@logicseek/hello-cc 1.1.0-rc.8 → 1.1.0

package/lib/discover.mjs

@@ -9,9 +9,11 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import os from 'node:os';
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { providerSessionPeerId } from './core/peers/session.mjs';
+import { inspectProcessIdentity } from './process/identity.mjs';
+import { assertSelectedCwdSnapshot, captureSelectedCwdSnapshot } from './process/selected-cwd-identity.mjs';
 
 // ─── Root detection ──────────────────────────────────────────────────────────
 
@@ -177,259 +179,131 @@ function readEnvFile(envPath) {
 
 // ─── Claude Code session discovery ───────────────────────────────────────────
 
-const CLAUDE_SESSIONS_DIR = path.join(os.homedir(), '.claude', 'sessions');
-
-/**
- * Read existing Claude Code session files and return info about live sessions
- * that belong to a hello-cc project.
- */
+// Session files contain a historical cwd and PID, not a root-bound proof of
+// which directory inode owned the provider session. A reused PID or pathname
+// can make an old session appear to belong to a replacement project.
 export function scanClaudeSessions() {
-  const results = [];
-  let files;
-  try { files = fs.readdirSync(CLAUDE_SESSIONS_DIR); }
-  catch { return results; }
-
-  for (const file of files) {
-    if (!file.endsWith('.json')) continue;
-    try {
-      const content = JSON.parse(
-        fs.readFileSync(path.join(CLAUDE_SESSIONS_DIR, file), 'utf8')
-      );
-      const { pid, sessionId, cwd, status } = content;
-      if (!pid || !sessionId || !cwd) continue;
-      if (!isAlive(pid)) continue;
-      const env = readEnvFile(`/proc/${pid}/environ`);
-
-      const hccRoot = findHccRoot(cwd);
-      if (!hccRoot) continue;
-
-      results.push({
-        kind: 'claude',
-        sessionId,
-        peerId: derivePeerId('claude', sessionId, null, env.HCC_PEER),
-        pid,
-        cwd,
-        hccRoot,
-        status: status || 'unknown',
-        transport: 'detected',
-      });
-    } catch { /* ignore malformed files */ }
-  }
-  return results;
+  return [];
 }
 
-/**
- * Watch ~/.claude/sessions/ for new session files.
- * Calls `onNew(sessionInfo)` for each new live session in an HCC project.
- * Returns the fs.FSWatcher or null.
- */
-export function watchClaudeSessions(onNew) {
-  try {
-    fs.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true });
-  } catch {}
-
-  try {
-    return fs.watch(CLAUDE_SESSIONS_DIR, { persistent: false }, (event, filename) => {
-      if (event !== 'rename' || !filename?.endsWith('.json')) return;
-      // Small delay so Claude Code finishes writing the file
-      setTimeout(() => {
-        try {
-          const content = JSON.parse(
-            fs.readFileSync(path.join(CLAUDE_SESSIONS_DIR, filename), 'utf8')
-          );
-          const { pid, sessionId, cwd, status } = content;
-          if (!pid || !sessionId || !cwd) return;
-          if (!isAlive(pid)) return;
-          const env = readEnvFile(`/proc/${pid}/environ`);
-          const hccRoot = findHccRoot(cwd);
-          if (!hccRoot) return;
-          onNew({
-            kind: 'claude',
-            sessionId,
-            peerId: derivePeerId('claude', sessionId, null, env.HCC_PEER),
-            pid,
-            cwd,
-            hccRoot,
-            status: status || 'unknown',
-            transport: 'detected',
-          });
-        } catch {}
-      }, 300);
-    });
-  } catch {
-    return null;
-  }
+// Keep the exported watcher interface inert until session files carry a
+// verifiable root/session receipt. Watching must not reintroduce attribution.
+export function watchClaudeSessions(_onNew) {
+  return null;
 }
 
 // ─── Codex session discovery ──────────────────────────────────────────────────
 
