@logicseek/hello-cc 1.1.0-rc.8 → 1.1.0

package/lib/runtime/native/client.mjs

@@ -1,9 +1,13 @@
 import http from 'node:http';
 import { CliError } from '../../shared/errors.mjs';
-import { readNativePointer } from './store.mjs';
+import { assertNativePointerOwner, readNativePointer } from './store.mjs';
+import { assertSelectedCwdSnapshot } from '../../process/selected-cwd-identity.mjs';
 
 export function nativeRequest(ctx, method, route, body = null, { timeoutMs = 35000, expectedGeneration } = {}) {
+  const selectedRootIdentity = ctx.initialRootIdentity || ctx.rootIdentity;
+  if (selectedRootIdentity) assertSelectedCwdSnapshot(selectedRootIdentity);
   const pointer = readNativePointer(ctx);
+  if (selectedRootIdentity) assertSelectedCwdSnapshot(selectedRootIdentity);
   if (!pointer) return Promise.reject(new CliError('NATIVE_RUNTIME_OFFLINE', 'Native runtime is offline. Run hcc native up.'));
   // Keep a policy-checked request bound to that runtime. This same pointer's
   // endpoint and credential are used below; never reread and follow a new owner.
@@ -12,6 +16,8 @@ export function nativeRequest(ctx, method, route, body = null, { timeoutMs = 350
     return Promise.reject(new CliError('NATIVE_OWNER_CHANGED',
       'Native runtime changed after policy verification. Inspect its current status before retrying.', { uncertain: false }));
   }
+  try { assertNativePointerOwner(ctx, pointer); }
+  catch (error) { return Promise.reject(error); }
   return new Promise((resolve, reject) => {
     const payload = body === null ? null : JSON.stringify(body);
     let timer;

package/lib/runtime/native/launcher.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url';
 import { CliError } from '../../shared/errors.mjs';
 import { fileLockEndpoint } from '../../shared/file-lock.mjs';
 import { openPrivateAppendFile } from '../private-file.mjs';
-import { nativePaths, readNativePointer } from './store.mjs';
+import { assertNativePointerOwner, nativePaths, readNativeOwnerStatus, readNativePointer } from './store.mjs';
 import { nativeRequest } from './client.mjs';
 import { spawnPinnedCwdProcess } from '../../process/pinned-cwd.mjs';
 import { assertSelectedCwdSnapshot, captureSelectedCwdSnapshot } from '../../process/selected-cwd-identity.mjs';
@@ -19,14 +19,19 @@ export function createNativeLauncher({ spawnProcess = spawn, request = nativeReq
   const starting = new Map();
 
   async function readReady(ctx) {
-    if (!readNativePointer(ctx)) return null;
+    if (ctx.initialRootIdentity) assertSelectedCwdSnapshot(ctx.initialRootIdentity);
+    const pointer = readNativePointer(ctx);
+    if (!pointer) return null;
+    try { assertNativePointerOwner(ctx, pointer); }
+    catch (error) { if (error.code === 'NATIVE_RUNTIME_OFFLINE') return null; throw error; }
     try {
       const status = await request(ctx, 'GET', '/status', null, { timeoutMs: 2000 });
       if (!status || status.root !== ctx.root || status.meshDb !== ctx.dbPath ||
-          typeof status.generation !== 'string' || !status.generation) {
+          status.generation !== pointer.generation) {
         throw new CliError('NATIVE_RESPONSE_INVALID', 'Native runtime does not match this project');
       }
       if (status.stopping) throw new CliError('NATIVE_RUNTIME_STOPPING', 'Native runtime is stopping; finish its shutdown before creating another worker');
+      if (ctx.initialRootIdentity) assertSelectedCwdSnapshot(ctx.initialRootIdentity);
       return status;
     } catch (error) {
       if (error.code === 'NATIVE_RUNTIME_OFFLINE') return null;
@@ -58,12 +63,23 @@ export function createNativeLauncher({ spawnProcess = spawn, request = nativeReq
     try {
       const existing = await readReady(ctx);
       if (existing) return existing;
+      // A daemon can hold its durable owner before publishing runtime.json.
+      // Keep the rc8 launcher lock and wait for that owner, rather than launch
+      // a second process when the pointer is temporarily absent.
