@logicseek/hello-cc 1.1.0-rc.3 → 1.1.0-rc.4

package/CHANGELOG.md

@@ -16,6 +16,45 @@ the release description from the current changelog section. Use
 `npm run release:github` with `GH_TOKEN` or `GITHUB_TOKEN` only for local
 backfills.
 
+## 1.1.0-rc.4
+
+### Summary
+
+This preview adds guarded forks for owned Codex and Claude sessions, durable
+submission retries, and a persisted Codex read-only policy. It retains the
+session isolation and shutdown fixes from rc.3.
+
+### Highlights
+
+- Fork an idle, owned Codex or Claude session into a distinct worker and provider
+  session. Pending approvals, unresolved deliveries and changing parent bindings
+  prevent a fork. DeepSeek Harness does not currently support native fork.
+- Create Codex workers with `--sandbox read-only`. Resumes and forks retain the
+  saved policy; approval escalation and HCC scoped MCP are disabled for these
+  workers. Codex must confirm the policy before the worker becomes available.
+  This is a provider filesystem sandbox, not an all-tools or network guarantee.
+- Retry an unconfirmed Web submission with its original ID and message after
+  reviewing its receipts. A later edited draft remains intact. Retries require
+  current control and the original executor identity. Older pending records
+  without the required identity remain available for manual review only.
+- Persist the message and its retry identity together; repair the delivery
+  record after interruption without creating a second message. Uncertain
+  provider execution is never automatically replayed.
+- Refresh late DeepSeek Harness tool input on the existing approval request,
+  preserving its identity and oversized-input restrictions.
+- Disable split views when the page lacks the browser session required by its
+  embedded pane. Keep saved layouts for a later authenticated page.
+- Distinguish the active runtime's clock observation from manual GC mutations
+  in regression checks while requiring all other metadata to remain unchanged.
+
+### Validation
+
+Validation covers policy persistence, legacy-runtime refusal, fork inheritance,
+submission recovery and browser retry behavior with later draft edits. Source,
+installed-package, CI and real-provider results retain separate receipts; prior
+historical connection-reset and provider failures are not reclassified by a
+passing retry. Existing frozen release archives remain unchanged.
+
 ## 1.1.0-rc.3
 
 ### Summary

package/docs/native.md

@@ -16,6 +16,41 @@ multiple pending inbox messages into the same turn. ACP resume and session close
 depend on the extensions the provider advertises. HCC does not claim that an ACP
 resume replays the original conversation transcript.
 
+## Session fork and retries with the original ID
+
+`hcc native fork --parent codex-reviewer --peer codex-branch` invokes the provider's
+session fork. Codex uses `thread/fork`; Claude uses the optional SDK's
+`forkSession`. The child receives a distinct session ID, executor, delivery records
+and subsequent history, plus its own MCP scope when the sandbox permits HCC tools.
+The parent keeps its identity. After
+closing the child, `native start --peer codex-branch --provider codex --resume
+last` resumes the child session. Fork inherits the parent's working directory
+and verifies its identity; pending inbox messages and permission grants are not
+copied.
+
+Only saved HCC-owned native sessions can fork. The parent must be idle or
+explicitly closed, without an active turn, pending approval, queued message or
+unresolved delivery. Parent send, close and inbox dispatch are fenced while
+forking. Existing TUI/Desktop sessions are outside this scope. A Claude SDK
+without `forkSession` reports unsupported capability. DeepSeek Harness
+0.2.0-rc.2 ACP does not implement fork; HCC does not replay a transcript to
+simulate native fork.
+
+A new message may use a unique `--submission-id` containing 8–100 letters,
+digits, underscores or hyphens. After a lost receipt, inspect `native
+deliveries`, then retry the same worker, sender, task and body with the original
+ID. Matching retries return the original durable receipt; changed payloads or
+targets are rejected. The project database commits the message and submission
+ID together. If the native delivery projection was not yet saved, retry or
+worker recovery repairs the original delivery while retaining local user
+origin. Retrying an existing `uncertain` delivery does not replay execution.
+
+Web offers **Retry same submission** for an unconfirmed send. Explicit
+confirmation follows receipt inspection, and the retry must retain the original
+executor and body. Later draft edits are preserved. Executor or project changes
+disable the old retry. Missing durable pending records or expired messages are
+rejected rather than sent as new work.
+
 ## Requirements
 
 Use Node.js 24 or later and a provider installed and authenticated in the same
@@ -121,12 +156,56 @@ message bus even when `--cwd DIR` selects another working directory. `--model
 MODEL` selects a provider-supported model. `--binary PATH` overrides the Codex
 or dsh executable. Claude uses the SDK and rejects `--binary`.
 
