@logicseek/hello-cc 1.1.0-rc.3 → 1.1.0-rc.4

package/lib/runtime/native/service.mjs

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import http from 'node:http';
-import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { CliError } from '../../shared/errors.mjs';
 import { redactSecrets } from '../../shared/redact.mjs';
 import { acquireFileLock } from '../../shared/file-lock.mjs';
@@ -108,10 +108,15 @@ export async function startNativeService(ctx, deps, options = {}) {
     assertPreviousOwnerExited();
     store = createNativeStore(ctx);
     mesh = deps.connect(ctx, { migrateRegistered: false });
+    mesh.exec(`CREATE TABLE IF NOT EXISTS native_user_submissions (
+      submission_id TEXT PRIMARY KEY, message_id INTEGER NOT NULL UNIQUE,
+      peer TEXT NOT NULL, payload_hash TEXT NOT NULL
+    )`);
     store.disconnected();
   } catch (error) { releaseAfterInitializationFailure(error); }
   const workers = new Map();
   const creating = new Set();
+  const forking = new Set();
   const operations = new Set();
   const generation = randomUUID();
   const token = randomBytes(32).toString('hex');
@@ -161,9 +166,32 @@ export async function startNativeService(ctx, deps, options = {}) {
       throw new CliError('NATIVE_OWNER_CHANGED', 'Native worker identity changed; refresh its current state before controlling it');
     }
   }
-  function save(worker) {
-    if (!worker.adapter || storeClosed) return;
+  function submissionHash(input) {
+    return createHash('sha256').update(JSON.stringify([
+      input.peer, input.from, input.taskId || null, input.body
+    ])).digest('hex');
+  }
+  function matchingUserSubmission(input, intent) {
+    const message = mesh.prepare('SELECT * FROM messages WHERE id=?').get(intent.message_id);
+    if (!message) throw new CliError('NATIVE_SUBMISSION_EXPIRED', 'Submission message is no longer available; do not retry it as new work');
+    if (intent.peer !== input.peer || intent.payload_hash !== submissionHash(input) ||
+        message.sender !== input.from || message.recipient !== input.peer ||
+        message.kind !== 'ask' || message.body !== input.body ||
+        (message.task_id || null) !== (input.taskId || null)) {
+      throw new CliError('NATIVE_SUBMISSION_MISMATCH', 'Submission ID is already used by a different message');
+    }
+    return message;
+  }
+  function workerSnapshot(worker, { checkSandbox = true } = {}) {
     const snapshot = worker.adapter.snapshot();
+    if (checkSandbox && snapshot.sandbox !== undefined && snapshot.sandbox !== worker.sandbox) {
+      throw new CliError('NATIVE_SANDBOX_MISMATCH', 'Provider sandbox does not match the native worker policy');
+    }
+    return { ...snapshot, sandbox: worker.sandbox };
+  }
+  function save(worker, options) {
+    if (!worker.adapter || storeClosed) return;
+    const snapshot = workerSnapshot(worker, options);
     tx(mesh, () => {
       assertOwner(worker);
       if (snapshot.sessionId && mesh.prepare('SELECT peer FROM peer_bindings WHERE provider=? AND (provider_session_id=? OR provider_session_name=?) AND peer<>?')
@@ -242,8 +270,15 @@ export async function startNativeService(ctx, deps, options = {}) {
       : mesh.prepare(`SELECT * FROM messages WHERE id>? AND sender<>? AND
           (recipient IS NULL OR recipient='' OR recipient='all' OR recipient=?) ORDER BY id LIMIT 1000`)
         .all(worker.lastMessageId, worker.peer, worker.peer);
+    const userIntent = mesh.prepare('SELECT peer,submission_id FROM native_user_submissions WHERE message_id=?');
     for (const message of messages) {
-      if (message.sender !== worker.peer) store.queue(worker.peer, message.id, randomUUID());
+      if (message.sender !== worker.peer) {
+        const intent = userIntent.get(message.id);
+        if (intent && intent.peer !== worker.peer) {
+          throw new CliError('NATIVE_SUBMISSION_MISMATCH', 'Native submission target changed before ingestion');
+        }
+        store.queue(worker.peer, message.id, intent?.submission_id || randomUUID(), intent ? 'user' : 'peer');
+      }
       if (!initial) worker.lastMessageId = message.id;
     }
   }
@@ -266,7 +301,12 @@ export async function startNativeService(ctx, deps, options = {}) {
         throw new CliError('BAD_ARGS', `Worker ${key} must be a nonempty string`);
       }
     }
+    if (input.sandbox !== undefined && (provider !== 'codex' ||
+        !['read-only', 'workspace-write'].includes(input.sandbox))) {
+      throw new CliError('BAD_ARGS', 'Only Codex workers support read-only or workspace-write sandbox policies');
+    }
     if (provider === 'claude' && input.binary !== undefined) throw new CliError('BAD_ARGS', 'Claude workers use the Agent SDK; --binary is available for Codex and dsh');
+    if (forking.has(peer)) throw new CliError('NATIVE_FORK_NOT_READY', 'This parent session is being forked');
     if (workers.has(peer) || creating.has(peer)) throw new CliError('NATIVE_WORKER_EXISTS', `Native worker is already open: ${peer}`);
     const previous = store.worker(peer);
     const fencedResume = input.resumeFence !== undefined;
@@ -288,6 +328,14 @@ export async function startNativeService(ctx, deps, options = {}) {
       sessionId = previous.session_id;
     } else if (previous?.session_id) throw new CliError('NATIVE_RESUME_REQUIRED', 'This peer has a saved session. Use --resume last or choose a new peer name.');
     if (previous && previous.provider !== provider) throw new CliError('NATIVE_SESSION_NOT_OWNED', 'Peer belongs to a different native provider');
+    const sandbox = provider === 'codex'
+      ? input.sandbox ?? (previous ? previous.sandbox : 'workspace-write') : null;
