@logicseek/hello-cc 1.1.0-rc.8 → 1.1.0

package/lib/web/project-files.mjs

@@ -1,9 +1,13 @@
 import fs from 'node:fs/promises';
 import { constants } from 'node:fs';
 import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
 import path from 'node:path';
-import { TextDecoder } from 'node:util';
+import process from 'node:process';
+import { promisify, TextDecoder } from 'node:util';
 import { CliError } from '../shared/errors.mjs';
+import { preparePinnedCwdLaunch } from '../process/pinned-cwd.mjs';
+import { captureSelectedCwdIdentity } from '../process/selected-cwd-identity.mjs';
 
 export const PROJECT_FILE_LIMITS = Object.freeze({ entries: 500, scannedEntries: 5000,
   textBytes: 1024 * 1024, mediaBytes: 10 * 1024 * 1024, sniffBytes: 4096 });
@@ -31,10 +35,11 @@ const errorStatus = new Map([['PROJECT_FILE_BAD_PATH', 400], ['PROJECT_FILE_FORB
 
 export function projectFileErrorStatus(error) { return errorStatus.get(error?.code); }
 
-function privateComponent(name) {
+export function privateComponent(name) {
   const lower = name.toLowerCase();
-  return ignored.has(lower) || privateNames.has(lower) || /^\.hcc-file-write-/.test(lower) || /^(?:\.?env)(?:[.-]|$)/.test(lower) ||
-    /\.env(?:[.-]|$)/.test(lower) ||
+  return ignored.has(lower) || privateNames.has(lower) || /^\.hcc-file-write-/.test(lower) || /^(?:\.?env)(?:[._-]|$)/.test(lower) ||
+    /\.env(?:[._-]|$)/.test(lower) ||
+    /^(?:auth|accounts)(?:[._-](?:backup|bak|old|orig|copy))?\.(?:json|jsonl)(?:[._-](?:backup|bak|old|orig|copy))?$/.test(lower) ||
     /(?:^|[._-])(?:secrets?|credentials?|tokens?)(?:[._-]|$)/.test(lower) ||
     /^(?:id_(?:rsa|dsa|ecdsa|ed25519)|terraform\.tfstate)(?:[.-]|$)/.test(lower) ||
     /^service[-_]account(?:[._-]|$)/.test(lower) || /\.(?:pem|key|p12|pfx|jks|keystore|kdbx|ovpn)(?:[.-]|$)/.test(lower);
@@ -93,6 +98,86 @@ function publicError(error) {
   return new CliError('PROJECT_FILE_UNAVAILABLE', 'The requested project path could not be read');
 }
 
