@logicseek/hello-cc 1.1.0-rc.8 → 1.1.0

package/lib/cli/commands/up.mjs

@@ -7,12 +7,13 @@ import { printResult } from '../../format.mjs';
 import { commandPath } from '../../cli-runtime.mjs';
 import { detectBranch } from '../../project-context.mjs';
 import { bindingFromDetected } from '../../core/peers/bindings.mjs';
+import { tx } from '../../db/schema.mjs';
 
 export function createUpCommand(deps) {
   const {
     connect, helpUp, PRODUCT_NAME,
     loadSetup, loadDiscover,
-    writeGuidance, sameResolvedPath,
+    writeGuidance,
     upsertPeer, upsertCanonicalPeerBinding
   } = deps;
 
@@ -88,12 +89,8 @@ async function prepareLocalBus(ctx, opts = {}) {
   const detected = [];
   if (!opts['no-discover']) {
     try {
-      const { scanClaudeSessions, scanCodexSessions, scanProcesses } = await loadDiscover();
-      const found = [
-        ...scanClaudeSessions(),
-        ...scanCodexSessions(),
-        ...scanProcesses(),
-      ].filter((s) => sameResolvedPath(s.hccRoot, ctx.root));
+      const { scanProcesses, verifiedLiveProcessForRoot, canRegisterProcessOnly } = await loadDiscover();
+      const found = scanProcesses().map((s) => verifiedLiveProcessForRoot(s, ctx)).filter(Boolean);
       const byId = new Map();
       for (const s of found) {
         if (!byId.has(s.peerId)) byId.set(s.peerId, s);
@@ -102,16 +99,27 @@ async function prepareLocalBus(ctx, opts = {}) {
         const db2 = connect(ctx);
         try {
           for (const s of byId.values()) {
-            detected.push(s);
-            upsertPeer(db2, {
-              id: s.peerId, kind: s.kind, role: 'peer',
-              worktree: s.cwd,
-              branch: detectBranch(s.cwd),
-              pid: s.pid,
-              status: 'running',
-              capabilities: 'detected'
-            });
-            upsertCanonicalPeerBinding(db2, bindingFromDetected(s, s.transport || 'detected'), true);
+            try {
+              const registered = tx(db2, () => {
+                const live = verifiedLiveProcessForRoot(s, ctx);
+                if (!live) return null;
+                if (!canRegisterProcessOnly(db2, live)) return null;
+                upsertPeer(db2, {
+                  id: live.peerId, kind: live.kind, role: 'peer',
+                  worktree: live.cwd, branch: detectBranch(live.cwd),
+                  pid: live.pid, processIdentity: live.processIdentity,
+                  status: 'running', capabilities: 'detected'
+                });
+                upsertCanonicalPeerBinding(db2, bindingFromDetected(live, live.transport || 'detected'), true);
+                if (!verifiedLiveProcessForRoot(live, ctx)) {
+                  throw Object.assign(new Error('Discovered process changed during registration'), { code: 'DISCOVERY_PROCESS_CHANGED' });
+                }
+                return live;
+              });
+              if (registered) detected.push(registered);
+            } catch (error) {
+              if (error?.code !== 'DISCOVERY_PROCESS_CHANGED') throw error;
+            }
           }
         } finally {
           db2.close();

package/lib/cli-runtime.mjs

@@ -2,7 +2,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
 import { projectDbPath } from './runtime/paths.mjs';
-import { captureSelectedCwdSnapshot } from './process/selected-cwd-identity.mjs';
+import { captureSelectedCwdSnapshot, sameSelectedCwdIdentity } from './process/selected-cwd-identity.mjs';
+import { HOOK_ROOT_IDENTITY_ENV, assertHookRootIdentity } from './core/sessions/hook-root-identity.mjs';
+import { CliError } from './shared/errors.mjs';
 
