phewsh 0.15.1 → 0.15.3

package/commands/ai.js

@@ -7,6 +7,7 @@ const {
   buildHeaders, buildBody, getUrl, streamParser,
 } = require('../lib/providers');
 const { HARNESSES, detectInstalled, listHarnesses, runViaHarness } = require('../lib/harnesses');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 const INTENT_DIR = path.join(process.cwd(), '.intent');
@@ -15,8 +16,7 @@ const args = process.argv.slice(3);
 const subcommand = args[0];
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function loadIntentContext() {

package/commands/browse.js

@@ -4,6 +4,7 @@ const os = require('os');
 const {
   getProvider, buildHeaders, buildBody, getUrl, streamParser, detectProvider,
 } = require('../lib/providers');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 
@@ -17,8 +18,7 @@ const green = (s) => `\x1b[32m${s}\x1b[0m`;
 const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function resolveApiKey(config, provider) {

package/commands/clarify.js

@@ -8,6 +8,7 @@ const path = require('path');
 const os = require('os');
 const readline = require('readline');
 const { readPPS, writePPS, createPPS, generateViews } = require('../lib/pps');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 const INTENT_DIR = path.join(process.cwd(), '.intent');
@@ -18,8 +19,7 @@ const rawFromFlag = textFlag !== -1 ? args.slice(textFlag + 1).join(' ') : null;
 const isUpdate = args.includes('--update') || args.includes('-u');
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function getProjectName() {

package/commands/gate.js

@@ -6,6 +6,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const readline = require('readline');
+const configFile = require('../lib/config-file');
 
 const INTENT_DIR = path.join(process.cwd(), '.intent');
 const PROJECT_PATH = path.join(INTENT_DIR, 'project.json');
@@ -91,8 +92,7 @@ function saveGate(gate) {
 }
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function createPrompter() {

package/commands/intent.js

@@ -5,6 +5,7 @@ const { execSync } = require('child_process');
 const { createPPS, writePPS, generateViews } = require('../lib/pps');
 
 const os = require('os');
+const configFile = require('../lib/config-file');
 const args = process.argv.slice(3);
 const INTENT_DIR = path.join(process.cwd(), '.intent');
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
@@ -156,8 +157,7 @@ async function initIntent() {
 }
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function loadGate() {

package/commands/login.js

@@ -4,18 +4,17 @@ const readline = require('readline');
 const os = require('os');
 const crypto = require('crypto');
 const { sendOtp, verifyOtp, refreshSession } = require('../lib/supabase');
+const configFile = require('../lib/config-file');
 
 const CONFIG_DIR = path.join(os.homedir(), '.phewsh');
 const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function saveConfig(config) {
-  fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 function createPrompter() {

package/commands/mcp.js

@@ -13,6 +13,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const configFile = require('../lib/config-file');
 const { spawn } = require('child_process');
 
 const PHEWSH_DIR = path.join(os.homedir(), '.phewsh');
@@ -79,8 +80,8 @@ async function loadCloudProjects() {
   const configPath = path.join(PHEWSH_DIR, 'config.json');
   if (!fs.existsSync(configPath)) return [];
 
-  let config;
-  try { config = JSON.parse(fs.readFileSync(configPath, 'utf-8')); } catch { return []; }
+  const config = configFile.loadConfig(configPath);
+  if (!config) return [];
   if (!config?.supabaseAccessToken || !config?.supabaseUserId) return [];
 
   try {
@@ -92,7 +93,7 @@ async function loadCloudProjects() {
       if (session?.access_token) {
         config.supabaseAccessToken = session.access_token;
         config.supabaseRefreshToken = session.refresh_token;
-        fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+        configFile.saveConfig(configPath, config);
       }
     }
 

package/commands/serve.js

@@ -17,6 +17,8 @@ const crypto = require('crypto');
 const os = require('os');
 const path = require('path');
 const fs = require('fs');
+const { corsHeaders, isAllowedRequest } = require('../lib/cors');
+const configFile = require('../lib/config-file');
 
 const b = (s) => `\x1b[1m${s}\x1b[0m`;
 const g = (s) => `\x1b[90m${s}\x1b[0m`;
@@ -204,14 +206,14 @@ function parseBody(req) {
   });
 }
 
