phewsh 0.15.0 → 0.15.2

package/commands/ai.js

@@ -7,6 +7,7 @@ const {
   buildHeaders, buildBody, getUrl, streamParser,
 } = require('../lib/providers');
 const { HARNESSES, detectInstalled, listHarnesses, runViaHarness } = require('../lib/harnesses');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 const INTENT_DIR = path.join(process.cwd(), '.intent');
@@ -15,8 +16,7 @@ const args = process.argv.slice(3);
 const subcommand = args[0];
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function loadIntentContext() {

package/commands/browse.js

@@ -4,6 +4,7 @@ const os = require('os');
 const {
   getProvider, buildHeaders, buildBody, getUrl, streamParser, detectProvider,
 } = require('../lib/providers');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 
@@ -17,8 +18,7 @@ const green = (s) => `\x1b[32m${s}\x1b[0m`;
 const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function resolveApiKey(config, provider) {

package/commands/clarify.js

@@ -8,6 +8,7 @@ const path = require('path');
 const os = require('os');
 const readline = require('readline');
 const { readPPS, writePPS, createPPS, generateViews } = require('../lib/pps');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 const INTENT_DIR = path.join(process.cwd(), '.intent');
@@ -18,8 +19,7 @@ const rawFromFlag = textFlag !== -1 ? args.slice(textFlag + 1).join(' ') : null;
 const isUpdate = args.includes('--update') || args.includes('-u');
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function getProjectName() {
@@ -110,6 +110,17 @@ function writeViews(intentDir, pps) {
 }
 
 async function main() {
+  // ESC backs out cleanly at any point — nothing half-written, no error.
+  if (process.stdin.isTTY) {
+    readline.emitKeypressEvents(process.stdin);
+    process.stdin.on('keypress', (str, key) => {
+      if (key && key.name === 'escape') {
+        console.log('\n\n  stopped — esc. Nothing changed.\n');
+        process.exit(0);
+      }
+    });
+  }
+
   if (args.includes('--help') || args.includes('-h')) {
     console.log(`
   😮‍💨🤫  phewsh clarify

package/commands/gate.js

@@ -6,6 +6,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const readline = require('readline');
+const configFile = require('../lib/config-file');
 
 const INTENT_DIR = path.join(process.cwd(), '.intent');
 const PROJECT_PATH = path.join(INTENT_DIR, 'project.json');
@@ -91,8 +92,7 @@ function saveGate(gate) {
 }
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function createPrompter() {

package/commands/intent.js

@@ -5,6 +5,7 @@ const { execSync } = require('child_process');
 const { createPPS, writePPS, generateViews } = require('../lib/pps');
 
 const os = require('os');
+const configFile = require('../lib/config-file');
 const args = process.argv.slice(3);
 const INTENT_DIR = path.join(process.cwd(), '.intent');
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
@@ -156,8 +157,7 @@ async function initIntent() {
 }
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function loadGate() {

package/commands/login.js

@@ -4,18 +4,17 @@ const readline = require('readline');
 const os = require('os');
 const crypto = require('crypto');
 const { sendOtp, verifyOtp, refreshSession } = require('../lib/supabase');
+const configFile = require('../lib/config-file');
 
 const CONFIG_DIR = path.join(os.homedir(), '.phewsh');
 const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function saveConfig(config) {
-  fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 function createPrompter() {

package/commands/mcp.js

@@ -13,6 +13,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const configFile = require('../lib/config-file');
 const { spawn } = require('child_process');
 
 const PHEWSH_DIR = path.join(os.homedir(), '.phewsh');
@@ -79,8 +80,8 @@ async function loadCloudProjects() {
   const configPath = path.join(PHEWSH_DIR, 'config.json');
   if (!fs.existsSync(configPath)) return [];
 
-  let config;
-  try { config = JSON.parse(fs.readFileSync(configPath, 'utf-8')); } catch { return []; }
+  const config = configFile.loadConfig(configPath);
+  if (!config) return [];
   if (!config?.supabaseAccessToken || !config?.supabaseUserId) return [];
 
   try {
@@ -92,7 +93,7 @@ async function loadCloudProjects() {
       if (session?.access_token) {
         config.supabaseAccessToken = session.access_token;
         config.supabaseRefreshToken = session.refresh_token;
-        fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+        configFile.saveConfig(configPath, config);
       }
     }
 

package/commands/serve.js

@@ -17,6 +17,8 @@ const crypto = require('crypto');
 const os = require('os');
 const path = require('path');
 const fs = require('fs');
+const { corsHeaders, isAllowedRequest } = require('../lib/cors');
+const configFile = require('../lib/config-file');
 
 const b = (s) => `\x1b[1m${s}\x1b[0m`;
 const g = (s) => `\x1b[90m${s}\x1b[0m`;
@@ -204,14 +206,14 @@ function parseBody(req) {
   });
 }
 
-function cors(res) {
-  res.setHeader('Access-Control-Allow-Origin', '*');
-  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+function cors(req, res) {
+  for (const [name, value] of Object.entries(corsHeaders(req))) {
+    res.setHeader(name, value);
+  }
 }
 
-function json(res, data, status = 200) {
-  cors(res);
+function json(req, res, data, status = 200) {
+  cors(req, res);
   res.writeHead(status, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify(data));
 }
@@ -221,12 +223,16 @@ function main() {
   const runtimes = detectRuntimes();
   const hasClaudeCode = runtimes.find(r => r.id === 'claude-code')?.connected;
 
-  const server = http.createServer(async (req, res) => {
+  const handleRequest = async (req, res) => {
     const url = new URL(req.url, `http://localhost:${port}`);
 
+    if (!isAllowedRequest(req)) {
+      return json(req, res, { error: 'Origin not allowed' }, 403);
+    }
+
     // CORS preflight
     if (req.method === 'OPTIONS') {
-      cors(res);
+      cors(req, res);
       res.writeHead(204);
       res.end();
       return;
@@ -234,7 +240,7 @@ function main() {
 
     // Health check
     if (url.pathname === '/health' && req.method === 'GET') {
-      return json(res, {
+      return json(req, res, {
         status: 'ok',
         runtimes: detectRuntimes(),
         version: require('../package.json').version,
@@ -249,7 +255,7 @@ function main() {
         const { actionId, runtimeId, packet } = body;
 
         if (!actionId || !runtimeId || !packet) {
-          return json(res, { error: 'Missing actionId, runtimeId, or packet' }, 400);
+          return json(req, res, { error: 'Missing actionId, runtimeId, or packet' }, 400);
         }
 
         const jobId = createJob(actionId, runtimeId, packet);
@@ -258,9 +264,9 @@ function main() {
         // Start execution in background
         executeJob(jobId);
 