+      while (Date.now() < deadline && ['live', 'unknown'].includes(readNativeOwnerStatus(ctx).state)) {
+        const status = await readReady(ctx);
+        if (status) return status;
+        await delay(pollMs);
+      }
+      if (Date.now() >= deadline) throw new CliError('NATIVE_RUNTIME_START_FAILED', 'A native owner is still starting or its exit is unconfirmed; inspect native status before retrying');
       let log, child;
       try {
         log = openPrivateAppendFile(paths.log);
         child = spawnPinnedCwdProcess(process.execPath, [fileURLToPath(new URL('../../../bin/hcc.mjs', import.meta.url)), '--root', ctx.root, '--db', ctx.dbPath, 'native', 'serve'], {
           cwd: ctx.root, expectedIdentity: ctx.initialRootIdentity,
-          env, detached: true, stdio: ['ignore', log, log]
+          env: { ...env, HCC_PINNED_ROOT_IDENTITY: JSON.stringify({
+            canonical: ctx.initialRootIdentity.canonical, identity: ctx.initialRootIdentity.identity
+          }) }, detached: true, stdio: ['ignore', log, log]
         }, spawnProcess);
       } catch (error) {
         if (error?.code === 'PROJECT_PATH_FORBIDDEN') throw new CliError('NATIVE_STATE_UNSAFE', error.message);

package/lib/runtime/native/service.mjs

@@ -7,13 +7,13 @@ import { redactSecrets } from '../../shared/redact.mjs';
 import { acquireFileLock } from '../../shared/file-lock.mjs';
 import { aggregateCleanupFailure } from '../../shared/cleanup-error.mjs';
 import { inspectProcessIdentity, compareProcessIdentity } from '../../process/identity.mjs';
-import { shellQuoteArg } from '../../format.mjs';
-import { commandPath } from '../../cli-runtime.mjs';
+import { recordCodexThreadRoot } from '../../core/sessions/codex-thread-root.mjs';
+import { assertPinnedSessionLaunchAllowed } from '../../process/pinned-cwd.mjs';
 import { tx } from '../../db/schema.mjs';
 import { createScopedMcpConfig } from '../../mcp/scope.mjs';
 import { createNativeAdapter, nativeWorkerEnv, NATIVE_PROVIDERS } from '../../integrations/native/index.mjs';
 import { assertSelectedCwdSnapshot, captureSelectedCwdSnapshot, sameSelectedCwdIdentity } from '../../process/selected-cwd-identity.mjs';
-import { createNativeStore, nativePaths, parseNativeCwdIdentity, readNativePointer, writeNativePointer } from './store.mjs';
+import { claimNativeOwner, createNativeStore, nativePaths, parseNativeCwdIdentity, readNativePointer, writeNativePointer } from './store.mjs';
 
 function publicError(error) {
   return redactSecrets({ code: error.code || 'NATIVE_REQUEST_FAILED', message: error.message || 'Native operation failed', extra: error.extra || {} });
@@ -65,8 +65,23 @@ export async function startNativeService(ctx, deps, options = {}) {
     throw new CliError('NATIVE_RUNTIME_IN_USE', 'The previous native runtime is still alive or its exit cannot be confirmed.');
   }
   assertPreviousOwnerExited();
+  const workers = new Map();
+  const creating = new Set();
+  const forking = new Set();
+  const operations = new Set();
+  const generation = randomUUID();
+  const token = randomBytes(32).toString('hex');
+  let stopping = false;
+  let shutdownPromise;
+  let shutdownError = null;
+  let ownershipLost = false;
+  let pollTimer;
+  const adapterFactory = options.adapterFactory || createNativeAdapter;
+
+  let server;
   const identity = deps.liveProcessIdentity(process.pid);
   let ownership;
+  let owner;
   try {
     ownership = (options.acquireOwnership || acquireFileLock)(path.join(paths.dir, 'service-owner'), { nonblocking: true, rejectLegacyOwner: true });
   } catch (error) {
@@ -86,10 +101,13 @@ export async function startNativeService(ctx, deps, options = {}) {
     storeClosed = true;
     const failures = [];
     if (mesh && !meshClosed) {
-      try { mesh.close(); meshClosed = true; } catch (error) { failures.push(error); }
+      try { mesh.close(); meshClosed = true; owner?.setMesh(null); } catch (error) { failures.push(error); }
     }
-    if (store && !nativeStoreClosed) {
-      try { store.close(); nativeStoreClosed = true; } catch (error) { failures.push(error); }
+    if (!failures.length && owner && !owner.lost) {
+      try { owner.release(); } catch (error) { failures.push(error); }
+    }
+    if (!failures.length && !nativeStoreClosed && (store || owner)) {
+      try { if (store) store.close(); else owner.db.close(); nativeStoreClosed = true; } catch (error) { failures.push(error); }
     }
     if (failures.length === 1) throw failures[0];
     if (failures.length > 1) throw new AggregateError(failures, 'Native persistence cleanup failed');
