@logicseek/hello-cc 1.1.0-rc.8 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logicseek/hello-cc",
-  "version": "1.1.0-rc.8",
+  "version": "1.1.0",
   "description": "Local control plane for coordinating Claude Code, Codex, and other coding CLI sessions.",
   "type": "module",
   "bin": {
@@ -9,6 +9,8 @@
   },
   "files": [
     "bin/",
+    "native/bin/",
+    "native/cwd-handoff/",
     "lib/",
     "scripts/",
     "assets/",
@@ -35,7 +37,11 @@
     "test:regression": "node ./scripts/regression.mjs",
     "test:web": "node ./scripts/web-workbench-acceptance.mjs",
     "test:web:installed": "node ./scripts/web-workbench-installed-acceptance.mjs",
-    "codex:protocol": "node ./scripts/codex-protocol.mjs"
+    "codex:protocol": "node ./scripts/codex-protocol.mjs",
+    "build:native:cwd-handoff": "node ./scripts/build-cwd-handoff.mjs",
+    "release:native:verify": "node ./scripts/verify-cwd-handoff-package.mjs",
+    "release:native:pack": "node ./scripts/pack-cwd-handoff.mjs",
+    "prepublishOnly": "npm run release:native:verify"
   },
   "repository": {
     "type": "git",

package/scripts/build-cwd-handoff.mjs

@@ -0,0 +1,47 @@
+import { spawnSync } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const hostTarget = `${process.platform}-${process.arch}`;
+const target = process.argv.length === 4 && process.argv[2] === '--target'
+  ? process.argv[3] : hostTarget;
+const supported = new Set(['darwin-arm64', 'darwin-x64', 'linux-arm64', 'linux-x64']);
+if ((process.argv.length !== 2 &&
+     !(process.argv.length === 4 && process.argv[2] === '--target')) ||
+    !supported.has(target) ||
+    (target !== hostTarget && !(process.platform === 'darwin' && target.startsWith('darwin-')))) {
+  console.error(`Unsupported native cwd handoff build target: ${target}`);
+  process.exit(1);
+}
+
+const source = path.join(root, 'native', 'cwd-handoff', 'hcc-cwd-handoff.c');
+const sourceHash = createHash('sha256').update(fs.readFileSync(source)).digest('hex');
+const outputDirectory = path.join(root, 'native', 'bin', target);
+const output = path.join(outputDirectory, 'hcc-cwd-handoff');
+fs.mkdirSync(outputDirectory, { recursive: true, mode: 0o755 });
+const temporary = path.join(outputDirectory,
+  `.hcc-cwd-handoff-${process.pid}-${randomBytes(4).toString('hex')}.tmp`);
+const compiler = process.env.CC || 'cc';
+const args = [
+  '-std=c11', '-O2', '-Wall', '-Wextra', '-Werror', '-pedantic',
+  '-D_FORTIFY_SOURCE=2', '-fstack-protector-strong',
+  `-DHCC_SOURCE_SHA256="${sourceHash}"`,
+  ...(process.platform === 'darwin' ? ['-arch', target.endsWith('arm64') ? 'arm64' : 'x86_64'] : []),
+  ...(process.platform === 'linux' ? ['-static', '-Wl,-z,relro,-z,now'] : []),
+  '-o', temporary, source
+];
+try {
+  const result = spawnSync(compiler, args, { stdio: 'inherit' });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`Native compiler exited with ${result.status ?? result.signal}`);
+  fs.chmodSync(temporary, 0o755);
+  fs.renameSync(temporary, output);
+  console.log(`Built ${path.relative(root, output)}`);
+} finally {
+  try { fs.unlinkSync(temporary); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+}

package/scripts/pack-cwd-handoff.mjs

@@ -0,0 +1,27 @@
+import { spawnSync } from 'node:child_process';
+import process from 'node:process';
+
+const verify = spawnSync(process.execPath, ['./scripts/verify-cwd-handoff-package.mjs'], {
+  stdio: 'inherit'
+});
+if (verify.error) throw verify.error;
+if (verify.status !== 0) process.exit(verify.status || 1);
+
+const packed = spawnSync('npm', ['pack', '--ignore-scripts', '--json'], {
+  encoding: 'utf8', maxBuffer: 16 * 1024 * 1024
+});
+if (packed.error) throw packed.error;
+if (packed.status !== 0) {
+  process.stderr.write(packed.stderr);
+  process.exit(packed.status || 1);
+}
+const [archive] = JSON.parse(packed.stdout);
+const files = new Map(archive.files.map(file => [file.path, file]));
+for (const target of ['darwin-arm64', 'darwin-x64', 'linux-arm64', 'linux-x64']) {
+  const name = `native/bin/${target}/hcc-cwd-handoff`;
+  const entry = files.get(name);
+  if (!entry || (entry.mode & 0o111) === 0 || (entry.mode & 0o022) !== 0) {
+    throw new Error(`npm tarball is missing safe executable ${name}`);
+  }
+}
+console.log(`Verified npm tarball ${archive.filename} (${archive.files.length} files)`);

