@logicseek/hello-cc 1.1.0-rc.8 → 1.1.0

package/lib/runtime/project-trust.mjs

@@ -13,7 +13,11 @@ export function unsafeDirectoryAcl(directory, stat = null) {
   try { identity ||= fs.lstatSync(directory); }
   catch { return true; }
   const signature = `${identity.dev}:${identity.ino}:${identity.ctimeNs ?? identity.ctimeMs}`;
-  const cached = aclCache.get(directory);
+  // Number Stats carry milliseconds; BigInt Stats carry nanoseconds. Keep
+  // both exact signatures instead of replacing one with the other on every
+  // read through a different state-validation path.
+  const cacheKey = `${typeof identity.dev === 'bigint' ? 'bigint' : 'number'}\0${directory}`;
+  const cached = aclCache.get(cacheKey);
   if (cached?.signature === signature) return cached.unsafe;
   const ls = fs.existsSync('/bin/ls') ? '/bin/ls'
     : fs.existsSync('/usr/bin/ls') ? '/usr/bin/ls' : null;
@@ -36,7 +40,7 @@ export function unsafeDirectoryAcl(directory, stat = null) {
         : permissions[10] === '+')
     : permissions[10] === '+';
   if (aclCache.size >= 1024) aclCache.clear();
-  aclCache.set(directory, { signature, unsafe });
+  aclCache.set(cacheKey, { signature, unsafe });
   return unsafe;
 }
 

package/lib/runtime/state-migration.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from 'node:url';
 import { DatabaseSync } from 'node:sqlite';
 import { compareProcessIdentity, inspectProcessIdentity } from '../process/identity.mjs';
 import { privateProjectStateDir, withPrivateProjectStateTransition,
-  privateStateBaseDir } from './private-state.mjs';
+  privateProjectStateManifest, privateStateBaseDir } from './private-state.mjs';
 import { unsafeDirectoryAcl } from './project-trust.mjs';
 
 const DIRECTORY_FLAGS = fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW;
@@ -264,6 +264,55 @@ function checkMeshPeers(db) {
   }
 }
 
+// A binding-only v1 -> v2 upgrade never copies or opens the store for write.
+// These checks are additional evidence, not proof that an unregistered writer
+// (including a pre-pointer old Web process) is absent; the operator must also
+// explicitly assert a cold drain.
+export function assertPrivateStateOffline(directory) {
+  checkedDirectory(directory, { exactMode: 0o700 });
+  const globalPointer = path.join(privateStateBaseDir(), 'runtime.json');
+  for (const file of [globalPointer, path.join(directory, 'runtime.json'),
+    path.join(directory, 'native', 'runtime.json')]) {
+    if (existing(file)) checkPointer(file);
+  }
+  const bufs = path.join(directory, 'bufs');
+  if (existing(bufs)) {
+    checkedDirectory(bufs, { exactMode: 0o700 });
+    for (const name of fs.readdirSync(bufs)) {
+      if (name.endsWith('.meta')) checkBufferMetadata(path.join(bufs, name));
+    }
+  }
+  const mesh = path.join(directory, 'mesh.db');
+  if (existing(mesh)) {
+    checkedRegular(mesh);
+    let db;
+    try {
+      db = new DatabaseSync(mesh, { readOnly: true, timeout: 1000 });
+      checkMeshPeers(db);
+    } catch (error) {
+      throw unsafe(`Cannot establish offline mesh peer state: ${mesh}`, error);
+    } finally { db?.close(); }
+  }
+  const nativeDb = path.join(directory, 'native', 'state.db');
+  if (existing(nativeDb)) {
+    checkedRegular(nativeDb);
+    let db;
+    try {
+      db = new DatabaseSync(nativeDb, { readOnly: true, timeout: 1000 });
+      if (db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='native_owner'").get()) {
+        const row = db.prepare('SELECT pid,start_token,command_hash,state FROM native_owner WHERE singleton=1').get();
+        if (row && row.state !== 'released') {
+          const stored = { pid: Number(row.pid), startToken: row.start_token,
+            commandHash: row.command_hash };
+          assertRecordedProcessDead(Number(row.pid), stored, 'native owner');
+        }
+      }
+    } catch (error) {
+      throw unsafe(`Cannot establish offline native owner state: ${nativeDb}`, error);
+    } finally { db?.close(); }
+  }
+}
+
 function snapshotDatabase(scratchDb, destination, { mesh = false } = {}) {
   let source;
   let target;
@@ -553,18 +602,17 @@ function sourceIdentity(root) {
   return { canonicalRoot, rootStat, source, sourceStat };
 }
 