+const execFileAsync = promisify(execFile);
+
+// The helper is launched with a checked directory identity and uses only
+// relative names after entering that inode. It never opens a project path.
+export async function runPinnedDirectoryWorker(directory, expectedIdentity, source, input) {
+  const binding = preparePinnedCwdLaunch(directory, process.execPath,
+    ['-e', source, JSON.stringify(input)], {
+      purpose: 'maintenance', expectedIdentity,
+      env: { PATH: '/usr/bin:/bin', NODE_OPTIONS: '', NODE_NO_WARNINGS: '1' }
+    });
+  try {
+    const { stdout } = await execFileAsync(binding.command, binding.args, {
+      cwd: binding.cwd, env: binding.env, timeout: 10000, maxBuffer: 4 * 1024 * 1024
+    });
+    return JSON.parse(stdout);
+  } catch (error) {
+    const stderr = String(error.stderr || '');
+    if (/HCC_PINNED_CWD_CHANGED:/.test(stderr)) throw changed();
+    const workerError = /HCC_DIRECTORY_WORKER_FAILED:([A-Z_]+)/.exec(stderr);
+    if (workerError?.[1] === 'PROJECT_FILE_CHANGED') throw changed();
+    if (workerError) { const failure = new Error(workerError[1]); failure.code = workerError[1]; throw failure; }
+    throw error;
+  } finally { binding.release(); }
+}
+
+function projectListWorker() {
+  const fs = require('node:fs');
+  const { scannedEntries } = JSON.parse(process.argv[1]);
+  const entries = [];
+  let scanned = 0, truncated = false, directory;
+  try {
+    directory = fs.opendirSync('.');
+    for (let item; (item = directory.readSync()) !== null;) {
+      if (++scanned > scannedEntries) { truncated = true; break; }
+      if (privateComponent(item.name) || /[\\:\x00-\x1f\x7f]/.test(item.name) || item.isSymbolicLink()) continue;
+      if (!item.isDirectory() && !item.isFile()) continue;
+      let stat;
+      try { stat = fs.lstatSync(item.name, { bigint: true }); }
+      catch (error) { if (error.code === 'ENOENT') error.code = 'PROJECT_FILE_CHANGED'; throw error; }
+      if (stat.isSymbolicLink() || (!stat.isDirectory() && (!stat.isFile() || stat.nlink !== 1n))) continue;
+      entries.push({ name: item.name, type: stat.isDirectory() ? 'directory' : 'file',
+        ...(stat.isFile() ? { size: Number(stat.size) } : {}) });
+    }
+    process.stdout.write(JSON.stringify({ entries, truncated }));
+  } catch (error) {
+    process.stderr.write('HCC_DIRECTORY_WORKER_FAILED:' + (error.code || 'PROJECT_FILE_UNAVAILABLE') + '\n');
+    process.exitCode = 1;
+  } finally { directory?.closeSync(); }
+}
+
+export const PROJECT_PRIVATE_COMPONENT_WORKER_SOURCE = `const ignored = new Set(${JSON.stringify([...ignored])});\n` +
+  `const privateNames = new Set(${JSON.stringify([...privateNames])});\n` +
+  `const privateComponent = ${privateComponent.toString()};\n`;
+const PROJECT_LIST_WORKER_SOURCE = PROJECT_PRIVATE_COMPONENT_WORKER_SOURCE +
+  `(${projectListWorker.toString()})()`;
+
+// Windows has no trusted pinned-cwd launch. Keep its existing read-only
+// listing behavior; transient ancestor replacement remains outside this POSIX fix.
+async function listProjectFilesByPath(snapshot) {
+  let directory;
+  try {
+    directory = await fs.opendir(snapshot.absolute);
+    const entries = [];
+    let scanned = 0, truncated = false;
+    for await (const item of directory) {
+      if (++scanned > PROJECT_FILE_LIMITS.scannedEntries) { truncated = true; break; }
+      if (privateComponent(item.name) || /[\\:\x00-\x1f\x7f]/.test(item.name) || item.isSymbolicLink()) continue;
+      if (!item.isDirectory() && !item.isFile()) continue;
+      let stat;
+      try { stat = await fs.lstat(path.join(snapshot.absolute, item.name), { bigint: true }); }
+      catch (error) { if (error.code === 'ENOENT') throw changed(); throw error; }
+      if (stat.isSymbolicLink() || (!stat.isDirectory() && (!stat.isFile() || stat.nlink !== 1n))) continue;
+      entries.push({ name: item.name, type: stat.isDirectory() ? 'directory' : 'file',
+        ...(stat.isFile() ? { size: Number(stat.size) } : {}) });
+    }
+    directory = null;
+    return { entries, truncated };
+  } finally { await directory?.close().catch(() => {}); }
+}
+
 async function inspectPath(root, parts, directory, rootIdentity) {
   assertBoundRoot(rootIdentity);
   const base = await fs.realpath(root), chain = [];
@@ -149,34 +234,31 @@ async function openChecked(snapshot, directory) {
 
 /** Single-level listing only. No project module or executable is loaded. */
 export async function listProjectFiles(root, relative = '', { rootIdentity } = {}) {
-  let handle, directory;
+  let handle, ownedIdentity;
   try {
-    const parts = relativePath(relative, true), snapshot = await inspectPath(root, parts, true, rootIdentity);
+    const parts = relativePath(relative, true);
+    ownedIdentity = rootIdentity ? null : captureSelectedCwdIdentity(root);
+    const identity = rootIdentity || ownedIdentity;
+    const snapshot = await inspectPath(root, parts, true, identity);
     handle = await openChecked(snapshot, true);
-    directory = await fs.opendir(snapshot.absolute);
-    const entries = [];
-    let scanned = 0, truncated = false;
-    for await (const item of directory) {
-      if (++scanned > PROJECT_FILE_LIMITS.scannedEntries) { truncated = true; break; }
-      if (privateComponent(item.name) || /[\\:\x00-\x1f\x7f]/.test(item.name) || item.isSymbolicLink()) continue;
-      if (!item.isDirectory() && !item.isFile()) continue;
-      let stat;
-      try { stat = await fs.lstat(path.join(snapshot.absolute, item.name), { bigint: true }); }
-      catch (error) { if (error.code === 'ENOENT') throw changed(); throw error; }
-      if (stat.isSymbolicLink() || (!stat.isDirectory() && (!stat.isFile() || stat.nlink !== 1n))) continue;
-      const entry = { name: item.name, path: relative ? relative + '/' + item.name : item.name,
-        type: stat.isDirectory() ? 'directory' : 'file' };
-      if (stat.isFile()) entry.size = Number(stat.size);
-      entries.push(entry);
+    let listing;
+    if (process.platform === 'win32') listing = await listProjectFilesByPath(snapshot);
+    else {
+      const expectedIdentity = { canonical: snapshot.absolute, identity: {
+        dev: snapshot.stat.dev.toString(), ino: snapshot.stat.ino.toString(),
+        birthtimeNs: snapshot.stat.birthtimeNs?.toString() || null } };
+      listing = await runPinnedDirectoryWorker(snapshot.absolute, expectedIdentity,
+        PROJECT_LIST_WORKER_SOURCE, { scannedEntries: PROJECT_FILE_LIMITS.scannedEntries });
     }
-    directory = null; // for-await closes the handle on completion and break.
+    const entries = listing.entries.map(item => ({ ...item,
+      path: relative ? relative + '/' + item.name : item.name }));
     await verifyPath(snapshot, handle);
-    assertBoundRoot(rootIdentity, snapshot.chain[0].stat);
+    assertBoundRoot(identity, snapshot.chain[0].stat);
     entries.sort((a, b) => a.type === b.type ? (a.name < b.name ? -1 : a.name > b.name ? 1 : 0) : a.type === 'directory' ? -1 : 1);
-    if (entries.length > PROJECT_FILE_LIMITS.entries) truncated = true;
-    return { path: relative, entries: entries.slice(0, PROJECT_FILE_LIMITS.entries), truncated };
+    return { path: relative, entries: entries.slice(0, PROJECT_FILE_LIMITS.entries),
+      truncated: listing.truncated || entries.length > PROJECT_FILE_LIMITS.entries };
   } catch (error) { throw publicError(error); }
-  finally { await directory?.close().catch(() => {}); await handle?.close().catch(() => {}); }
+  finally { await handle?.close().catch(() => {}); ownedIdentity?.release(); }
 }
 
