED_KEYS = new Set([
   '_',
   'COLUMNS',
   'HCC_DB',
+  HOOK_ROOT_IDENTITY_ENV,
   'HCC_NO_AUTO_INSTALL_TMUX',
   'HCC_PEER',
   'HCC_ROOT',
@@ -41,8 +43,12 @@ const LAUNCH_ENV_IGNORED_KEYS = new Set([
   'SSH_AUTH_SOCK'
 ]);
 
-export function childSessionEnv(extra = {}, baseEnv = process.env) {
+export function childSessionEnv(extra = {}, baseEnv = process.env, { rootIdentity = null } = {}) {
   const env = { ...(baseEnv || {}), ...extra };
+  if (Object.hasOwn(extra, 'HCC_ROOT')) {
+    if (extra.HCC_ROOT) env[HOOK_ROOT_IDENTITY_ENV] = hookRootIdentityValue(extra.HCC_ROOT, rootIdentity);
+    else delete env[HOOK_ROOT_IDENTITY_ENV];
+  }
   delete env[WEB_CHILD_ENV];
   delete env.HCC_RUNTIME_LOCAL_ONLY;
   return env;

package/lib/db/connection.mjs

@@ -10,7 +10,8 @@ import { DatabaseSync } from 'node:sqlite';
 import { CliError } from '../shared/errors.mjs';
 import {
   DB_SCHEMA_VERSION,
-  execWithBusyRetry
+  execWithBusyRetry,
+  readSchemaVersion
 } from './schema.mjs';
 import { initSchemaWithBackup } from './migration-backup.mjs';
 import { readProjectRegistry } from '../runtime/projects.mjs';
@@ -18,6 +19,7 @@ import { resolveProjectDatabase, secureExistingProjectStateDirectory } from '../
 import { projectStateDir, legacyProjectStateDir } from '../runtime/paths.mjs';
 import { privateProjectStateDir, ensurePrivateProjectStateDir } from '../runtime/private-state.mjs';
 import { unsafeDirectoryAcl } from '../runtime/project-trust.mjs';
+import { assertSelectedCwdSnapshot } from '../process/selected-cwd-identity.mjs';
 
 const MIGRATION_FAILURE_COOLDOWN_MS = 5 * 60 * 1000;
 
@@ -28,16 +30,40 @@ function managedDatabase(ctx) {
   try { canonicalRoot = fs.realpathSync.native(requestedRoot); } catch {}
   const requestedDb = path.resolve(ctx.dbPath);
   let canonicalCandidate = requestedDb;
-  try {
-    canonicalCandidate = path.join(fs.realpathSync.native(path.dirname(requestedDb)), path.basename(requestedDb));
-  } catch {}
-  return [requestedRoot, canonicalRoot].some(root =>
+  let parent = path.dirname(requestedDb);
+  const missingParents = [];
+  for (;;) {
+    try {
+      canonicalCandidate = path.join(fs.realpathSync.native(parent),
+        ...missingParents, path.basename(requestedDb));
+      break;
+    } catch (error) {
+      if (error?.code !== 'ENOENT' || path.dirname(parent) === parent) break;
+      missingParents.unshift(path.basename(parent));
+      parent = path.dirname(parent);
+    }
+  }
+  const candidates = new Set([requestedDb, canonicalCandidate]);
+  try { candidates.add(fs.realpathSync.native(requestedDb)); } catch {}
+  const within = (parent, candidate) => {
+    const relative = path.relative(parent, candidate);
+    return relative !== '' && relative !== '..' &&
+      !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  };
+  const managed = [requestedRoot, canonicalRoot].some(root =>
     [legacyProjectStateDir(root), privateProjectStateDir(root)].some(stateDir =>
-      [requestedDb, canonicalCandidate].some(db => {
-        const relative = path.relative(stateDir, db);
-        return relative !== '' && relative !== '..' &&
-          !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
-      })));
+      [...candidates].some(db => within(stateDir, db))));
+  if (managed) return true;
+  // A context may have captured A's local or private .hello-cc DB before its
+  // root alias was repointed to B. A reserved state path is never an explicit
+  // external DB just because it no longer belongs to the current root.
+  const reservedStatePath = db => path.dirname(db).split(path.sep).some(segment =>
+    segment.toLowerCase() === '.hello-cc');
+  if ([...candidates].some(reservedStatePath)) {
+    throw new CliError('PROJECT_PATH_FORBIDDEN',
+      `Private database path is not bound to the current project root: ${requestedDb}`);
+  }
+  return false;
 }
 