-        return json(res, { jobId, status: 'queued' });
+        return json(req, res, { jobId, status: 'queued' });
       } catch (err) {
-        return json(res, { error: err.message }, 400);
+        return json(req, res, { error: err.message }, 400);
       }
     }
 
@@ -272,8 +278,7 @@ function main() {
         const { outcomeStats, pendingDecisions, bypassStats } = require('../lib/outcomes');
         const { listProjects } = require('../lib/projects-index');
 
-        let config = {};
-        try { config = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.phewsh', 'config.json'), 'utf-8')) || {}; } catch { /* none */ }
+        const config = configFile.loadConfig(path.join(os.homedir(), '.phewsh', 'config.json'), {});
 
         const harnessList = listHarnesses().map(h => ({
           id: h.id, label: h.label, role: h.role, installed: h.installed, headless: h.headless,
@@ -290,7 +295,7 @@ function main() {
         const intentFiles = ['vision.md', 'plan.md', 'next.md']
           .filter(f => fs.existsSync(path.join(process.cwd(), '.intent', f)));
 
-        return json(res, {
+        return json(req, res, {
           project: { name: path.basename(process.cwd()), cwd: process.cwd(), intentFiles },
           route: routeId === 'api'
             ? { id: 'api', label: `API (${config.provider || 'anthropic'} key)` }
@@ -305,7 +310,7 @@ function main() {
           version: require('../package.json').version,
         });
       } catch (err) {
-        return json(res, { error: err.message }, 500);
+        return json(req, res, { error: err.message }, 500);
       }
     }
 
@@ -315,7 +320,7 @@ function main() {
     if (url.pathname === '/receipts' && req.method === 'GET') {
       const limit = Math.min(parseInt(url.searchParams.get('limit') || '50', 10), 200);
       const project = url.searchParams.get('project') || null;
-      return json(res, gatherReceipts({ project, limit }));
+      return json(req, res, gatherReceipts({ project, limit }));
     }
 
     // Check job status
@@ -323,8 +328,8 @@ function main() {
     if (statusMatch && req.method === 'GET') {
       const jobId = statusMatch[1];
       const job = jobs.get(jobId);
-      if (!job) return json(res, { error: 'Job not found' }, 404);
-      return json(res, {
+      if (!job) return json(req, res, { error: 'Job not found' }, 404);
+      return json(req, res, {
         jobId: job.jobId,
         status: job.status,
         statusText: job.statusText,
@@ -334,10 +339,16 @@ function main() {
     }
 
     // 404
-    json(res, { error: 'Not found' }, 404);
-  });
+    json(req, res, { error: 'Not found' }, 404);
+  };
+
+  const server = http.createServer(handleRequest);
+
+  server.listen(port, '127.0.0.1', () => {
+    const mirror = http.createServer(handleRequest);
+    mirror.on('error', () => { /* IPv6 unavailable or already bound */ });
+    mirror.listen(port, '::1');
 
-  server.listen(port, () => {
     console.log('');
     console.log(`  ${b(w('PHEWSH Serve'))} ${g('v' + require('../package.json').version)}`);
     console.log(`  ${g('Live execution bridge for phewsh.com/intent')}`);

package/commands/session.js

@@ -17,9 +17,11 @@ const intentDir = () => path.join(process.cwd(), '.intent');
 const { select, refreshSession: refreshSess } = require('../lib/supabase');
 const { readPPS } = require('../lib/pps');
 const { push, pull, ensureValidToken } = require('./sync');
-const { HARNESSES, listHarnesses, runViaHarness } = require('../lib/harnesses');
+const { HARNESSES, listHarnesses, runViaHarness, cancelActive } = require('../lib/harnesses');
 const { recordDecision, labelOutcome, pendingDecisions, outcomeStats, OUTCOMES } = require('../lib/outcomes');
 const { recordSessionEvent } = require('../lib/receipts-data');
+const configFile = require('../lib/config-file');
+const { createFailureTracker, createLineDispatcher } = require('../lib/session-input');
 const { recordProject, listProjects, scanForProjects, fmtAgo } = require('../lib/projects-index');
 
 // Brand palette shortcuts
@@ -152,13 +154,11 @@ const INTENT_MODES = {
 };
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function saveConfig(config) {
-  fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 function loadIntentContext() {
@@ -198,21 +198,28 @@ function buildHarnessPrompt(messages, input) {
   return `Conversation so far:\n\n${transcript}\n\n---\n\nUser: ${input}\n\nRespond to the last user message.`;
 }
 
-async function streamChat(apiKey, messages, systemPrompt, modelId) {
+async function streamChat(apiKey, messages, systemPrompt, modelId, opts = {}) {
   const body = { model: modelId, max_tokens: 2048, messages, stream: true };
   if (systemPrompt) body.system = systemPrompt;
 
   const spin = ui.spinner('thinking');
 
-  const response = await fetch('https://api.anthropic.com/v1/messages', {
-    method: 'POST',
-    headers: {
-      'x-api-key': apiKey,
-      'anthropic-version': '2023-06-01',
-      'content-type': 'application/json',
-    },
-    body: JSON.stringify(body),
-  });
+  let response;
+  try {
+    response = await fetch('https://api.anthropic.com/v1/messages', {
+      method: 'POST',
+      headers: {
+        'x-api-key': apiKey,
+        'anthropic-version': '2023-06-01',
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify(body),
+      signal: opts.signal,
+    });
+  } catch (err) {
+    spin.stop();
+    throw err;
+  }
 
   if (!response.ok) {
     spin.stop();
@@ -484,6 +491,8 @@ async function main() {
 