 async function readBytes(handle, length) {

package/lib/web/pty-sessions.mjs

@@ -17,6 +17,7 @@ import { detectBranch } from '../project-context.mjs';
 import { tx } from '../db/schema.mjs';
 import { spawnPinnedCwdPty } from '../process/pinned-cwd.mjs';
 import { captureSelectedCwdSnapshot } from '../process/selected-cwd-identity.mjs';
+import { assertCodexTerminalLaunch, CODEX_SESSION_ORIGIN_ENV } from '../core/sessions/codex-thread-root.mjs';
 
 export function createPtySessions(deps) {
   const {
@@ -60,13 +61,20 @@ export function createPtySessions(deps) {
     const expectedCwdIdentity = input.cwdIdentity ||
       (cwd === pctx.root ? pctx.rootIdentity || pctx.initialRootIdentity : null) ||
       captureSelectedCwdSnapshot(cwd);
+    const rootDb = connectWebProject(pctx);
+    let codexOrigin;
+    try {
+      codexOrigin = assertCodexTerminalLaunch(rootDb, input.binding, { command, root: pctx.root,
+        rootIdentity: pctx.rootIdentity || pctx.initialRootIdentity, cwd, cwdIdentity: expectedCwdIdentity });
+    } finally { rootDb.close(); }
     const callerEnv = input.env && typeof input.env === 'object' ? input.env : process.env;
     const shell = callerEnv.SHELL || process.env.SHELL || 'bash';
     const env = childSessionEnv({
       HCC_PEER: id,
       HCC_ROOT: pctx.root,
       HCC_DB: pctx.dbPath,
-      TERM: 'xterm-256color'
+      TERM: 'xterm-256color',
+      ...(codexOrigin ? { [CODEX_SESSION_ORIGIN_ENV]: codexOrigin } : {})
     }, callerEnv, { rootIdentity: pctx.rootIdentity || pctx.initialRootIdentity });
     const size = input.size || { cols: 100, rows: 30 };
     const previousSession = sessions.get(key);
@@ -199,7 +207,12 @@ export function createPtySessions(deps) {
     if (!['claude', 'codex', 'shell'].includes(kind)) {
       throw new CliError('BAD_REQUEST', `Unsupported session kind: ${kind}`);
     }
-    if (input.command || input.binding) return { ...input, kind, projectCtx: pctx };
+    if (input.command || input.binding) {
+      if (kind === 'codex' && input.mode && input.mode !== 'new') {
+        throw new CliError('BAD_REQUEST', 'Codex history mode cannot be combined with a custom command or binding');
+      }
+      return { ...input, kind, projectCtx: pctx };
+    }
 
     const opts = webSessionBuildOptions(input);
     if (kind === 'shell' && hasResumeOpts(opts)) {

package/lib/web/session-serialize.mjs

@@ -13,7 +13,12 @@ export function createSessionSerialize({
   localClientObservation = () => null
 }) {
   function sessionKey(projectCtx, id) {
-    return `${projectCtx.root}\0${id}`;
+    const owner = projectCtx.rootIdentity || projectCtx.initialRootIdentity;
+    const identity = owner?.identity;
+    const binding = identity
+      ? `${owner.canonical}\0${identity.dev}\0${identity.ino}\0${identity.birthtimeNs}`
+      : projectCtx.root;
+    return `${binding}\0${projectCtx.dbPath || ''}\0${id}`;
   }
 