+### Codex read-only file sandbox
+
+```sh
+hcc native start --peer codex-readonly --provider codex --sandbox read-only
+hcc native close --peer codex-readonly
+hcc native start --peer codex-readonly --provider codex --resume last
+```
+
+Only Codex accepts `--sandbox read-only|workspace-write`. New sessions default to
+the existing `workspace-write` behavior. Resume inherits the stored policy when
+omitted and rejects a different explicit policy; use a new worker for a different
+policy. Legacy saved Codex workers migrate to their original workspace-write mode.
+Retries before a session exists inherit the selected policy unless explicitly changed. Before
+creating/resuming a Codex worker, both CLI and Web require the runtime's sandbox-policy
+protocol version. It refuses an older daemon before sending a create request and
+does not restart it automatically. Creation is bound to the just-verified runtime
+generation; a missing identity or instance replacement rejects the request without
+following the successor or retrying. After existing project work finishes, stop the
+old runtime and start it with this version. Older runtime code cannot enforce the
+new stored policy; downgrade execution is outside this read-only guarantee.
+Web can still inspect or close a legacy worker, but refuses Codex send/respond
+when its fresh snapshot has no sandbox policy. Read-only workers must also report
+provider verification before those actions. Web mutations are bound to the runtime
+generation observed immediately before admission.
+
+Read-only fixes approval policy to `never`, requests `readOnly` and disabled
+sandbox network for each new turn, and denies command/file/permission escalation
+and MCP elicitation. Ordinary user questions remain available. Start/resume fail
+closed if the provider does not report the requested policy, or if a resumed
+thread already has an active turn. Forks require the same checks. `sandboxVerified` means matching provider
+readback, not independent proof of operating-system enforcement.
+
+HCC does not inject its scoped mutation MCP or command instructions into a
+read-only worker. Its control plane still records messages, replies, delivery
+receipts and audit events. The provider file sandbox does not make every external
+service, user-configured MCP server or hook read-only; strict acceptance still
+needs a private HOME without external tools. This policy is separate from the Web
+viewer/control lease: a controller may still submit a review to a read-only worker.
+
+Available since `1.1.0-rc.4`. Native Web snapshots retain `sandbox` and
+`sandboxVerified`. Choose the read-only policy with the CLI. Native forks inherit the saved parent
+policy and cannot override it; the child is independently verified before use.
+
 | Command | Options / behavior |
 | --- | --- |
 | `hcc native up` | Start or reuse the project's background runtime |
 | `hcc native status` | Inspect persisted worker state and runtime identity |
-| `hcc native start` | Required `--peer NAME --provider codex\|claude\|dsh`; optional `--cwd DIR --model MODEL --resume last`; `--binary PATH` is available only for Codex and dsh |
-| `hcc native send` | Required `--peer NAME --body TEXT`; optional `--from NAME --task ID`; returns a durable message/submission receipt |
+| `hcc native start` | Required `--peer NAME --provider codex\|claude\|dsh`; optional `--cwd DIR --model MODEL --resume last`; `--binary PATH` is available only for Codex and dsh; `--sandbox read-only\|workspace-write` is Codex-only |
+| `hcc native fork` | Required `--parent NAME --peer NEW_NAME`; optional `--model MODEL --binary PATH`; forks an HCC-owned Codex or Claude session into a new worker |
+| `hcc native send` | Required `--peer NAME --body TEXT`; optional `--from NAME --task ID --submission-id ID`; returns a durable message/submission receipt |
 | `hcc native deliveries` | Optional `--peer NAME`; inspect delivery receipts |
 | `hcc native events` | Required `--peer NAME`; optional `--after ID`; inspect a bounded event history |
 | `hcc native requests` | Requires `--peer NAME`; inspect pending requests bound to this executor, session and turn |

package/docs/native.zh-CN.md

@@ -14,6 +14,34 @@ Native 模式运行由 HCC 创建并持有的后台 worker。共享 peer、任
 不代表 host 会把多条待处理消息塞进同一个 turn。ACP 的 resume 和 session close
 取决于 provider 声明的扩展；不能把 ACP resume 等同于重放原始会话历史。
 
+## 会话 fork 与原 ID 重试
+
+`hcc native fork --parent codex-reviewer --peer codex-branch` 使用 provider 自身的
+会话 fork。Codex 通过 `thread/fork`，Claude 通过可选 SDK 的 `forkSession` 创建
+新的会话 ID；子 worker 有独立 executor、消息投递记录和后续历史，策略允许 HCC
+工具时也有独立 MCP scope。
+父会话仍保留原身份；关闭子 worker 后可用 `native start --peer codex-branch
+--provider codex --resume last` 恢复子会话。fork 继承父会话的工作目录，并复核目录
+身份，不复制父 worker 的未决 inbox 或权限批准。
+
+只能 fork HCC 持有且保存了会话 ID 的 native worker。父 worker 必须空闲或已明确
+关闭，无活动 turn、待审批请求、排队或结果不明的投递；fork 期间暂停父 worker
+的发送、关闭和 inbox 分发。已有 TUI/Desktop 会话不在此范围内。Claude SDK
+缺少 `forkSession` 时明确报不支持。DeepSeek Harness 0.2.0-rc.2 的 ACP 实现未提供
+fork；HCC 不用 transcript 重放冒充原生 fork。
+
+每条新消息可指定唯一的 `--submission-id`，格式为 8–100 个英文字母、数字、下划线
+或连字符。遇到回执丢失时先查 `native deliveries`，然后对同一 worker、sender、task
+和正文沿用原 ID 重试。相同 ID 返回原持久回执，正文或目标变化会被拒绝。项目
+数据库同时保存消息和 submission ID；若消息已提交而 native 投递记录尚未写入，
+重试或 worker 恢复会补齐原记录，保留用户请求来源。已有 `uncertain` 投递不会
+因为重试被自动重放。
+
+Web 遇到未确认提交时提供“沿用原提交重试”。此操作需核对持久回执后明确确认，
+并保持原执行器身份与原正文；之后编辑的草稿会保留。执行器或项目变化时禁用原
+提交重试。没有匹配的持久 pending 记录、或原消息已被清理时拒绝重试；不会把
+原 ID 当作新工作发送。
+
 ## 环境准备
 