@@ -106,26 +124,32 @@ export async function startNativeService(ctx, deps, options = {}) {
   }
   try {
     assertPreviousOwnerExited();
-    store = createNativeStore(ctx);
-    mesh = deps.connect(ctx, { migrateRegistered: false });
-    mesh.exec(`CREATE TABLE IF NOT EXISTS native_user_submissions (
-      submission_id TEXT PRIMARY KEY, message_id INTEGER NOT NULL UNIQUE,
-      peer TEXT NOT NULL, payload_hash TEXT NOT NULL
-    )`);
+    assertSelectedCwdSnapshot(serviceRootIdentity);
+    owner = claimNativeOwner(ctx, { rootIdentity: serviceRootIdentity, identity, generation,
+      inspect: options.inspectProcessIdentity || inspectProcessIdentity,
+      onLoss() {
+        stopping = true;
+        clearInterval(pollTimer);
+        shutdownError = publicError(new CliError('NATIVE_OWNER_LOST', 'Native runtime ownership changed; all further writes are stopped'));
+        for (const worker of workers.values()) { worker.quarantined = true; worker.mcpCapability?.dispose(); }
+        queueMicrotask(() => { void shutdown().catch(() => {}); });
+      } });
+    store = createNativeStore(ctx, { owner });
+    assertSelectedCwdSnapshot(serviceRootIdentity);
+    mesh = owner.withWrite(() => deps.connect(ctx, { migrateRegistered: false }));
+    owner.setMesh(mesh);
+    owner.withWrite(() => mesh.exec(`
+      CREATE TABLE IF NOT EXISTS native_user_submissions (
+        submission_id TEXT PRIMARY KEY, message_id INTEGER NOT NULL UNIQUE,
+        peer TEXT NOT NULL, payload_hash TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS native_worker_reservations (
+        peer TEXT PRIMARY KEY, owner TEXT NOT NULL UNIQUE, provider TEXT NOT NULL,
+        cwd TEXT NOT NULL, pid INTEGER NOT NULL
+      );`));
     store.disconnected();
+    recoverWorkerReservations();
   } catch (error) { releaseAfterInitializationFailure(error); }
-  const workers = new Map();
-  const creating = new Set();
-  const forking = new Set();
-  const operations = new Set();
-  const generation = randomUUID();
-  const token = randomBytes(32).toString('hex');
-  let stopping = false;
-  let shutdownPromise;
-  let shutdownError = null;
-  let ownershipLost = false;
-  let pollTimer;
-  const adapterFactory = options.adapterFactory || createNativeAdapter;
 
   function track(promise) {
     operations.add(promise);
@@ -137,7 +161,7 @@ export async function startNativeService(ctx, deps, options = {}) {
     if (stopping) throw new CliError('NATIVE_RUNTIME_STOPPING', 'Native runtime is stopping');
   }
   function assertOwnership() {
-    try { ownership.assertHeld(); }
+    try { ownership.assertHeld(); owner?.assertCurrent(); }
     catch {
       const error = new CliError('NATIVE_RUNTIME_OWNERSHIP_LOST', 'Native ownership is no longer confirmed; the runtime is stopping.');
       if (!ownershipLost) {
@@ -149,6 +173,10 @@ export async function startNativeService(ctx, deps, options = {}) {
       throw error;
     }
   }
+  function assertWorkerDirectory(worker) {
+    assertSelectedCwdSnapshot(serviceRootIdentity);
+    assertSelectedCwdSnapshot(worker.cwdIdentity);
+  }
   function assertOwner(worker) {
     assertOwnership();
     const binding = mesh.prepare('SELECT * FROM peer_bindings WHERE peer=?').get(worker.peer);
@@ -166,6 +194,33 @@ export async function startNativeService(ctx, deps, options = {}) {
       throw new CliError('NATIVE_OWNER_CHANGED', 'Native worker identity changed; refresh its current state before controlling it');
     }
   }
+  function recoverWorkerReservations() {
+    owner.withWrite(() => tx(mesh, () => {
+      for (const reservation of mesh.prepare('SELECT * FROM native_worker_reservations').all()) {
+        if (!store.worker(reservation.peer)) {
+          const binding = mesh.prepare('SELECT * FROM peer_bindings WHERE peer=?').get(reservation.peer);
+          const peer = mesh.prepare('SELECT * FROM peers WHERE id=?').get(reservation.peer);
+          if (binding?.runtime_target === reservation.owner) {
+            if (binding.transport !== 'native' || binding.provider !== reservation.provider ||
+                binding.runtime_session_id !== reservation.peer ||
+                binding.provider_session_id || binding.provider_session_name ||
+                !peer || peer.kind !== reservation.provider || peer.role !== 'native-worker' ||
+                peer.worktree !== reservation.cwd || peer.pid !== reservation.pid) {
+              throw new CliError('NATIVE_OWNER_UNVERIFIED', 'Reserved native peer changed before recovery');
+            }
+            mesh.prepare('DELETE FROM peer_bindings WHERE peer=? AND runtime_target=?')