-function codexSessionsDir() {
-  const d = new Date();
-  return path.join(
-    os.homedir(), '.codex', 'sessions',
-    String(d.getFullYear()),
-    String(d.getMonth() + 1).padStart(2, '0'),
-    String(d.getDate()).padStart(2, '0')
-  );
-}
-
-function parseCodexSessionFile(filePath) {
-  try {
-    const firstLine = fs.readFileSync(filePath, 'utf8').split('\n')[0];
-    if (!firstLine) return null;
-    const parsed = JSON.parse(firstLine);
-    if (parsed.type !== 'session_meta') return null;
-    const { id, cwd } = parsed.payload || {};
-    if (!id || !cwd) return null;
-    return { sessionId: id, cwd };
-  } catch { return null; }
+// Provider history may only be attributed by a separately persisted,
+// root-bound receipt; a live process with the same cwd or resume ID is not one.
+export function scanCodexSessions() {
+  return [];
 }
 
-/**
- * Scan today's Codex session files.  Match to running processes via cmdline.
- */
-export function scanCodexSessions() {
-  const results = [];
-  const dir = codexSessionsDir();
-  let files;
-  try { files = fs.readdirSync(dir); } catch { return results; }
-
-  // Build maps from /proc. Fresh sessions and --last/fork launches usually do
-  // not expose the new session id in argv, so cwd is the fallback.
-  const runningCodex = getRunningCodexSessions();
-
-  for (const file of files.sort().reverse().slice(0, 30)) {
-    if (!file.endsWith('.jsonl')) continue;
-    const info = parseCodexSessionFile(path.join(dir, file));
-    if (!info) continue;
-
-    const proc = runningCodex.bySessionId.get(info.sessionId) || firstProcessForCwd(runningCodex.byCwd, info.cwd);
-    if (!proc) continue;
-
-    const hccRoot = findHccRoot(info.cwd);
-    if (!hccRoot) continue;
-
-    results.push({
-      kind: 'codex',
-      sessionId: info.sessionId,
-      peerId: derivePeerId('codex', info.sessionId, null, proc.peerId),
-      pid: proc.pid,
-      cwd: info.cwd,
-      hccRoot,
-      status: 'running',
-      transport: 'detected',
-    });
-  }
-  return results;
+// The same boundary applies to newly created session files.
+export function watchCodexSessions(_onNew) {
+  return null;
 }
 
-/**
- * Walk /proc to find all running `codex` Node processes and map session ID → PID.
- * Codex launches as: `node /path/to/codex [resume] <session-id>` or similar.
- */
-function getRunningCodexSessions() {
-  const bySessionId = new Map();
-  const byCwd = new Map();
-  if (process.platform !== 'linux') return { bySessionId, byCwd };
+// ─── Live process-only discovery ───────────────────────────────────────────────
 
-  let pids;
-  try { pids = fs.readdirSync('/proc').filter(e => /^\d+$/.test(e)); }
-  catch { return { bySessionId, byCwd }; }
+function sameProcessIdentity(left, right) {
+  return left?.pid === right?.pid && left?.startToken === right?.startToken &&
+    left?.commandHash === right?.commandHash;
+}
 
-  for (const pid of pids) {
-    try {
-      const cmdline = readFileSafe(`/proc/${pid}/cmdline`).split('\0');
-      if (!cmdline.some(a => a.includes('codex'))) continue;
-      const cwd = fs.readlinkSync(`/proc/${pid}/cwd`);
-      const env = readEnvFile(`/proc/${pid}/environ`);
-      const procInfo = { pid: parseInt(pid), peerId: env.HCC_PEER || null };
-      if (!byCwd.has(cwd)) byCwd.set(cwd, []);
-      byCwd.get(cwd).push(procInfo);
-
-      // codex resume <uuid>
-      const resumeId = parseCodexResumeId(cmdline);
-      if (resumeId) {
-        bySessionId.set(resumeId, procInfo);
-      }
-    } catch {}
-  }
-  return { bySessionId, byCwd };
+function sameDirectoryStat(left, right) {
+  return left.isDirectory() && right.isDirectory() && left.dev === right.dev &&
+    left.ino === right.ino && left.birthtimeNs === right.birthtimeNs;
 }
 