 export function createContext(global = {}, deps = {}) {
   const cwd = deps.cwd || process.cwd();
@@ -24,6 +26,19 @@ export function createContext(global = {}, deps = {}) {
     if (error?.code !== 'ENOENT') throw error;
     root = requestedRoot;
   }
+  const inheritedIdentity = process.env.HCC_PINNED_ROOT_IDENTITY;
+  if (inheritedIdentity) {
+    // A background child has already entered the selected inode. Its later
+    // --root pathname lookup must not silently create a new B context.
+    delete process.env.HCC_PINNED_ROOT_IDENTITY;
+    let expected;
+    try { expected = JSON.parse(inheritedIdentity); }
+    catch { throw new CliError('PROJECT_PATH_CHANGED', 'Pinned project root identity is invalid'); }
+    if (!sameSelectedCwdIdentity(expected, initialRootIdentity)) {
+      throw new CliError('PROJECT_PATH_CHANGED', 'Pinned project root changed before child initialization');
+    }
+  }
+  assertHookRootIdentity(root, process.env[HOOK_ROOT_IDENTITY_ENV]);
   const envDb = global.root ? null : process.env.HCC_DB;
   const dbPath = path.resolve(global.db || envDb || projectDbPath(root));
   return { cwd, root, dbPath, json: global.json,

package/lib/core/coordination/event-retention.mjs

@@ -19,6 +19,8 @@ export const DURABLE_RUNTIME_EVENTS = `
   SELECT e.id FROM events e WHERE e.type = 'native.web.submission.pending'
   UNION
   SELECT e.id FROM events e WHERE e.type = 'codex.executor.started'
+  UNION
+  SELECT e.id FROM events e WHERE e.type = 'codex.thread.root-bound'
 `;
 
 export function pruneOldEventsPreservingTmuxAuthority(db, cutoff, options = {}) {