-function markerBody(project) {
-  return JSON.stringify({
-    version: 1,
-    canonicalRoot: project.canonicalRoot,
-    dev: String(project.rootStat.dev),
-    ino: String(project.rootStat.ino)
-  }) + '\n';
+function markerBody(project, binding) {
+  if (binding.dev !== String(project.rootStat.dev) || binding.ino !== String(project.rootStat.ino) ||
+      (binding.version === 2 && binding.birthtimeNs !== String(project.rootStat.birthtimeNs))) {
+    throw unsafe('Project root identity changed before migration marker publication');
+  }
+  return `${JSON.stringify(binding)}\n`;
 }
 
-function writeMarker(stage, project) {
+function writeMarker(stage, project, binding) {
   const marker = path.join(stage, MARKER);
-  const body = markerBody(project);
+  const body = markerBody(project, binding);
   const fd = fs.openSync(marker, CREATE_FLAGS, 0o600);
   try {
     fs.writeFileSync(fd, body);
@@ -600,19 +648,22 @@ export function migrateLegacyProjectState(root, { confirmedOffline = false, asse
   const project = sourceIdentity(root);
   const base = privateStateBaseDir();
   const destination = privateProjectStateDir(project.canonicalRoot);
+  const destinationManifest = privateProjectStateManifest(project.canonicalRoot);
   const projects = path.dirname(destination);
+  const stageParent = destinationManifest.version === 2 ? path.dirname(projects) : projects;
   if (project.source === base || projects.startsWith(`${project.source}${path.sep}`)) {
     throw unsafe('Legacy source overlaps private destination');
   }
   checkHomeAncestry(path.dirname(base));
   ensurePrivateDirectory(base);
   ensurePrivateDirectory(projects);
+  if (stageParent !== projects) ensurePrivateDirectory(stageParent);
   return withPrivateProjectStateTransition(project.canonicalRoot, ({ setAuthorityKind }) => {
   const projectsStat = checkedDirectory(projects, { exactMode: 0o700 });
   if (existing(destination)) {
     throw failure('STATE_MIGRATION_EXISTS', `Private project state already exists: ${destination}`);
   }
-  const stage = path.join(projects, `.${path.basename(destination)}.migration-${randomBytes(12).toString('hex')}`);
+  const stage = path.join(stageParent, `.${path.basename(destination)}.migration-${randomBytes(12).toString('hex')}`);
   const stageStat = privateMkdir(stage);
   let committed = false;
   try {
@@ -644,7 +695,7 @@ export function migrateLegacyProjectState(root, { confirmedOffline = false, asse
     if (!sameFile(checkedDirectory(projects, { exactMode: 0o700 }), projectsStat)) {
       throw unsafe('Private projects directory changed before commit');
     }
-    writeMarker(stage, project);
+    writeMarker(stage, project, destinationManifest);
     // Persist authority before exposing the destination. If the rename fails,
     // the marker makes future access fail closed until an explicit retry.
     writeAuthorityMarker(projects, setAuthorityKind);
@@ -655,10 +706,12 @@ export function migrateLegacyProjectState(root, { confirmedOffline = false, asse
     fs.renameSync(stage, destination);
     try {
       fsyncDirectory(projects);
+      if (stageParent !== projects) fsyncDirectory(stageParent);
     } catch (error) {
       try {
         fs.renameSync(destination, stage);
         fsyncDirectory(projects);
+        if (stageParent !== projects) fsyncDirectory(stageParent);
       } catch (rollbackError) {
         throw failure('STATE_MIGRATION_COMMIT_UNCERTAIN',
           `Cannot confirm or roll back migration commit at ${destination}`, rollbackError);
@@ -677,7 +730,7 @@ export function migrateLegacyProjectState(root, { confirmedOffline = false, asse
         const current = existing(stage);
         if (current && current.isDirectory() && sameFile(current, stageStat)) {
           fs.rmSync(stage, { recursive: true, force: false });
-          fsyncDirectory(projects);
+          fsyncDirectory(stageParent);
         }
       } catch { /* Preserve the original error; an uncommitted stage is inert. */ }
     }