   function sessionIdentityMatches(session, projectCtx) {

package/lib/web/startup.mjs

@@ -373,6 +373,8 @@ async function startWebBackgroundLocked(ctx, args, opts) {
   const childEnv = {
     ...process.env,
     [WEB_CHILD_ENV]: '1',
+    HCC_PINNED_ROOT_IDENTITY: JSON.stringify({ canonical: expectedRootIdentity.canonical,
+      identity: expectedRootIdentity.identity }),
     HCC_ROOT: boundRoot,
     HCC_DB: boundCtx.dbPath
   };
@@ -404,7 +406,7 @@ async function waitForStartedRuntime(ctx, child, logFile) {
   const deadline = Date.now() + WEB_RUNTIME_START_TIMEOUT_MS;
   while (Date.now() < deadline) {
     const runtime = await readHealthyGlobalRuntime();
-    if (runtime) return runtime;
+    if (runtime && runtime.pid === child.pid && runtime.root === ctx.root && runtime.db === ctx.dbPath) return runtime;
     if (exitInfo) {
       const detail = redactedLogText(tailFile(logFile));
       throw new CliError('RUNTIME_START_FAILED',

package/lib/web/tmux-sessions.mjs

@@ -12,8 +12,11 @@ import { CliError } from '../shared/errors.mjs';
 import { tx } from '../db/schema.mjs';
 import { required } from '../cli-args.mjs';
 import { readClockGraceUntil } from '../shared/clock-grace.mjs';
-import { preparePinnedCwdLaunch } from '../process/pinned-cwd.mjs';
+import { compareProcessIdentity, inspectProcessIdentity } from '../process/identity.mjs';
+import { assertPinnedSessionLaunchAllowed } from '../process/pinned-cwd.mjs';
+import { prepareTmuxCwdHandoff } from '../process/tmux-cwd-handoff.mjs';
 import { captureSelectedCwdSnapshot } from '../process/selected-cwd-identity.mjs';
+import { assertCodexTerminalLaunch, CODEX_SESSION_ORIGIN_ENV } from '../core/sessions/codex-thread-root.mjs';
 import { peerEvidenceAllowsReap } from '../core/peers/evidence.mjs';
 import { isDshHookBinding } from '../core/peers/bindings.mjs';
 import { conditionalTmuxKill, conditionalTmuxRename, prepareTmuxRestartBinding, rollbackTmuxRestartBinding, validateTmuxDestructiveEvidence } from '../core/peers/tmux-safety.mjs';
@@ -25,8 +28,8 @@ import { adoptionPaused } from './adoption-state.mjs';
 import { ensureTmuxAvailable, runTmux, tmuxCapturePane, tmuxEnvironmentArgs, tmuxHasSession, tmuxKillSession, tmuxLaunchFingerprint, tmuxListSessionNames, tmuxManagedSessionName, tmuxManagedSessionNameMatches, tmuxPaneInfo, tmuxProviderState, tmuxSendLiteral, tmuxSessionEnvironmentValue, tmuxSessionHasClients } from '../tmux.mjs';
 
 // tmux returns after creating a pane, not after its command has entered cwd.
-// Keep the parent's captured directory FD alive until the bootstrap confirms
-// the checked chdir, or tmux definitively reports that the pane exited.
+// The broker holds the captured FD until the pane confirms fchdir, or the
+// bounded handoff fails without granting access to the selected directory.
 export function monitorPinnedTmuxLaunch(binding, paneTarget, { paneInfo = tmuxPaneInfo, intervalMs = 100 } = {}) {
   let timer;
   let released = false;
@@ -39,11 +42,13 @@ export function monitorPinnedTmuxLaunch(binding, paneTarget, { paneInfo = tmuxPa
   function check() {
     if (released) return true;
     if (binding.acknowledged()) { release(); return true; }
+    if (binding.failed?.()) { release(); return true; }
     try {
       if (paneInfo(paneTarget).dead) { release(); return true; }
     } catch {
       // Even a missing pane/server does not prove its child process exited:
-      // a tmux crash can leave an orphan bootstrap alive. Retain the FD.
+      // a tmux crash can leave an orphan client alive. The broker timeout
+      // still bounds this pending handoff without granting an unknown PID.
     }
     return false;
   }
@@ -54,15 +59,15 @@ export function monitorPinnedTmuxLaunch(binding, paneTarget, { paneInfo = tmuxPa
 }
 