package/scripts/regression.mjs

@@ -11,6 +11,9 @@ import crypto from 'node:crypto';
 import { performance } from 'node:perf_hooks';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { DatabaseSync } from 'node:sqlite';
+import { captureSelectedCwdSnapshot } from '../lib/process/selected-cwd-identity.mjs';
+import { recordCodexThreadRoot } from '../lib/core/sessions/codex-thread-root.mjs';
+import { createEventHelpers } from '../lib/db/events.mjs';
 import { Readable } from 'node:stream';
 import { pathToFileURL } from 'node:url';
 import WebSocket from 'ws';
@@ -53,6 +56,7 @@ const diagnosticSecrets = new Set();
 const fixtureFailures = new WeakSet();
 const fixtureCommandFailures = new WeakMap();
 const fixtureHttpFailures = new WeakMap();
+const fixtureShimRegistrationFailures = new WeakMap();
 const managedTmuxSessions = new Set();
 
 const env = {
@@ -95,6 +99,9 @@ export function fixtureFailureError(message, commandResult = null, diagnosticOpe
   fixtureFailures.add(error);
   const command = fixtureCommandResult(commandResult, diagnosticOperation);
   if (command) fixtureCommandFailures.set(error, command);
+  if (diagnosticOperation === 'shim-registration') {
+    fixtureShimRegistrationFailures.set(error, fixtureShimRegistrationSummary(commandResult));
+  }
   return error;
 }
 
@@ -108,10 +115,47 @@ export function fixtureFailureDiagnostic(error) {
       : new Error('regression failure handler').stack.split('\n').slice(1, 7),
     ...(fixtureCommandFailures.has(error) ? { command: fixtureCommandFailures.get(error) } : {}),
     ...(fixtureHttpFailures.has(error) ? { http: fixtureHttpFailures.get(error) } : {}),
+    ...(fixtureShimRegistrationFailures.has(error)
+      ? { shimRegistration: fixtureShimRegistrationFailures.get(error) } : {}),
     ...(terminalMarker ? { terminalMarker } : {})
   };
 }
 
+export function fixtureShimRegistrationSummary(observation = {}) {
+  // Public annotations retain only fixture-owned booleans and finite enums.
+  // CLI tables, provider output, identifiers, paths and environment are excluded.
+  const bool = value => typeof value === 'boolean' ? value : null;
+  const member = (value, allowed) => allowed.includes(value) ? value : 'unknown';
+  const section = key => observation?.[key] && typeof observation[key] === 'object'
+    ? observation[key] : {};
+  const text = section('text'), persisted = section('persisted'), pane = section('pane');
+  return Object.freeze({
+    text: Object.freeze({ format: member(text.format, ['runtime', 'database']),
+      peerPresent: bool(text.peerPresent), tmuxPresent: bool(text.tmuxPresent), panePresent: bool(text.panePresent) }),
+    providerEntered: bool(observation?.providerEntered),
+    persisted: Object.freeze({ state: member(persisted.state, ['available', 'unavailable']),
+      peerPresent: bool(persisted.peerPresent), bindingPresent: bool(persisted.bindingPresent),
+      transport: member(persisted.transport, ['tmux', 'web-pty', 'native', 'app-server', 'claude-mod', 'hook', 'detected']),
+      targetMatches: bool(persisted.targetMatches), sessionMatches: bool(persisted.sessionMatches),
+      peerStatus: member(persisted.peerStatus, ['starting', 'running', 'idle', 'working', 'busy', 'active', 'exited', 'detached', 'stale', 'blocked', 'closed']),
+      processState: member(persisted.processState, ['live', 'dead', 'unknown']) }),
+    pane: Object.freeze({ state: member(pane.state, ['found', 'not-found', 'unavailable']),
+      dead: bool(pane.dead), processState: member(pane.processState, ['live', 'dead', 'unknown']),
+      command: member(pane.command, ['bash', 'sh', 'zsh', 'node', 'env', 'hcc-cwd-handoff']) }),
+    events: Object.freeze((Array.isArray(observation?.events) ? observation.events : [])
+      .filter(type => ['peer.start.requested', 'tmux.session.attached', 'tmux.session.detached',
+        'tmux.session.exited', 'tmux.session.gc', 'tmux.session.rebind_cleanup_pending'].includes(type)).slice(0, 8))
+  });
+}
+
+export function fixturePeerListFormat(list) {
+  if (typeof list !== 'string') return 'unknown';
+  const header = list.split(/\r?\n/, 1)[0].trim().split(/\s+/).join(' ');
+  if (header === 'id peer kind role status type pane provider resume session pid command') return 'runtime';
+  if (header === 'id kind role status age active branch') return 'database';
+  return 'unknown';
+}
+
 function fixtureHttpRoute(route) {
   if (typeof route !== 'string') return null;
   const pathname = route.split(/[?#]/, 1)[0];
@@ -5697,6 +5741,19 @@ async function multiProjectWebWorkflow() {
   await stopSession(claudeResume.id);
 