+    if (provider === 'codex' && !['read-only', 'workspace-write'].includes(sandbox)) {
+      throw new CliError('NATIVE_STATE_INVALID', 'Saved native sandbox policy is invalid');
+    }
+    if (sessionId && input.sandbox !== undefined && input.sandbox !== previous.sandbox) {
+      throw new CliError('NATIVE_SANDBOX_MISMATCH', 'Resume must retain the saved native session sandbox policy');
+    }
     if (input.cwd !== undefined && typeof input.cwd !== 'string') throw new CliError('BAD_ARGS', 'Worker cwd must be a directory');
     let cwd;
     try {
@@ -299,7 +347,7 @@ export async function startNativeService(ctx, deps, options = {}) {
     }
     const expectedCwdIdentity = captureSelectedCwdSnapshot(cwd);
     if (sessionId) assertSavedWorkerCwd(previous, expectedCwdIdentity);
-    const worker = { peer, provider, cwd, cwdIdentity: expectedCwdIdentity,
+    const worker = { peer, provider, cwd, sandbox, cwdIdentity: expectedCwdIdentity,
       branch: deps.detectBranch(cwd), owner: `native:${generation}:${peer}:${randomUUID()}`,
       active: null, output: [], quarantined: false, closing: false, dispatch: null, closePromise: null };
     // Reserve identity before starting the child so installed hooks can only
@@ -327,17 +375,21 @@ export async function startNativeService(ctx, deps, options = {}) {
       worker.lastMessageId = mesh.prepare('SELECT COALESCE(MAX(id),0) AS id FROM messages').get().id;
       ingest(worker, true);
     });
-    store.saveWorker({ peer, provider, cwd, cwdIdentity: expectedCwdIdentity, sessionId, status: 'opening' });
+    store.saveWorker({ peer, provider, cwd, cwdIdentity: expectedCwdIdentity, sandbox, sessionId, status: 'opening' });
     creating.add(peer);
     workers.set(peer, worker);
     try {
-      worker.mcpCapability = (options.mcpConfigFactory || createScopedMcpConfig)({ root: ctx.root, dbPath: ctx.dbPath,
-        peer, executorId: worker.owner, ownerIdentity: identity,
-        binding: { transport: 'native', runtimeSessionId: peer, runtimeTarget: worker.owner } });
+      // A provider file sandbox cannot restrict a mutating MCP server.
+      if (sandbox !== 'read-only') {
+        worker.mcpCapability = (options.mcpConfigFactory || createScopedMcpConfig)({ root: ctx.root, dbPath: ctx.dbPath,
+          peer, executorId: worker.owner, ownerIdentity: identity,
+          binding: { transport: 'native', runtimeSessionId: peer, runtimeTarget: worker.owner } });
+      }
       assertSelectedCwdSnapshot(expectedCwdIdentity);
       worker.adapter = await adapterFactory(provider, { binary: input.binary || undefined, cwd,
         expectedCwdIdentity,
-        executorId: worker.owner, interactive: true, mcpServers: { hello_cc_scoped: worker.mcpCapability.config },
+        executorId: worker.owner, interactive: true,
+        ...(worker.mcpCapability ? { mcpServers: { hello_cc_scoped: worker.mcpCapability.config } } : {}),
         env: nativeWorkerEnv(process.env, ctx, peer, worker.owner), onEvent: (event) => {
           if (worker.adapter) record(worker, event);
         } });
@@ -346,13 +398,18 @@ export async function startNativeService(ctx, deps, options = {}) {
       requireRunning();
       if (worker.closing) throw new CliError('NATIVE_WORKER_CLOSING', 'Worker was closed while opening');
       assertOwner(worker);
-      await worker.adapter.open({ sessionId, model: input.model || undefined });
+      if (input.forkSessionId && !worker.adapter.capabilities.fork) throw new CliError('NATIVE_CAPABILITY_UNSUPPORTED', 'Provider does not support native fork');
+      await worker.adapter.open({ sessionId, ...(input.forkSessionId ? { forkSessionId: input.forkSessionId } : {}),
+        model: input.model || undefined, ...(sandbox ? { sandbox } : {}) });
+      if (input.forkSessionId && (!worker.adapter.snapshot().sessionId || worker.adapter.snapshot().sessionId === input.forkSessionId)) {
+        throw new CliError('NATIVE_PROTOCOL_ERROR', 'Fork did not create a distinct provider session');
+      }
       requireRunning();
       assertSelectedCwdSnapshot(expectedCwdIdentity);
       assertSelectedCwdSnapshot(serviceRootIdentity);
       save(worker);
       deps.addEvent(mesh, 'native.worker.opened', peer, null, { provider, session_id: worker.adapter.snapshot().sessionId || null, resumed: Boolean(sessionId) });
-      return { peer, ...worker.adapter.snapshot() };
+      return { peer, ...workerSnapshot(worker) };
     } catch (error) {
       worker.closing = true;
       worker.mcpCapability?.dispose();
@@ -364,10 +421,10 @@ export async function startNativeService(ctx, deps, options = {}) {
       }
       if (!cleanupError) workers.delete(peer);
       try {
-        if (worker.adapter) save(worker);
+        if (worker.adapter) save(worker, { checkSandbox: false });
         else tx(mesh, () => { assertOwner(worker); mesh.prepare("UPDATE peers SET status='blocked' WHERE id=?").run(peer); });
       } catch {}
-      store.saveWorker({ peer, provider, cwd, ...(worker.adapter?.snapshot() || {}), status: 'error' });
+      store.saveWorker({ peer, provider, cwd, cwdIdentity: expectedCwdIdentity, ...(worker.adapter?.snapshot() || {}), sandbox, status: 'error' });
       if (cleanupError) throw new CliError('NATIVE_CLOSE_FAILED', 'Worker initialization failed and its owned provider exit was not confirmed',
         { uncertain: true, initialization: publicError(error), cleanup: publicError(cleanupError) });
       throw error;
@@ -379,8 +436,10 @@ export async function startNativeService(ctx, deps, options = {}) {