 需要 Node.js 24 或更新版本，并在运行 HCC 的同一环境中安装、登录对应 provider。
@@ -103,12 +131,50 @@ hcc msg inbox --peer coordinator
 `--binary PATH` 覆盖 Codex 或 dsh 可执行文件。Claude 使用 SDK，传入 `--binary`
 会直接报错。
 
+### Codex 文件只读沙箱
+
+```sh
+hcc native start --peer codex-readonly --provider codex --sandbox read-only
+# 关闭后恢复原会话时继承已保存的策略；不要改成 workspace-write。
+hcc native close --peer codex-readonly
+hcc native start --peer codex-readonly --provider codex --resume last
+```
+
+`--sandbox` 仅支持 Codex 的 `read-only` 和 `workspace-write`。新会话未指定时保持
+`workspace-write`；恢复时未指定则继承存储策略，显式不同的策略会被拒绝，需要另建
+worker。旧版本记录迁移为原有 `workspace-write` 行为；无权限推断或自动升级。
+首次初始化尚未建立会话时，重试默认继承已选择策略，也可显式更改。CLI 与 Web 创建／恢复 Codex worker
+前检查后台服务的沙箱协议版本；旧服务不支持时在发送创建请求前拒绝，不自动重启。
+创建请求绑定刚核实的 runtime generation；期间实例被替换或身份缺失时拒绝发送，
+不会跟随新实例自动重试。
+应等项目任务结束后由用户停止旧 runtime，再以新版本启动。不要用旧版本 runtime
+读取新版本只读记录：旧代码不了解该策略，回退执行不属于只读保障。
+Web 仍可查看或关闭旧 worker；其最新快照不含沙箱策略时，拒绝 Codex 发送和回答审批／问题。
+只读 worker 还必须回报 provider 已校验策略，才能执行这两类操作。Web 写请求绑定准入前
+刚读取的 runtime generation，不会自动跟随替换实例。
+
+只读模式固定 `approvalPolicy: never`，每个新 turn 显式请求 `readOnly`、关闭沙箱网络，
+拒绝命令／文件／权限提升和 MCP 授权表单；普通用户问题仍可回答。启动／恢复要求
+provider 回报相符策略，否则关闭自有连接并报错；fork 子会话执行相同校验。已有活动 turn 的只读恢复也拒绝，
+不能用新策略为正在执行的旧 turn 作保证。`sandboxVerified` 仅表示 provider 回报匹配，
+不是一份操作系统行为证明。
+
+HCC 不为只读 worker 注入自有的任务／锁／结果写操作 MCP，也不提示模型执行 HCC
+写命令。HCC 控制面仍保存消息、回复、投递和审计。Codex 的文件沙箱不等于所有外部
+服务或用户配置的 MCP／hooks 都只读；严格隔离验收仍须独立 HOME、无外部工具。
+它也不同于网页“观察／控制”权限：控制者仍可向只读 worker 发送审阅请求。
+
+此功能自 `1.1.0-rc.4` 起提供。Web 的 native 快照会保留 `sandbox` 与 `sandboxVerified`。
+请通过 CLI 选择只读策略。
+原生 fork 继承父会话的持久化策略，不能覆盖或提升；子会话启用前会独立校验。
+
 | 命令 | 参数与作用 |
 | --- | --- |
 | `hcc native up` | 启动或复用本项目后台 runtime |
 | `hcc native status` | 查看持久化 worker 状态和 runtime 身份 |
-| `hcc native start` | 必须 `--peer NAME --provider codex\|claude\|dsh`；可选 `--cwd DIR --model MODEL --resume last`；`--binary PATH` 仅适用于 Codex 和 dsh |
-| `hcc native send` | 必须 `--peer NAME --body TEXT`；可选 `--from NAME --task ID`；返回持久消息/submission 回执 |
+| `hcc native start` | 必须 `--peer NAME --provider codex\|claude\|dsh`；可选 `--cwd DIR --model MODEL --resume last`；`--binary PATH` 仅适用于 Codex 和 dsh；`--sandbox read-only\|workspace-write` 仅适用于 Codex |
+| `hcc native fork` | 必须 `--parent NAME --peer NEW_NAME`；可选 `--model MODEL --binary PATH`；复制 HCC 持有的 Codex 或 Claude 会话到新 worker |
+| `hcc native send` | 必须 `--peer NAME --body TEXT`；可选 `--from NAME --task ID --submission-id ID`；返回持久消息/submission 回执 |
 | `hcc native deliveries` | 可选 `--peer NAME`，查看投递回执 |
 | `hcc native events` | 必须 `--peer NAME`；可选 `--after ID`，查看有界事件历史 |
 | `hcc native requests` | 必须 `--peer NAME`；查看与该执行器、会话、turn 绑定的待处理请求 |