 function secureOwnedSqliteFile(file, { create = false, readOnly = false, optional = false } = {}) {
@@ -115,6 +141,11 @@ export function createConnectionHelpers({ now, dedupePeerBindings, redactedLogTe
   const migratedRegisteredProjectDbs = new Set();
 
   function connect(ctx, options = {}) {
+    const existingSchema = options.existingSchema === true;
+    if (existingSchema && options.create !== false) {
+      throw new TypeError('existingSchema requires create: false');
+    }
+    if (ctx.initialRootIdentity) assertSelectedCwdSnapshot(ctx.initialRootIdentity);
     let dbPath = ctx.dbPath;
     if (managedDatabase(ctx)) {
       const rootWasMissing = options.create !== false && !fs.existsSync(ctx.root);
@@ -144,20 +175,35 @@ export function createConnectionHelpers({ now, dedupePeerBindings, redactedLogTe
       }
       if (options.create !== false) fs.mkdirSync(path.dirname(dbPath), { recursive: true });
     }
-    const db = new DatabaseSync(dbPath, { timeout: 5000 });
-    db.exec('PRAGMA busy_timeout = 5000;');
-    execWithBusyRetry(db, 'PRAGMA journal_mode = WAL;', { ignoreBusy: true });
-    db.exec('PRAGMA synchronous = NORMAL;');
-    db.exec('PRAGMA wal_autocheckpoint = 1000;');
-    db.exec('PRAGMA foreign_keys = ON;');
-    initSchemaWithBackup(db, dbPath, {
-      beforePostMigrationIndexes: dedupePeerBindings
-    });
-    if (options.migrateRegistered !== false) migrateRegisteredProjectDbs(ctx);
-    return db;
+    const db = new DatabaseSync(dbPath, { timeout: existingSchema ? 0 : 5000 });
+    try {
+      if (existingSchema) {
+        // Shutdown may abandon advisory detachment when another writer owns
+        // the DB. Never migrate, change journal mode, or retry while exiting.
+        db.exec('PRAGMA busy_timeout = 0; PRAGMA foreign_keys = ON;');
+        if (readSchemaVersion(db) !== DB_SCHEMA_VERSION) {
+          throw new CliError('DB_SCHEMA_NOT_CURRENT', 'Shutdown requires an existing current database schema');
+        }
+        return db;
+      }
+      db.exec('PRAGMA busy_timeout = 5000;');
+      execWithBusyRetry(db, 'PRAGMA journal_mode = WAL;', { ignoreBusy: true });
+      db.exec('PRAGMA synchronous = NORMAL;');
+      db.exec('PRAGMA wal_autocheckpoint = 1000;');
+      db.exec('PRAGMA foreign_keys = ON;');
+      initSchemaWithBackup(db, dbPath, {
+        beforePostMigrationIndexes: dedupePeerBindings
+      });
+      if (options.migrateRegistered !== false) migrateRegisteredProjectDbs(ctx);
+      return db;
+    } catch (error) {
+      try { db.close(); } catch {}
+      throw error;
+    }
   }
 