     const tasks = mesh.prepare("SELECT id,status,owner,title FROM tasks WHERE status NOT IN ('done','abandoned') ORDER BY id DESC LIMIT 8").all();
     const locks = mesh.prepare('SELECT resource,owner,task_id FROM locks WHERE expires_at>? ORDER BY resource LIMIT 8').all(Math.floor(Date.now() / 1000));
     return ['[hello-cc native coordination]', `peer: ${worker.peer}`, `project: ${ctx.root}`,
-      'Use the scoped hello_cc_scoped MCP tools for HCC state, tasks, locks, results and handoffs. Continue your owned task until done, blocked or handed off.',
-      `Use this exact prefix for HCC commands: ${command}`,
+      ...(worker.sandbox === 'read-only'
+        ? ['This worker uses the Codex read-only file sandbox. Inspect and report only; do not modify files or execute mutating coordination commands. HCC coordination MCP tools are not attached.']
+        : ['Use the scoped hello_cc_scoped MCP tools for HCC state, tasks, locks, results and handoffs. Continue your owned task until done, blocked or handed off.',
+          `Use this exact prefix for HCC commands: ${command}`]),
       'Only the message below is newly delivered from the inbox in this turn. You may use previous turns already present in this same provider session as context. Do not independently consume or acknowledge other inbox messages.',
       delivery.origin === 'user'
         ? 'The request below was submitted by the local user through authenticated HCC CLI or Web controls. Follow it within the user scope; tool permissions still require explicit approval.'
@@ -413,12 +472,81 @@ export async function startNativeService(ctx, deps, options = {}) {
     }
     if (!worker.closing) { try { save(worker); } catch (error) { record(worker, { type: 'error', ...publicError(error) }); } }
   }
+  async function forkWorker(input) {
+    requireRunning();
+    if (typeof input.parent !== 'string' || !input.parent || input.parent === input.peer ||
+        Object.keys(input).some(key => !['parent', 'peer', 'model', 'binary', 'generation', 'owner', 'sessionId'].includes(key))) {
+      throw new CliError('BAD_ARGS', 'Fork requires an owned parent and a different new peer');
+    }
+    const saved = store.worker(input.parent);
+    const binding = mesh.prepare('SELECT * FROM peer_bindings WHERE peer=?').get(input.parent);
+    const parent = workers.get(input.parent);
+    if (!saved?.session_id || !binding || binding.transport !== 'native' || binding.provider !== saved.provider ||
+        binding.provider_session_id !== saved.session_id || binding.runtime_session_id !== input.parent || !binding.runtime_target) {
+      throw new CliError('NATIVE_SESSION_NOT_OWNED', 'Only a saved HCC-owned native session can be forked');
+    }
+    if (!['codex', 'claude'].includes(saved.provider) || (parent && !parent.adapter?.capabilities.fork)) {
+      throw new CliError('NATIVE_CAPABILITY_UNSUPPORTED', 'This provider does not support native fork');
+    }
+    if (forking.has(input.parent) || creating.has(input.parent) || (parent
+        ? parent.closing || parent.quarantined || parent.active || parent.dispatch ||
+          !['idle', 'ready', 'completed'].includes(parent.adapter.snapshot().status) ||
+          parent.adapter.snapshot().pendingApprovals?.length
+        : saved.status !== 'closed')) {
+      throw new CliError('NATIVE_FORK_NOT_READY', 'Finish or resolve the parent operation before forking');
+    }
+    if (parent) { assertRequestedOwner(parent, input); assertSelectedCwdSnapshot(parent.cwdIdentity); ingest(parent); }
+    else if ((input.owner !== undefined && input.owner !== binding.runtime_target) ||
+             (input.sessionId !== undefined && input.sessionId !== saved.session_id) ||
+             (input.generation !== undefined && input.generation !== generation)) {
+      throw new CliError('NATIVE_OWNER_CHANGED', 'Saved parent identity changed');
+    }
+    if (store.db.prepare("SELECT id FROM deliveries WHERE peer=? AND state NOT IN ('completed','failed') LIMIT 1").get(input.parent)) {
+      throw new CliError('NATIVE_FORK_NOT_READY', 'Parent has queued or unresolved deliveries');
+    }
+    if (saved.provider === 'codex' && !['read-only', 'workspace-write'].includes(saved.sandbox)) {
+      throw new CliError('NATIVE_STATE_INVALID', 'Saved parent sandbox policy is invalid');
+    }
+    if (parent && workerSnapshot(parent).sandbox !== saved.sandbox) {
+      throw new CliError('NATIVE_SANDBOX_MISMATCH', 'Parent sandbox policy changed');
+    }
+    const cwdIdentity = captureSelectedCwdSnapshot(saved.cwd);
+    assertSavedWorkerCwd(saved, cwdIdentity);
+    forking.add(input.parent);
+    try {
+      const child = await createWorker({ peer: input.peer, provider: saved.provider, cwd: saved.cwd,
+        model: input.model, binary: input.binary, forkSessionId: saved.session_id,
+        ...(saved.provider === 'codex' ? { sandbox: saved.sandbox } : {}) });
+      try {
+        requireRunning();
+        const current = mesh.prepare('SELECT * FROM peer_bindings WHERE peer=?').get(input.parent);
+        if (!current || current.transport !== 'native' || current.provider !== saved.provider ||
+            current.runtime_session_id !== input.parent || current.runtime_target !== binding.runtime_target ||
+            current.provider_session_id !== saved.session_id) {
+          throw new CliError('NATIVE_OWNER_CHANGED', 'Parent identity changed while forking');
+        }
+        if (saved.provider === 'codex' && store.worker(input.parent)?.sandbox !== saved.sandbox) {
+          throw new CliError('NATIVE_SANDBOX_MISMATCH', 'Parent sandbox policy changed while forking');
+        }
+        assertSelectedCwdSnapshot(cwdIdentity);