package/lib/cli/commands/native.mjs

@@ -9,8 +9,9 @@ import { startNativeService } from '../../runtime/native/service.mjs';
 
 export function nativeHelp() {
   console.log(`Usage: hcc native up|status|down
-       hcc native start --peer NAME --provider codex|claude|dsh [--cwd DIR] [--model MODEL] [--binary PATH] [--resume last]
-       hcc native send --peer NAME --body TEXT [--from NAME] [--task ID]
+       hcc native start --peer NAME --provider codex|claude|dsh [--cwd DIR] [--model MODEL] [--binary PATH] [--resume last] [--sandbox read-only|workspace-write]
+       hcc native fork --parent NAME --peer NEW_NAME [--model MODEL] [--binary PATH]
+       hcc native send --peer NAME --body TEXT [--from NAME] [--task ID] [--submission-id ID]
        hcc native events --peer NAME [--after ID]
        hcc native deliveries [--peer NAME]
        hcc native requests --peer NAME
@@ -20,29 +21,48 @@ export function nativeHelp() {
 
 Native workers share the project task/message/lock bus. Only HCC-owned saved
 sessions can resume. Existing TUI/Desktop sessions keep their own transport.
+Use a unique --submission-id for each new message and reuse it only for an
+exact retry after an uncertain receipt.
 Providers retain their permission checks; interactive requests await an explicit Web or local response.
+Codex alone accepts --sandbox. New sessions default to workspace-write; resumed and forked sessions inherit their saved policy.
+read-only disables permission escalation and HCC scoped MCP tools. It is a provider file sandbox, not an all-tools/network guarantee.
 Claude workers require the optional @anthropic-ai/claude-agent-sdk package.
 dsh workers use the ACP profile, not its Web-service terminal.`);
 }
 
 export function createNativeCommands(deps) {
+  function requireSandboxRuntime(runtime) {
+    if (runtime?.sandboxPolicyVersion !== 1) {
+      throw new CliError('NATIVE_SANDBOX_RUNTIME_UNSUPPORTED',
+        'This native runtime cannot preserve Codex sandbox policies. Stop the project native runtime after its work has finished, then start it with this HCC version. No worker was created.');
+    }
+    if (typeof runtime?.generation !== 'string' ||
+        !runtime.generation.trim() || runtime.generation.length > 128) {
+      throw new CliError('NATIVE_OWNER_CHANGED', 'Native runtime did not report a verifiable generation. No worker was created.');
+    }
+  }
   async function cmdNative(ctx, args) {
     const command = args[0];
     if (!command || wantsHelp(args)) return nativeHelp();
     const opts = parseOpts(args.slice(1));
     const allowed = {
       up: [], serve: [], down: [], status: [],
-      start: ['peer', 'provider', 'cwd', 'model', 'binary', 'resume'],
-      send: ['peer', 'body', 'from', 'task'],
+      start: ['peer', 'provider', 'cwd', 'model', 'binary', 'resume', 'sandbox'],
+      send: ['peer', 'body', 'from', 'task', 'submission-id'],
       events: ['peer', 'after'], deliveries: ['peer'], requests: ['peer'],
       respond: ['peer', 'request', 'decision', 'response-file'],
+      fork: ['peer', 'parent', 'model', 'binary'],
       interrupt: ['peer', 'turn'], close: ['peer']
     };
     if (!Object.hasOwn(allowed, command)) throw new CliError('BAD_ARGS', `Unknown native command: ${command}`);
     validateOpts(`native ${command}`, opts, allowed[command]);