   function connectReadOnly(ctx) {
+    if (ctx.initialRootIdentity) assertSelectedCwdSnapshot(ctx.initialRootIdentity);
     const managed = managedDatabase(ctx);
     const dbPath = managed
       ? resolveProjectDatabase({ root: ctx.root, db: ctx.dbPath, createStateDir: false }).db

package/lib/diagnostics/codex-protocol.mjs

@@ -0,0 +1,105 @@
+import { CODEX_INTERACTION_METHODS } from '../integrations/codex-interactions.mjs';
+
+// A bounded upgrade gate, not a JSON Schema validator or a runtime permission
+// check. Generated types remain the authoritative version-specific artifacts.
+export const CODEX_CLIENT_METHODS = Object.freeze([
+  'initialize', 'thread/start', 'thread/resume', 'thread/read', 'thread/list',
+  'thread/fork', 'turn/start', 'turn/steer', 'turn/interrupt',
+  'mcpServerStatus/list', 'mcpServer/tool/call', 'account/read', 'account/rateLimits/read'
+]);
+export const CODEX_NOTIFICATION_METHODS = Object.freeze([
+  'thread/started', 'thread/status/changed', 'turn/started', 'turn/completed',
+  'turn/plan/updated', 'turn/diff/updated', 'item/started', 'item/completed',
+  'item/agentMessage/delta', 'serverRequest/resolved', 'error',
+  'account/updated', 'account/login/completed', 'account/rateLimits/updated'
+]);
+const ACCOUNT_SCHEMA_FILES = ['GetAccountParams', 'GetAccountResponse', 'GetAccountRateLimitsResponse',
+  'AccountUpdatedNotification', 'AccountLoginCompletedNotification', 'AccountRateLimitsUpdatedNotification'];
+export const CODEX_PROTOCOL_SCHEMA_FILES = Object.freeze([
+  'ClientRequest', 'ClientNotification', 'ServerRequest', 'ServerNotification',
+  'CommandExecutionRequestApprovalResponse', 'FileChangeRequestApprovalResponse',
+  'PermissionsRequestApprovalResponse', 'ToolRequestUserInputResponse',
+  'McpServerElicitationRequestParams', 'McpServerElicitationRequestResponse',
+  ...ACCOUNT_SCHEMA_FILES
+]);
+// Official account schemas are generated only in the versioned v2 directory.
+export const CODEX_PROTOCOL_SCHEMA_PATHS = Object.freeze(Object.fromEntries(CODEX_PROTOCOL_SCHEMA_FILES
+  .map(name => [name, (ACCOUNT_SCHEMA_FILES.includes(name) ? 'v2/' : '') + name + '.json'])));
+
+function methods(schema) {
+  return (schema?.oneOf || []).flatMap(row => row.properties?.method?.enum || []);
+}
+function enumValues(schema, document, seen = new Set()) {
+  if (!schema || typeof schema !== 'object') return [];
+  if (schema.$ref) {
+    const ref = schema.$ref;
+    if (seen.has(ref) || !ref.startsWith('#/definitions/')) return [];
+    const next = new Set(seen); next.add(ref);
+    return enumValues(document.definitions?.[ref.slice('#/definitions/'.length)], document, next);
+  }
+  return [...(schema.enum || []), ...(Object.hasOwn(schema, 'const') ? [schema.const] : []),
+    ...['oneOf', 'anyOf', 'allOf'].flatMap(key => (schema[key] || []).flatMap(row => enumValues(row, document, seen)))];
+}
+
+export function inspectCodexProtocol(schemas) {
+  const checks = [];
+  const check = (contract, ok) => checks.push({ contract, status: ok ? 'pass' : 'fail' });
+  for (const [file, expected] of [
+    ['ClientRequest', CODEX_CLIENT_METHODS], ['ClientNotification', ['initialized']],
+    ['ServerRequest', [...CODEX_INTERACTION_METHODS]], ['ServerNotification', CODEX_NOTIFICATION_METHODS]
+  ]) {
+    const available = methods(schemas[file]);
+    for (const method of expected) check(`${file}: ${method}`, available.includes(method));
+  }
+  for (const [file, fields] of [
+    ['CommandExecutionRequestApprovalResponse', ['decision']],
+    ['FileChangeRequestApprovalResponse', ['decision']],
+    ['PermissionsRequestApprovalResponse', ['permissions', 'scope']],
+    ['ToolRequestUserInputResponse', ['answers']],
+    ['McpServerElicitationRequestResponse', ['action', 'content']]
+  ]) {
+    const schema = schemas[file];