+        deps.addEvent(mesh, 'native.worker.forked', input.peer, null,
+          { provider: saved.provider, parent_peer: input.parent, parent_session_id: saved.session_id, session_id: child.sessionId });
+        return { ...child, parent: input.parent, parentSessionId: saved.session_id };
+      } catch (error) {
+        try { await closeWorker(input.peer); }
+        catch (cleanup) {
+          throw aggregateCleanupFailure(error, cleanup, 'Native fork validation and child cleanup both failed', { phase: 'native-fork' });
+        }
+        throw error;
+      }
+    } finally { forking.delete(input.parent); }
+  }
   async function poll() {
     if (stopping) return;
     try { assertOwnership(); } catch { return; }
     for (const worker of workers.values()) {
       try {
-        if (worker.closing || creating.has(worker.peer)) continue;
+        if (worker.closing || creating.has(worker.peer) || forking.has(worker.peer)) continue;
         save(worker);
         ingest(worker);
         if (worker.active || worker.dispatch || worker.quarantined) continue;
@@ -454,7 +582,7 @@ export async function startNativeService(ctx, deps, options = {}) {
       // Factories can resolve after close begins. Confirm their cleanup even
       // when initialization itself rejected; its cleanup may also have failed.
       if (worker.adapter && worker.adapter !== adapterAtClose) await worker.adapter.close();
-      try { save(worker); } catch (error) { if (!['NATIVE_PEER_IN_USE', 'NATIVE_RUNTIME_OWNERSHIP_LOST'].includes(error.code)) throw error; }
+      try { save(worker, { checkSandbox: false }); } catch (error) { if (!['NATIVE_PEER_IN_USE', 'NATIVE_RUNTIME_OWNERSHIP_LOST'].includes(error.code)) throw error; }
       if (!creating.has(peer)) workers.delete(peer);
       return { peer, status: 'closed' };
     })();
@@ -463,7 +591,7 @@ export async function startNativeService(ctx, deps, options = {}) {
       worker.quarantined = true;
       worker.closePromise = null;
       if (!storeClosed) store.saveWorker({ peer: worker.peer, provider: worker.provider, cwd: worker.cwd,
-        ...worker.adapter?.snapshot(), status: 'uncertain' });
+        ...worker.adapter?.snapshot(), sandbox: worker.sandbox, status: 'uncertain' });
       console.error(JSON.stringify(publicError(error)));
     });
     return worker.closePromise;
@@ -480,10 +608,11 @@ export async function startNativeService(ctx, deps, options = {}) {
       let result;
       if (request.method === 'POST' && !['/down', '/close'].includes(url.pathname)) requireRunning();
       if (request.method === 'GET' && url.pathname === '/status') {
-        result = { generation, root: fs.realpathSync(ctx.root), meshDb: path.resolve(ctx.dbPath), pid: process.pid, stopping, shutdown_error: shutdownError,
+        result = { generation, sandboxPolicyVersion: 1, root: fs.realpathSync(ctx.root), meshDb: path.resolve(ctx.dbPath), pid: process.pid, stopping, shutdown_error: shutdownError,
           workers: store.workers().map((row) => ({ ...row, owned: workers.has(row.peer),
           owner: workers.get(row.peer)?.owner || null,
           ...(workers.has(row.peer) && workers.get(row.peer).adapter ? { capabilities: workers.get(row.peer).adapter.snapshot().capabilities,
+            sandboxVerified: workers.get(row.peer).adapter.snapshot().sandboxVerified,
             quarantined: workers.get(row.peer).quarantined } : {}) })) };
       } else if (request.method === 'GET' && /^\/workers\/[^/]+\/(state|account)$/.test(url.pathname)) {
         const peer = decodeURIComponent(url.pathname.split('/')[2]);
@@ -506,9 +635,9 @@ export async function startNativeService(ctx, deps, options = {}) {
           await worker.adapter.readAccount();
           assertRequestedOwner(worker, identity);
         }
-        const snapshot = worker.adapter.snapshot();
+        const snapshot = workerSnapshot(worker);
         result = { root: fs.realpathSync(ctx.root), meshDb: path.resolve(ctx.dbPath), generation,
-          peer, provider: worker.provider, owner: worker.owner, cwd: worker.cwd, snapshot,
+          peer, provider: worker.provider, owner: worker.owner, cwd: worker.cwd, sandbox: worker.sandbox, snapshot,
           quarantined: worker.quarantined, closing: worker.closing,
           active_delivery: worker.active ? { message_id: worker.active.message.id,
             submission_id: worker.active.delivery.submission_id, turn_id: worker.active.turnId } : null,
@@ -521,11 +650,15 @@ export async function startNativeService(ctx, deps, options = {}) {
       } else if (request.method === 'POST' && url.pathname === '/workers') {
         const input = await jsonBody(request);
         requireRunning();
+        if (input.forkSessionId !== undefined) throw new CliError('BAD_ARGS', 'Use the guarded /fork endpoint');
         result = await createWorker(input);
+      } else if (request.method === 'POST' && url.pathname === '/fork') {
+        result = await track(forkWorker(await jsonBody(request)));
       } else if (request.method === 'POST' && url.pathname === '/send') {
         const input = await jsonBody(request);
         requireRunning();
         const worker = workers.get(input.peer);
+        if (forking.has(input.peer)) throw new CliError('NATIVE_FORK_NOT_READY', 'Wait for the parent fork to finish');
         if (!worker || worker.closing || creating.has(input.peer)) throw new CliError('NATIVE_WORKER_NOT_FOUND', 'Target native worker is not open');
         if (worker.quarantined) throw new CliError('NATIVE_WORKER_UNCERTAIN', 'Worker needs inspection and an explicit close/resume before more submissions');