+              .run(reservation.peer, reservation.owner);
+            mesh.prepare('DELETE FROM peers WHERE id=?').run(reservation.peer);
+          } else if (binding || peer) {
+            // Another writer changed the peer; do not erase its record.
+            throw new CliError('NATIVE_OWNER_UNVERIFIED', 'Reserved native peer has ambiguous ownership');
+          }
+        }
+        mesh.prepare('DELETE FROM native_worker_reservations WHERE peer=? AND owner=?')
+          .run(reservation.peer, reservation.owner);
+      }
+    }));
+  }
   function submissionHash(input) {
     return createHash('sha256').update(JSON.stringify([
       input.peer, input.from, input.taskId || null, input.body
@@ -192,6 +247,7 @@ export async function startNativeService(ctx, deps, options = {}) {
   function save(worker, options) {
     if (!worker.adapter || storeClosed) return;
     const snapshot = workerSnapshot(worker, options);
+    owner.withWrite(() => {
     tx(mesh, () => {
       assertOwner(worker);
       if (snapshot.sessionId && mesh.prepare('SELECT peer FROM peer_bindings WHERE provider=? AND (provider_session_id=? OR provider_session_name=?) AND peer<>?')
@@ -210,6 +266,7 @@ export async function startNativeService(ctx, deps, options = {}) {
         status, capabilities: JSON.stringify(snapshot.capabilities || worker.adapter.capabilities) });
     });
     store.saveWorker({ peer: worker.peer, provider: worker.provider, cwd: worker.cwd, cwdIdentity: worker.cwdIdentity, ...snapshot });
+    });
   }
   function belongs(event, active) {
     if (!active) return false;
@@ -220,6 +277,7 @@ export async function startNativeService(ctx, deps, options = {}) {
   function record(worker, event) {
     if (storeClosed || worker.closing) return;
     try {
+      owner.withWrite(() => {
       assertOwner(worker);
       const safe = redactSecrets(event);
       if (event.type !== 'delta' && event.type !== 'output') store.event(worker.peer, safe);
@@ -237,7 +295,8 @@ export async function startNativeService(ctx, deps, options = {}) {
         tx(mesh, () => {
           assertOwner(worker);
           if (completed) {
-            const text = worker.output.join('\n\n') || event.text;
+            const text = typeof event.text === 'string' && event.text
+              ? event.text : worker.output.join('\n\n');
             // A reply is delivered for context, but must not create another
             // automatic reply and an unbounded loop between native workers.
             if (text && active.message.kind !== 'reply') deps.sendMessage(mesh, worker.peer, active.message.sender, active.message.task_id, 'reply', text,
@@ -252,16 +311,18 @@ export async function startNativeService(ctx, deps, options = {}) {
         worker.active = null;
         worker.output = [];
       }
-      if (event.type === 'error' && active && (associated || (!event.turnId && !event.submissionId))) {
+      if (event.type === 'error' && event.willRetry !== true && active && (associated || (!event.turnId && !event.submissionId))) {
         store.updateDelivery(active.delivery.id, 'uncertain', active.turnId, safe);
         worker.active = null;
         worker.output = [];
         worker.quarantined = true;
       }
       save(worker);
+      });
     } catch (error) {
       worker.quarantined = true;
       console.error(JSON.stringify(publicError(error)));
+      if (owner.lost) return;
       void closeWorker(worker.peer).catch((closeError) => console.error(JSON.stringify(publicError(closeError))));
     }
   }
@@ -290,7 +351,9 @@ export async function startNativeService(ctx, deps, options = {}) {
   }
   async function createWorkerNow(input) {
     requireRunning();
+    assertPinnedSessionLaunchAllowed();
     assertSelectedCwdSnapshot(serviceRootIdentity);
+    recoverWorkerReservations();
     const peer = typeof input.peer === 'string' ? input.peer : '';
     const provider = input.provider;
     if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(peer) || peer === 'all' || !NATIVE_PROVIDERS.includes(provider)) {
@@ -352,7 +415,7 @@ export async function startNativeService(ctx, deps, options = {}) {
       active: null, output: [], quarantined: false, closing: false, dispatch: null, closePromise: null };
     // Reserve identity before starting the child so installed hooks can only
     // heartbeat this exact worker. Every subsequent write checks this owner.