   // ── Turn runners — every route records a decision, leaves a receipt ────
   // Both return true on success so the fallback flow can chain them.
+  const failureTracker = createFailureTracker();
+  let lastTurnFailure = null;
 
   async function runHarnessTurn(input, harnessId, fullSystem) {
     const decisionId = recordDecision({
@@ -491,22 +500,34 @@ async function main() {
     });
     decisionsThisSession++;
     try {
+      turnInFlight = true;
       const output = await runViaHarness(harnessId, fullSystem, buildHarnessPrompt(messages, input), { model: harnessModel });
+      turnInFlight = false;
       messages.push({ role: 'user', content: input });
       messages.push({ role: 'assistant', content: (output || '').trim() });
       recordSessionEvent(harnessId, projectName, 'task_complete', {
         taskId: decisionId, success: true, summary: input.slice(0, 140),
       });
+      lastTurnFailure = null;
       awaitingOutcome = decisionId;
       console.log(slate(`  via ${HARNESSES[harnessId].label} · outcome? 1 kept · 2 reverted · 3 superseded · 4 failed · or keep typing`));
       return true;
     } catch (err) {
+      turnInFlight = false;
+      if (userCancelled) {
+        userCancelled = false;
+        console.log(`\n  ${slate('cancelled — esc')}`);
+        return true; // user's call, not a failure: no fallback offer
+      }
       try { labelOutcome(decisionId, 'failed'); } catch { /* keep going */ }
       recordSessionEvent(harnessId, projectName, 'task_complete', {
         taskId: decisionId, success: false, summary: input.slice(0, 140),
       });
-      const limitHit = /limit|quota|rate|usage|exhaust/i.test(err.message);
-      console.error(`\n  ${ember('!')} ${cream(HARNESSES[harnessId].label)} ${sage(limitHit ? 'hit a usage wall' : 'failed')}${slate(' — ' + err.message.split('\n')[0])}`);
+      const failure = failureTracker.classify(harnessId, err.message);
+      lastTurnFailure = { ...failure, harnessId };
+      if (!failure.duplicate) {
+        console.error(`\n  ${ember('!')} ${cream(HARNESSES[harnessId].label)} ${sage(failure.kind === 'usage-limit' ? 'hit a usage wall' : 'failed')}${slate(' — ' + err.message.split('\n')[0])}`);
+      }
       return false;
     }
   }
@@ -519,7 +540,11 @@ async function main() {
     messages.push({ role: 'user', content: input });
     console.log('');
     try {
-      const result = await streamChat(config.apiKey, messages, fullSystem, modelId(currentModel));
+      turnInFlight = true;
+      turnAbort = new AbortController();
+      const result = await streamChat(config.apiKey, messages, fullSystem, modelId(currentModel), { signal: turnAbort.signal });
+      turnInFlight = false;
+      turnAbort = null;
       messages.push({ role: 'assistant', content: result.content });
       if (result.promptTokens) totalPromptTokens += result.promptTokens;
       if (result.completionTokens) totalCompletionTokens += result.completionTokens;
@@ -537,6 +562,14 @@ async function main() {
       });
       return true;
     } catch (err) {
+      turnInFlight = false;
+      turnAbort = null;
+      if (userCancelled || err.name === 'AbortError') {
+        userCancelled = false;
+        messages.pop();
+        console.log(`\n  ${slate('cancelled — esc')}`);
+        return true; // user's call, not a failure: no fallback offer
+      }
       try { labelOutcome(decisionId, 'failed'); } catch { /* keep going */ }
       messages.pop();
       console.error(`\n  ${ember('!')} ${sage('API route failed')}${slate(' — ' + err.message.split('\n')[0])}`);
@@ -547,10 +580,17 @@ async function main() {
   // Fallbacks are a first-class flow: the route changes, the context and
   // record do not. Ask by default; auto-switch only if setup said so.
   async function offerFallbacks(input, fullSystem, failedId) {
+    if (lastTurnFailure?.duplicate && lastTurnFailure.harnessId === failedId) {
+      return;
+    }
+
     const options = harnesses
       .filter(h => h.installed && h.headless && h.id !== failedId)
       .map(h => h.id);
     if (config?.apiKey && failedId !== 'api') options.push('api');
+    if (lastTurnFailure?.kind === 'usage-limit' && lastTurnFailure.harnessId === failedId) {
+      options.push(failedId);
+    }
 
     if (options.length === 0) {
       console.log(`  ${sage('No fallback ready.')} ${slate('Install Codex or Gemini, or add an API key with /key — context would travel automatically.')}`);
@@ -571,8 +611,14 @@ async function main() {
     }
 
     const list = options.map((id, i) =>
-      `${teal(String(i + 1))} ${sage(id === 'api' ? 'direct API (your key)' : HARNESSES[id].label)}`
+      `${teal(String(i + 1))} ${sage(id === 'api'
+        ? 'direct API (your key)'
+        : id === failedId ? HARNESSES[id].label + ' (retry once)' : HARNESSES[id].label)}`
     ).join(slate(' · '));
+    if (lastTurnFailure?.kind === 'usage-limit' && lastTurnFailure.harnessId === failedId) {
+      const codexReady = options.includes('codex');
+      console.log(`  ${sage(codexReady ? '/use codex switches the session now, or retry Claude once below.' : 'You can retry this route once below, or /use another installed route.')}`);
+    }
     console.log(`  ${sage('Retry with your context intact:')} ${list} ${slate('· enter = skip')}`);
     console.log(`  ${slate('prefer auto-switching? phewsh setup sets it once')}`);
     awaitingFallback = { input, fullSystem, options };
@@ -586,23 +632,65 @@ async function main() {
     historySize: 100,
   });
 