         if (typeof input.body !== 'string' || !input.body.trim() || typeof input.from !== 'string' || !input.from.trim() ||
@@ -549,11 +682,28 @@ export async function startNativeService(ctx, deps, options = {}) {
             return;
           }
         }
-        const messageId = deps.sendMessage(mesh, input.from, input.peer, input.taskId || null, 'ask', input.body);
-        // The authenticated control endpoint supplies user intent; bus ingestion
-        // always queues peer origin. Caller-provided names/fields cannot promote bus data.
-        const delivery = store.queue(input.peer, messageId, input.submissionId || randomUUID(), 'user');
-        result = { message_id: messageId, submission_id: delivery.submission_id, state: delivery.state };
+        result = (() => {
+          const submissionId = input.submissionId || randomUUID();
+          let intent = mesh.prepare('SELECT * FROM native_user_submissions WHERE submission_id=?').get(submissionId);
+          if (intent) matchingUserSubmission(input, intent);
+          else {
+            // The message and its retry key commit together in mesh.db. The
+            // state.db delivery is a repairable projection, not a cross-DB commit.
+            const messageId = tx(mesh, () => {
+              const id = deps.sendMessage(mesh, input.from, input.peer, input.taskId || null, 'ask', input.body);
+              mesh.prepare(`INSERT INTO native_user_submissions(submission_id,message_id,peer,payload_hash)
+                VALUES (?,?,?,?)`).run(submissionId, id, input.peer, submissionHash(input));
+              return id;
+            });
+            intent = { submission_id: submissionId, message_id: messageId };
+            options.afterUserSubmissionMeshCommit?.({ submissionId, messageId });
+          }
+          const delivery = store.queue(input.peer, intent.message_id, submissionId, 'user');
+          if (!delivery || delivery.submission_id !== submissionId || delivery.origin !== 'user') {
+            throw new CliError('NATIVE_SUBMISSION_MISMATCH', 'Submission delivery conflicts with the durable message intent');
+          }
+          return { message_id: intent.message_id, submission_id: submissionId, state: delivery.state };
+        })();
       } else if (request.method === 'POST' && url.pathname === '/interrupt') {
         const input = await jsonBody(request);
         requireRunning();
@@ -568,13 +718,24 @@ export async function startNativeService(ctx, deps, options = {}) {
         const worker = workers.get(input.peer);
         if (!worker?.adapter || worker.closing || creating.has(input.peer)) throw new CliError('NATIVE_WORKER_NOT_FOUND', 'Target native worker is not open');
         assertRequestedOwner(worker, input);
-        if (input.executorId !== worker.owner || !worker.adapter.capabilities.approvals || !worker.adapter.respond) {
+        const snapshot = workerSnapshot(worker);
+        const matches = (snapshot.pendingApprovals || []).filter(pending => pending.requestId === input.requestId &&
+          pending.executorId === worker.owner && pending.sessionId === input.sessionId && pending.turnId === input.turnId);
+        const pending = matches.length === 1 ? matches[0] : null;
+        // Select permission from the adapter's exact pending request, never a
+        // caller-supplied kind. Read-only questions do not grant tool approvals.
+        const canRespond = pending?.kind === 'userInput'
+          ? worker.adapter.capabilities.userInput : worker.adapter.capabilities.approvals;
+        if (input.executorId !== worker.owner || !pending || !canRespond || !worker.adapter.respond ||
+            (input.kind !== undefined && input.kind !== pending.kind) ||
+            (pending.kind === 'userInput' && ['permissions', 'scope', 'content'].some(key => input[key] !== undefined))) {
           throw new CliError('NATIVE_APPROVAL_MISMATCH', 'Interaction belongs to another executor or provider has no responder');
         }
         result = await track(Promise.resolve(worker.adapter.respond(input)));
         save(worker);
       } else if (request.method === 'POST' && url.pathname === '/close') {
         const input = await jsonBody(request);
+        if (forking.has(input.peer)) throw new CliError('NATIVE_FORK_NOT_READY', 'Wait for the parent fork to finish');
         if (input.owner !== undefined || input.generation !== undefined || input.provider !== undefined || input.sessionId !== undefined) {
           const worker = workers.get(input.peer);
           if (!worker) throw new CliError('NATIVE_WORKER_NOT_FOUND', 'Target native worker is not open');

package/lib/runtime/native/store.mjs

@@ -130,7 +130,7 @@ export function createNativeStore(ctx) {
     PRAGMA foreign_keys = ON;
     CREATE TABLE IF NOT EXISTS workers (
       peer TEXT PRIMARY KEY, provider TEXT NOT NULL, session_id TEXT,
-      cwd TEXT NOT NULL, cwd_identity TEXT, status TEXT NOT NULL, updated_at INTEGER NOT NULL
+      cwd TEXT NOT NULL, cwd_identity TEXT, status TEXT NOT NULL, updated_at INTEGER NOT NULL, sandbox TEXT
     );
     CREATE TABLE IF NOT EXISTS deliveries (
       id INTEGER PRIMARY KEY, peer TEXT NOT NULL, message_id INTEGER NOT NULL,
@@ -150,6 +150,19 @@ export function createNativeStore(ctx) {
     if (!db.prepare('PRAGMA table_info(workers)').all().some(column => column.name === 'cwd_identity')) {
       db.exec('ALTER TABLE workers ADD COLUMN cwd_identity TEXT');
     }
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      if (!db.prepare('PRAGMA table_info(workers)').all().some(column => column.name === 'sandbox')) {
+        // Only the legacy schema implies the former workspace-write default.