package/lib/shared/redact.mjs

@@ -52,7 +52,10 @@ export function redactSecrets(value, seen = new WeakSet()) {
 
     const clone = {};
     for (const [key, entry] of Object.entries(value)) {
-      clone[key] = isSecretKey(key) ? REDACTED : redactSecrets(entry, seen);
+      // Boolean isSecret describes an input control; its value is not a credential.
+      clone[key] = key === 'isSecret' && typeof entry === 'boolean'
+        ? entry
+        : isSecretKey(key) ? REDACTED : redactSecrets(entry, seen);
     }
     return clone;
   } finally {

package/lib/terminal/tmux.mjs

@@ -4,6 +4,7 @@ import process from 'node:process';
 import { spawn, spawnSync } from 'node:child_process';
 import { performance } from 'node:perf_hooks';
 import { CliError } from '../shared/errors.mjs';
+import { privateProjectGenerationFromPath } from '../runtime/private-state.mjs';
 import { shellQuoteArg } from '../format.mjs';
 import {
   LAUNCH_FINGERPRINT_ENV,
@@ -15,7 +16,7 @@ import {
 } from '../core/peers/format.mjs';
 
 export function runTmux(args, opts = {}) {
-  const result = spawnSync('tmux', args, {
+  const result = (opts.spawn || spawnSync)('tmux', args, {
     encoding: 'utf8',
     stdio: ['pipe', 'pipe', 'pipe'],
     input: opts.input || '',
@@ -28,7 +29,10 @@ export function runTmux(args, opts = {}) {
     if (result.error.code === 'ETIMEDOUT' || result.killed) {
       throw new CliError('TMUX_ERROR', `tmux timed out after ${opts.timeout ?? 5000}ms: tmux ${args.join(' ')}`);
     }
-    throw new CliError('TMUX_ERROR', `tmux failed: ${result.error.message}`);
+    const preSpawnCode = (!Number.isInteger(result.pid) || result.pid <= 0) &&
+      ['ENOENT', 'EACCES'].includes(result.error.code) ? result.error.code : null;
+    throw new CliError('TMUX_ERROR', `tmux failed: ${result.error.message}`,
+      preSpawnCode ? { preSpawnCode } : {});
   }
   if (result.status !== 0) {
     const message = (result.stderr || result.stdout || '').trim() || `tmux ${args.join(' ')} failed`;
@@ -201,6 +205,11 @@ function legacyManagedProjectRoot(root) {
 }
 
 export function tmuxManagedSessionPrefix(ctx) {
+  // A replacement project at the same spelling keeps A's v1 namespace, but
+  // its v2 private DB lives in an independent immutable generation. Derive the
+  // new tmux namespace from that captured DB route, never today's root inode.
+  const generation = privateProjectGenerationFromPath(ctx.dbPath);
+  if (generation) return `hcc2-${generation}-`;
   return `hcc-${shortHash(managedProjectRoot(ctx.root))}-`;
 }
 
@@ -228,6 +237,7 @@ function rootsIdentifySameProject(left, right) {
 export function tmuxManagedSessionPrefixMatches(ctx, sessionName, sessionRoot = null) {
   if (!sessionName) return false;
   if (sessionName.startsWith(tmuxManagedSessionPrefix(ctx))) return true;
+  if (tmuxManagedSessionPrefix(ctx).startsWith('hcc2-')) return false;
   return Boolean(sessionRoot) && rootsIdentifySameProject(ctx.root, sessionRoot) &&
     sessionName.startsWith(legacyTmuxManagedSessionPrefix({ root: sessionRoot }));
 }
@@ -235,6 +245,7 @@ export function tmuxManagedSessionPrefixMatches(ctx, sessionName, sessionRoot =
 export function tmuxManagedSessionNameMatches(ctx, sessionName, peerId, sessionRoot = null) {
   if (!sessionName) return false;
   if (sessionName === tmuxManagedSessionName(ctx, peerId)) return true;
+  if (tmuxManagedSessionPrefix(ctx).startsWith('hcc2-')) return false;
   return Boolean(sessionRoot) && rootsIdentifySameProject(ctx.root, sessionRoot) &&
     sessionName === legacyTmuxManagedSessionName({ root: sessionRoot }, peerId);
 }