-    if (['start', 'send', 'events', 'interrupt', 'close', 'requests', 'respond'].includes(command) && !opts.peer) throw new CliError('BAD_ARGS', 'Missing --peer');
+    if (['start', 'fork', 'send', 'events', 'interrupt', 'close', 'requests', 'respond'].includes(command) && !opts.peer) throw new CliError('BAD_ARGS', 'Missing --peer');
     if (command === 'start' && !opts.provider) throw new CliError('BAD_ARGS', 'Missing --provider');
     if (command === 'start' && opts.provider === 'claude' && opts.binary !== undefined) throw new CliError('BAD_ARGS', 'Claude workers use the Agent SDK; --binary is available for Codex and dsh');
+    if (command === 'start' && opts.sandbox !== undefined &&
+        (opts.provider !== 'codex' || !['read-only', 'workspace-write'].includes(opts.sandbox))) {
+      throw new CliError('BAD_ARGS', '--sandbox accepts read-only or workspace-write for Codex only');
+    }
     if (command === 'send' && !opts.body?.trim()) throw new CliError('BAD_ARGS', 'Missing --body');
     let result;
     if (command === 'up') result = await ensureNativeRuntime(ctx);
@@ -53,14 +73,28 @@ export function createNativeCommands(deps) {
       process.once('SIGINT', shutdown);
       return;
     } else if (command === 'start') {
-      await ensureNativeRuntime(ctx);
+      const runtime = await ensureNativeRuntime(ctx);
+      if (opts.provider === 'codex') requireSandboxRuntime(runtime);
       result = await nativeRequest(ctx, 'POST', '/workers', { peer: opts.peer, provider: opts.provider,
-        cwd: opts.cwd ? path.resolve(ctx.cwd, opts.cwd) : ctx.root, model: opts.model, binary: opts.binary, resume: opts.resume });
+        cwd: opts.cwd ? path.resolve(ctx.cwd, opts.cwd) : ctx.root, model: opts.model, binary: opts.binary, resume: opts.resume,
+        ...(opts.sandbox !== undefined ? { sandbox: opts.sandbox } : {}) },
+        opts.provider === 'codex' ? { expectedGeneration: runtime.generation } : undefined);
+    } else if (command === 'fork') {
+      if (!opts.parent) throw new CliError('BAD_ARGS', 'Missing --parent');
+      const runtime = await nativeRequest(ctx, 'GET', '/status');
+      requireSandboxRuntime(runtime);
+      result = await nativeRequest(ctx, 'POST', '/fork', { parent: opts.parent, peer: opts.peer, model: opts.model, binary: opts.binary },
+        { expectedGeneration: runtime.generation });
     } else if (command === 'send') {
       const taskId = intOpt(opts, 'task', null);
       if (taskId !== null && taskId < 1) throw new CliError('BAD_ARGS', 'Task ID must be positive');
+      const submissionId = opts['submission-id'];
+      if (submissionId !== undefined && !/^[A-Za-z0-9_-]{8,100}$/.test(submissionId)) {
+        throw new CliError('BAD_ARGS', 'Submission ID must contain 8 to 100 letters, digits, underscores, or hyphens');
+      }
       const sender = deps.resolveCurrentPeer(ctx, opts, 'from', 'shell').id;
-      result = await nativeRequest(ctx, 'POST', '/send', { peer: opts.peer, from: sender, body: opts.body, taskId });
+      result = await nativeRequest(ctx, 'POST', '/send', { peer: opts.peer, from: sender, body: opts.body, taskId,
+        ...(submissionId ? { submissionId } : {}) });
     } else if (command === 'events') {
       const after = intOpt(opts, 'after', 0);
       if (after < 0) throw new CliError('BAD_ARGS', 'Event cursor must be nonnegative');