+    check(`${file}: response fields`, fields.every(field => Object.hasOwn(schema?.properties || {}, field)));
+    // HCC never supplies unknown required response fields. Optional extensions
+    // are compatible with this gate; new required fields demand adapter review.
+    check(`${file}: no new required response fields`, Boolean(schema) && (schema.required || []).every(field => fields.includes(field)));
+  }
+  for (const [file, field, expected] of [
+    ['CommandExecutionRequestApprovalResponse', 'decision', ['accept', 'decline', 'cancel']],
+    ['FileChangeRequestApprovalResponse', 'decision', ['accept', 'decline', 'cancel']],
+    ['PermissionsRequestApprovalResponse', 'scope', ['turn', 'session']],
+    ['McpServerElicitationRequestResponse', 'action', ['accept', 'decline', 'cancel']]
+  ]) {
+    const values = enumValues(schemas[file]?.properties?.[field], schemas[file] || {});
+    check(`${file}: ${field} choices`, expected.every(value => values.includes(value)));
+  }
+  const elicitation = schemas.McpServerElicitationRequestParams;
+  check('MCP elicitation: thread and server identity',
+    ['threadId', 'serverName'].every(field => elicitation?.required?.includes(field)) &&
+    Object.hasOwn(elicitation?.properties || {}, 'turnId'));
+  for (const [mode, fields] of [['form', ['message', 'mode', 'requestedSchema']], ['url', ['message', 'mode', 'elicitationId', 'url']]]) {
+    check(`MCP elicitation: ${mode} identity and payload`, Boolean(elicitation?.oneOf?.some(row =>
+      row.properties?.mode?.enum?.includes(mode) && fields.every(field => row.required?.includes(field) && Object.hasOwn(row.properties || {}, field)))));
+  }
+  check('Account read: explicit nonrefreshing option', schemas.GetAccountParams?.properties?.refreshToken?.type === 'boolean' &&
+    (schemas.GetAccountParams?.required || []).every(field => field === 'refreshToken'));
+  check('Account read: auth requirement is explicit', schemas.GetAccountResponse?.required?.includes('requiresOpenaiAuth') &&
+    schemas.GetAccountResponse?.properties?.requiresOpenaiAuth?.type === 'boolean');
+  check('Account read: recognized account types', ['apiKey', 'chatgpt', 'amazonBedrock'].every(type =>
+    schemas.GetAccountResponse?.definitions?.Account?.oneOf?.some(row => row.properties?.type?.enum?.includes(type))));
+  check('Account limits: historical and multi-bucket fields', ['rateLimits', 'rateLimitsByLimitId'].every(field =>
+    Object.hasOwn(schemas.GetAccountRateLimitsResponse?.properties || {}, field)));
+  check('Account limits: window percentage', schemas.GetAccountRateLimitsResponse?.definitions?.RateLimitWindow?.required?.includes('usedPercent') &&
+    ['integer', 'number'].includes(schemas.GetAccountRateLimitsResponse?.definitions?.RateLimitWindow?.properties?.usedPercent?.type));
+  check('Account notifications: status and quota fields', Object.hasOwn(schemas.AccountUpdatedNotification?.properties || {}, 'authMode') &&
+    Object.hasOwn(schemas.AccountUpdatedNotification?.properties || {}, 'planType') && schemas.AccountRateLimitsUpdatedNotification?.required?.includes('rateLimits'));
+  check('Account notification: correlated login completion', schemas.AccountLoginCompletedNotification?.required?.includes('success') &&
+    Object.hasOwn(schemas.AccountLoginCompletedNotification?.properties || {}, 'loginId'));
+  const unsupportedServerRequests = methods(schemas.ServerRequest).filter(method => !CODEX_INTERACTION_METHODS.has(method)).sort();
+  return {
+    status: checks.every(entry => entry.status === 'pass') ? 'compatible' : 'incompatible',
+    checks, unsupportedServerRequests,
+    scope: 'Method presence, response fields and choices, MCP form/URL identity, and read-only account/quota fields; not full schema or runtime validation.',
+    inferenceCalled: false, accountAccessed: false
+  };
+}