-  // Live input coloring: slash commands render teal, @mentions peach, as
-  // you type — same signal Claude Code gives. TTY-only, fail-soft: if the
-  // private readline API ever changes, input falls back to plain.
+  // Live input coloring — like Claude Code: text stays normal, and only a
+  // RECOGNIZED leading /command (or @harness) token turns teal (peach for @)
+  // so you know it registered. Arguments stay plain. TTY-only, fail-soft.
+  const KNOWN_COMMANDS = new Set([
+    'quit', 'exit', 'q', 'help', 'h', 'init', 'intent', 'clarify', 'model',
+    'models', 'council', 'all', 'provider', 'route', 'use', 'work', 'run',
+    'clear', 'status', 'key', 'login', 'export', 'push', 'pull', 'serve',
+    'sync', 'harnesses', 'fallback', 'outcomes', 'tour', 'update', 'upgrade',
+    'agents', 'context', 'gate', 'reload', 'sequence', 'setup', 'system', 'watch',
+  ]);
+  const installedIds = harnesses.filter(h => h.installed).map(h => h.id);
+  let turnAbort = null;       // AbortController while an API turn streams
+  let turnInFlight = false;   // any route — ESC cancels
+  let userCancelled = false;  // distinguishes esc from real failures
+
+  function colorizeInput(cur) {
+    const tok = cur.slice(1).split(/\s/)[0].toLowerCase();
+    if (!tok) return null;
+    if (cur[0] === '/' && KNOWN_COMMANDS.has(tok)) {
+      return `\x1b[38;5;79m/${cur.slice(1, 1 + tok.length)}\x1b[0m${cur.slice(1 + tok.length)}`;
+    }
+    if (cur[0] === '@' && installedIds.some(id => id === tok || id.startsWith(tok))) {
+      return `\x1b[38;5;216m@${cur.slice(1, 1 + tok.length)}\x1b[0m${cur.slice(1 + tok.length)}`;
+    }
+    return null;
+  }
+
   if (process.stdout.isTTY && typeof rl._writeToOutput === 'function') {
     const origWrite = rl._writeToOutput.bind(rl);
     rl._writeToOutput = function (s) {
       try {
         const cur = rl.line || '';
-        if ((cur[0] === '/' || cur[0] === '@') && typeof s === 'string' && s.includes(cur)) {
-          const c = cur[0] === '/' ? '\x1b[38;5;79m' : '\x1b[38;5;216m';
-          s = s.split(cur).join(c + cur + '\x1b[0m');
+        if (typeof s === 'string' && cur && s.includes(cur)) {
+          const colored = colorizeInput(cur);
+          if (colored) s = s.split(cur).join(colored);
         }
       } catch { /* never break input */ }
       origWrite(s);
     };
-    process.stdin.on('keypress', () => {
+  }
+
+  if (process.stdin.isTTY) {
+    process.stdin.on('keypress', (str, key) => {
       try {
+        // ESC: cancel an in-flight turn, or clear the input line.
+        if (key && key.name === 'escape') {
+          if (turnInFlight) {
+            userCancelled = true;
+            if (turnAbort) turnAbort.abort();
+            cancelActive();
+          } else if (rl.line) {
+            rl.line = '';
+            rl.cursor = 0;
+            rl._refreshLine();
+          }
+          return;
+        }
+        // Re-render so token coloring tracks edits (and un-colors when it
+        // stops matching a known command).
         const cur = rl.line || '';
         if (cur[0] === '/' || cur[0] === '@') rl._refreshLine();
       } catch { /* never break input */ }
@@ -611,13 +699,7 @@ async function main() {
 
   rl.prompt();
 
-  rl.on('line', async (line) => {
-    const input = line.trim();
-
-    if (!input) {
-      rl.prompt();
-      return;
-    }
+  async function handleInput(input) {
 
     // A bare number right after a route failure picks the fallback
     if (awaitingFallback) {
@@ -789,6 +871,7 @@ async function main() {
         console.log(`  ${cream('session')}`);
         console.log(`    ${teal('/work')} ${slate('[harness]')} ${sage('Hand off to interactive Claude Code/Codex — outcome on return')}`);
         console.log(`    ${teal('/run')} ${slate('<prompt>')} ${sage('One-shot prompt (no history)')}`);
+        console.log(`    ${teal('esc')}          ${sage('Cancel a running turn · clear the input line')}`);
         console.log(`    ${teal('/clear')}       ${sage('Clear conversation')}`);
         console.log(`    ${teal('/status')}      ${sage('Session stats')}`);
         console.log(`    ${teal('/quit')}        ${sage('Exit')}`);
@@ -1136,11 +1219,24 @@ async function main() {
         ui.divider('line');
         if (route?.type === 'harness') {
           const h = HARNESSES[route.id];
-          console.log(`  ${b(cream('Models'))} ${sage('— ' + h.label + ' owns its own model list')}`);
+          console.log(`  ${b(cream('Models'))} ${sage('— via ' + h.label)}`);
           ui.divider('line');
-          console.log(`  ${sage('Current preference:')} ${cream(harnessModel || h.label + ' default')}`);
-          console.log(`  ${sage('Set one with')} ${cream('/model <anything ' + h.label + ' accepts>')} ${slate('— it validates, not phewsh')}`);
-          console.log(`  ${slate('shortcuts that work for Claude Code: sonnet · opus · haiku · fable · any full model id')}`);
+          if (h.modelHints) {
+            // Aliases the harness resolves to its own current versions —
+            // stable names, so this list can't go stale.
+            console.log(`    ${cream('default'.padEnd(12))} ${sage(h.label + "'s own default")}${!harnessModel ? ` ${teal('●')}` : ''}`);
+            h.modelHints.forEach(m => {
+              const active = harnessModel === m ? ` ${teal('●')}` : '';
+              console.log(`    ${cream(m.padEnd(12))} ${sage('latest ' + m.charAt(0).toUpperCase() + m.slice(1))}${active}`);
+            });
+            if (harnessModel && !h.modelHints.includes(harnessModel)) {
+              console.log(`    ${cream(harnessModel.padEnd(12))} ${sage('(pass-through)')} ${teal('●')}`);
+            }
+            console.log(`\n  ${sage('Switch:')} ${cream('/model <name>')} ${slate('— any full model id also works; ' + h.label + ' validates')}`);
+          } else {
+            console.log(`  ${sage('Current preference:')} ${cream(harnessModel || h.label + ' default')}`);
+            console.log(`  ${sage(h.label + ' owns its model list —')} ${cream('/model <anything it accepts>')} ${slate('passes through; it validates')}`);
+          }
           console.log('');
           rl.prompt();
           return;
@@ -1230,6 +1326,15 @@ async function main() {
         const artifacts = ['vision', 'plan', 'next', 'status'];
         const intentDir = path.join(process.cwd(), '.intent');
 