package/lib/ui/help.mjs

@@ -59,6 +59,7 @@ Environment:
   HCC_PEER               Default peer id; inferred automatically when absent
   HCC_WEB_TOKEN          Set an explicit web access token
   HCC_RUNTIME_CA         CA file for HCC_RUNTIME_URL=https endpoints
+  HCC_PINNED_LAUNCH_MODE pinned (default) or hold new HCC-managed launches
 `);
     },
 

package/lib/web/codex-app-server.mjs

@@ -534,7 +534,7 @@ export function createCodexAppServer({
 
   async function call(method, params, mutation = false, absorb = true) {
     await initialize();
-    if (method === 'thread/list') assertCwdHandoff();
+    if (method === 'thread/list' || method === 'turn/steer') assertCwdHandoff();
     return request(method, params, mutation, absorb);
   }
 
@@ -611,6 +611,7 @@ export function createCodexAppServer({
           [...uncertain.values()].some((entry) => entry.threadId === threadId)) {
         throw new CodexAppServerError('CODEX_THREAD_BUSY', 'thread has an active or uncertain turn; no input was submitted');
       }
+      assertCwdHandoff();
       currentThreadId = threadId; submittingThreads.add(threadId);
       try {
         return await request('turn/start', { ...objectParams(params), threadId, input: normalized }, true);
@@ -639,6 +640,7 @@ export function createCodexAppServer({
       // No await between checking a live request and replying to its exact RPC id.
       assertActiveTurn(threadId, turnId);
       if (approvals.get(rpcKey(requestId)) !== approval) throw new CodexAppServerError('CODEX_APPROVAL_MISMATCH', 'approval was resolved');
+      if (decision === 'accept' || (approval.kind === 'userInput' && decision !== 'cancel')) assertCwdHandoff();
       write({ id: requestId, result });
       approval.status = 'submitted';
       approval.params = redactMcpUrlInteraction(approval).params;

package/lib/web/codex-sessions.mjs

@@ -8,7 +8,14 @@ import { childSessionEnv } from '../core/sessions/launch.mjs';
 import { createCodexAppServer } from './codex-app-server.mjs';
 import { waitForLiveProcessIdentity } from '../process/identity.mjs';
 import { createScopedMcpConfig } from '../mcp/scope.mjs';
-import { sameSelectedCwdIdentity } from '../process/selected-cwd-identity.mjs';
+import { assertSelectedCwdSnapshot,
+  sameSelectedCwdIdentity } from '../process/selected-cwd-identity.mjs';
+import { selectedCodexRootSnapshot, readCodexThreadRootBindings,
+  assertCodexThreadRoot, recordCodexThreadRoot } from '../core/sessions/codex-thread-root.mjs';
+
+function selectedRootSnapshot(pctx) {
+  return selectedCodexRootSnapshot(pctx.root, pctx.rootIdentity);
+}
 
 // Each structured session owns one executor. Existing TUI sessions are never
 // silently resumed here: provider identity and live-owner evidence fence that.
@@ -21,7 +28,35 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
 
   function assertSelectedProject(pctx) {
     if (isStopping()) throw new CliError('RUNTIME_STOPPING', 'Web runtime is stopping');
-    pctx.rootIdentity?.assertUnchanged();
+    if (typeof pctx.rootIdentity?.assertUnchanged === 'function') pctx.rootIdentity.assertUnchanged();
+    else if (pctx.rootIdentity) assertSelectedCwdSnapshot(pctx.rootIdentity);
+  }
+
+  function assertRecordedThreadRoot(pctx, threadId, knownBindings = null) {
+    assertSelectedProject(pctx);
+    let original;
+    if (knownBindings) original = assertCodexThreadRoot(null, threadId, selectedRootSnapshot(pctx), knownBindings);
+    else {
+      const db = connectWebProject(pctx);
+      try { original = assertCodexThreadRoot(db, threadId, selectedRootSnapshot(pctx)); }
+      finally { db.close(); }
+    }
+    assertSelectedProject(pctx);
+    return original;
+  }
+
+  function recordThreadRoot(pctx, threadId, snapshot, origin) {
+    threadIdentifier(threadId);
+    assertSelectedCwdSnapshot(snapshot);
+    assertSelectedProject(pctx);
+    const db = connectWebProject(pctx);
+    try {
+      tx(db, () => {
+        assertSelectedCwdSnapshot(snapshot);
+        recordCodexThreadRoot(db, addEvent, threadId, snapshot, origin);
+      });
+    } finally { db.close(); }
+    assertSelectedCwdSnapshot(snapshot);
   }
 