package/lib/guidance.mjs

@@ -1,6 +1,7 @@
-import fs from 'node:fs';
-import path from 'node:path';
 import { resolveProjectDatabase } from './runtime/project-path.mjs';
+import { writeProjectGuidanceFiles, removeProjectGuidanceFiles } from './process/pinned-guidance.mjs';
+import { writePinnedProjectGuidance } from './process/pinned-project-state.mjs';
+import { captureSelectedCwdIdentity } from './process/selected-cwd-identity.mjs';
 
 export function guidanceMarkdown() {
   return `# hello-cc Coordination Rules
@@ -84,41 +85,24 @@ Before stopping:
 `;
 }
 
-export function writeGuidance(root) {
-  const stateDir = resolveProjectDatabase({ root, createStateDir: true }).stateDir;
-  const guidePath = path.join(stateDir, 'HCC.md');
-  const content = guidanceMarkdown();
-  fs.writeFileSync(guidePath, content);
-  const clause = `\n<!-- hello-cc:start -->\n\n${content}\n<!-- hello-cc:end -->\n`;
-  for (const file of ['CLAUDE.md', 'AGENTS.md']) {
-    const target = path.join(root, file);
-    if (!fs.existsSync(target)) {
-      fs.writeFileSync(target, clause.trimStart());
-      continue;
-    }
-    const existing = fs.readFileSync(target, 'utf8');
-    const updated = existing.includes('<!-- hello-cc:start -->')
-      ? existing.replace(/<!-- hello-cc:start -->[\s\S]*?<!-- hello-cc:end -->/, clause.trim())
-      : `${existing.trimEnd()}\n${clause}`;
-    fs.writeFileSync(target, updated);
+export function writeGuidance(root, options = {}) {
+  const selectedRoot = captureSelectedCwdIdentity(root, options.expectedSnapshot);
+  let selectedState;
+  try {
+    const stateDir = resolveProjectDatabase({ root, createStateDir: true }).stateDir;
+    selectedState = captureSelectedCwdIdentity(stateDir);
+    selectedRoot.assertUnchanged();
+    const content = guidanceMarkdown();
+    writeProjectGuidanceFiles(root, content, { ...options, expectedBinding: selectedRoot });
+    selectedRoot.assertUnchanged();
+    return writePinnedProjectGuidance(stateDir, content, selectedState,
+      { spawnProcess: options.stateSpawnProcess });
+  } finally {
+    selectedState?.release();
+    selectedRoot.release();
   }
-  return guidePath;
 }
 
-export function removeGuidanceBlocks(root) {
-  const changed = [];
-  for (const file of ['CLAUDE.md', 'AGENTS.md']) {
-    const target = path.join(root, file);
-    if (!fs.existsSync(target)) continue;
-    const existing = fs.readFileSync(target, 'utf8');
-    const updated = existing
-      .replace(/\n?<!-- hello-cc:start -->[\s\S]*?<!-- hello-cc:end -->\n?/g, '\n')
-      .replace(/\n{3,}/g, '\n\n')
-      .trimEnd();
-    if (updated !== existing) {
-      fs.writeFileSync(target, updated ? `${updated}\n` : '');
-      changed.push(target);
-    }
-  }
-  return changed;
+export function removeGuidanceBlocks(root, options = {}) {
+  return removeProjectGuidanceFiles(root, options);
 }