-function firstProcessForCwd(byCwd, cwd) {
-  const direct = byCwd.get(cwd);
-  if (direct?.length) return direct[0];
-  for (const [procCwd, pids] of byCwd.entries()) {
-    if ((procCwd === cwd || procCwd.startsWith(`${cwd}${path.sep}`) || cwd.startsWith(`${procCwd}${path.sep}`)) && pids.length) {
-      return pids[0];
-    }
-  }
-  return null;
+function matchesSnapshot(stat, snapshot) {
+  return stat.isDirectory() && stat.dev.toString() === snapshot.identity.dev &&
+    stat.ino.toString() === snapshot.identity.ino &&
+    (stat.birthtimeNs?.toString() || null) === snapshot.identity.birthtimeNs;
 }
 
-/**
- * Watch today's Codex sessions directory for new session files.
- */
-export function watchCodexSessions(onNew) {
-  const dir = codexSessionsDir();
-  try { fs.mkdirSync(dir, { recursive: true }); } catch {}
+function processPeerId(kind, pid, identity) {
+  const suffix = createHash('sha256').update(`${pid}\0${identity.startToken}`).digest('hex').slice(0, 20);
+  return `${kind}-process-${suffix}`;
+}
 
+// Recheck immediately before registration. Historical paths and provider IDs
+// are not authority: the same pathname can now name a different directory.
+// The proc cwd itself, its current canonical name, and its parent chain must
+// all lead to the selected root inode. A changed/reused PID is rejected too.
+export function verifiedLiveProcessForRoot(record, ctx, { procRoot = '/proc', observeProcess = inspectProcessIdentity } = {}) {
+  if (record?.source !== 'process' || !Number.isSafeInteger(record.pid) || record.pid < 1 ||
+      !record.processIdentity || record.sessionId || record.resumeId) return null;
+  const selected = ctx.rootIdentity || ctx.initialRootIdentity || captureSelectedCwdSnapshot(ctx.root);
+  assertSelectedCwdSnapshot(selected);
   try {
-    return fs.watch(dir, { persistent: false }, (event, filename) => {
-      if (event !== 'rename' || !filename?.endsWith('.jsonl')) return;
-      setTimeout(() => {
-        const info = parseCodexSessionFile(path.join(dir, filename));
-        if (!info) return;
-
-        const running = getRunningCodexSessions();
-        const proc = running.bySessionId.get(info.sessionId) || firstProcessForCwd(running.byCwd, info.cwd);
-
-        const hccRoot = findHccRoot(info.cwd);
-        if (!hccRoot) return;
-
-        onNew({
-          kind: 'codex',
-          sessionId: info.sessionId,
-          peerId: derivePeerId('codex', info.sessionId, null, proc?.peerId),
-          pid: proc?.pid || null,
-          cwd: info.cwd,
-          hccRoot,
-          status: 'running',
-          transport: 'detected',
-        });
-      }, 500);
-    });
-  } catch {
+    const before = observeProcess(record.pid);
+    if (before.state !== 'live' || !sameProcessIdentity(record.processIdentity, before.identity)) return null;
+    const procCwd = `${procRoot}/${record.pid}/cwd`;
+    const liveCwd = fs.realpathSync.native(procCwd);
+    const relative = path.relative(selected.canonical, liveCwd);
+    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return null;
+    const procStat = fs.statSync(procCwd, { bigint: true });
+    if (!sameDirectoryStat(procStat, fs.statSync(liveCwd, { bigint: true }))) return null;
+    // Keep the /proc magic link in the path while walking upwards: path.join
+    // would erase "cwd/.." before the kernel could resolve the live inode.
+    let ancestor = procCwd;
+    for (let level = 0, depth = relative ? relative.split(path.sep).length : 0; level < depth; level++) {
+      ancestor += '/..';
+    }
+    if (!matchesSnapshot(fs.statSync(ancestor, { bigint: true }), selected)) return null;
+    const after = observeProcess(record.pid);
+    if (after.state !== 'live' || !sameProcessIdentity(before.identity, after.identity)) return null;
+    assertSelectedCwdSnapshot(selected);
+    return { ...record, cwd: liveCwd, hccRoot: selected.canonical, processIdentity: after.identity };
+  } catch (error) {
+    if (error?.code === 'PROJECT_PATH_CHANGED') throw error;
     return null;
   }
 }
 