package/lib/core/sessions/codex-thread-root.mjs

@@ -0,0 +1,144 @@
+import path from 'node:path';
+import { CliError } from '../../shared/errors.mjs';
+import { assertSelectedCwdSnapshot, captureSelectedCwdSnapshot,
+  sameSelectedCwdIdentity } from '../../process/selected-cwd-identity.mjs';
+import { buildCodexCommand } from '../../integrations/providers.mjs';
+
+export const CODEX_THREAD_ROOT_EVENT = 'codex.thread.root-bound';
+export const CODEX_SESSION_ORIGIN_ENV = 'HCC_CODEX_SESSION_ORIGIN';
+
+function unverified() {
+  return new CliError('CODEX_HISTORY_UNVERIFIED',
+    'Codex thread has no trustworthy original project identity; manual review and association are required');
+}
+
+function invalid() {
+  return new CliError('CODEX_HISTORY_BINDING_INVALID',
+    'Codex thread has an invalid or conflicting original project identity');
+}
+
+function checkedThreadId(threadId) {
+  if (typeof threadId !== 'string' || !threadId.trim() || threadId.length > 512 || /[\r\n\0]/.test(threadId)) {
+    throw new CliError('BAD_REQUEST', 'A bounded Codex thread identity is required');
+  }
+  return threadId;
+}
+
+function rootIsValid(root) {
+  return typeof root?.canonical === 'string' && path.isAbsolute(root.canonical) &&
+    typeof root.identity?.dev === 'string' && /^\d+$/.test(root.identity.dev) &&
+    typeof root.identity?.ino === 'string' && /^\d+$/.test(root.identity.ino) &&
+    (root.identity?.birthtimeNs === null ||
+      (typeof root.identity?.birthtimeNs === 'string' && /^\d+$/.test(root.identity.birthtimeNs)));
+}
+
+export function selectedCodexRootSnapshot(root, expected = null) {
+  if (typeof expected?.assertUnchanged === 'function') expected.assertUnchanged();
+  else if (expected) assertSelectedCwdSnapshot(expected);
+  const snapshot = captureSelectedCwdSnapshot(root);
+  if (expected && !sameSelectedCwdIdentity(snapshot, expected)) {
+    throw new CliError('PROJECT_PATH_CHANGED', 'Selected project directory changed');
+  }
+  return snapshot;
+}
+
+// event.actor is the thread ID so corrupt receipt payloads can be isolated to
+// their own thread. Unknown or invalid receipts never fall back to cwd text.
+export function readCodexThreadRootBindings(db, threadId = null) {
+  const bindings = new Map();
+  const rows = threadId === null
+    ? db.prepare('SELECT actor,payload FROM events WHERE type = ?').all(CODEX_THREAD_ROOT_EVENT)
+    : db.prepare('SELECT actor,payload FROM events WHERE type = ? AND actor = ?')
+      .all(CODEX_THREAD_ROOT_EVENT, checkedThreadId(threadId));
+  for (const row of rows) {
+    const id = row.actor;
+    if (typeof id !== 'string' || !id || id.length > 512 || /[\r\n\0]/.test(id)) continue;
+    let payload;
+    try { payload = JSON.parse(row.payload); } catch { bindings.set(id, null); continue; }
+    const root = payload?.root;
+    if (payload?.version !== 1 || payload.thread_id !== id || !rootIsValid(root)) {
+      bindings.set(id, null);
+      continue;
+    }
+    const previous = bindings.get(id);
+    if (previous === null || (previous && !sameSelectedCwdIdentity(previous, root))) {
+      bindings.set(id, null);
+    } else {
+      bindings.set(id, root);
+    }
+  }
+  return bindings;
+}
+
+export function assertCodexThreadRoot(db, threadId, selected, knownBindings = null) {
+  checkedThreadId(threadId);
+  if (typeof selected?.assertUnchanged === 'function') selected.assertUnchanged();
+  else assertSelectedCwdSnapshot(selected);
+  const bindings = knownBindings || readCodexThreadRootBindings(db, threadId);
+  if (!bindings.has(threadId)) throw unverified();
+  const original = bindings.get(threadId);
+  if (!original) throw invalid();
+  if (!sameSelectedCwdIdentity(original, selected)) {
+    throw new CliError('PROJECT_PATH_FORBIDDEN', 'Codex thread belongs to a different project directory identity');
+  }
+  return original;
+}
+
+export function recordCodexThreadRoot(db, addEvent, threadId, selected, origin, { allowSame = false } = {}) {
+  checkedThreadId(threadId);
+  if (typeof selected?.assertUnchanged === 'function') selected.assertUnchanged();
+  else assertSelectedCwdSnapshot(selected);
+  const bindings = readCodexThreadRootBindings(db, threadId);
+  if (bindings.has(threadId)) {
+    if (allowSame && bindings.get(threadId) && sameSelectedCwdIdentity(bindings.get(threadId), selected)) return false;
+    throw new CliError('CODEX_THREAD_ALREADY_BOUND', 'Codex thread already has a project identity');
+  }
+  addEvent(db, CODEX_THREAD_ROOT_EVENT, threadId, null, {
+    version: 1, thread_id: threadId,
+    root: { canonical: selected.canonical, identity: selected.identity }, origin
+  });
+  return true;
+}
+
+// Validate the command we will actually launch, not only a caller-supplied
+// binding: a binding for thread X must never authorize `codex resume Y`.
+// Return an origin marker only for a first-party new/fork command whose hook
+// can safely persist the resulting thread's launch-time directory identity.
+export function assertCodexTerminalLaunch(db, binding, { command, root, rootIdentity = null,
+  cwd = root, cwdIdentity = null, argv = null } = {}) {
+  if (binding?.provider !== 'codex') return null;
+  const mode = binding.resume_mode || 'command';
+  if (!['new', 'resume', 'fork', 'last', 'fork-last'].includes(mode)) return null;
+  const selectedRoot = selectedCodexRootSnapshot(root, rootIdentity);
+  const selectedCwd = selectedCodexRootSnapshot(cwd, cwdIdentity);
+  if (!sameSelectedCwdIdentity(selectedRoot, selectedCwd)) {
+    if (mode === 'new') return null;
+    throw new CliError('PROJECT_PATH_FORBIDDEN', 'Codex history can only be opened in its selected project directory');
+  }
+  if (mode === 'new') {
+    const directNew = Array.isArray(argv) && argv.length === 1 && path.basename(argv[0]) === 'codex';
+    return directNew || (!argv && command === 'codex') ? 'new' : null;
+  }
+  if (mode === 'last' || mode === 'fork-last') {
+    throw new CliError('CODEX_HISTORY_ID_REQUIRED',
+      'Codex --last cannot prove the selected thread identity; choose an explicit verified thread ID');
+  }
+  if (!binding.resume_arg) {
+    throw new CliError('CODEX_HISTORY_ID_REQUIRED', 'Choose an explicit verified Codex thread ID');
+  }
+  const sourceId = checkedThreadId(binding.resume_arg);
+  const expected = buildCodexCommand('history-check', mode === 'fork'
+    ? { fork: true, resume: sourceId } : { resume: sourceId }).command;
+  const commandMatches = Array.isArray(argv)
+    ? argv.length === 3 && path.basename(argv[0]) === 'codex' &&
+      argv[1] === mode && argv[2] === sourceId
+    : command === expected && (!binding.command || binding.command === expected);
+  if (!commandMatches ||
+      (mode === 'resume' && ((binding.provider_session_id && binding.provider_session_id !== sourceId) ||
+        (binding.provider_session_name && binding.provider_session_name !== sourceId)))) {
+    throw new CliError('CODEX_HISTORY_COMMAND_UNVERIFIED',
+      'Codex history command does not match the verified thread identity');
+  }
+  assertCodexThreadRoot(db, sourceId, selectedRoot);
+  return mode === 'fork' ? 'fork' : null;
+}