package/lib/integrations/codex-account.mjs

@@ -0,0 +1,143 @@
+// Read-only projection of official App Server account and quota data. Never
+// forward emails, credential identifiers, tokens, raw errors or unknown fields.
+const PLANS = new Set(['free', 'go', 'plus', 'pro', 'prolite', 'team',
+  'self_serve_business_usage_based', 'business', 'enterprise_cbp_usage_based', 'enterprise', 'edu', 'unknown']);
+const TYPES = new Set(['apiKey', 'chatgpt', 'amazonBedrock']);
+const REASONS = new Set(['rate_limit_reached', 'workspace_owner_credits_depleted', 'workspace_member_credits_depleted',
+  'workspace_owner_usage_limit_reached', 'workspace_member_usage_limit_reached']);
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const finite = value => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+const integer = value => Number.isSafeInteger(value) && value >= 0;
+const bucketId = value => typeof value === 'string' && /^[A-Za-z0-9_.-]{1,80}$/.test(value) ? value : null;
+
+function windowValue(value) {
+  if (!record(value) || !finite(value.usedPercent)) return null;
+  return { usedPercent: value.usedPercent,
+    resetsAt: integer(value.resetsAt) ? value.resetsAt : null,
+    windowDurationMins: integer(value.windowDurationMins) && value.windowDurationMins > 0 ? value.windowDurationMins : null };
+}
+function bucketValue(value, id = null) {
+  if (!record(value)) return null;
+  const primary = windowValue(value.primary), secondary = windowValue(value.secondary);
+  const credits = record(value.credits) && typeof value.credits.hasCredits === 'boolean' && typeof value.credits.unlimited === 'boolean'
+    ? { hasCredits: value.credits.hasCredits, unlimited: value.credits.unlimited } : null;
+  if (!primary && !secondary && !credits && !REASONS.has(value.rateLimitReachedType)) return null;
+  return { id: bucketId(id) || bucketId(value.limitId), primary, secondary, credits,
+    planType: PLANS.has(value.planType) ? value.planType : null,
+    reached: REASONS.has(value.rateLimitReachedType) ? value.rateLimitReachedType : null };
+}
+function unavailableReason(error) {
+  return error?.code === -32601 || (error?.extra?.rpcCode ?? error?.extra?.rpc_code) === -32601 ? 'unsupported' : 'unavailable';
+}
+function accountValue(value) {
+  if (!record(value) || typeof value.requiresOpenaiAuth !== 'boolean' ||
+      (value.account != null && (!record(value.account) || !TYPES.has(value.account.type)))) return null;
+  const type = value.account?.type || null;
+  return { requiresOpenaiAuth: value.requiresOpenaiAuth, type,
+    planType: type === 'chatgpt' && PLANS.has(value.account.planType) ? value.account.planType : null,
+    authentication: value.requiresOpenaiAuth === false ? 'providerManaged' : type ? 'authenticated' : 'required' };
+}
+
+export function createCodexAccountState({ request, onChange = () => {}, now = Date.now } = {}) {
+  let state = { status: 'unknown', stale: false, reason: null, type: null, planType: null,
+    authentication: 'unknown', requiresOpenaiAuth: null, checkedAt: null,
+    rateLimits: { status: 'unknown', stale: false, reason: null, checkedAt: null, buckets: [] } };
+  let accountRevision = 0, limitsRevision = 0, inFlight = null, closed = false, recheck = false;
+  const snapshot = () => structuredClone(state);
+  const publish = () => { try { onChange(snapshot()); } catch {} };
+  function relevantLimits() { return state.status === 'ready' && state.type === 'chatgpt' && state.requiresOpenaiAuth === true; }
+  function notification(method, params = {}) {
+    if (!['account/updated', 'account/rateLimits/updated', 'account/login/completed'].includes(method)) return false;
+    if (closed) return true;
+    if (method !== 'account/rateLimits/updated') {
+      // Account changes can precede a read reply. That older response cannot
+      // reattach the previous account's quotas to the current executor.
+      accountRevision++; limitsRevision++; recheck = true;
+      state = { ...state, status: 'unknown', stale: true, reason: null, type: null, planType: null,
+        authentication: 'unknown', requiresOpenaiAuth: null,
+        rateLimits: { status: 'unknown', stale: false, reason: null, checkedAt: null, buckets: [] } };
+      publish();
+      queueMicrotask(() => { if (!closed && !inFlight) void refresh(); });