+        // Full markdown render — **bold**, *italic*, `code`, [links] become
+        // terminal formatting, not literal symbols. `base` keeps the line's
+        // color after each inline reset.
+        const inlineMd = (t, base) => t
+          .replace(/\*\*([^*]+)\*\*/g, (_, x) => `\x1b[1m\x1b[38;5;230m${x}\x1b[0m${base}`)
+          .replace(/(^|\W)\*([^*\n]+)\*(?=\W|$)/g, (_, p, x) => `${p}\x1b[3m${x}\x1b[23m`)
+          .replace(/`([^`]+)`/g, (_, x) => `\x1b[38;5;79m${x}\x1b[0m${base}`)
+          .replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, x, u) => `\x1b[4m\x1b[38;5;79m${x}\x1b[0m${base} \x1b[2m(${u})\x1b[22m`);
+        const C = { sage: '\x1b[38;5;151m', slate: '\x1b[38;5;247m' };
         const renderMd = (raw) => {
           let body = raw;
           if (body.startsWith('---')) {
@@ -1237,11 +1342,12 @@ async function main() {
             if (end !== -1) body = body.slice(end + 4);
           }
           return body.trim().split('\n').map(l => {
-            if (/^#{1,2}\s/.test(l)) return `  ${b(teal(l.replace(/^#+\s*/, '')))}`;
-            if (/^#{3,}\s/.test(l)) return `  ${cream(l.replace(/^#+\s*/, ''))}`;
-            if (/^\s*[-*]\s/.test(l)) return `    ${teal('·')} ${sage(l.replace(/^\s*[-*]\s*/, ''))}`;
-            if (/^\s*\d+\.\s/.test(l)) return `    ${sage(l.trim())}`;
-            return `  ${slate(l)}`;
+            if (/^#{1,2}\s/.test(l)) return `\n  ${b(teal(inlineMd(l.replace(/^#+\s*/, ''), '')))}`;
+            if (/^#{3,}\s/.test(l)) return `  ${cream(inlineMd(l.replace(/^#+\s*/, ''), ''))}`;
+            if (/^\s*[-*]\s/.test(l)) return `    ${teal('·')} ${C.sage}${inlineMd(l.replace(/^\s*[-*]\s*/, ''), C.sage)}\x1b[0m`;
+            if (/^\s*\d+\.\s/.test(l)) return `    ${C.sage}${inlineMd(l.trim(), C.sage)}\x1b[0m`;
+            if (/^---+\s*$/.test(l)) return `  ${slate('─'.repeat(40))}`;
+            return `  ${C.slate}${inlineMd(l, C.slate)}\x1b[0m`;
           }).join('\n');
         };
 
@@ -1353,9 +1459,17 @@ async function main() {
         console.log(`  ${slate(members.map(m => m.label).join(' · '))}`);
 
         const prompt = buildHarnessPrompt(messages, cmdArg);
+        turnInFlight = true;
         const settled = await Promise.allSettled(members.map(m =>
           runViaHarness(m.id, councilSystem, prompt, { quiet: true })
         ));
+        turnInFlight = false;
+        if (userCancelled) {
+          userCancelled = false;
+          console.log(`\n  ${slate('council cancelled — esc')}\n`);
+          rl.prompt();
+          return;
+        }
 
         const answers = [];
         settled.forEach((r, i) => {
@@ -1446,8 +1560,11 @@ async function main() {
           if (!config?.apiKey) {
             console.log(`  ${ember('!')} ${sage('No API key set — run /key first.')}`);
           } else {
+            config = loadConfig() || {};
+            config.defaultRoute = 'api';
+            saveConfig(config);
             route = { type: 'api' };
-            console.log(`  ${teal('●')} ${sage('Routing via')} ${cream(routeLabel(route, config))}`);
+            console.log(`  ${teal('●')} ${sage('Default route:')} ${cream(routeLabel(route, config))}`);
           }
         } else if (HARNESSES[target]) {
           if (!harnesses.find(h => h.id === target)?.installed) {
@@ -1455,13 +1572,15 @@ async function main() {
           } else if (!HARNESSES[target].args) {
             console.log(`  ${sage(HARNESSES[target].label + ' is interactive-only — drop into it with')} ${cream('/work ' + target)} ${sage('(phewsh records the outcome when you return)')}`);
           } else {
+            config = loadConfig() || {};
+            config.defaultRoute = target;
+            saveConfig(config);
             route = { type: 'harness', id: target };
-            console.log(`  ${teal('●')} ${sage('Routing via')} ${cream(routeLabel(route, config))} ${slate('— no API key, your subscription')}`);
+            console.log(`  ${teal('●')} ${sage('Default route:')} ${cream(routeLabel(route, config))} ${slate('— saved across sessions')}`);
           }
         } else {
           console.log(`  ${sage('Unknown route. Options:')} ${cream(Object.keys(HARNESSES).join(', ') + ', api')}`);
         }
-        console.log(`  ${slate('make it stick across sessions: phewsh setup')}`);
         rl.prompt();
         return;
       }
@@ -1705,9 +1824,19 @@ async function main() {
 
     console.log('');
     rl.prompt();
+  }
+
+  const lineDispatcher = createLineDispatcher(handleInput, {
+    onNoop: () => rl.prompt(),
+    onError: (err) => {
+      console.error(`\n  ${ember('!')} ${sage('Input failed:')} ${err.message}`);
+      rl.prompt();
+    },
   });
+  rl.on('line', lineDispatcher.push);
 
-  rl.on('close', () => {
+  rl.on('close', async () => {
+    await lineDispatcher.drain();
     console.log(`\n  ${sage('session ended')}\n`);
     process.exit(0);
   });

package/commands/setup.js

@@ -10,6 +10,7 @@ const os = require('os');
 const readline = require('readline');
 const ui = require('../lib/ui');
 const { HARNESSES, listHarnesses } = require('../lib/harnesses');
+const configFile = require('../lib/config-file');
 
 const { b, teal, sage, slate, cream, ember, green } = ui;
 
@@ -17,12 +18,11 @@ const CONFIG_DIR = path.join(os.homedir(), '.phewsh');
 const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
 
 function loadConfig() {
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return {}; }
+  return configFile.loadConfig(CONFIG_PATH, {});
 }
 
 function saveConfig(config) {
-  fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 function ask(rl, prompt) {
@@ -58,10 +58,19 @@ module.exports = async function setup() {
   console.log('');
 