-// ─── Generic process scan (fallback) ─────────────────────────────────────────
+// Binding updates merge an existing provider session ID when the incoming
+// record omits one. Process-only discovery must never inherit that history.
+export function canRegisterProcessOnly(db, record) {
+  const binding = db.prepare('SELECT transport, provider_session_id, provider_session_name, resume_mode, resume_arg, runtime_target FROM peer_bindings WHERE peer=?')
+    .get(record.peerId);
+  if (binding) return binding.transport === 'detected' && !binding.provider_session_id &&
+    !binding.provider_session_name && !binding.resume_arg && !binding.runtime_target &&
+    binding.resume_mode === 'unknown';
+  return !db.prepare('SELECT id FROM peers WHERE id=?').get(record.peerId);
+}
 
 /**
- * Scan /proc for any running claude/codex processes that belong to an HCC
- * project.  Used as a fallback when session files are not available.
- * Returns an array of discovered session info objects.
+ * Scan /proc for live claude/codex processes. This does not infer ownership of
+ * provider history from argv, stale session files, or pathname equality.
+ * Call verifiedLiveProcessForRoot before registering a result to a project.
  */
-export function scanProcesses() {
+export function scanProcesses({ procRoot = '/proc', platform = process.platform,
+  observeProcess = inspectProcessIdentity } = {}) {
   const results = [];
-  if (process.platform !== 'linux') return results;
+  if (platform !== 'linux') return results;
 
   let pids;
-  try { pids = fs.readdirSync('/proc').filter(e => /^\d+$/.test(e)); }
+  try { pids = fs.readdirSync(procRoot).filter(e => /^\d+$/.test(e)); }
   catch { return results; }
 
   const seen = new Set();
 
   for (const pidStr of pids) {
     try {
-      const cmdline = readFileSafe(`/proc/${pidStr}/cmdline`).split('\0');
+      const pid = Number(pidStr);
+      const cmdline = readFileSafe(`${procRoot}/${pidStr}/cmdline`).split('\0');
       const hasClaude = cmdline.some(a => /claude/.test(a) && !a.includes('hcc'));
       const hasCodex  = cmdline.some(a => /\bcodex\b/.test(a));
       if (!hasClaude && !hasCodex) continue;
 
-      const cwd = fs.readlinkSync(`/proc/${pidStr}/cwd`);
-      const env = readEnvFile(`/proc/${pidStr}/environ`);
+      const cwd = fs.readlinkSync(`${procRoot}/${pidStr}/cwd`);
+      const env = readEnvFile(`${procRoot}/${pidStr}/environ`);
+      const observed = observeProcess(pid);
+      if (observed.state !== 'live' || !observed.identity) continue;
+      const commandHash = createHash('sha256').update(cmdline.filter(Boolean).join(' ').trim()).digest('hex');
+      if (observed.identity.commandHash !== commandHash) continue;
 
       const kind = hasClaude ? 'claude' : 'codex';
 
@@ -440,19 +314,7 @@ export function scanProcesses() {
         if (entrypoint && entrypoint !== 'cli') continue;
       }
 