   function managedSessionMatchesProject(session, pctx) {
@@ -47,6 +82,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     const pctx = input.projectCtx;
     assertSelectedProject(pctx);
     const cwd = pctx.root;
+    const selectedRoot = selectedRootSnapshot(pctx);
     const mode = input.mode || 'new';
     if (!['new', 'resume'].includes(mode)) throw new CliError('BAD_REQUEST', 'App Server supports new or explicit resume');
     const threadId = mode === 'resume' ? String(input.resume || '').trim() : null;
@@ -75,6 +111,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
           previousPeer = owner.id;
         }
         if (bindings.length > 1) throw new CliError('THREAD_IN_USE', 'Provider thread has ambiguous peer ownership');
+        assertRecordedThreadRoot(pctx, threadId);
       }
     } finally { db.close(); }
     startingThreads.add(reservation);
@@ -88,7 +125,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     let closeScheduled = false;
     let adapter;
     let ownerIdentity = null;
-    try { adapter = adapterFactory({ cwd, expectedCwdIdentity: pctx.rootIdentity || pctx.initialRootIdentity,
+    try { adapter = adapterFactory({ cwd, expectedCwdIdentity: pctx.rootIdentity || selectedRoot,
       changeView: true, env: childSessionEnv({
       HCC_PEER: id, HCC_ROOT: pctx.root, HCC_DB: pctx.dbPath, HCC_SHIM_NO_ATTACH: '1'
     }, process.env, { rootIdentity: pctx.rootIdentity || pctx.initialRootIdentity }), async onSpawn({ pid, executorId }) {
@@ -97,7 +134,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       assertSelectedProject(pctx);
       ownerIdentity = owner.identity;
       session.mcpCapability = mcpConfigFactory({ root: pctx.root, dbPath: pctx.dbPath,
-        peer: id, executorId, ownerIdentity,
+        peer: id, executorId, ownerIdentity, rootIdentity: pctx.rootIdentity || selectedRoot,
         binding: { transport: 'app-server', runtimeSessionId: id } });
       return { mcp_servers: { hello_cc_scoped: session.mcpCapability.config } };
     }, onChange(state, event, metadata) {
@@ -127,6 +164,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       if (threadId) {
         const source = await adapter.peekThread(threadId);
         assertProjectThread(pctx, source.thread, threadId);
+        assertRecordedThreadRoot(pctx, threadId);
       }
       assertSelectedProject(pctx);
       const response = threadId ? await adapter.resumeThread(threadId, params) : await adapter.startThread(params);
@@ -134,6 +172,8 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       const thread = response.thread;
       if (!thread?.id) throw new CliError('CODEX_PROTOCOL_ERROR', 'App Server returned no thread identity');
       if (threadId && thread.id !== threadId) throw new CliError('CODEX_PROTOCOL_ERROR', 'Resumed thread identity changed');
+      assertSelectedCwdSnapshot(selectedRoot);
+      if (!threadId) recordThreadRoot(pctx, thread.id, selectedRoot, 'new');
       const executorState = adapter.snapshot();
       if (executorState.status !== 'ready' || executorState.processExited) {
         throw new CliError('CODEX_DISCONNECTED', 'Executor disconnected while opening its thread; no session was registered');
@@ -233,7 +273,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     broadcast(session, { type: 'exit', event: { reason: 'executor stopped' } });
     closeSessionClients(session);
   }
-  function assertProjectThread(pctx, thread, expectedId = null) {
+  function assertThreadPath(pctx, thread, expectedId = null) {
     assertSelectedProject(pctx);
     let matches = false;
     try { matches = typeof thread?.cwd === 'string' && fs.realpathSync(thread.cwd) === fs.realpathSync(pctx.root); } catch {}
@@ -244,6 +284,12 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     return thread;
   }
 