-    tx(mesh, () => {
+    owner.withWrite(() => tx(mesh, () => {
       const binding = mesh.prepare('SELECT * FROM peer_bindings WHERE peer=?').get(peer);
       const existing = mesh.prepare('SELECT * FROM peers WHERE id=?').get(peer);
       if (fencedResume && (!binding || binding.runtime_target !== input.resumeFence.owner ||
@@ -374,14 +437,20 @@ export async function startNativeService(ctx, deps, options = {}) {
       assertOwner(worker);
       worker.lastMessageId = mesh.prepare('SELECT COALESCE(MAX(id),0) AS id FROM messages').get().id;
       ingest(worker, true);
-    });
+      if (!previous) mesh.prepare(`INSERT INTO native_worker_reservations(peer,owner,provider,cwd,pid)
+        VALUES (?,?,?,?,?)`).run(peer, worker.owner, provider, cwd, process.pid);
+    }));
+    options.afterWorkerReservation?.({ peer, owner: worker.owner });
     store.saveWorker({ peer, provider, cwd, cwdIdentity: expectedCwdIdentity, sandbox, sessionId, status: 'opening' });
+    if (!previous) owner.withWrite(() => mesh.prepare('DELETE FROM native_worker_reservations WHERE peer=? AND owner=?')
+      .run(peer, worker.owner));
     creating.add(peer);
     workers.set(peer, worker);
     try {
       // A provider file sandbox cannot restrict a mutating MCP server.
       if (sandbox !== 'read-only') {
         worker.mcpCapability = (options.mcpConfigFactory || createScopedMcpConfig)({ root: ctx.root, dbPath: ctx.dbPath,
+          rootIdentity: serviceRootIdentity,
           peer, executorId: worker.owner, ownerIdentity: identity,
           binding: { transport: 'native', runtimeSessionId: peer, runtimeTarget: worker.owner } });
       }
@@ -390,7 +459,7 @@ export async function startNativeService(ctx, deps, options = {}) {
         expectedCwdIdentity,
         executorId: worker.owner, interactive: true,
         ...(worker.mcpCapability ? { mcpServers: { hello_cc_scoped: worker.mcpCapability.config } } : {}),
-        env: nativeWorkerEnv(process.env, ctx, peer, worker.owner), onEvent: (event) => {
+        env: nativeWorkerEnv(process.env, { ...ctx, initialRootIdentity: serviceRootIdentity }, peer, worker.owner), onEvent: (event) => {
           if (worker.adapter) record(worker, event);
         } });
       assertSelectedCwdSnapshot(expectedCwdIdentity);
@@ -407,8 +476,14 @@ export async function startNativeService(ctx, deps, options = {}) {
       requireRunning();
       assertSelectedCwdSnapshot(expectedCwdIdentity);
       assertSelectedCwdSnapshot(serviceRootIdentity);
+      if (provider === 'codex' && !sessionId && !input.forkSessionId && worker.adapter.snapshot().sessionId &&
+          sameSelectedCwdIdentity(expectedCwdIdentity, serviceRootIdentity)) {
+        assertSelectedCwdSnapshot(serviceRootIdentity);
+        owner.withWrite(() => tx(mesh, () => recordCodexThreadRoot(mesh, deps.addEvent,
+          worker.adapter.snapshot().sessionId, serviceRootIdentity, 'native-new')));
+      }
       save(worker);
-      deps.addEvent(mesh, 'native.worker.opened', peer, null, { provider, session_id: worker.adapter.snapshot().sessionId || null, resumed: Boolean(sessionId) });
+      owner.withWrite(() => deps.addEvent(mesh, 'native.worker.opened', peer, null, { provider, session_id: worker.adapter.snapshot().sessionId || null, resumed: Boolean(sessionId) }));
       return { peer, ...workerSnapshot(worker) };
     } catch (error) {
       worker.closing = true;
@@ -422,7 +497,7 @@ export async function startNativeService(ctx, deps, options = {}) {
       if (!cleanupError) workers.delete(peer);
       try {
         if (worker.adapter) save(worker, { checkSandbox: false });
-        else tx(mesh, () => { assertOwner(worker); mesh.prepare("UPDATE peers SET status='blocked' WHERE id=?").run(peer); });
+        else owner.withWrite(() => tx(mesh, () => { assertOwner(worker); mesh.prepare("UPDATE peers SET status='blocked' WHERE id=?").run(peer); }));
       } catch {}
       store.saveWorker({ peer, provider, cwd, cwdIdentity: expectedCwdIdentity, ...(worker.adapter?.snapshot() || {}), sandbox, status: 'error' });
       if (cleanupError) throw new CliError('NATIVE_CLOSE_FAILED', 'Worker initialization failed and its owned provider exit was not confirmed',
@@ -431,15 +506,13 @@ export async function startNativeService(ctx, deps, options = {}) {
     } finally { creating.delete(peer); }
   }
   function context(worker, message, delivery) {
-    const command = ['env', `HCC_PEER=${worker.peer}`, `HCC_ROOT=${ctx.root}`, `HCC_DB=${ctx.dbPath}`,
-      process.execPath, commandPath()].map(shellQuoteArg).join(' ');
     const tasks = mesh.prepare("SELECT id,status,owner,title FROM tasks WHERE status NOT IN ('done','abandoned') ORDER BY id DESC LIMIT 8").all();
     const locks = mesh.prepare('SELECT resource,owner,task_id FROM locks WHERE expires_at>? ORDER BY resource LIMIT 8').all(Math.floor(Date.now() / 1000));
     return ['[hello-cc native coordination]', `peer: ${worker.peer}`, `project: ${ctx.root}`,
       ...(worker.sandbox === 'read-only'
         ? ['This worker uses the Codex read-only file sandbox. Inspect and report only; do not modify files or execute mutating coordination commands. HCC coordination MCP tools are not attached.']