-      const explicitClaudeSession = kind === 'claude' ? parseClaudeSessionId(cmdline) : '';
-      const sessionId = kind === 'claude'
-        ? (env.CLAUDE_CODE_SESSION_ID || explicitClaudeSession || '')
-        : parseCodexResumeId(cmdline) || '';
-
-      let resumeId = null;
-      if (kind === 'claude') {
-        resumeId = parseClaudeFork(cmdline) ? null : parseClaudeResumeId(cmdline);
-      } else {
-        resumeId = parseCodexResumeId(cmdline);
-      }
-
-      const peerId = derivePeerId(kind, sessionId, resumeId, env.HCC_PEER);
+      const peerId = processPeerId(kind, pid, observed.identity);
       if (seen.has(peerId)) continue;
       seen.add(peerId);
 
@@ -461,14 +323,16 @@ export function scanProcesses() {
 
       results.push({
         kind,
-        sessionId,
-        resumeId,
+        sessionId: '',
+        resumeId: null,
         peerId,
-        pid: parseInt(pidStr),
+        pid,
         cwd,
         hccRoot,
         status: 'running',
         transport: 'detected',
+        source: 'process',
+        processIdentity: observed.identity,
       });
     } catch {}
   }

package/lib/integrations/dsh-collaboration.mjs

@@ -17,6 +17,7 @@ import { createScopedMcpTools } from '../mcp/tools.mjs';
 import { resolveProjectDatabase } from '../runtime/project-path.mjs';
 import { registerProjectActivity } from '../runtime/projects.mjs';
 import { compareProcessIdentity, inspectProcessIdentity } from '../process/identity.mjs';
+import { assertSelectedCwdSnapshot, captureSelectedCwdSnapshot } from '../process/selected-cwd-identity.mjs';
 
 const fail = (message) => { throw new CliError('DSH_COLLABORATION_CONFLICT', message); };
 
@@ -39,8 +40,11 @@ export function createDshCollaboration({ sessionId, cwd, maxContextChars = 16000
   if (typeof sessionId !== 'string' || !sessionId || sessionId.length > 1024 ||
       sessionId.trim() !== sessionId || /[\u0000-\u001f\u007f]/.test(sessionId) ||
       typeof cwd !== 'string' || !path.isAbsolute(cwd)) fail('Agent requires its real session ID and absolute cwd');
+  const rootIdentity = captureSelectedCwdSnapshot(cwd);
   const project = resolveProjectDatabase({ root: cwd, createStateDir: true });
-  const ctx = { root: project.root, cwd: project.root, dbPath: project.db, json: true };
+  assertSelectedCwdSnapshot(rootIdentity);
+  const ctx = { root: project.root, cwd: project.root, dbPath: project.db, json: true,
+    initialRootIdentity: rootIdentity };
   const peer = providerSessionPeerId('dsh', sessionId);
   const owner = `cordis:${randomUUID()}`;
   const now = () => Math.floor(Date.now() / 1000);
@@ -127,7 +131,10 @@ export function createDshCollaboration({ sessionId, cwd, maxContextChars = 16000
     finally { db.close(); }
   }
   const authority = { scope: Object.freeze({ root: ctx.root, dbPath: ctx.dbPath, peer, executorId: owner }),
-    assertValid: () => { if (disposed || retiring) fail('The Cordis Agent authority has been disposed'); }, assertOwnership };
+    assertValid: () => {
+      if (disposed || retiring) fail('The Cordis Agent authority has been disposed');
+      assertSelectedCwdSnapshot(rootIdentity);
+    }, assertOwnership };
   const service = createScopedMcpTools({ ctx, authority, connect, now, addEvent,
     touchPeer: (db, id, status) => { assertOwnership(db); if (id !== peer) fail('Peer identity changed'); peers.touchPeer(db, id, status); } });
   let queue = Promise.resolve();