 export function runPinnedTmuxNewSession({ cwd, expectedIdentity, shell, command, env, sessionName, tmuxEnv },
-  { run = runTmux, paneInfo = tmuxPaneInfo, bootstrapCwd } = {}) {
-  const binding = preparePinnedCwdLaunch(cwd, shell, ['-c', command], {
-    env, expectedIdentity, acknowledge: true, ...(bootstrapCwd ? { bootstrapCwd } : {})
-  });
+  { run = runTmux, paneInfo = tmuxPaneInfo, prepare = prepareTmuxCwdHandoff, onCreated } = {}) {
+  const binding = prepare({ cwd, expectedIdentity, shell, command, env });
   let args;
   try {
-    // Multiple shell-command arguments make tmux exec the command directly,
-    // without its default shell or shell startup hooks running before pinning.
-    args = ['new-session', '-d', '-s', sessionName, '-c', binding.cwd,
+    // -P atomically reports the pane's original PID. The native broker
+    // authorizes exactly that PID before sending the captured directory FD;
+    // tmux and its shell never resolve the user's selected pathname.
+    args = ['new-session', '-d', '-P', '-F', '#{pane_id}|#{pane_pid}|#{session_id}|#{session_created}',
+      '-s', sessionName, '-c', binding.cwd,
       ...tmuxEnvironmentArgs(tmuxEnv), '--',
       ...isolatedEnvCommandArgs(binding.env), binding.command, ...binding.args];
   } catch (error) {
@@ -70,14 +75,80 @@ export function runPinnedTmuxNewSession({ cwd, expectedIdentity, shell, command,
     throw error;
   }
   try {
-    run(args);
+    const receipt = String(run(args) || '').trim();
+    const fields = receipt.split('|');
+    if (fields.length !== 4 || !/^%\d+$/.test(fields[0]) ||
+        !/^[1-9]\d*$/.test(fields[1]) || !/^\$\d+$/.test(fields[2]) ||
+        !/^[1-9]\d*$/.test(fields[3]) || !Number.isSafeInteger(Number(fields[1]))) {
+      throw new CliError('TMUX_ERROR', 'tmux did not report an unambiguous new pane identity');
+    }
+    // The caller must know there is a candidate session to roll back even if
+    // authorization or the subsequent bind acknowledgement fails.
+    onCreated?.(fields);
+    binding.authorize(Number(fields[1]));
+    // A tmux pane receipt proves only creation. Do not publish/attach it or
+    // tear down a parked old session until the native client reports fchdir.
+    binding.waitBoundSync();
+    return monitorPinnedTmuxLaunch(binding, fields[0], { paneInfo });
   } catch (error) {
-    // A timed-out tmux command may have created the pane. Do not release its
-    // directory FD until a checked bootstrap ACK or definitive pane exit.
-    monitorPinnedTmuxLaunch(binding, `${sessionName}:0.0`, { paneInfo });
+    // A timed-out tmux command may have created a pane, but without the
+    // immutable receipt no PID is authorized. Closing the broker leaves any
+    // orphan client unable to enter the selected directory.
+    binding.release();
     throw error;
   }
-  return monitorPinnedTmuxLaunch(binding, `${sessionName}:0.0`, { paneInfo });
+}
+
+// A missing tmux pane is only evidence about tmux. The captured process
+// fingerprint decides whether the original owner exited or became orphaned.
+export function pollTmuxSessionExit(session, state, {
+  paneInfo = tmuxPaneInfo,
+  inspectProcess = inspectProcessIdentity,
+  detach
+} = {}) {
+  const stored = session.adoptionIdentity?.process_identity;
+  function originalStatus() {
+    if (compareProcessIdentity(stored, stored) !== 'live') return 'detached';
+    let observation;
+    try { observation = inspectProcess(stored.pid); }
+    catch { return 'detached'; }
+    if (observation?.state === 'dead') return 'exited';
+    if (observation?.state !== 'live') return 'detached';
+    return compareProcessIdentity(stored, observation.identity) === 'dead' ? 'exited' : 'detached';
+  }
+
+  let result = 'unknown';
+  let paneReused = false;
+  try {
+    const fresh = paneInfo(session.pane);
+    if (!fresh || fresh.dead) {
+      result = originalStatus();
+    } else if ((fresh.pane && fresh.pane !== session.pane) ||
+        Number(fresh.pid) !== Number(stored?.pid)) {
+      paneReused = true;
+      result = originalStatus();
+    } else {
+      let observation;
+      try { observation = inspectProcess(stored.pid); }
+      catch { observation = null; }
+      if (observation?.state === 'dead') result = 'exited';
+      else if (observation?.state === 'live') {
+        const match = compareProcessIdentity(stored, observation.identity);
+        result = match === 'live' ? 'running' : match === 'dead' ? 'exited' : 'unknown';
+      }
+      paneReused = result === 'exited';
+    }
+  } catch (error) {
+    const message = error?.code === 'TMUX_ERROR' ? String(error.message || '') : '';
+    if (/can't find pane|can't find session|no server running/i.test(message)) result = originalStatus();
+  }
+
+  if (result === 'running' || result === 'unknown') {
+    state.deadCount = 0;
+  } else if (paneReused || ++state.deadCount >= 3) {
+    detach(session, result);
+  }
+  return result;
 }
 