   // Agent-run (no TTY): auto-configure instead of asking questions nobody
-  // can answer. Pick the first installed harness; humans can change it later.
+  // can answer. Keep an existing valid route; otherwise pick the first
+  // installed harness.
   const chatCapable = installed.filter(h => h.headless);
   if (!process.stdin.isTTY) {
-    if (chatCapable.length > 0) {
+    const configuredHarness = chatCapable.find(h => h.id === config.defaultRoute);
+    if (configuredHarness) {
+      if (!config.fallback) config.fallback = 'ask';
+      saveConfig(config);
+      console.log(`  ${teal('●')} ${sage('Kept configured default route:')} ${cream(configuredHarness.label)} ${slate('— no API key needed')}`);
+    } else if (config.defaultRoute === 'api' && config.apiKey) {
+      saveConfig(config);
+      console.log(`  ${teal('●')} ${sage('Kept configured default route: API (existing key found)')}`);
+    } else if (chatCapable.length > 0) {
       config.defaultRoute = chatCapable[0].id;
       if (!config.fallback) config.fallback = 'ask';
       saveConfig(config);

package/commands/style.js

@@ -6,6 +6,7 @@ const path = require('path');
 const os = require('os');
 const readline = require('readline');
 const { select, upsert, SUPABASE_URL, SUPABASE_ANON_KEY } = require('../lib/supabase');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 const STYLE_CACHE_DIR = path.join(os.homedir(), '.phewsh', 'styletree');
@@ -18,7 +19,7 @@ const c = (s) => `\x1b[36m${s}\x1b[0m`;
 const y = (s) => `\x1b[33m${s}\x1b[0m`;
 
 function loadConfig() {
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function ask(rl, q) {

package/commands/sync.js

@@ -7,6 +7,7 @@ const os = require('os');
 const crypto = require('crypto');
 const { select, upsert, refreshSession } = require('../lib/supabase');
 const { readPPS, writePPS } = require('../lib/pps');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 const INTENT_DIR = path.join(process.cwd(), '.intent');
@@ -15,14 +16,11 @@ const FILE_TO_KIND = { 'vision.md': 'vision', 'plan.md': 'plan', 'next.md': 'nex
 const KIND_TO_FILE = { vision: 'vision.md', plan: 'plan.md', next: 'next.md' };
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function saveConfig(config) {
-  const dir = path.dirname(CONFIG_PATH);
-  fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 function genProjectId() {

package/commands/watch.js

@@ -13,6 +13,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const configFile = require('../lib/config-file');
 
 const INTENT_DIR = path.join(process.cwd(), '.intent');
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
@@ -38,14 +39,11 @@ const red = (s) => `\x1b[31m${s}\x1b[0m`;
 // ── Config + Auth ──────────────────────────────────────────────────────────
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function saveConfig(config) {
-  const dir = path.dirname(CONFIG_PATH);
-  fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 // ── Context Generation (mirrors context.js) ────────────────────────────────

package/lib/config-file.js

@@ -0,0 +1,36 @@
+const fs = require('fs');
+const path = require('path');
+
+function hardenConfigPath(configPath) {
+  const dir = path.dirname(configPath);
+  if (fs.existsSync(dir)) {
+    try { fs.chmodSync(dir, 0o700); } catch { /* best effort on non-POSIX filesystems */ }
+  }
+  if (fs.existsSync(configPath)) {
+    try { fs.chmodSync(configPath, 0o600); } catch { /* best effort on non-POSIX filesystems */ }
+  }
+}
+
+function loadConfig(configPath, fallback = null) {
+  if (!fs.existsSync(configPath)) return fallback;
+  hardenConfigPath(configPath);
+  try {
+    return JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+  } catch {
+    return fallback;
+  }
+}
+
+function saveConfig(configPath, config) {
+  const dir = path.dirname(configPath);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(dir, 0o700); } catch { /* best effort on non-POSIX filesystems */ }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(configPath, 0o600); } catch { /* existing files keep their prior mode */ }
+}
+
+module.exports = {
+  hardenConfigPath,
+  loadConfig,
+  saveConfig,
+};

package/lib/cors.js

@@ -0,0 +1,48 @@
+const DEFAULT_ALLOWED_ORIGINS = new Set([
+  'https://phewsh.com',
+  'https://www.phewsh.com',
+  'http://localhost:3000',
+  'http://127.0.0.1:3000',
+  'http://[::1]:3000',
+]);
+
+function allowedOrigins() {
+  const origins = new Set(DEFAULT_ALLOWED_ORIGINS);
+  for (const origin of (process.env.PHEWSH_ALLOWED_ORIGINS || '').split(',')) {
+    const trimmed = origin.trim();
+    if (trimmed) origins.add(trimmed);
+  }
+  return origins;
+}
+
+function requestOrigin(req) {
+  const origin = req.headers.origin;
+  return Array.isArray(origin) ? origin[0] : origin;
+}
+
+function isAllowedRequest(req) {
+  const origin = requestOrigin(req);
+  if (origin) return allowedOrigins().has(origin);
+
+  // CLI clients do not send browser fetch metadata. A browser can omit Origin
+  // on some cross-site requests, so reject those before they reach any route.
+  return req.headers['sec-fetch-site'] !== 'cross-site';
+}
+
+function corsHeaders(req) {
+  const origin = requestOrigin(req);
+  if (!origin || !allowedOrigins().has(origin)) return {};
+
+  return {
+    'Access-Control-Allow-Origin': origin,
+    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Phewsh-Runtime',
+    'Access-Control-Max-Age': '600',
+    Vary: 'Origin',
+  };
+}
+
+module.exports = {
+  corsHeaders,
+  isAllowedRequest,
+};

package/lib/harnesses.js

@@ -20,7 +20,7 @@ const { execSync, spawn } = require('child_process');
 // list of its own, so it can never go stale. Harnesses without a known
 // model flag ignore the preference and use their own config.
 const HARNESSES = {
-  'claude-code': { bin: 'claude',       label: 'Claude Code',  role: 'writes code',          auth: 'Claude subscription / Console', models: true, args: (p, m) => ['-p', p, '--output-format', 'text', ...(m ? ['--model', m] : [])] },
+  'claude-code': { bin: 'claude',       label: 'Claude Code',  role: 'writes code',          auth: 'Claude subscription / Console', models: true, modelHints: ['sonnet', 'opus', 'haiku', 'fable'], args: (p, m) => ['-p', p, '--output-format', 'text', ...(m ? ['--model', m] : [])] },
   'codex':       { bin: 'codex',        label: 'Codex CLI',    role: 'reasons & reviews',    auth: 'ChatGPT plan',                  models: true, args: (p, m) => ['exec', ...(m ? ['-m', m] : []), p] },
   'gemini':      { bin: 'gemini',       label: 'Gemini CLI',   role: "another model's take", auth: 'Google login',                  models: true, args: (p, m) => ['-p', p, ...(m ? ['-m', m] : [])] },
   'cursor':      { bin: 'cursor-agent', label: 'Cursor Agent', role: 'edits files',          auth: 'Cursor account',                models: true, args: (p, m) => ['-p', p, '--output-format', 'text', ...(m ? ['--model', m] : [])] },
@@ -36,6 +36,17 @@ const HARNESSES = {
   'droid':       { bin: 'droid',        label: 'Droid',        role: 'agentic coding',       auth: 'Factory account',               args: (p) => ['exec', p] },
 };
 