   const codexResumeName = `web-codex-resume-${testId}`;
+  const unverifiedCodexResume = await runtimeFetch('/api/sessions', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ kind: 'codex', mode: 'resume', resume: codexResumeName })
+  }, { root });
+  const unverifiedCodexBody = await unverifiedCodexResume.json();
+  if (unverifiedCodexResume.ok || unverifiedCodexBody.error?.code !== 'CODEX_HISTORY_UNVERIFIED') {
+    fail(`path-only Codex history was accepted: ${JSON.stringify(unverifiedCodexBody)}`);
+  }
+  // This disposable fixture explicitly models a first-party root receipt;
+  // matching cwd text alone must not authorize the resume above.
+  withMeshDb((db) => recordCodexThreadRoot(db, createEventHelpers().addEvent,
+    codexResumeName, captureSelectedCwdSnapshot(root), 'regression-fixture'));
   const codexResume = await startProvider({ kind: 'codex', mode: 'resume', resume: codexResumeName });
   const expectedCodexPeer = `codex-${shortHash(codexResumeName)}`;
   if (!codexResume.command.includes(`codex resume ${codexResumeName}`)) {
@@ -5736,11 +5793,15 @@ async function multiProjectWebWorkflow() {
     fail(`resumable API omitted named codex resume session:\n${JSON.stringify(resumableRows, null, 2)}`);
   }
 
-  const codexLast = await startProvider({ kind: 'codex', mode: 'last' });
-  if (codexLast.command !== 'codex resume --last') {
-    fail(`web codex last command wrong:\n${JSON.stringify(codexLast, null, 2)}`);
+  const codexLastResponse = await runtimeFetch('/api/sessions', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ kind: 'codex', mode: 'last' })
+  }, { root });
+  const codexLastBody = await codexLastResponse.json();
+  if (codexLastResponse.ok || codexLastBody.error?.code !== 'CODEX_HISTORY_ID_REQUIRED') {
+    fail(`Codex --last was accepted without a provable thread ID: ${JSON.stringify(codexLastBody)}`);
   }
-  await stopSession(codexLast.id);
 
   const claudeContinue = await startProvider({ kind: 'claude', mode: 'continue' });
   if (claudeContinue.command !== 'claude --continue') {
@@ -6571,6 +6632,43 @@ async function tmuxBackedStartWorkflow() {
   await assertTmuxGcPolicy();
 }
 