 export function createTmuxSessions(deps) {
@@ -105,6 +176,8 @@ export function createTmuxSessions(deps) {
   const adoptionSessionNames = deps.tmuxListSessionNames || tmuxListSessionNames;
   const adoptionSessionEnvironment = deps.tmuxSessionEnvironmentValue || tmuxSessionEnvironmentValue;
   const adoptionSessionMatches = deps.tmuxManagedSessionNameMatches || tmuxManagedSessionNameMatches;
+  const inspectExitProcess = deps.inspectProcessIdentity || inspectProcessIdentity;
+  const scheduleExitPoller = deps.scheduleTmuxExitPoller || setInterval;
 
   function isAdoptionPaused(projectCtx, info, peer, existingDb = null) {
     const db = existingDb || connectWebProject(projectCtx);
@@ -709,29 +782,12 @@ export function createTmuxSessions(deps) {
     let rebindOldPlan = null;
     let rebindOldBindingSubject = null;
 
-    // Detect pane death (retry 3 times before detaching — handles Ctrl+C transient states)
-    let deadCount = 0;
-    session.exitPoller = setInterval(() => {
+    const exitState = { deadCount: 0 };
+    session.exitPoller = scheduleExitPoller(() => {
       if (isStopping()) return;
-      try {
-        const fresh = tmuxPaneInfo(session.pane);
-        if (fresh.dead) {
-          deadCount++;
-          if (deadCount >= 3) detachTmuxSession(session, 'exited');
-        } else {
-          deadCount = 0;
-        }
-      } catch (err) {
-        // sess-03: only a definitive "pane/session is gone" error counts toward
-        // detach; a transient tmux failure (busy server, momentary hiccup) must
-        // not detach a live session after 3 attempts.
-        const message = err?.code === 'TMUX_ERROR' ? String(err.message || '') : '';
-        const definitivelyGone = /can't find pane|can't find session|no server running/i.test(message);
-        if (definitivelyGone) {
-          deadCount++;
-          if (deadCount >= 3) detachTmuxSession(session, 'exited');
-        }
-      }
+      pollTmuxSessionExit(session, exitState, {
+        paneInfo: adoptionPaneInfo, inspectProcess: inspectExitProcess, detach: detachTmuxSession
+      });
     }, 3000);
 
     let db = null;
@@ -909,7 +965,6 @@ export function createTmuxSessions(deps) {
     for (const existing of sessions.values()) {
       if (providerSessionBindingMatches(existing.binding, input.binding)) input.authorizeMutation?.(existing);
     }
-    ensureTmuxAvailable({ autoInstall: false });
     const pctx = input.projectCtx || ctx;
     const kind = input.kind || 'shell';
     const id = input.id || nextProjectSessionId(pctx, kind);
@@ -924,6 +979,13 @@ export function createTmuxSessions(deps) {
     const expectedCwdIdentity = input.cwdIdentity ||
       (cwd === pctx.root ? pctx.rootIdentity || pctx.initialRootIdentity : null) ||
       captureSelectedCwdSnapshot(cwd);
+    const historyDb = connectWebProject(pctx);
+    let codexOrigin;
+    try {
+      codexOrigin = assertCodexTerminalLaunch(historyDb, input.binding, { command, root: pctx.root,
+        rootIdentity: pctx.rootIdentity || pctx.initialRootIdentity, cwd, cwdIdentity: expectedCwdIdentity });
+    } finally { historyDb.close(); }
+    ensureTmuxAvailable({ autoInstall: false });
     const sessionName = tmuxManagedSessionName(pctx, id);
     let paneTarget = `${sessionName}:0.0`;
     const callerEnv = input.env && typeof input.env === 'object' ? input.env : process.env;
@@ -931,14 +993,15 @@ export function createTmuxSessions(deps) {
       HCC_PEER: id,
       HCC_ROOT: pctx.root,
       HCC_DB: pctx.dbPath,
-      TERM: 'xterm-256color'
+      TERM: 'xterm-256color',
+      ...(codexOrigin ? { [CODEX_SESSION_ORIGIN_ENV]: codexOrigin } : {})
     }, callerEnv, { rootIdentity: pctx.rootIdentity || pctx.initialRootIdentity });
     env[LAUNCH_FINGERPRINT_ENV] = launchFingerprint({ command, cwd, env });
     let hasSession = tmuxHasSession(sessionName);
     const relaunchableProvider = isRelaunchableProviderSession(kind, command, input.binding || {});
     const oldTmuxTargetsForRebind = [];
     const parkedOldTmuxSessions = [];
-    let createdTmuxSession = false;
+    let createdTmuxSession = null;
     let pendingOldSession = null;
     let pendingRestartAudit = null;
 