+        // A missing value in the new schema must never escalate on reopen.
+        db.exec(`ALTER TABLE workers ADD COLUMN sandbox TEXT;
+          UPDATE workers SET sandbox='workspace-write' WHERE provider='codex';`);
+      }
+      db.exec('COMMIT');
+    } catch (error) {
+      try { db.exec('ROLLBACK'); } catch { /* Preserve the migration failure. */ }
+      throw error;
+    }
   } catch (error) {
     try { db.close(); } catch { /* Preserve the initialization failure. */ }
     throw error;
@@ -160,14 +173,25 @@ export function createNativeStore(ctx) {
     worker(peer) { return db.prepare('SELECT * FROM workers WHERE peer = ?').get(peer) || null; },
     workers() { return db.prepare('SELECT * FROM workers ORDER BY peer').all(); },
     saveWorker(worker) {
+      const previous = this.worker(worker.peer);
+      const sandbox = worker.provider === 'codex'
+        ? worker.sandbox === undefined ? previous ? previous.sandbox : 'workspace-write' : worker.sandbox
+        : worker.sandbox ?? null;
+      if ((worker.provider === 'codex' && !['read-only', 'workspace-write'].includes(sandbox)) ||
+          (worker.provider !== 'codex' && sandbox !== null)) {
+        throw new CliError('BAD_ARGS', 'Only Codex workers support read-only or workspace-write sandbox policies');
+      }
+      if (previous?.provider === worker.provider && previous.session_id && previous.sandbox !== sandbox) {
+        throw new CliError('NATIVE_SANDBOX_MISMATCH', 'A saved native session cannot change its sandbox policy');
+      }
       const cwdIdentity = worker.cwdIdentity ? JSON.stringify({ version: 1,
         requested: worker.cwdIdentity.requested, canonical: worker.cwdIdentity.canonical,
         identity: worker.cwdIdentity.identity }) : null;
-      db.prepare(`INSERT INTO workers(peer, provider, session_id, cwd, cwd_identity, status, updated_at) VALUES (?,?,?,?,?,?,?)
+      db.prepare(`INSERT INTO workers(peer, provider, session_id, cwd, cwd_identity, status, updated_at, sandbox) VALUES (?,?,?,?,?,?,?,?)
         ON CONFLICT(peer) DO UPDATE SET provider=excluded.provider, session_id=COALESCE(excluded.session_id,workers.session_id),
         cwd=excluded.cwd, cwd_identity=COALESCE(excluded.cwd_identity,workers.cwd_identity),
-        status=excluded.status, updated_at=excluded.updated_at`)
-        .run(worker.peer, worker.provider, worker.sessionId || null, worker.cwd, cwdIdentity, worker.status, now());
+        status=excluded.status, updated_at=excluded.updated_at, sandbox=excluded.sandbox`)
+        .run(worker.peer, worker.provider, worker.sessionId || null, worker.cwd, cwdIdentity, worker.status, now(), sandbox);
     },
     queue(peer, messageId, submissionId, origin = 'peer') {
       if (!['peer', 'user'].includes(origin)) throw new CliError('BAD_ARGS', 'Unknown native message origin');

package/lib/web/browser/core.mjs

@@ -198,6 +198,13 @@ import { TERMINAL_THEMES } from '../ui-preferences.mjs';
     const searchAddon = new SearchAddon.SearchAddon({ highlightLimit: 1000 });
     term.loadAddon(searchAddon);
     term.open(document.getElementById('terminal'));
+    // xterm creates this field at open; identify it and keep autofill disabled.