package/lib/integrations/native/claude.mjs

@@ -6,6 +6,7 @@ import { createNativeInteractions } from './interactions.mjs';
 import { CliError } from '../../shared/errors.mjs';
 import { claudeUsage } from './telemetry.mjs';
 import { captureSelectedCwdIdentity } from '../../process/selected-cwd-identity.mjs';
+import { HOOK_ROOT_IDENTITY_ENV } from '../../core/sessions/hook-root-identity.mjs';
 
 const SESSION_MARKERS = new Set([
   'CLAUDECODE', 'CLAUDE_CODE_SESSION_ID', 'CLAUDE_CODE_PARENT_SESSION_ID',
@@ -24,6 +25,11 @@ function isolatedEnv(source, coordinationEnv = source) {
   // An inherited terminal's partial HCC markers must not identify the worker.
   if (COORDINATION_KEYS.every((key) => typeof coordinationEnv[key] === 'string' && coordinationEnv[key])) {
     for (const key of COORDINATION_KEYS) clean[key] = coordinationEnv[key];
+    // The hook must receive the same launch-time directory receipt as the
+    // worker; otherwise a rebound project path would look like a legacy hook.
+    if (typeof coordinationEnv[HOOK_ROOT_IDENTITY_ENV] === 'string' && coordinationEnv[HOOK_ROOT_IDENTITY_ENV]) {
+      clean[HOOK_ROOT_IDENTITY_ENV] = coordinationEnv[HOOK_ROOT_IDENTITY_ENV];
+    }
   }
   return clean;
 }

package/lib/integrations/native/codex.mjs

@@ -102,7 +102,8 @@ export function createCodexAdapter(options = {}) {
     } else if (method === 'turn/diff/updated') {
       emit({ type: 'diff', diff: params.diff, turnId, submissionId });
     } else if (method === 'error') {
-      emit({ type: 'error', turnId, error: params.error ?? params });
+      emit({ type: 'error', turnId, submissionId, error: params.error ?? params,
+        ...(typeof params.willRetry === 'boolean' ? { willRetry: params.willRetry } : {}) });
     } else if (method === 'serverRequest/resolved') {
       interactions.resolved(params.requestId);
     } else if (method === 'thread/status/changed' && params.status?.type === 'systemError') {
@@ -169,7 +170,8 @@ export function createCodexAdapter(options = {}) {
     status('opening');
     try {
       cwdBinding?.assertUnchanged();
-      rpc = rpcFactory({ binary, args: ['app-server', '--stdio'], cwd, env, timeoutMs,
+      rpc = rpcFactory({ binary, args: ['app-server', '--stdio'], cwd, env,
+        expectedIdentity: cwdBinding || options.expectedCwdIdentity, timeoutMs,
         onNotification: notification, onRequest: serverRequest, onExit: exited, onError: transportError });
       await rpc.start();
       if (closed) throw adapterError('NATIVE_SESSION_CLOSED', 'The Codex session was closed while opening.');

package/lib/integrations/native/dsh-acp.mjs

@@ -205,7 +205,7 @@ export function createDshAcpAdapter(options = {}) {
         cwdBinding.assertUnchanged();
         const config = {
           binary: options.binary || 'dsh', args: ['--profile', 'acp'],
-          cwd, env: options.env, timeoutMs: options.timeoutMs,
+          cwd, env: options.env, expectedIdentity: cwdBinding, timeoutMs: options.timeoutMs,
           onNotification, onRequest, onExit, onError: onTransportError
         };
         rpc = options.rpcFactory ? options.rpcFactory(config) : new JsonRpcProcess(config);