@@ -954,29 +1017,59 @@ export function createTmuxSessions(deps) {
         if (tmuxHasSession(parked.originalName)) {
           quarantineName = `hcc-rollback-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`;
           try {
-            runTmux(['rename-session', '-t', parked.originalName, quarantineName]);
+            if (!createdTmuxSession || createdTmuxSession.session !== parked.originalName) {
+              throw new CliError('TMUX_CONDITIONAL_RENAME_MISMATCH',
+                'Cannot prove the session occupying the original name is our failed candidate');
+            }
+            conditionalTmuxRename(runTmux, createdTmuxSession, quarantineName, { allowClients: true });
           } catch (err) {
-            failures.push(`could not quarantine failed replacement ${parked.originalName}: ${err?.message || err}`);
+            failures.push(`could not prove and quarantine failed replacement ${parked.originalName}: ${err?.message || err}`);
             continue;
           }
         }
         try {
-          runTmux(['rename-session', '-t', parked.parkedName, parked.originalName]);
+          conditionalTmuxRename(runTmux, parked.authority, parked.originalName);
         } catch (err) {
           failures.push(`could not restore ${parked.parkedName} to ${parked.originalName}: ${err?.message || err}`);
           if (quarantineName && !tmuxHasSession(parked.originalName)) {
-            try { runTmux(['rename-session', '-t', quarantineName, parked.originalName]); } catch {}
+            try {
+              conditionalTmuxRename(runTmux,
+                { ...createdTmuxSession, session: quarantineName }, parked.originalName,
+                { allowClients: true });
+            } catch {}
           }
           continue;
         }
+        if (parked.bindingPreparation?.restored) {
+          let bindingRolledBack = false;
+          let bindingRollbackError = null;
+          try {
+            const rollbackDb = connectWebProject(pctx);
+            try {
+              bindingRolledBack = rollbackTmuxRestartBinding(rollbackDb, parked.bindingPreparation);
+            } finally { rollbackDb.close(); }
+          } catch (err) {
+            bindingRollbackError = err?.message || String(err);
+          }
+          if (!bindingRolledBack) {
+            const reason = bindingRollbackError || 'binding changed';
+            failures.push(`could not roll back parked binding ${parked.originalName}: ${reason}`);
+          }
+        }
         if (quarantineName) {
-          try { tmuxKillSession(quarantineName); } catch { quarantined.push(quarantineName); }
+          try {
+            conditionalTmuxKill(runTmux,
+              { ...createdTmuxSession, session: quarantineName }, { allowClients: true });
+          } catch { quarantined.push(quarantineName); }
         }
       }
       return { failures, quarantined };
     }
 
     function restartExistingTmuxSession(reason) {
+      // A held rollout may still attach to a live pane, but must not park it
+      // before discovering that a replacement launch is disallowed.
+      assertPinnedSessionLaunchAllowed({ env });
       const existing = getSession(pctx, id);
       const hasWebClients = hasOpenClients(existing);
       const hasTmuxClients = tmuxSessionHasClients(sessionName);
@@ -1056,7 +1149,8 @@ export function createTmuxSessions(deps) {
           binding_rollback_failed: !bindingRolledBack
         });
       }
-      parkedOldTmuxSessions.push({ oldTarget, originalName: sessionName, parkedName });
+      parkedOldTmuxSessions.push({ oldTarget, originalName: sessionName, parkedName,
+        authority: { ...storedAuthority, session: parkedName }, bindingPreparation });
       if (oldTarget) oldTmuxTargetsForRebind.push({ oldPeer: id, oldTarget, allowedSessionName: parkedName });
       if (existing) {
         oldTarget = oldTarget || existing.pane || null;
@@ -1112,8 +1206,17 @@ export function createTmuxSessions(deps) {
         };
         if (relaunchableProvider) tmuxEnv[PROVIDER_STATE_ENV] = 'starting';
         runPinnedTmuxNewSession({ cwd, expectedIdentity: expectedCwdIdentity,
-          shell, command, env, sessionName, tmuxEnv });
-        createdTmuxSession = true;
+          shell, command, env, sessionName, tmuxEnv }, {
+          onCreated(fields) {
+            createdTmuxSession = {
+              session: sessionName,
+              session_created: fields[3],
+              session_id: fields[2],
+              pane: fields[0],
+              process_identity: { pid: Number(fields[1]) }
+            };
+          }
+        });
       }
 