+    const terminalInput = term.textarea;
+    if (terminalInput) {
+      terminalInput.id = 'terminalInput';
+      terminalInput.name = 'terminalInput';
+      terminalInput.autocomplete = 'off';
+    }
 
     function resizeTerm() {
       const el = document.getElementById('terminal');
@@ -1934,7 +1941,8 @@ import { TERMINAL_THEMES } from '../ui-preferences.mjs';
     };
     installCommandPalette();
     window.hccWorkspaceHost = {
-      embedded:paneMode, app:appEl, primary:document.getElementById('workspacePrimaryPane'),
+      embedded:paneMode, paneAllowed:document.body.dataset.workspacePaneAllowed === 'true',
+      app:appEl, primary:document.getElementById('workspacePrimaryPane'),
       project:() => currentProject, projectIdentity:() => projectRequests.rootIdentity(),
       active:() => active, sessions:() => sessions, ready:() => sessionsLoaded,
       esc, showTerminal:() => setMobileView('terminal'), layoutChanged:() => { syncPanelAccess(); requestAnimationFrame(resizeTerm); }

package/lib/web/http-routes.mjs

@@ -156,7 +156,7 @@ export function createHttpRoutes(deps) {
           sendWebHtml(res, renderWebLogin);
           return;
         }
-        sendWebHtml(res, renderWebIndex);
+        sendWebHtml(res, nonce => renderWebIndex({ nonce, paneAllowed: hasCookie }));
         return;
       }
       if (req.method === 'GET' && url.pathname === '/assets/xterm.js') {

package/lib/web/native-sessions.mjs

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { CliError } from '../shared/errors.mjs';
 import { redactSecrets } from '../shared/redact.mjs';
@@ -32,6 +32,17 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
 
   function projectKey(ctx) { return `${ctx.root}\0${path.resolve(ctx.dbPath)}`; }
 
+  function sandboxRuntimeOptions(ctx, provider, runtime) {
+    if (provider !== 'codex') return undefined;
+    if (runtime?.sandboxPolicyVersion !== 1) {
+      throw new CliError('NATIVE_SANDBOX_RUNTIME_UNSUPPORTED',
+        'This native runtime cannot preserve Codex sandbox policies. Stop it after its work has finished, then start it with this HCC version. No worker was created.');
+    }
+    assertProject(ctx, runtime);
+    if (!runtime.generation.trim()) throw new CliError('NATIVE_SCOPE_CHANGED', 'Native runtime has no verifiable generation');
+    return { expectedGeneration: runtime.generation };
+  }
+
   function workerCwd(ctx, value) {
     if (value !== undefined && (typeof value !== 'string' || !value.trim() || value.length > 4096 || /[\x00-\x1f\x7f]/.test(value))) {
       throw new CliError('BAD_REQUEST', 'Native worker cwd must be a nonempty directory path');
@@ -149,14 +160,15 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
       if (!entry.resumable) throw new CliError('NATIVE_RESUME_NOT_READY', entry.resumeDetail);
       const existing = sessions.get(key);
       if (existing && existing.type !== 'native') throw new CliError('NATIVE_PEER_IN_USE', 'Another session owns this peer');
-      await ensureRuntime(ctx);
+      const runtime = await ensureRuntime(ctx);
       if (stopped) throw new CliError('NATIVE_WEB_DISCONNECTED', 'Web stopped before worker restore');
+      const requestOptions = sandboxRuntimeOptions(ctx, saved.provider, runtime);
       entry = historyWorker(ctx, readNativeWorkerHistory(ctx, peer).worker, await historyRuntime(ctx));
       if (entry.owner !== input.owner || entry.sessionId !== input.sessionId) throw new CliError('NATIVE_OWNER_CHANGED', 'Saved worker identity changed; refresh history');
       if (!entry.resumable) throw new CliError('NATIVE_RESUME_NOT_READY', entry.resumeDetail);
       try {
         receipt = await nativeApi(ctx, 'POST', '/workers', { peer, provider: saved.provider, cwd: workerCwd(ctx, saved.cwd),
-          resume: 'last', resumeFence: { owner: input.owner, sessionId: input.sessionId } });
+          resume: 'last', resumeFence: { owner: input.owner, sessionId: input.sessionId } }, requestOptions);
       } catch (error) {
         let ownerChanged = true;
         try { ownerChanged = historyWorker(ctx, saved, null).owner !== input.owner; } catch {}
@@ -212,15 +224,16 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
     assertNewPeer(ctx, peer);
     creating.add(key);
     try {
-      await ensureRuntime(ctx);
+      const runtime = await ensureRuntime(ctx);
       if (stopped) throw new CliError('NATIVE_WEB_DISCONNECTED', 'Web stopped before worker creation');
       assertNewPeer(ctx, peer);
       workerCwd(ctx, cwd);
+      const requestOptions = sandboxRuntimeOptions(ctx, input.kind, runtime);
       let receipt;
       try {
         // Exactly one create attempt. A lost response is not safe to replay.