+// In-flight harness children — so ESC in the session can cancel a turn.
+const ACTIVE_CHILDREN = new Set();
+
+function cancelActive() {
+  let n = 0;
+  for (const c of ACTIVE_CHILDREN) {
+    try { c.kill('SIGTERM'); n++; } catch { /* already gone */ }
+  }
+  return n;
+}
+
 function isInstalled(id) {
   const h = HARNESSES[id];
   if (!h) return false;
@@ -68,6 +79,8 @@ function runViaHarness(id, systemPrompt, userPrompt, opts = {}) {
 
   return new Promise((resolve, reject) => {
     const child = spawn(h.bin, h.args(prompt, model), { stdio: ['pipe', 'pipe', 'pipe'] });
+    ACTIVE_CHILDREN.add(child);
+    child.on('close', () => ACTIVE_CHILDREN.delete(child));
     // Some harnesses (codex exec, gemini) wait for stdin EOF before running.
     child.stdin.end();
 
@@ -87,4 +100,4 @@ function runViaHarness(id, systemPrompt, userPrompt, opts = {}) {
   });
 }
 
-module.exports = { HARNESSES, isInstalled, detectInstalled, listHarnesses, runViaHarness };
+module.exports = { HARNESSES, isInstalled, detectInstalled, listHarnesses, runViaHarness, cancelActive };

package/lib/session-input.js

@@ -0,0 +1,67 @@
+function createLineDispatcher(handleInput, {
+  onError = (err) => { throw err; },
+  onNoop = () => {},
+  schedule = setImmediate,
+} = {}) {
+  let pendingLines = [];
+  let scheduled = false;
+  let chain = Promise.resolve();
+
+  function flush() {
+    scheduled = false;
+    const lines = pendingLines;
+    pendingLines = [];
+    const input = lines.join('\n').trim();
+    if (!input) {
+      onNoop();
+      return;
+    }
+    chain = chain.then(() => handleInput(input)).catch(onError);
+  }
+
+  function push(line) {
+    pendingLines.push(String(line));
+    if (scheduled) return;
+    scheduled = true;
+    schedule(flush);
+  }
+
+  async function drain() {
+    if (scheduled) flush();
+    await chain;
+  }
+
+  return { push, drain };
+}
+
+function createFailureTracker() {
+  const seen = new Map();
+
+  function classify(harnessId, message) {
+    const text = String(message || '').trim();
+    const firstLine = text.split('\n')[0].trim();
+    const isClaudeUsageLimit = harnessId === 'claude-code'
+      && /(usage|rate|session|weekly|monthly)?\s*(limit|quota)|exhaust|resets?\s/i.test(text);
+
+    if (!isClaudeUsageLimit) {
+      return { kind: 'failure', duplicate: false, key: null };
+    }
+
+    const normalized = text.toLowerCase().replace(/\s+/g, ' ').slice(0, 300);
+    const key = `${harnessId}:${normalized}`;
+    const count = (seen.get(key) || 0) + 1;
+    seen.set(key, count);
+    return {
+      kind: 'usage-limit',
+      duplicate: count > 1,
+      key,
+    };
+  }
+
+  return { classify };
+}
+
+module.exports = {
+  createFailureTracker,
+  createLineDispatcher,
+};

package/mcp/http-server.js

@@ -27,6 +27,7 @@ import { URL } from "url";
 
 import { readFileSync, readdirSync } from "fs";
 import { join } from "path";
+import corsPolicy from "../lib/cors.js";
 
 import {
   loadProjects, recordResult, recordSession, updateLocalStatusMd,
@@ -35,6 +36,8 @@ import {
 import * as runtimes from "./lib/runtime-registry.js";
 import * as queue from "./lib/dispatch-queue.js";
 
+const { corsHeaders, isAllowedRequest } = corsPolicy;
+
 // Version comes from the phewsh package this server ships inside — never hardcode it.
 const VERSION = (() => {
   try {
@@ -49,23 +52,16 @@ const DEFAULT_HOST = "127.0.0.1";
 
 // ─── HTTP helpers ───────────────────────────────────────────────────────────
 
-const CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-  "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Phewsh-Runtime",
-  "Access-Control-Max-Age": "600",
-};
-
-function json(res, status, body) {
+function json(req, res, status, body) {
   res.writeHead(status, {
     "Content-Type": "application/json",
-    ...CORS_HEADERS,
+    ...corsHeaders(req),
   });
   res.end(JSON.stringify(body));
 }
 
-function text(res, status, body) {
-  res.writeHead(status, { "Content-Type": "text/plain", ...CORS_HEADERS });
+function text(req, res, status, body) {
+  res.writeHead(status, { "Content-Type": "text/plain", ...corsHeaders(req) });
   res.end(body);
 }
 
@@ -85,7 +81,7 @@ async function readJsonBody(req) {
 
 function handleHealth(req, res) {
   const connected = runtimes.list();
-  json(res, 200, {
+  json(req, res, 200, {
     status: "ok",
     runtimes: connected,
     version: VERSION,
@@ -97,7 +93,7 @@ async function handleDispatch(req, res) {
   try {
     const body = await readJsonBody(req);
     if (!body.packet || !body.packet.objective) {
-      return json(res, 400, { error: "Missing packet.objective" });
+      return json(req, res, 400, { error: "Missing packet.objective" });
     }
 
     // Auto-register the target runtime as "expected" so /health reflects
@@ -122,26 +118,26 @@ async function handleDispatch(req, res) {
       taskSummary: body.packet?.objective?.task?.slice(0, 120),
     });
 
-    json(res, 200, { jobId: job.jobId, status: job.status });
+    json(req, res, 200, { jobId: job.jobId, status: job.status });
   } catch (err) {
-    json(res, 400, { error: err.message });
+    json(req, res, 400, { error: err.message });
   }
 }
 
-function handleStatus(res, jobId) {
+function handleStatus(req, res, jobId) {
   const job = queue.getStatus(jobId);
-  if (!job) return json(res, 404, { error: "Job not found" });
+  if (!job) return json(req, res, 404, { error: "Job not found" });
   const { packet, ...rest } = job;
-  json(res, 200, rest);
+  json(req, res, 200, rest);
 }
 