+function collectShimRegistrationObservation(peer, pane, list, providerLog) {
+  const observation = {
+    text: { format: fixturePeerListFormat(list), peerPresent: list.includes(peer),
+      tmuxPresent: list.includes('tmux'), panePresent: list.includes(pane) },
+    providerEntered: fs.existsSync(providerLog), persisted: { state: 'unavailable' },
+    pane: { state: 'unavailable' }, events: []
+  };
+  let db;
+  try {
+    db = new DatabaseSync(path.join(root, '.hello-cc', 'mesh.db'), { readOnly: true, timeout: 250 });
+    const savedPeer = db.prepare('SELECT status, pid FROM peers WHERE id = ?').get(peer);
+    const binding = db.prepare('SELECT transport, runtime_target, runtime_session_id FROM peer_bindings WHERE peer = ?').get(peer);
+    observation.persisted = { state: 'available', peerPresent: Boolean(savedPeer), bindingPresent: Boolean(binding),
+      transport: binding?.transport, targetMatches: binding?.runtime_target === pane,
+      sessionMatches: binding?.runtime_session_id === peer, peerStatus: savedPeer?.status,
+      processState: Number.isSafeInteger(savedPeer?.pid) && savedPeer.pid > 0
+        ? inspectProcessIdentity(savedPeer.pid).state : 'unknown' };
+    observation.events = db.prepare(`SELECT type FROM events
+      WHERE type IN ('peer.start.requested', 'tmux.session.attached', 'tmux.session.detached',
+        'tmux.session.exited', 'tmux.session.gc', 'tmux.session.rebind_cleanup_pending')
+      AND (actor = ? OR (json_valid(payload) AND json_extract(payload, '$.target_peer') = ?))
+      ORDER BY id DESC LIMIT 8`).all(peer, peer).map(event => event.type);
+  } catch { /* A failed inspection must not replace the original assertion. */ }
+  finally { try { db?.close(); } catch {} }
+  const result = spawnSync('tmux', ['display-message', '-p', '-t', pane,
+    '#{pane_id}|#{pane_dead}|#{pane_pid}|#{pane_current_command}'], {
+    env, encoding: 'utf8', timeout: 1000, maxBuffer: 1024, stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const parts = String(result.stdout || '').trim().split('|');
+  if (result.status === 0 && parts[0] === pane && ['0', '1'].includes(parts[1])) {
+    const pid = /^\d+$/.test(parts[2] || '') ? Number(parts[2]) : null;
+    observation.pane = { state: 'found', dead: parts[1] === '1', command: parts[3],
+      processState: Number.isSafeInteger(pid) && pid > 0 ? inspectProcessIdentity(pid).state : 'unknown' };
+  } else if (result.status === 1) observation.pane = { state: 'not-found' };
+  return observation;
+}
+
 async function shimTmuxWorkflow() {
   if (!tmuxAvailable()) {
     log('[6/13] shim tmux-backed launch skipped (tmux not installed)');
@@ -6601,10 +6699,12 @@ async function shimTmuxWorkflow() {
     fail(`codex shim did not pass through exec:\n${codexExec}`);
   }
 
+  const shimProviderLog = path.join(outDir, 'shim-initial-provider');
   const shimEnv = {
     ...env,
     HCC_SHIM_NO_ATTACH: '1',
     HCC_FAKE_STAY_ALIVE: '1',
+    HCC_FAKE_LOG: shimProviderLog,
     HCC_NO_AUTO_INSTALL_TMUX: '1',
     HCC_REG_VALUE: 'shim-first'
   };
@@ -6615,7 +6715,8 @@ async function shimTmuxWorkflow() {
   const pane = parsePane(output);
   const list = hcc(['peer', 'list']);
   if (!list.includes(peer) || !list.includes('tmux') || !list.includes(pane)) {
-    fail(`shim peer missing from list:\n${list}`);
+    fail(`shim peer missing from list:\n${list}`,
+      collectShimRegistrationObservation(peer, pane, list, shimProviderLog), 'shim-registration');
   }
   const hookPreservePayload = JSON.stringify({
     session_id: 'hook-preserve-session',
@@ -7801,8 +7902,13 @@ async function syntaxAndHelp() {
       HOME: scanHome
     };
     const scanOutput = run(process.execPath, [hccBin, '--root', scanRealRoot, 'scan'], { env: scanEnv });
-    if (!scanOutput.includes('claude') || !scanOutput.includes('scan-realpath')) {
-      fail(`scan did not match discovered hccRoot through realpath comparison:\n${scanOutput}`);
+    if (scanOutput.includes('scan-realpath-session') || scanOutput.includes('scan-realpath')) {
+      fail(`scan attributed path-only Claude history to the selected project:\n${scanOutput}`);
+    }
+    run(process.execPath, [hccBin, '--root', scanRealRoot, 'scan', '--register'], { env: scanEnv });
+    const registered = run(process.execPath, [hccBin, '--root', scanRealRoot, 'peer', 'list'], { env: scanEnv });
+    if (registered.includes('scan-realpath')) {
+      fail(`scan registered path-only Claude history as a live peer:\n${registered}`);
     }
   } finally {
     try { fs.rmSync(scanHome, { recursive: true, force: true }); } catch {}