       pane = tmuxPaneInfo(paneTarget).pane;
@@ -1152,7 +1255,7 @@ export function createTmuxSessions(deps) {
       });
     } catch (err) {
       if (createdTmuxSession) {
-        try { tmuxKillSession(sessionName); } catch {}
+        try { conditionalTmuxKill(runTmux, createdTmuxSession, { allowClients: true }); } catch {}
       }
       const rollback = restoreParkedOldTmuxSessions();
       // attachTmuxSession removes a failed candidate from the map. Restore the

package/lib/web/ui-interactions.mjs

@@ -8,6 +8,9 @@ export function installInteractionPanel(createForms = createMcpFormValidator, cr
 (() => {
     if (window.hccInteractions) return;
     const mcpForms = createForms(), mcpUrls = createUrls();
+    if (typeof document !== 'undefined') document.addEventListener?.('submit', event => {
+      if (event.target?.matches?.('.hcc-interaction-form')) event.preventDefault();
+    });
     const drafts = new Map(), expanded = new Map();
     let focus = null;
     function remember(container) {
@@ -107,7 +110,7 @@ export function installInteractionPanel(createForms = createMcpFormValidator, cr
       try { ({ fields } = mcpForms.describe(request.params)); }
       catch (_) { return '<p role="alert">' + esc(text('This MCP request mode or schema is unsupported. Decline or cancel this request.', '暂不支持此 MCP 请求模式或表单结构，请拒绝或取消请求。')) + '</p>'; }
       if (!fields.length) return '';
-      const attr = suffix => ' data-interaction-field="' + esc(key + ':mcp:' + suffix) + '"';
+      const attr = suffix => ' name="' + esc(key + ':mcp:' + suffix) + '" data-interaction-field="' + esc(key + ':mcp:' + suffix) + '"';
       const select = (i, choices, value) => '<select data-mcp-field="' + i + '"' + attr(i) + '><option value="">' + esc(text('Choose a value', '请选择')) + '</option>'
         + choices.map((choice, n) => '<option value="' + n + '"' + (value === choice.value ? ' selected' : '') + '>' + esc(choice.label) + '</option>').join('') + '</select>';
       return '<p>' + esc(text('Required fields are marked *. Optional fields are sent only when selected. Responses are not saved in browser storage.', '带 * 的为必填项；可选项仅在勾选填写后发送。答复不会保存到浏览器存储。')) + '</p>'
@@ -140,8 +143,8 @@ export function installInteractionPanel(createForms = createMcpFormValidator, cr
           + (destination.loopback ? '<p>' + esc(text('This address belongs to the executor computer. A browser on another device may not reach it; open this task on the executor computer to authorize.', '此地址位于执行器所在电脑。其他设备的浏览器可能无法访问，请在执行器所在电脑打开本任务完成授权。')) + '</p>' : '');
       }
       if (request.kind === 'mcp') return mcpForm(request, key, esc, text);
-      const field = suffix => ' data-interaction-field="' + esc(key + ':' + suffix) + '"';
-      if (request.kind === 'userInput') return (request.params?.questions || []).map((q, i) => {
+      const field = suffix => ' name="' + esc(key + ':' + suffix) + '" data-interaction-field="' + esc(key + ':' + suffix) + '"';
+      if (request.kind === 'userInput') return '<form class="hcc-interaction-form" autocomplete="off">' + (request.params?.questions || []).map((q, i) => {
         const label = '<label>' + esc(q.header || '') + '<p>' + esc(q.question || '') + '</p>';
         const free = '<input data-answer="' + i + '" type="' + (q.isSecret ? 'password' : 'text') + '" maxlength="8192" autocomplete="off"' + field('answer:' + i) + '>';
         if (!q.options?.length) return label + free + '</label>';
@@ -149,7 +152,7 @@ export function installInteractionPanel(createForms = createMcpFormValidator, cr
           + q.options.map((o, n) => '<option value="' + n + '">' + esc(o.label + (o.description ? ' — ' + o.description : '')) + '</option>').join('')
           + (q.isOther ? '<option value="other">' + esc(text('Other (enter below)', '其他（在下方输入）')) + '</option>' : '') + '</select>'
           + (q.isOther ? free : '') + '</label>';
-      }).join('');
+      }).join('') + '</form>';
       if (request.kind !== 'permissions') return '';
       const p = request.params?.permissions || {}, fs = p.fileSystem || {};
       const choice = (name, index, label) => '<label><input type="checkbox" data-permission="' + name + '" data-index="' + index + '"' + field(name + ':' + index) + '> ' + esc(label) + '</label>';