package/lib/core/sessions/launch.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import process from 'node:process';
 import { shortHash } from '../peers/format.mjs';
 import { HOOK_ROOT_IDENTITY_ENV, hookRootIdentityValue } from './hook-root-identity.mjs';
+import { CODEX_SESSION_ORIGIN_ENV } from './codex-thread-root.mjs';
 
 export const WEB_CHILD_ENV = 'HCC_WEB_CHILD';
 export const LAUNCH_FINGERPRINT_ENV = 'HCC_LAUNCH_FINGERPRINT';
@@ -12,8 +13,10 @@ const LAUNCH_ENV_IGNORED_KEYS = new Set([
   '_',
   'COLUMNS',
   'HCC_DB',
+  CODEX_SESSION_ORIGIN_ENV,
   HOOK_ROOT_IDENTITY_ENV,
   'HCC_NO_AUTO_INSTALL_TMUX',
+  'HCC_PINNED_LAUNCH_MODE',
   'HCC_PEER',
   'HCC_ROOT',
   'HCC_RUNTIME_LOCAL_ONLY',
@@ -45,6 +48,7 @@ const LAUNCH_ENV_IGNORED_KEYS = new Set([
 
 export function childSessionEnv(extra = {}, baseEnv = process.env, { rootIdentity = null } = {}) {
   const env = { ...(baseEnv || {}), ...extra };
+  if (!Object.hasOwn(extra, CODEX_SESSION_ORIGIN_ENV)) delete env[CODEX_SESSION_ORIGIN_ENV];
   if (Object.hasOwn(extra, 'HCC_ROOT')) {
     if (extra.HCC_ROOT) env[HOOK_ROOT_IDENTITY_ENV] = hookRootIdentityValue(extra.HCC_ROOT, rootIdentity);
     else delete env[HOOK_ROOT_IDENTITY_ENV];