package/scripts/verify-cwd-handoff-package.mjs

@@ -0,0 +1,60 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const source = fs.readFileSync(path.join(root, 'native', 'cwd-handoff', 'hcc-cwd-handoff.c'));
+const sourceHash = createHash('sha256').update(source).digest('hex');
+const buildIdentity = Buffer.from(`HCC_SOURCE_SHA256:${sourceHash}`);
+const targets = new Map([
+  ['darwin-arm64', 0x0100000c],
+  ['darwin-x64', 0x01000007],
+  ['linux-arm64', 183],
+  ['linux-x64', 62]
+]);
+
+function verifyBinary(target, machine) {
+  const filename = path.join(root, 'native', 'bin', target, 'hcc-cwd-handoff');
+  const stat = fs.lstatSync(filename);
+  if (!stat.isFile() || (stat.mode & 0o111) === 0 || (stat.mode & 0o022) !== 0) {
+    throw new Error(`${target}: helper must be an executable, non-writable regular file`);
+  }
+  const binary = fs.readFileSync(filename);
+  if (binary.indexOf(buildIdentity) < 0) {
+    throw new Error(`${target}: binary is stale relative to its packaged C source`);
+  }
+  if (target.startsWith('darwin-')) {
+    if (binary.length < 8 || binary.readUInt32LE(0) !== 0xfeedfacf ||
+        binary.readUInt32LE(4) !== machine) {
+      throw new Error(`${target}: unexpected Mach-O architecture`);
+    }
+  } else {
+    if (binary.length < 64 || binary.subarray(0, 4).toString('hex') !== '7f454c46' ||
+        binary[4] !== 2 || binary[5] !== 1 || binary.readUInt16LE(18) !== machine) {
+      throw new Error(`${target}: unexpected ELF architecture`);
+    }
+    const programHeaderOffset = Number(binary.readBigUInt64LE(32));
+    const programHeaderSize = binary.readUInt16LE(54);
+    const programHeaderCount = binary.readUInt16LE(56);
+    if (programHeaderSize < 56 || programHeaderCount === 0 ||
+        programHeaderOffset + programHeaderSize * programHeaderCount > binary.length) {
+      throw new Error(`${target}: invalid ELF program headers`);
+    }
+    for (let i = 0; i < programHeaderCount; i++) {
+      const type = binary.readUInt32LE(programHeaderOffset + programHeaderSize * i);
+      if (type === 2 || type === 3) {
+        throw new Error(`${target}: Linux helper must not need a dynamic loader`);
+      }
+    }
+  }
+  console.log(`Verified ${path.relative(root, filename)}`);
+}
+
+try {
+  for (const [target, machine] of targets) verifyBinary(target, machine);
+} catch (error) {
+  console.error(`Native cwd handoff package incomplete: ${error.message}`);
+  process.exitCode = 1;
+}