+  function assertProjectThread(pctx, thread, expectedId = null, knownBindings = null) {
+    assertThreadPath(pctx, thread, expectedId);
+    assertRecordedThreadRoot(pctx, thread.id, knownBindings);
+    return thread;
+  }
+
   function threadIdentifier(value) {
     if (typeof value !== 'string' || !value.trim() || value.length > 512 || /[\r\n\0]/.test(value)) {
       throw new CliError('BAD_REQUEST', 'A bounded thread identity is required');
@@ -253,18 +299,22 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
 
   async function withHistoryAdapter(pctx, action, fresh = false) {
     assertSelectedProject(pctx);
+    const selectedRoot = selectedRootSnapshot(pctx);
     const managed = !fresh && [...sessions.values()].find(session => session.type === 'app-server' &&
       managedSessionMatchesProject(session, pctx) && session.status === 'running' && session.adapter.snapshot().status === 'ready');
     if (managed) {
       const result = await action(managed.adapter);
+      assertSelectedCwdSnapshot(selectedRoot);
       assertSelectedProject(pctx);
       return result;
     }
     const adapter = adapterFactory({ cwd: pctx.root,
+      expectedCwdIdentity: pctx.rootIdentity || selectedRoot,
       env: childSessionEnv({ HCC_ROOT: pctx.root, HCC_DB: pctx.dbPath, HCC_SHIM_NO_ATTACH: '1' },
         process.env, { rootIdentity: pctx.rootIdentity || pctx.initialRootIdentity }) });
     try {
       const result = await action(adapter);
+      assertSelectedCwdSnapshot(selectedRoot);
       assertSelectedProject(pctx);
       return result;
     } finally {
@@ -283,10 +333,17 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
     }
     const result = await withHistoryAdapter(pctx, adapter => adapter.listThreads({ cwd: pctx.root, limit, cursor }));
     assertSelectedProject(pctx);
+    const db = connectWebProject(pctx);
+    let knownBindings;
+    try { knownBindings = readCodexThreadRootBindings(db); }
+    finally { db.close(); }
+    let unverifiedCount = 0;
     const threads = (result.data || []).filter(thread => {
-      try { assertProjectThread(pctx, thread); return true; }
+      try { assertProjectThread(pctx, thread, null, knownBindings); return true; }
       catch (error) {
         if (error?.code === 'PROJECT_PATH_CHANGED') throw error;
+        if (error?.code === 'CODEX_HISTORY_UNVERIFIED' || error?.code === 'CODEX_HISTORY_BINDING_INVALID') unverifiedCount += 1;
+        else if (error?.code !== 'PROJECT_PATH_FORBIDDEN') throw error;
         return false;
       }
     }).map(thread => {
@@ -295,11 +352,12 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       return { ...thread, managedSessionId: managed?.id || null };
     });
     assertSelectedProject(pctx);
-    return { threads, nextCursor: result.nextCursor || null };
+    return { threads, nextCursor: result.nextCursor || null, unverifiedCount };
   }
 
   async function readCodexThread(pctx, threadId) {
     threadIdentifier(threadId);
+    assertRecordedThreadRoot(pctx, threadId);
     const result = await withHistoryAdapter(pctx, adapter => adapter.peekThread(threadId));
     return { thread: assertProjectThread(pctx, result.thread, threadId) };
   }
@@ -313,6 +371,7 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       if (!['confirmed', 'lastTurnId', 'action_token', 'actionToken', 'epoch', 'authorizeMutation'].includes(key)) throw new CliError('BAD_REQUEST', `Unsupported history fork option: ${key}`);
     }
     if (input.lastTurnId !== undefined) threadIdentifier(input.lastTurnId);
+    assertRecordedThreadRoot(pctx, threadId);
     // Fork on a temporary executor and close it before resume. A live source
     // keeps its process and active turn; the new thread has one managed owner.
     const result = await withHistoryAdapter(pctx, async adapter => {
@@ -320,8 +379,9 @@ export function createCodexSessions({ sessions, sessionKey, nextProjectSessionId
       assertProjectThread(pctx, source.thread, threadId);
       assertSelectedProject(pctx);
       const forked = await adapter.forkThread(threadId, input.lastTurnId ? { lastTurnId: input.lastTurnId } : {}, input.authorizeMutation);
-      assertProjectThread(pctx, forked.thread);
+      assertThreadPath(pctx, forked.thread);
       if (forked.thread.id === threadId) throw new CliError('CODEX_PROTOCOL_ERROR', 'Fork did not create a new thread');
+      recordThreadRoot(pctx, forked.thread.id, selectedRootSnapshot(pctx), 'fork');
       return forked;
     }, true);
     try {