package/lib/integrations/native/claude.mjs

@@ -89,7 +89,7 @@ export function createClaudeAdapter(options = {}) {
   const cwdBinding = options.cwd ? captureSelectedCwdIdentity(options.cwd, options.expectedCwdIdentity) : null;
   const capabilities = Object.freeze({
     create: true, resume: true, send: true, observe: true,
-    interrupt: true, close: true, steer: false, fork: false, approvals: Boolean(options.interactive), mcp: Boolean(options.mcpServers)
+    interrupt: true, close: true, steer: false, fork: true, approvals: Boolean(options.interactive), mcp: Boolean(options.mcpServers)
   });
   const timeoutMs = options.timeoutMs ?? 10_000;
   const env = isolatedEnv(options.env || process.env, options.coordinationEnv || options.env || {});
@@ -99,6 +99,7 @@ export function createClaudeAdapter(options = {}) {
   let model;
   let metrics = null, runtimeMetadata = {};
   let queryFunction = options.query;
+  let forkFunction = options.forkSession;
   let sdkQuery = null;
   let pump = null;
   let activeTurn = null;
@@ -251,13 +252,17 @@ export function createClaudeAdapter(options = {}) {
   }
 
   async function open(request = {}) {
-    const resumeId = request.sessionId;
+    let resumeId = request.sessionId;
+    const forkSessionId = request.forkSessionId;
+    if (forkSessionId !== undefined && (typeof forkSessionId !== 'string' || !forkSessionId.trim() || resumeId !== undefined)) {
+      throw new CliError('BAD_ARGS', 'A fork needs one nonempty source session ID and cannot also resume');
+    }
     const selectedModel = request.model;
     if (closed) throw new CliError('NATIVE_CLOSED', 'Claude native session is closed');
     cwdBinding?.assertUnchanged();
     if (opening) return opening;
     if (status !== 'created') {
-      if ((resumeId && resumeId !== requestedSessionId) ||
+      if (forkSessionId || (resumeId && resumeId !== requestedSessionId) ||
           (selectedModel && selectedModel !== model)) {
         throw new CliError('NATIVE_ALREADY_OPEN', 'Claude adapter already owns a different session');
       }
@@ -282,6 +287,7 @@ export function createClaudeAdapter(options = {}) {
           }
           const sdk = await import(entry);
           queryFunction = sdk.query;
+          forkFunction = sdk.forkSession;
         } catch (error) {
           // A found SDK with broken exports/dependencies is not a missing SDK.
           throw error;
@@ -291,6 +297,26 @@ export function createClaudeAdapter(options = {}) {
         throw new CliError('NATIVE_SDK_INVALID', 'Claude Agent SDK must expose a query function');
       }
       if (closed) throw new CliError('NATIVE_CLOSED', 'Claude native session is closed');
+      if (forkSessionId) {
+        if (typeof forkFunction !== 'function') throw new CliError('NATIVE_CAPABILITY_UNSUPPORTED', 'This Claude SDK does not export forkSession');
+        // SDK transcript mutations use the host config directory, unlike query()
+        // which also accepts an environment override. Never fork in another home.
+        for (const key of ['HOME', 'CLAUDE_CONFIG_DIR']) {
+          if (env[key] !== undefined && env[key] !== process.env[key]) {
+            throw new CliError('NATIVE_FORK_ENV_MISMATCH', 'Claude fork requires the runtime and worker to use the same provider home');
+          }
+        }
+        cwdBinding?.assertUnchanged();
+        const forked = await forkFunction(forkSessionId, { dir: options.cwd });
+        cwdBinding?.assertUnchanged();
+        if (closed) throw new CliError('NATIVE_CLOSED', 'Claude native session was closed while forking');
+        if (typeof forked?.sessionId !== 'string' || !forked.sessionId.trim() ||
+            /[\x00-\x1f\x7f]/.test(forked.sessionId) || forked.sessionId === forkSessionId) {
+          throw new CliError('NATIVE_SESSION_MISMATCH', 'Claude fork did not create a distinct valid session');
+        }
+        resumeId = forked.sessionId;
+        sessionId = resumeId;
+      }
       requestedSessionId = resumeId || null;
       model = selectedModel;
       // The SDK initializes after the first prompt. A requested resume ID is

package/lib/integrations/native/codex.mjs

@@ -6,7 +6,7 @@ import { captureSelectedCwdIdentity } from '../../process/selected-cwd-identity.
 import { CODEX_INTERACTION_METHODS, codexInteractionKind, codexInteractionResponse, cancelCodexInteraction, codexInteractiveConfig } from '../codex-interactions.mjs';
 
 const CAPABILITIES = Object.freeze({ create: true, resume: true, send: true, observe: true,
-  steer: true, interrupt: true, close: true, fork: false, accountRead: true });
+  steer: true, interrupt: true, close: true, fork: true, accountRead: true });
 const TERMINAL_TURN_STATUSES = new Set(['completed', 'interrupted', 'failed']);
 
 function adapterError(code, message) {
@@ -18,7 +18,8 @@ export function createCodexAdapter(options = {}) {
   const { binary = 'codex', cwd, env, timeoutMs = 30_000, onEvent = () => {},
     rpcFactory = (config) => new JsonRpcProcess(config) } = options;
   const cwdBinding = cwd ? captureSelectedCwdIdentity(cwd, options.expectedCwdIdentity) : null;
-  const state = { provider: 'codex', sessionId: null, turnId: null, status: 'new', owned: true };
+  const state = { provider: 'codex', sessionId: null, turnId: null, status: 'new', owned: true,
+    sandbox: null, sandboxVerified: false };
   const terminalTurns = new Set();
   const interruptedTurns = new Set();
   const turnSubmissions = new Map();
@@ -112,7 +113,10 @@ export function createCodexAdapter(options = {}) {
 
   function serverRequest(method, params = {}, requestId) {
     if (!CODEX_INTERACTION_METHODS.has(method)) throw adapterError('NATIVE_SERVER_REQUEST_UNSUPPORTED', `Unsupported Codex server request: ${method}`);
-    if (options.interactive && params.threadId === state.sessionId && params.turnId && !terminalTurns.has(params.turnId)) {
+    // A read-only session can answer questions, but no human response can grant
+    // command/file/permission or MCP approval outside its requested policy.
+    const canInteract = state.sandbox !== 'read-only' || method === 'item/tool/requestUserInput';
+    if (canInteract && options.interactive && params.threadId === state.sessionId && params.turnId && !terminalTurns.has(params.turnId)) {
       // A server request can precede the turn/start admission response.
       if (!state.turnId && pendingSubmissionId) { state.turnId = params.turnId; status('busy'); }
       return interactions.request({ requestId, sessionId: params.threadId, turnId: params.turnId,
@@ -146,13 +150,22 @@ export function createCodexAdapter(options = {}) {
       turnId: state.turnId, extra: { ...error.extra } });
   }
 