package/scripts/web-workbench-acceptance.mjs

@@ -73,6 +73,7 @@ const evidence = {
   schemaVersion: 1, dir, packageRoot: repo, packageVersion: JSON.parse(fs.readFileSync(path.join(repo, 'package.json'), 'utf8')).version,
   node: process.version, platform: process.platform, checks: [], screenshots: [], errors: [], console: [], expectedErrors: [], cleanup: {},
   sourceFiles: hashes(), browser: 'Playwright 1.62.1; isolated headless context; repeatable CI runner',
+  browserFallbackReason: 'Browser plugin not available',
   mode: 'Simulated native adapters; actual HTTP, SQLite, native service and browser; no models or credentials',
   startedAt: new Date().toISOString(), success: false
 };
@@ -168,6 +169,82 @@ async function checkSharedSplit(page) {
     check('real split panes share one project GET while keeping response copies, drafts and action tokens independent');
   } finally { page.off('request', track); }
 }
+async function userQuestionChecks(page) {
+  await select(page, 'qa-claude');
+  // Selecting a session opens a viewer; an interactive answer needs an
+  // explicit lease claim through the same visible control as ordinary users.
+  if (!await page.evaluate(() => window.hccHandoff.canControl)) {
+    assert.equal(await page.locator('#nativeSend').isDisabled(), true);
+    await page.locator('#claimControlBtn').click();
+  }
+  await page.waitForFunction(() => window.hccHandoff.active === 'qa-claude' && window.hccHandoff.canControl);
+  const adapter = adapters.get('claude');
+  const answer = 'FORM_FIXTURE_ANSWER_DO_NOT_PERSIST';
+  const request = { kind: 'userInput', method: 'item/tool/requestUserInput', requestId: 'qa-user-question',
+    executorId: adapter.state.executorId, sessionId: adapter.state.sessionId, turnId: 'qa-question-turn',
+    params: { questions: [{ id: 'fixture-answer', header: 'Acceptance question',
+      question: 'Enter the test-owned answer, then explicitly send it.', isSecret: true }] } };
+  adapter.state.capabilities.userInput = true;
+  adapter.state.pendingApprovals = [request];
+  const responses = adapter.responses?.length || 0;
+  await page.locator('#nativeRead').click();
+  const form = page.locator('#nativeApprovals form.hcc-interaction-form');
+  await form.waitFor({ state: 'visible' });
+  const showQuestion = async () => {
+    // Use the product's response jump so the question and its field are both
+    // visible without disturbing a user's retained conversation position.
+    await page.locator('#nativeApprovalJump').click();
+    const label = form.locator('label'), paragraph = form.locator('p');
+    // At 390px the retained conversation area is short. The jump focuses the
+    // answer control; scroll its full label into the reading area as a user can.
+    await label.scrollIntoViewIfNeeded();
+    assert.ok((await label.innerText()).includes('Acceptance question'));
+    assert.equal(await paragraph.innerText(), 'Enter the test-owned answer, then explicitly send it.');
+    const [labelBox, questionBox, scrollBox] = await Promise.all([
+      label.boundingBox(), paragraph.boundingBox(), page.locator('#nativeScroll').boundingBox()
+    ]);
+    assert.ok(labelBox && questionBox && scrollBox);
+    assert.ok(labelBox.y >= scrollBox.y && questionBox.y + questionBox.height <= scrollBox.y + scrollBox.height,
+      'The question header and text must remain visible with its answer field');
+  };
+  await showQuestion();
+  const field = form.locator('[data-answer="0"]');
+  assert.ok(await field.getAttribute('name'));
+  assert.equal(await form.getAttribute('autocomplete'), 'off');
+  await field.fill(answer);
+  await page.evaluate(() => {
+    window.__qaQuestionSubmits = [];
+    document.addEventListener('submit', event => {
+      if (event.target.matches('form.hcc-interaction-form')) window.__qaQuestionSubmits.push(event.defaultPrevented);
+    });
+  });
+  const initialUrl = page.url();
+  await field.press('Enter');
+  await page.waitForFunction(() => window.__qaQuestionSubmits.length > 0);
+  assert.deepEqual(await page.evaluate(() => window.__qaQuestionSubmits), [true]);
+  assert.equal(page.url(), initialUrl);
+  assert.equal(adapter.responses?.length || 0, responses, 'Enter must not answer an executor request');
+  await showQuestion();
+  await shot(page, 'desktop-user-question-form');
+  await page.setViewportSize({ width: 390, height: 844 });
+  assert.equal(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth + 2), true);
+  await showQuestion();
+  await shot(page, 'mobile-user-question-form');
+  await page.setViewportSize({ width: 1440, height: 1000 });
+  assert.equal(await page.evaluate(() => window.hccHandoff.active), 'qa-claude');
+  assert.equal(await page.evaluate(() => window.hccHandoff.canControl), true);
+  const submit = page.locator('#nativeApprovals [data-decision="accept"]');
+  assert.equal(await submit.isDisabled(), false, 'Only the current controller can answer this request');
+  await submit.click();
+  await form.waitFor({ state: 'detached' });
+  assert.equal(adapter.responses.length, responses + 1);
+  assert.deepEqual(adapter.responses.at(-1).answers, { 'fixture-answer': { answers: [answer] } });
+  assert.equal(await page.evaluate(answer =>
+    [...Object.values(localStorage), ...Object.values(sessionStorage)].some(value => value.includes(answer)), answer), false);
+  check('user-question forms retain named fields, suppress Enter navigation, and send only after an explicit answer without browser storage');
+  await select(page, 'qa-codex');
+}
+
 async function extendedChecks(page, context) {
   await page.setViewportSize({ width: 1440, height: 1000 });
   await select(page, 'qa-codex');
@@ -187,6 +264,7 @@ async function extendedChecks(page, context) {
   await page.waitForFunction(() => window.hccHandoff.canControl);
   check('actual WebSocket reconnect restores missing output without replaying unsent input');
   await automaticReconnectChecks(page);
+  await userQuestionChecks(page);
 