         : ['Use the scoped hello_cc_scoped MCP tools for HCC state, tasks, locks, results and handoffs. Continue your owned task until done, blocked or handed off.',
-          `Use this exact prefix for HCC commands: ${command}`]),
+          'Ordinary hcc CLI commands from this native worker are blocked because they cannot preserve the runtime owner fence; use the scoped MCP tools instead.']),
       'Only the message below is newly delivered from the inbox in this turn. You may use previous turns already present in this same provider session as context. Do not independently consume or acknowledge other inbox messages.',
       delivery.origin === 'user'
         ? 'The request below was submitted by the local user through authenticated HCC CLI or Web controls. Follow it within the user scope; tool permissions still require explicit approval.'
@@ -450,7 +523,10 @@ export async function startNativeService(ctx, deps, options = {}) {
       '[open tasks]', ...tasks.map((row) => JSON.stringify(row)), '[active locks]', ...locks.map((row) => JSON.stringify(row))].join('\n');
   }
   async function dispatch(worker, delivery, message) {
+    let directoryChanged = false;
     try {
+      owner.assertCurrent();
+      assertWorkerDirectory(worker);
       const label = delivery.origin === 'user' ? 'Local user request' : 'Peer coordination message';
       const receipt = await worker.adapter.send({ text: `${context(worker, message, delivery)}\n\n${label} #${message.id} (${message.kind}) from ${message.sender}:\n${message.body}`,
         submissionId: delivery.submission_id });
@@ -461,7 +537,8 @@ export async function startNativeService(ctx, deps, options = {}) {
         store.updateDelivery(delivery.id, state, worker.active.turnId, { receipt_status: receipt.status });
       }
     } catch (error) {
-      if (!storeClosed) {
+      directoryChanged = error.code === 'PROJECT_PATH_CHANGED';
+      if (!storeClosed && !directoryChanged) {
         const current = store.delivery(worker.peer, message.id);
         if (current && !['completed', 'failed'].includes(current.state)) {
           store.updateDelivery(delivery.id, error.extra?.uncertain || current.state === 'uncertain' ? 'uncertain' : 'failed', null, publicError(error));
@@ -469,8 +546,9 @@ export async function startNativeService(ctx, deps, options = {}) {
       }
       if (worker.active?.delivery.id === delivery.id) { worker.active = null; worker.output = []; }
       worker.quarantined = true;
+      if (directoryChanged) worker.mcpCapability?.dispose();
     }
-    if (!worker.closing) { try { save(worker); } catch (error) { record(worker, { type: 'error', ...publicError(error) }); } }
+    if (!worker.closing && !directoryChanged) { try { save(worker); } catch (error) { record(worker, { type: 'error', ...publicError(error) }); } }
   }
   async function forkWorker(input) {
     requireRunning();
@@ -495,7 +573,7 @@ export async function startNativeService(ctx, deps, options = {}) {
         : saved.status !== 'closed')) {
       throw new CliError('NATIVE_FORK_NOT_READY', 'Finish or resolve the parent operation before forking');
     }
-    if (parent) { assertRequestedOwner(parent, input); assertSelectedCwdSnapshot(parent.cwdIdentity); ingest(parent); }
+    if (parent) { assertRequestedOwner(parent, input); assertWorkerDirectory(parent); ingest(parent); }
     else if ((input.owner !== undefined && input.owner !== binding.runtime_target) ||
              (input.sessionId !== undefined && input.sessionId !== saved.session_id) ||
              (input.generation !== undefined && input.generation !== generation)) {
@@ -529,8 +607,8 @@ export async function startNativeService(ctx, deps, options = {}) {
           throw new CliError('NATIVE_SANDBOX_MISMATCH', 'Parent sandbox policy changed while forking');
         }
         assertSelectedCwdSnapshot(cwdIdentity);
-        deps.addEvent(mesh, 'native.worker.forked', input.peer, null,
-          { provider: saved.provider, parent_peer: input.parent, parent_session_id: saved.session_id, session_id: child.sessionId });
+        owner.withWrite(() => deps.addEvent(mesh, 'native.worker.forked', input.peer, null,