-  async function open({ sessionId, model } = {}) {
+  async function open({ sessionId, forkSessionId, model, sandbox = 'workspace-write' } = {}) {
     if (closed || state.status !== 'new') {
       throw adapterError('NATIVE_SESSION_ALREADY_OPEN', 'This Codex adapter can open only one owned session.');
     }
     if (sessionId !== undefined && (typeof sessionId !== 'string' || !sessionId.trim())) {
       throw adapterError('BAD_ARGS', 'A Codex resume sessionId must be a nonempty string.');
     }
+    if (forkSessionId !== undefined && (typeof forkSessionId !== 'string' || !forkSessionId.trim() || sessionId !== undefined)) {
+      throw adapterError('BAD_ARGS', 'A fork needs one nonempty source session ID and cannot also resume.');
+    }
+    if (sandbox !== 'read-only' && sandbox !== 'workspace-write') {
+      throw adapterError('BAD_ARGS', 'A Codex sandbox must be read-only or workspace-write.');
+    }
+    state.sandbox = sandbox;
+    const readOnly = sandbox === 'read-only';
+    capabilities.approvals = Boolean(options.interactive) && !readOnly;
     status('opening');
     try {
       cwdBinding?.assertUnchanged();
@@ -166,20 +179,32 @@ export function createCodexAdapter(options = {}) {
       await rpc.notify('initialized', {});
       if (closed) throw adapterError('NATIVE_SESSION_CLOSED', 'The Codex session was closed while opening.');
       const config = codexInteractiveConfig(options.mcpServers ? { mcp_servers: options.mcpServers } : {}, Boolean(options.interactive));
-      const params = { sandbox: 'workspace-write', approvalPolicy: 'on-request', approvalsReviewer: 'user',
+      if (readOnly) config['features.request_permissions_tool'] = false;
+      const params = { sandbox, approvalPolicy: readOnly ? 'never' : 'on-request', approvalsReviewer: 'user',
         ...(Object.keys(config).length ? { config } : {}),
-        ...(cwd ? { cwd } : {}), ...(model ? { model } : {}), ...(sessionId ? { threadId: sessionId } : {}) };
+        ...(cwd ? { cwd } : {}), ...(model ? { model } : {}), ...(sessionId || forkSessionId ? { threadId: sessionId || forkSessionId } : {}) };
       cwdBinding?.assertUnchanged();
-      const response = await rpc.request(sessionId ? 'thread/resume' : 'thread/start', params);
-      if (!response?.thread?.id || (sessionId && response.thread.id !== sessionId)) {
+      const response = await rpc.request(forkSessionId ? 'thread/fork' : sessionId ? 'thread/resume' : 'thread/start', params);
+      if (typeof response?.thread?.id !== 'string' || !response.thread.id.trim() ||
+          (sessionId && response.thread.id !== sessionId) || (forkSessionId && response.thread.id === forkSessionId)) {
         throw adapterError('NATIVE_PROTOCOL_ERROR', 'Codex returned an invalid native thread identity.');
       }
       if (closed) throw adapterError('NATIVE_SESSION_CLOSED', 'The Codex session was closed while opening.');
+      const activeTurn = response.thread.turns?.findLast((turn) => turn.status === 'inProgress');
+      // Readback must confirm policy before exposing a resumed or forked thread.
+      if (readOnly && (response.sandbox?.type !== 'readOnly' ||
+          (response.sandbox.networkAccess !== undefined && response.sandbox.networkAccess !== false) ||
+          response.approvalPolicy !== 'never')) {
+        throw adapterError('NATIVE_SANDBOX_UNVERIFIED', 'Codex did not confirm the requested read-only sandbox and never-approve policy.');
+      }
+      if (readOnly && (activeTurn || response.thread.status?.type === 'active')) {
+        throw adapterError('NATIVE_READ_ONLY_BUSY', 'An existing active Codex turn cannot be resumed or forked as verified read-only. Wait for it to finish first.');
+      }
+      state.sandboxVerified = readOnly || (response.sandbox?.type === 'workspaceWrite' && response.approvalPolicy === 'on-request');
       state.sessionId = response.thread.id;
       state.runtimeMetadata = { ...(typeof response.model === 'string' ? { model: response.model } : {}),
         ...(typeof response.approvalPolicy === 'string' ? { permissionMode: response.approvalPolicy } : {}) };
       emit({ type: 'metadata', runtimeMetadata: state.runtimeMetadata });
-      const activeTurn = response.thread.turns?.findLast((turn) => turn.status === 'inProgress');
       state.turnId = activeTurn?.id ?? null;
       status(state.turnId ? 'busy' : 'idle');
       return snapshot();
@@ -196,6 +221,7 @@ export function createCodexAdapter(options = {}) {
   function send({ text, submissionId, expectedTurnId } = {}) {
     return serial(async () => {
       requireOpen();
+      cwdBinding?.assertUnchanged();
       if (typeof text !== 'string' || !text.trim()) throw adapterError('BAD_ARGS', 'A native message needs nonempty text.');
       const turnId = state.turnId;
       if (expectedTurnId !== undefined && expectedTurnId !== turnId) {
@@ -207,6 +233,9 @@ export function createCodexAdapter(options = {}) {
       const method = turnId ? 'turn/steer' : 'turn/start';
       const params = { threadId: state.sessionId, input: [{ type: 'text', text }],
         ...(submissionId ? { clientUserMessageId: submissionId } : {}),
+        ...(!turnId && state.sandbox === 'read-only' ? {
+          sandboxPolicy: { type: 'readOnly', networkAccess: false }, approvalPolicy: 'never'
+        } : {}),
         ...(turnId ? { expectedTurnId: expectedTurnId ?? turnId } : {}) };
       try {
         pendingSubmissionId = submissionId;