+      return true;
+    }
+    if (!relevantLimits()) return true;
+    const next = bucketValue(params.rateLimits);
+    if (!next) return true;
+    limitsRevision++;
+    const buckets = state.rateLimits.buckets.slice();
+    if (next.id === null && buckets.length === 1) next.id = buckets[0].id;
+    if (next.id === null && buckets.length > 1 && !buckets.some(entry => entry.id === null)) return true;
+    const index = buckets.findIndex(entry => entry.id === next.id);
+    if (index < 0) { if (buckets.length < 16) buckets.push(next); }
+    else {
+      const previous = buckets[index];
+      // Rolling updates are sparse. Null metadata/windows mean unavailable in
+      // this update, not a quota of zero or a request to erase the prior value.
+      buckets[index] = Object.fromEntries(Object.keys(next).map(key => [key,
+        ['primary', 'secondary'].includes(key) && next[key] && previous[key]
+          ? Object.fromEntries(Object.keys(next[key]).map(field => [field, next[key][field] ?? previous[key][field]]))
+          : next[key] ?? previous[key]]));
+    }
+    state.rateLimits = { status: 'ready', stale: false, reason: null, checkedAt: now(), buckets };
+    publish(); return true;
+  }
+  async function read() {
+    const revision = accountRevision;
+    recheck = false;
+    let value;
+    try { value = accountValue(await request('account/read', { refreshToken: false }));
+      if (!value) throw Object.assign(new Error('Invalid account response'), { code: 'CODEX_ACCOUNT_PROTOCOL_ERROR' });
+    } catch (error) {
+      if (!closed && revision === accountRevision) {
+        state.status = 'unavailable'; state.stale = state.checkedAt !== null; state.reason = unavailableReason(error);
+        state.authentication = 'unknown';
+        state.rateLimits = { ...state.rateLimits, status: 'unavailable', stale: state.rateLimits.checkedAt !== null, reason: 'unavailable' };
+        publish();
+      }
+      return snapshot();
+    }
+    if (closed || revision !== accountRevision) return snapshot();
+    state = { ...state, ...value, status: 'ready', stale: false, reason: null, checkedAt: now() };
+    if (!relevantLimits()) {
+      state.rateLimits = { status: 'notApplicable', stale: false, reason: null, checkedAt: null, buckets: [] };
+      publish(); return snapshot();
+    }
+    publish();
+    const quotaRevision = limitsRevision;
+    try {
+      const response = await request('account/rateLimits/read', {});
+      if (!record(response) || !record(response.rateLimits)) throw new Error('Invalid quota response');
+      const entries = record(response.rateLimitsByLimitId) ? Object.entries(response.rateLimitsByLimitId)
+        .filter(([id]) => bucketId(id)).slice(0, 16).map(([id, bucket]) => bucketValue(bucket, id)).filter(Boolean) : [];
+      const legacy = bucketValue(response.rateLimits);
+      const buckets = entries.length ? entries : legacy ? [legacy] : [];
+      if (!closed && revision === accountRevision && quotaRevision === limitsRevision) {
+        state.rateLimits = { status: buckets.length ? 'ready' : 'unavailable', stale: false,
+          reason: buckets.length ? null : 'unavailable', checkedAt: buckets.length ? now() : null, buckets };
+        publish();
+      }
+    } catch (error) {
+      if (!closed && revision === accountRevision && quotaRevision === limitsRevision) {
+        state.rateLimits = { ...state.rateLimits, status: 'unavailable', stale: state.rateLimits.checkedAt !== null, reason: unavailableReason(error) };
+        publish();
+      }
+    }
+    return snapshot();
+  }
+  function refresh() {
+    if (closed) return Promise.resolve(snapshot());
+    if (inFlight) return inFlight;
+    inFlight = read().finally(() => {
+      inFlight = null;
+      if (recheck && !closed) queueMicrotask(() => { if (!inFlight && !closed) void refresh(); });
+    });
+    return inFlight;
+  }
+  function close() {
+    closed = true; accountRevision++; limitsRevision++;
+    state.status = 'unavailable'; state.stale = state.checkedAt !== null; state.reason = 'disconnected';
+    state.authentication = 'unknown';
+    state.rateLimits = { ...state.rateLimits, status: 'unavailable', stale: state.rateLimits.checkedAt !== null, reason: 'disconnected' };
+  }
+  return { snapshot, refresh, notification, close };
+}