         receipt = await nativeApi(ctx, 'POST', '/workers', { peer, provider: input.kind, cwd,
-          ...(input.model === undefined ? {} : { model: input.model }) });
+          ...(input.model === undefined ? {} : { model: input.model }) }, requestOptions);
       } catch (error) {
         if (error.extra?.uncertain) throw new CliError('NATIVE_CREATE_UNCONFIRMED',
           `Creation of ${peer} is unconfirmed. Refresh the Agent list or inspect native status before creating another worker`,
@@ -308,6 +321,8 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
         !value.snapshot || value.snapshot.provider !== value.provider ||
         typeof value.snapshot.status !== 'string' ||
         (value.snapshot.sessionId != null && typeof value.snapshot.sessionId !== 'string') ||
+        (value.snapshot.sandbox != null && !['read-only', 'workspace-write'].includes(value.snapshot.sandbox)) ||
+        (value.snapshot.sandboxVerified !== undefined && typeof value.snapshot.sandboxVerified !== 'boolean') ||
         !Array.isArray(value.events) || !Array.isArray(value.deliveries) ||
         value.events.some((event) => event.peer !== peer || !Number.isSafeInteger(event.id) || event.id < 1) ||
         value.deliveries.some((delivery) => delivery.peer !== peer)) {
@@ -393,6 +408,7 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
       status: value.snapshot.status, cwd: value.cwd, capabilities: value.snapshot.capabilities || {},
       metrics: value.snapshot.metrics || null, runtimeMetadata: value.snapshot.runtimeMetadata || null,
       account: value.snapshot.account || null, pendingApprovals: value.snapshot.pendingApprovals || [],
+      sandbox: value.snapshot.sandbox || null, sandboxVerified: value.snapshot.sandboxVerified === true,
       quarantined: Boolean(value.quarantined), closing: Boolean(value.closing),
       activeDelivery: value.active_delivery || null, events: history.slice(-HISTORY_LIMIT),
       deliveries: value.deliveries.slice(0, 100), eventCursor: cursor,
@@ -516,6 +532,9 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
       if (!text || text.length > 100000 || typeof submissionId !== 'string' || !/^[A-Za-z0-9_-]{8,100}$/.test(submissionId)) {
         throw new CliError('BAD_REQUEST', 'A message and a unique submissionId are required');
       }
+      if (input.retry !== undefined && typeof input.retry !== 'boolean') {
+        throw new CliError('BAD_REQUEST', 'Native submission retry must be explicit');
+      }
     }
     try { await readState(session); }
     catch (error) {
@@ -535,6 +554,15 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
       return applyState(session, validateState(session.ctx, session.peerId, value));
     }
     if (session.status !== 'running') throw new CliError('NATIVE_WORKER_NOT_FOUND', 'Native worker is not open');
+    if (session.kind === 'codex' && ['send', 'respond'].includes(action)) {
+      if (!['read-only', 'workspace-write'].includes(session.nativeState.sandbox)) {
+        throw new CliError('NATIVE_SANDBOX_RUNTIME_UNSUPPORTED',
+          'This native worker does not report its Codex sandbox policy. Finish its work and restart the native runtime with this HCC version before sending or responding.');
+      }
+      if (session.nativeState.sandbox === 'read-only' && !session.nativeState.sandboxVerified) {
+        throw new CliError('NATIVE_SANDBOX_UNVERIFIED', 'The Codex provider has not confirmed this read-only worker policy');
+      }
+    }
     if (typeof input.authorizeMutation === 'function') input.authorizeMutation();
     const identity = { peer: session.peerId, generation: session.nativeIdentity.generation,
       owner: session.nativeIdentity.owner, provider: session.kind, sessionId: session.nativeIdentity.sessionId };
@@ -544,17 +572,29 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
     if (action === 'interrupt' && !session.nativeState.capabilities.interrupt) {
       throw new CliError('NATIVE_CAPABILITY_UNSUPPORTED', 'Provider does not support interrupt');
     }
-    const pending = { submission_id: submissionId, owner: identity.owner, generation: identity.generation,
-      provider: identity.provider, provider_session_id: identity.sessionId };
+    const pending = { submission_id: submissionId, peer: identity.peer,
+      owner: identity.owner, generation: identity.generation,
+      provider: identity.provider, provider_session_id: identity.sessionId,
+      ...(action === 'send' ? { body_hash: createHash('sha256').update(text).digest('hex') } : {}) };
     if (action === 'send') {
       const db = connectWebProject(session.ctx);
       try {
         tx(db, () => {
-          if (db.prepare(`SELECT id FROM events WHERE type='native.web.submission.pending'
-            AND json_extract(payload, '$.submission_id')=? LIMIT 1`).get(submissionId)) {
-            throw new CliError('SUBMISSION_EXISTS', 'This submission was already attempted; inspect native deliveries before sending again');
+          const previous = db.prepare(`SELECT payload FROM events WHERE type='native.web.submission.pending'
+            AND json_extract(payload, '$.submission_id')=? ORDER BY id DESC LIMIT 1`).get(submissionId);
+          if (previous) {
+            if (input.retry !== true) {
+              throw new CliError('SUBMISSION_EXISTS', 'This submission was already attempted; inspect native deliveries before sending again');
+            }
+            let saved;
+            try { saved = JSON.parse(previous.payload); } catch { /* Reject below. */ }
+            if (!saved || Object.keys(pending).some(key => saved[key] !== pending[key])) {
+              throw new CliError('NATIVE_SUBMISSION_MISMATCH', 'Retry must keep the original worker, executor and message');
+            }
+          } else {
+            if (input.retry === true) throw new CliError('NATIVE_SUBMISSION_UNVERIFIED', 'No durable pending submission exists for this retry');
+            addEvent(db, 'native.web.submission.pending', session.peerId, null, pending);
           }
-          addEvent(db, 'native.web.submission.pending', session.peerId, null, pending);
         });
       } finally { db.close(); }
     }
@@ -566,12 +606,12 @@ export function createNativeSessions({ sessions, sessionKey, connectWebProject,
           : action === 'interrupt' ? { turnId: input.turnId || session.nativeState.turnId || undefined }
           : action === 'respond' ? { executorId: input.executorId, requestId: input.requestId, turnId: input.turnId,
             decision: input.decision, permissions: input.permissions, scope: input.scope, answers: input.answers, content: input.content } : {})
-      });
+      }, { expectedGeneration: identity.generation });
       if (action === 'send') {
         if (!Number.isSafeInteger(result?.message_id) || result.submission_id !== submissionId || typeof result.state !== 'string') {
           throw new CliError('NATIVE_RESPONSE_INVALID', 'Native queue receipt is invalid', { uncertain: true });
         }
-        receiptEvent(session, 'native.web.submission.queued', { ...pending, message_id: result.message_id, state: result.state });
+        receiptEvent(session, 'native.web.submission.queued', { ...pending, message_id: result.message_id, state: result.state, ...(input.retry === true ? { retry: true } : {}) });
       }
       current(session);
       if (action === 'respond') { await readState(session); current(session); }