-function cors(res) {
-  res.setHeader('Access-Control-Allow-Origin', '*');
-  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+function cors(req, res) {
+  for (const [name, value] of Object.entries(corsHeaders(req))) {
+    res.setHeader(name, value);
+  }
 }
 
-function json(res, data, status = 200) {
-  cors(res);
+function json(req, res, data, status = 200) {
+  cors(req, res);
   res.writeHead(status, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify(data));
 }
@@ -221,12 +223,16 @@ function main() {
   const runtimes = detectRuntimes();
   const hasClaudeCode = runtimes.find(r => r.id === 'claude-code')?.connected;
 
-  const server = http.createServer(async (req, res) => {
+  const handleRequest = async (req, res) => {
     const url = new URL(req.url, `http://localhost:${port}`);
 
+    if (!isAllowedRequest(req)) {
+      return json(req, res, { error: 'Origin not allowed' }, 403);
+    }
+
     // CORS preflight
     if (req.method === 'OPTIONS') {
-      cors(res);
+      cors(req, res);
       res.writeHead(204);
       res.end();
       return;
@@ -234,7 +240,7 @@ function main() {
 
     // Health check
     if (url.pathname === '/health' && req.method === 'GET') {
-      return json(res, {
+      return json(req, res, {
         status: 'ok',
         runtimes: detectRuntimes(),
         version: require('../package.json').version,
@@ -249,7 +255,7 @@ function main() {
         const { actionId, runtimeId, packet } = body;
 
         if (!actionId || !runtimeId || !packet) {
-          return json(res, { error: 'Missing actionId, runtimeId, or packet' }, 400);
+          return json(req, res, { error: 'Missing actionId, runtimeId, or packet' }, 400);
         }
 
         const jobId = createJob(actionId, runtimeId, packet);
@@ -258,9 +264,9 @@ function main() {
         // Start execution in background
         executeJob(jobId);
 
-        return json(res, { jobId, status: 'queued' });
+        return json(req, res, { jobId, status: 'queued' });
       } catch (err) {
-        return json(res, { error: err.message }, 400);
+        return json(req, res, { error: err.message }, 400);
       }
     }
 
@@ -272,8 +278,7 @@ function main() {
         const { outcomeStats, pendingDecisions, bypassStats } = require('../lib/outcomes');
         const { listProjects } = require('../lib/projects-index');
 
-        let config = {};
-        try { config = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.phewsh', 'config.json'), 'utf-8')) || {}; } catch { /* none */ }
+        const config = configFile.loadConfig(path.join(os.homedir(), '.phewsh', 'config.json'), {});
 
         const harnessList = listHarnesses().map(h => ({
           id: h.id, label: h.label, role: h.role, installed: h.installed, headless: h.headless,
@@ -290,7 +295,7 @@ function main() {
         const intentFiles = ['vision.md', 'plan.md', 'next.md']
           .filter(f => fs.existsSync(path.join(process.cwd(), '.intent', f)));
 
-        return json(res, {
+        return json(req, res, {
           project: { name: path.basename(process.cwd()), cwd: process.cwd(), intentFiles },
           route: routeId === 'api'
             ? { id: 'api', label: `API (${config.provider || 'anthropic'} key)` }
@@ -305,7 +310,7 @@ function main() {
           version: require('../package.json').version,
         });
       } catch (err) {
-        return json(res, { error: err.message }, 500);
+        return json(req, res, { error: err.message }, 500);
       }
     }
 
@@ -315,7 +320,7 @@ function main() {
     if (url.pathname === '/receipts' && req.method === 'GET') {
       const limit = Math.min(parseInt(url.searchParams.get('limit') || '50', 10), 200);
       const project = url.searchParams.get('project') || null;
-      return json(res, gatherReceipts({ project, limit }));
+      return json(req, res, gatherReceipts({ project, limit }));
     }
 