-function handleResult(res, jobId) {
+function handleResult(req, res, jobId) {
   const job = queue.getStatus(jobId);
-  if (!job) return json(res, 404, { error: "Job not found" });
+  if (!job) return json(req, res, 404, { error: "Job not found" });
   if (job.status !== "done" && job.status !== "error") {
-    return json(res, 202, { status: job.status, message: "Job not yet complete" });
+    return json(req, res, 202, { status: job.status, message: "Job not yet complete" });
   }
-  json(res, 200, {
+  json(req, res, 200, {
     jobId: job.jobId,
     status: job.status,
     result: job.result,
@@ -150,7 +146,7 @@ function handleResult(res, jobId) {
   });
 }
 
-function handleReceipts(res, url) {
+function handleReceipts(req, res, url) {
   // The merged proof trail: every claim an agent made, with the evidence file
   // behind it. Same data `phewsh receipts` shows in the terminal — exposed
   // here so the web app can render it.
@@ -213,13 +209,13 @@ function handleReceipts(res, url) {
     if (e.kind === "dispatch_enqueued") counts.dispatched++;
   }
 
-  json(res, 200, {
+  json(req, res, 200, {
     summary: { ...counts, totalEvents: filtered.length },
     events: filtered.slice(0, limit),
   });
 }
 
-function handleJobsList(res, url) {
+function handleJobsList(req, res, url) {
   const limit = Math.min(parseInt(url.searchParams.get("limit") || "50", 10), 200);
   const statusFilter = url.searchParams.get("status") || undefined;
   const jobs = queue.list({ limit, status: statusFilter }).map(j => {
@@ -229,20 +225,20 @@ function handleJobsList(res, url) {
       summary: packet?.objective?.task?.slice(0, 140) || null,
     };
   });
-  json(res, 200, { jobs });
+  json(req, res, 200, { jobs });
 }
 
-function handleNextForRuntime(res, url, req) {
+function handleNextForRuntime(req, res, url) {
   const runtimeId = url.searchParams.get("runtime") || req.headers["x-phewsh-runtime"];
-  if (!runtimeId) return json(res, 400, { error: "Missing ?runtime= or X-Phewsh-Runtime header" });
+  if (!runtimeId) return json(req, res, 400, { error: "Missing ?runtime= or X-Phewsh-Runtime header" });
 
   runtimes.register({ id: runtimeId, label: runtimeId, transport: "http" });
 
   const job = queue.nextForRuntime(runtimeId);
-  if (!job) return json(res, 204, null);
+  if (!job) return json(req, res, 204, null);
 
   queue.markExecuting(job.jobId, runtimeId, "Picked up by HTTP harness");
-  json(res, 200, { jobId: job.jobId, actionId: job.actionId, packet: job.packet });
+  json(req, res, 200, { jobId: job.jobId, actionId: job.actionId, packet: job.packet });
 }
 
 async function handleJobComplete(req, res, jobId) {
@@ -251,7 +247,7 @@ async function handleJobComplete(req, res, jobId) {
     const { success = true, result = "", issues, agentId, projectId } = body;
 
     const job = queue.getStatus(jobId);
-    if (!job) return json(res, 404, { error: "Job not found" });
+    if (!job) return json(req, res, 404, { error: "Job not found" });
 
     const updated = success
       ? queue.complete(jobId, result)
@@ -279,9 +275,9 @@ async function handleJobComplete(req, res, jobId) {
 
     if (agentId) runtimes.touch(agentId);
 
-    json(res, 200, { jobId, status: updated.status });
+    json(req, res, 200, { jobId, status: updated.status });
   } catch (err) {
-    json(res, 400, { error: err.message });
+    json(req, res, 400, { error: err.message });
   }
 }
 
@@ -289,8 +285,12 @@ async function handleJobComplete(req, res, jobId) {
 
 export function startHttpServer({ port = DEFAULT_PORT, host = DEFAULT_HOST } = {}) {
   const server = createServer(async (req, res) => {
+    if (!isAllowedRequest(req)) {
+      return json(req, res, 403, { error: "Origin not allowed" });
+    }
+
     if (req.method === "OPTIONS") {
-      res.writeHead(204, CORS_HEADERS);
+      res.writeHead(204, corsHeaders(req));
       return res.end();
     }
 
@@ -302,26 +302,26 @@ export function startHttpServer({ port = DEFAULT_PORT, host = DEFAULT_HOST } = {
       if (req.method === "POST" && pathname === "/dispatch") return await handleDispatch(req, res);
       if (req.method === "GET" && pathname.startsWith("/status/")) {
         const jobId = pathname.slice("/status/".length);
-        return handleStatus(res, jobId);
+        return handleStatus(req, res, jobId);
       }
       if (req.method === "GET" && pathname.startsWith("/result/")) {
         const jobId = pathname.slice("/result/".length);
-        return handleResult(res, jobId);
+        return handleResult(req, res, jobId);
       }
-      if (req.method === "GET" && pathname === "/jobs") return handleJobsList(res, url);
-      if (req.method === "GET" && pathname === "/receipts") return handleReceipts(res, url);
-      if (req.method === "GET" && pathname === "/next") return handleNextForRuntime(res, url, req);
+      if (req.method === "GET" && pathname === "/jobs") return handleJobsList(req, res, url);
+      if (req.method === "GET" && pathname === "/receipts") return handleReceipts(req, res, url);
+      if (req.method === "GET" && pathname === "/next") return handleNextForRuntime(req, res, url);
       if (req.method === "POST" && pathname.match(/^\/jobs\/[^/]+\/complete$/)) {
         const jobId = pathname.split("/")[2];
         return await handleJobComplete(req, res, jobId);
       }
       if (req.method === "GET" && pathname === "/") {
-        return text(res, 200, `PHEWSH MCP HTTP transport v${VERSION}\nEndpoints: /health /dispatch /status/:id /result/:id /jobs /receipts /next /jobs/:id/complete\n`);
+        return text(req, res, 200, `PHEWSH MCP HTTP transport v${VERSION}\nEndpoints: /health /dispatch /status/:id /result/:id /jobs /receipts /next /jobs/:id/complete\n`);
       }
-      return json(res, 404, { error: `No route for ${req.method} ${pathname}` });
+      return json(req, res, 404, { error: `No route for ${req.method} ${pathname}` });
     } catch (err) {
       console.error("[http]", err);
-      return json(res, 500, { error: err.message });
+      return json(req, res, 500, { error: err.message });
     }
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phewsh",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "Turn intent into action. Structure your thinking, execute your next step.",
   "bin": {
     "phewsh": "bin/phewsh.js"