+          { provider: saved.provider, parent_peer: input.parent, parent_session_id: saved.session_id, session_id: child.sessionId }));
         return { ...child, parent: input.parent, parentSessionId: saved.session_id };
       } catch (error) {
         try { await closeWorker(input.peer); }
@@ -547,6 +625,7 @@ export async function startNativeService(ctx, deps, options = {}) {
     for (const worker of workers.values()) {
       try {
         if (worker.closing || creating.has(worker.peer) || forking.has(worker.peer)) continue;
+        assertWorkerDirectory(worker);
         save(worker);
         ingest(worker);
         if (worker.active || worker.dispatch || worker.quarantined) continue;
@@ -561,7 +640,12 @@ export async function startNativeService(ctx, deps, options = {}) {
         const operation = dispatch(worker, delivery, message);
         worker.dispatch = operation;
         void track(operation).finally(() => { worker.dispatch = null; }).catch(() => {});
-      } catch (error) { record(worker, { type: 'error', ...publicError(error) }); }
+      } catch (error) {
+        if (error.code === 'PROJECT_PATH_CHANGED') {
+          worker.quarantined = true;
+          worker.mcpCapability?.dispose();
+        } else record(worker, { type: 'error', ...publicError(error) });
+      }
     }
   }
   function closeWorker(peer) {
@@ -570,7 +654,7 @@ export async function startNativeService(ctx, deps, options = {}) {
     if (worker.closePromise) return worker.closePromise;
     worker.closing = true;
     worker.mcpCapability?.dispose();
-    if (worker.active && !storeClosed) {
+    if (worker.active && !storeClosed && !owner.lost) {
       store.updateDelivery(worker.active.delivery.id, 'uncertain', worker.active.turnId, { reason: 'worker_closed' });
       worker.active = null;
     }
@@ -582,7 +666,7 @@ export async function startNativeService(ctx, deps, options = {}) {
       // Factories can resolve after close begins. Confirm their cleanup even
       // when initialization itself rejected; its cleanup may also have failed.
       if (worker.adapter && worker.adapter !== adapterAtClose) await worker.adapter.close();
-      try { save(worker, { checkSandbox: false }); } catch (error) { if (!['NATIVE_PEER_IN_USE', 'NATIVE_RUNTIME_OWNERSHIP_LOST'].includes(error.code)) throw error; }
+      try { save(worker, { checkSandbox: false }); } catch (error) { if (!['NATIVE_PEER_IN_USE', 'NATIVE_RUNTIME_OWNERSHIP_LOST', 'NATIVE_OWNER_LOST'].includes(error.code)) throw error; }
       if (!creating.has(peer)) workers.delete(peer);
       return { peer, status: 'closed' };
     })();
@@ -590,7 +674,7 @@ export async function startNativeService(ctx, deps, options = {}) {
     void closing.catch((error) => {
       worker.quarantined = true;
       worker.closePromise = null;
-      if (!storeClosed) store.saveWorker({ peer: worker.peer, provider: worker.provider, cwd: worker.cwd,
+      if (!storeClosed && !owner.lost) store.saveWorker({ peer: worker.peer, provider: worker.provider, cwd: worker.cwd,
         ...worker.adapter?.snapshot(), sandbox: worker.sandbox, status: 'uncertain' });
       console.error(JSON.stringify(publicError(error)));
     });
@@ -606,6 +690,7 @@ export async function startNativeService(ctx, deps, options = {}) {
     try {
       const url = new URL(request.url, 'http://localhost');
       let result;
+      owner.assertCurrent();
       if (request.method === 'POST' && !['/down', '/close'].includes(url.pathname)) requireRunning();
       if (request.method === 'GET' && url.pathname === '/status') {
         result = { generation, sandboxPolicyVersion: 1, root: fs.realpathSync(ctx.root), meshDb: path.resolve(ctx.dbPath), pid: process.pid, stopping, shutdown_error: shutdownError,
@@ -660,6 +745,7 @@ export async function startNativeService(ctx, deps, options = {}) {
         const worker = workers.get(input.peer);
         if (forking.has(input.peer)) throw new CliError('NATIVE_FORK_NOT_READY', 'Wait for the parent fork to finish');
         if (!worker || worker.closing || creating.has(input.peer)) throw new CliError('NATIVE_WORKER_NOT_FOUND', 'Target native worker is not open');