package/lib/integrations/native/dsh-acp.mjs

@@ -81,6 +81,16 @@ export function createDshAcpAdapter(options = {}) {
     if (toolCalls.size > 128) toolCalls.delete(toolCalls.keys().next().value);
     if (Object.hasOwn(bounded, 'rawInput') || bounded.contextTruncated) {
       for (const waiter of [...toolContextWaiters]) if (waiter.toolCallId === update.toolCallId) waiter.finish(bounded);
+      // Context may arrive after the bounded initial wait. Refresh the same
+      // unresolved permission rather than leaving its acceptance blocked.
+      for (const request of interactions.snapshot()) {
+        if (request.sessionId !== sessionId || request.turnId !== active.turnId ||
+            request.params.toolCall?.toolCallId !== update.toolCallId || !request.params.toolCall.contextPending) continue;
+        const toolCall = { ...request.params.toolCall, ...bounded };
+        delete toolCall.contextPending;
+        interactions.update({ requestId: request.requestId, sessionId, turnId: active.turnId,
+          params: { ...request.params, toolCall } });
+      }
     }
   }
 

package/lib/integrations/native/interactions.mjs

@@ -23,8 +23,7 @@ export function createNativeInteractions({ executorId = randomUUID(), isActive,
     if (signal?.aborted || !isActive(sessionId, turnId)) return Promise.resolve(cancelled);
     if (used.has(key) || pending.size >= 64) throw Object.assign(new Error('Duplicate or excessive native interaction requests'), { code: 'NATIVE_PROTOCOL_ERROR' });
     used.add(key); if (used.size > 256) used.delete(used.values().next().value);
-    let truncated = false, preview = structuredClone(params);
-    if (JSON.stringify(preview).length > 65536) { truncated = true; preview = { preview: JSON.stringify(params).slice(0, 65536) }; }
+    const { preview, truncated } = previewParams(params);
     const promise = new Promise(resolve => {
       const entry = { executorId, requestId: id, sessionId, turnId, kind, method, params: preview,
         truncated, status: 'pending', createdAt: Date.now(), resolve, validate, cancelled };
@@ -38,6 +37,20 @@ export function createNativeInteractions({ executorId = randomUUID(), isActive,
     });
     return promise;
   }
+  function previewParams(params) {
+    let truncated = false, preview = structuredClone(params);
+    const serialized = JSON.stringify(preview);
+    if (serialized.length > 65536) { truncated = true; preview = { preview: serialized.slice(0, 65536) }; }
+    return { preview, truncated };
+  }
+  function update({ requestId, sessionId, turnId, params }) {
+    const key = JSON.stringify([typeof requestId, requestId]), entry = pending.get(key);
+    if (!entry || entry.sessionId !== sessionId || entry.turnId !== turnId || !isActive(sessionId, turnId)) return false;
+    const { preview, truncated } = previewParams(params);
+    entry.params = preview; entry.truncated = truncated;
+    onChange?.(redactMcpUrlInteraction({ type: 'approval', ...snapshot().find(value => value.requestId === requestId) }));
+    return true;
+  }
   function respond(input) {
     const key = JSON.stringify([typeof input.requestId, input.requestId]), entry = pending.get(key);
     if (!entry || input.executorId !== executorId || input.sessionId !== entry.sessionId || input.turnId !== entry.turnId || !isActive(entry.sessionId, entry.turnId)) {
@@ -47,7 +60,7 @@ export function createNativeInteractions({ executorId = randomUUID(), isActive,
     settle(key, result, 'answered');
     return { executorId, requestId: entry.requestId, sessionId: entry.sessionId, turnId: entry.turnId, status: 'submitted' };
   }
-  return { executorId, request, snapshot, respond, expire, resolved(requestId) {
+  return { executorId, request, update, snapshot, respond, expire, resolved(requestId) {
     const key = JSON.stringify([typeof requestId, requestId]);
     if (pending.has(key)) settle(key, pending.get(key).cancelled, 'resolved-by-provider');
   } };

package/lib/runtime/native/client.mjs

@@ -2,9 +2,16 @@ import http from 'node:http';
 import { CliError } from '../../shared/errors.mjs';
 import { readNativePointer } from './store.mjs';
 
-export function nativeRequest(ctx, method, route, body = null, { timeoutMs = 35000 } = {}) {
+export function nativeRequest(ctx, method, route, body = null, { timeoutMs = 35000, expectedGeneration } = {}) {
   const pointer = readNativePointer(ctx);
   if (!pointer) return Promise.reject(new CliError('NATIVE_RUNTIME_OFFLINE', 'Native runtime is offline. Run hcc native up.'));
+  // Keep a policy-checked request bound to that runtime. This same pointer's
+  // endpoint and credential are used below; never reread and follow a new owner.
+  if (expectedGeneration !== undefined && (typeof expectedGeneration !== 'string' ||
+      !expectedGeneration.trim() || expectedGeneration.length > 128 || pointer.generation !== expectedGeneration)) {
+    return Promise.reject(new CliError('NATIVE_OWNER_CHANGED',
+      'Native runtime changed after policy verification. Inspect its current status before retrying.', { uncertain: false }));
+  }
   return new Promise((resolve, reject) => {
     const payload = body === null ? null : JSON.stringify(body);
     let timer;