package/lib/integrations/native/jsonrpc.mjs

@@ -40,10 +40,10 @@ export class JsonRpcProcess {
 
   async start() {
     if (this.child || this.closed) throw new CliError('NATIVE_TRANSPORT_STATE', 'Transport cannot be started twice');
-    const { binary, args = [], cwd, env } = this.options;
+    const { binary, args = [], cwd, env, expectedIdentity } = this.options;
     assertExecutableAvailable(binary, cwd || process.cwd(), env);
     this.child = spawnPinnedCwdProcess(binary, args, {
-      cwd: cwd || process.cwd(), env, shell: false, stdio: ['pipe', 'pipe', 'pipe']
+      cwd: cwd || process.cwd(), env, expectedIdentity, shell: false, stdio: ['pipe', 'pipe', 'pipe']
     });
     this.child.stdout.setEncoding('utf8');
     this.child.stdout.on('data', (chunk) => this.read(chunk));

package/lib/mcp/scope.mjs

@@ -6,6 +6,9 @@ import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { CliError } from '../shared/errors.mjs';
 import { inspectProcessIdentity } from '../process/identity.mjs';
+import { assertSelectedCwdSnapshot, captureSelectedCwdSnapshot,
+  sameSelectedCwdIdentity } from '../process/selected-cwd-identity.mjs';
+import { nativeOwnerGeneration } from '../runtime/native/store.mjs';
 
 const PATH_KEY = 'HCC_MCP_BOOTSTRAP_PATH';
 const TOKEN_KEY = 'HCC_MCP_BOOTSTRAP_TOKEN';
@@ -20,23 +23,54 @@ function validIdentity(value) {
 function sameIdentity(a, b) {
   return a?.pid === b?.pid && a?.startToken === b?.startToken && a?.commandHash === b?.commandHash;
 }
+function validRootIdentity(value) {
+  const identity = value?.identity;
+  return typeof value?.requested === 'string' && path.isAbsolute(value.requested) &&
+    typeof value.canonical === 'string' && path.isAbsolute(value.canonical) &&
+    typeof identity?.dev === 'string' && /^\d+$/.test(identity.dev) &&
+    typeof identity.ino === 'string' && /^\d+$/.test(identity.ino) &&
+    (identity.birthtimeNs === null ||
+      (typeof identity.birthtimeNs === 'string' && /^\d+$/.test(identity.birthtimeNs)));
+}
+function assertLaunchRoot(root, rootIdentity) {
+  if (!validRootIdentity(rootIdentity)) fail();
+  if (typeof rootIdentity.assertUnchanged === 'function') rootIdentity.assertUnchanged();
+  else assertSelectedCwdSnapshot(rootIdentity);
+  const selected = captureSelectedCwdSnapshot(root);
+  if (!sameSelectedCwdIdentity(rootIdentity, selected)) {
+    throw new CliError('PROJECT_PATH_CHANGED', 'Selected project directory changed');
+  }
+  return { requested: selected.canonical, canonical: selected.canonical,
+    identity: { ...rootIdentity.identity } };
+}
+function assertCapabilityRoot(receipt, root) {
+  if (!validRootIdentity(receipt) || receipt.requested !== root || receipt.canonical !== root) fail();
+  try { assertSelectedCwdSnapshot(receipt); }
+  catch { fail(); }
+}
 