   const observerContext = await browser.newContext({ viewport: { width: 1280, height: 900 } });
   await observerContext.addInitScript(browserInstrumentation);
@@ -355,7 +433,7 @@ try{
  service=await startNativeService(ctx,deps,{pollMs:1000000,afterUserSubmissionMeshCommit:retryFault.afterMeshCommit,adapterFactory:async(provider,options)=>{
   const peer=options.env.HCC_PEER;
   const state={provider,status:'idle',sessionId:peer,turnId:null,executorId:options.executorId,capabilities:{send:true,interrupt:true,close:true,resume:true}};
-  const adapter={opens:[],snapshot:()=>structuredClone(state),capabilities:state.capabilities,async open(input={}){this.opens.push(structuredClone(input));if(input.sessionId)state.sessionId=input.sessionId;return this.snapshot();},async send(input){this.sent=(this.sent||0)+1;state.status='running';state.turnId='qa-turn';this.active=input;return{status:'queued',turnId:state.turnId};},async interrupt(){state.status='idle';state.turnId=null;},async close(){state.status='closed';},emit(value){options.onEvent({provider,sessionId:state.sessionId,turnId:'qa-turn',...value});},state};
+  const adapter={opens:[],snapshot:()=>structuredClone(state),capabilities:state.capabilities,async open(input={}){this.opens.push(structuredClone(input));if(input.sessionId)state.sessionId=input.sessionId;return this.snapshot();},async send(input){this.sent=(this.sent||0)+1;state.status='running';state.turnId='qa-turn';this.active=input;return{status:'queued',turnId:state.turnId};},async interrupt(){state.status='idle';state.turnId=null;},async respond(input){this.responses ||= [];this.responses.push(structuredClone(input));state.pendingApprovals=[];return {status:'submitted',requestId:input.requestId};},async close(){state.status='closed';},emit(value){options.onEvent({provider,sessionId:state.sessionId,turnId:'qa-turn',...value});},state};
   adapters.set(provider,adapter);adaptersByPeer.set(peer,adapter);return adapter;
  }});
  for(const provider of ['codex','claude','dsh'])await api('POST','/workers',{peer:'qa-'+provider,provider});

package/scripts/web-workbench-installed-acceptance.mjs

@@ -49,7 +49,7 @@ function hashes() {
     if (fs.statSync(filename).isDirectory()) for (const name of fs.readdirSync(filename).sort()) walk(path.join(relative, name));
     else result[relative] = sha256(filename);
   };
-  for (const name of ['bin', 'lib', 'scripts', 'package.json', 'package-lock.json']) walk(name);
+  for (const name of ['bin', 'lib', 'native', 'scripts', 'package.json', 'package-lock.json']) walk(name);
   return result;
 }
 const receipt = {
@@ -78,6 +78,16 @@ try {
   run(install.command, install.parameters, 'install');
   const installed = path.join(prefix, 'node_modules', '@logicseek', 'hello-cc');
   assert.equal(JSON.parse(fs.readFileSync(path.join(installed, 'package.json'), 'utf8')).version, metadata.version);
+  receipt.nativeHelpers = [];
+  for (const target of ['darwin-arm64', 'darwin-x64', 'linux-arm64', 'linux-x64']) {
+    const relative = `native/bin/${target}/hcc-cwd-handoff`;
+    const entry = metadata.files.find(file => file.path === relative);
+    assert.ok(entry && (entry.mode & 0o111) && !(entry.mode & 0o022), 'Safe packaged helper missing: ' + target);
+    const installedHelper = path.join(installed, relative);
+    assert.equal(sha256(installedHelper), sha256(path.join(repo, relative)), 'Installed helper differs from source: ' + target);
+    receipt.nativeHelpers.push({ target, sha256: sha256(installedHelper), mode: entry.mode });
+  }
+  receipt.checks.push('four executable native helpers match their packed and installed source bytes');
   const publicCli = path.join(prefix, 'node_modules', '.bin', 'hcc');
   assert.equal(fs.realpathSync(publicCli), path.join(installed, 'bin', 'hcc.mjs'));
   const help = run(publicCli, ['--help'], 'public-cli', { cwd: prefix });