+        assertWorkerDirectory(worker);
         if (worker.quarantined) throw new CliError('NATIVE_WORKER_UNCERTAIN', 'Worker needs inspection and an explicit close/resume before more submissions');
         if (typeof input.body !== 'string' || !input.body.trim() || typeof input.from !== 'string' || !input.from.trim() ||
             (input.taskId != null && (!Number.isSafeInteger(input.taskId) || input.taskId < 1))) throw new CliError('BAD_ARGS', 'Message needs a sender, nonempty body, and valid task ID');
@@ -682,7 +768,7 @@ export async function startNativeService(ctx, deps, options = {}) {
             return;
           }
         }
-        result = (() => {
+        result = owner.withWrite(() => {
           const submissionId = input.submissionId || randomUUID();
           let intent = mesh.prepare('SELECT * FROM native_user_submissions WHERE submission_id=?').get(submissionId);
           if (intent) matchingUserSubmission(input, intent);
@@ -703,7 +789,7 @@ export async function startNativeService(ctx, deps, options = {}) {
             throw new CliError('NATIVE_SUBMISSION_MISMATCH', 'Submission delivery conflicts with the durable message intent');
           }
           return { message_id: intent.message_id, submission_id: submissionId, state: delivery.state };
-        })();
+        });
       } else if (request.method === 'POST' && url.pathname === '/interrupt') {
         const input = await jsonBody(request);
         requireRunning();
@@ -717,6 +803,7 @@ export async function startNativeService(ctx, deps, options = {}) {
         requireRunning();
         const worker = workers.get(input.peer);
         if (!worker?.adapter || worker.closing || creating.has(input.peer)) throw new CliError('NATIVE_WORKER_NOT_FOUND', 'Target native worker is not open');
+        assertWorkerDirectory(worker);
         assertRequestedOwner(worker, input);
         const snapshot = workerSnapshot(worker);
         const matches = (snapshot.pendingApprovals || []).filter(pending => pending.requestId === input.requestId &&
@@ -750,7 +837,9 @@ export async function startNativeService(ctx, deps, options = {}) {
       reply(response, 200, { ok: true, data: redactSecrets(result) });
     } catch (error) { reply(response, error.code === 'BAD_ARGS' ? 400 : 409, { ok: false, error: publicError(error) }); }
   }
-  const server = http.createServer((request, response) => { void route(request, response); });
+  server = http.createServer((request, response) => {
+    void track(route(request, response)).catch(error => console.error(JSON.stringify(publicError(error))));
+  });
   server.requestTimeout = 40000;
   server.headersTimeout = 10000;
   let serverClosed = false;
@@ -765,8 +854,10 @@ export async function startNativeService(ctx, deps, options = {}) {
   try {
     await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
     ownership.assertHeld();
-    writeNativePointer(ctx, { root: fs.realpathSync(ctx.root), meshDb: path.resolve(ctx.dbPath), pid: process.pid,
-      port: server.address().port, token, generation, processIdentity: identity });
+    assertSelectedCwdSnapshot(serviceRootIdentity);
+    owner.withWrite(() => writeNativePointer(ctx, { root: fs.realpathSync(ctx.root), meshDb: path.resolve(ctx.dbPath), pid: process.pid,
+      rootIdentity: serviceRootIdentity, ownerVersion: 2, ownerIdentity: identity, stateGeneration: owner.stateGeneration,
+      port: server.address().port, token, generation, processIdentity: identity }));
   } catch (error) {
     try { await closeServer(); }
     catch (cleanup) {
@@ -797,7 +888,9 @@ export async function startNativeService(ctx, deps, options = {}) {
       }
       await closeServer();
       closePersistence();
-      if (readNativePointer(ctx)?.generation === generation) fs.rmSync(paths.pointer, { force: true });
+      try {
+        if (readNativePointer(ctx)?.generation === generation) fs.rmSync(paths.pointer, { force: true });
+      } catch (error) { if (error.code !== 'PROJECT_PATH_CHANGED') throw error; }
       ownership.release();
       options.onShutdown?.();
     })();