 // Per executor only: callers pass this entry to its thread configuration. No
 // user/global Codex configuration is read or written.
-export function createScopedMcpConfig({ root, dbPath, peer, executorId, ownerIdentity,
+export function createScopedMcpConfig({ root, dbPath, peer, executorId, ownerIdentity, rootIdentity,
   binding = { transport: 'app-server', runtimeSessionId: peer },
   cliPath = fileURLToPath(new URL('../../bin/hcc.mjs', import.meta.url)) }) {
   if (typeof peer !== 'string' || !peer.trim() || peer.length > 256 || /[\r\n\0]/.test(peer) ||
       typeof executorId !== 'string' || !executorId || executorId.length > 256 || !validIdentity(ownerIdentity) ||
-      (binding.transport === 'native' && (binding.runtimeTarget !== executorId || binding.runtimeSessionId !== peer))) fail();
-  const scope = { root: canonical(root), dbPath: canonical(dbPath), peer, executorId,
+      (binding.transport === 'native' && (binding.runtimeTarget !== executorId || binding.runtimeSessionId !== peer ||
+        !nativeOwnerGeneration(executorId)))) fail();
+  const launchRoot = assertLaunchRoot(root, rootIdentity);
+  const scope = { root: launchRoot.canonical, dbPath: canonical(dbPath), peer, executorId,
+    rootIdentity: launchRoot,
     ownerIdentity: { ...ownerIdentity }, binding: { ...binding } };
+  if (typeof rootIdentity.assertUnchanged === 'function') rootIdentity.assertUnchanged();
+  assertCapabilityRoot(scope.rootIdentity, scope.root);
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-mcp-'));
   fs.chmodSync(directory, 0o700);
   const bootstrapPath = path.join(directory, 'scope.json');
   const token = randomBytes(32).toString('base64url');
   try {
-    fs.writeFileSync(bootstrapPath, JSON.stringify({ version: 1, ...scope, tokenHash: digest(token) }),
+    assertCapabilityRoot(scope.rootIdentity, scope.root);
+    fs.writeFileSync(bootstrapPath, JSON.stringify({ version: 2, ...scope, tokenHash: digest(token) }),
       { flag: 'wx', mode: 0o600 });
   } catch (error) { fs.rmSync(directory, { recursive: true, force: true }); throw error; }
   let disposed = false;
@@ -64,13 +98,16 @@ export function loadScopedMcpBootstrap(ctx, peer, env = process.env) {
           (process.platform !== 'win32' && (stat.mode & 0o077)) ||
           (process.getuid && stat.uid !== process.getuid())) fail();
       const value = JSON.parse(fs.readFileSync(fd, 'utf8'));
-      if (value.version !== 1 || typeof value.tokenHash !== 'string' || !/^[a-f0-9]{64}$/.test(value.tokenHash) ||
-          !timingSafeEqual(Buffer.from(value.tokenHash, 'hex'), Buffer.from(digest(token), 'hex')) ||
+      if (value.version !== 2 || typeof value.tokenHash !== 'string' || !/^[a-f0-9]{64}$/.test(value.tokenHash) ||
+          !timingSafeEqual(Buffer.from(value.tokenHash, 'hex'), Buffer.from(digest(token), 'hex'))) fail();
+      assertCapabilityRoot(value.rootIdentity, value.root);
+      if (
           value.root !== canonical(ctx.root) || value.dbPath !== canonical(ctx.dbPath) ||
           value.peer !== peer || !validIdentity(value.ownerIdentity) ||
           typeof value.executorId !== 'string' || !value.executorId || !value.binding ||
           typeof value.binding.transport !== 'string' ||
-          (value.binding.transport === 'native' && (value.binding.runtimeTarget !== value.executorId || value.binding.runtimeSessionId !== peer))) fail();
+          (value.binding.transport === 'native' && (value.binding.runtimeTarget !== value.executorId || value.binding.runtimeSessionId !== peer ||
+            !nativeOwnerGeneration(value.executorId)))) fail();
       return value;
     } catch { fail(); } finally { if (fd !== undefined) fs.closeSync(fd); }
   }
@@ -99,6 +136,11 @@ export function loadScopedMcpBootstrap(ctx, peer, env = process.env) {
     }
   }
   assertValid();
+  const rootIdentity = Object.freeze({ requested: original.rootIdentity.requested,
+    canonical: original.rootIdentity.canonical,
+    identity: Object.freeze({ ...original.rootIdentity.identity }) });
   return { scope: Object.freeze({ root: original.root, dbPath: original.dbPath, peer,
-    executorId: original.executorId }), assertValid, assertOwnership };
+    executorId: original.executorId, rootIdentity,
+    nativeOwnerGeneration: original.binding.transport === 'native' ? nativeOwnerGeneration(original.executorId) : null }),
+    assertValid, assertOwnership };
 }