package/lib/integrations/dsh-collaboration.mjs

@@ -16,7 +16,7 @@ import { createCoordinationState } from '../coordination-state.mjs';
 import { createScopedMcpTools } from '../mcp/tools.mjs';
 import { resolveProjectDatabase } from '../runtime/project-path.mjs';
 import { registerProjectActivity } from '../runtime/projects.mjs';
-import { inspectProcessIdentity } from '../process/identity.mjs';
+import { compareProcessIdentity, inspectProcessIdentity } from '../process/identity.mjs';
 
 const fail = (message) => { throw new CliError('DSH_COLLABORATION_CONFLICT', message); };
 
@@ -29,9 +29,8 @@ function verifiedDeadOwner(peer) {
   // A recycled PID has a different start token. A changed command alone does
   // not prove the original process exited (a live process may change its title).
   return observed.state === 'live' && observed.identity?.pid === peer.pid &&
-    typeof observed.identity.startToken === 'string' &&
-    typeof observed.identity.commandHash === 'string' && /^[a-f0-9]{64}$/.test(observed.identity.commandHash) &&
-    observed.identity.startToken !== peer.pid_start_token;
+    compareProcessIdentity({ pid: peer.pid, startToken: peer.pid_start_token,
+      commandHash: peer.pid_command_hash }, observed.identity) === 'dead';
 }
 
 // One in-process authority per Agent. All mutations still go through the same

package/lib/integrations/dsh.mjs

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
 import { createHash, randomUUID } from 'node:crypto';
-import { spawn } from 'node:child_process';
+import { spawnPinnedCwdProcess } from '../process/pinned-cwd.mjs';
 import { fileURLToPath } from 'node:url';
 import { CliError } from '../shared/errors.mjs';
 import { withFileLock } from '../shared/file-lock.mjs';
@@ -271,7 +271,9 @@ export async function launchDshWeb(ctx, options = {}) {
   const env = createDshEnvironment(options.env || process.env, { dshHome: options.dshHome, cwd: ctx.cwd });
   const args = ['web', '--patch', setup.patchPath, ...(options.args || [])];
   return new Promise((resolve, reject) => {
-    const child = spawn(binary, args, { cwd: setup.root, env, stdio: options.stdio || 'inherit' });
+    const child = spawnPinnedCwdProcess(binary, args, {
+      cwd: setup.root, env, stdio: options.stdio || 'inherit'
+    });
     const handlers = new Map();
     const cleanup = () => {
       for (const signal of handlers.keys()) process.removeListener(signal, handlers.get(signal));