     // Check job status
@@ -323,8 +328,8 @@ function main() {
     if (statusMatch && req.method === 'GET') {
       const jobId = statusMatch[1];
       const job = jobs.get(jobId);
-      if (!job) return json(res, { error: 'Job not found' }, 404);
-      return json(res, {
+      if (!job) return json(req, res, { error: 'Job not found' }, 404);
+      return json(req, res, {
         jobId: job.jobId,
         status: job.status,
         statusText: job.statusText,
@@ -334,10 +339,16 @@ function main() {
     }
 
     // 404
-    json(res, { error: 'Not found' }, 404);
-  });
+    json(req, res, { error: 'Not found' }, 404);
+  };
+
+  const server = http.createServer(handleRequest);
+
+  server.listen(port, '127.0.0.1', () => {
+    const mirror = http.createServer(handleRequest);
+    mirror.on('error', () => { /* IPv6 unavailable or already bound */ });
+    mirror.listen(port, '::1');
 
-  server.listen(port, () => {
     console.log('');
     console.log(`  ${b(w('PHEWSH Serve'))} ${g('v' + require('../package.json').version)}`);
     console.log(`  ${g('Live execution bridge for phewsh.com/intent')}`);

package/commands/session.js

@@ -20,6 +20,8 @@ const { push, pull, ensureValidToken } = require('./sync');
 const { HARNESSES, listHarnesses, runViaHarness, cancelActive } = require('../lib/harnesses');
 const { recordDecision, labelOutcome, pendingDecisions, outcomeStats, OUTCOMES } = require('../lib/outcomes');
 const { recordSessionEvent } = require('../lib/receipts-data');
+const configFile = require('../lib/config-file');
+const { createFailureTracker, createLineDispatcher } = require('../lib/session-input');
 const { recordProject, listProjects, scanForProjects, fmtAgo } = require('../lib/projects-index');
 
 // Brand palette shortcuts
@@ -152,13 +154,11 @@ const INTENT_MODES = {
 };
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function saveConfig(config) {
-  fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 function loadIntentContext() {
@@ -491,6 +491,8 @@ async function main() {
 
   // ── Turn runners — every route records a decision, leaves a receipt ────
   // Both return true on success so the fallback flow can chain them.
+  const failureTracker = createFailureTracker();
+  let lastTurnFailure = null;
 
   async function runHarnessTurn(input, harnessId, fullSystem) {
     const decisionId = recordDecision({
@@ -506,6 +508,7 @@ async function main() {
       recordSessionEvent(harnessId, projectName, 'task_complete', {
         taskId: decisionId, success: true, summary: input.slice(0, 140),
       });
+      lastTurnFailure = null;
       awaitingOutcome = decisionId;
       console.log(slate(`  via ${HARNESSES[harnessId].label} · outcome? 1 kept · 2 reverted · 3 superseded · 4 failed · or keep typing`));
       return true;
@@ -520,8 +523,11 @@ async function main() {
       recordSessionEvent(harnessId, projectName, 'task_complete', {
         taskId: decisionId, success: false, summary: input.slice(0, 140),
       });
-      const limitHit = /limit|quota|rate|usage|exhaust/i.test(err.message);
-      console.error(`\n  ${ember('!')} ${cream(HARNESSES[harnessId].label)} ${sage(limitHit ? 'hit a usage wall' : 'failed')}${slate(' — ' + err.message.split('\n')[0])}`);
+      const failure = failureTracker.classify(harnessId, err.message);
+      lastTurnFailure = { ...failure, harnessId };
+      if (!failure.duplicate) {
+        console.error(`\n  ${ember('!')} ${cream(HARNESSES[harnessId].label)} ${sage(failure.kind === 'usage-limit' ? 'hit a usage wall' : 'failed')}${slate(' — ' + err.message.split('\n')[0])}`);
+      }
       return false;
     }
   }
@@ -574,10 +580,17 @@ async function main() {
   // Fallbacks are a first-class flow: the route changes, the context and
   // record do not. Ask by default; auto-switch only if setup said so.
   async function offerFallbacks(input, fullSystem, failedId) {
+    if (lastTurnFailure?.duplicate && lastTurnFailure.harnessId === failedId) {
+      return;
+    }
+
     const options = harnesses
       .filter(h => h.installed && h.headless && h.id !== failedId)
       .map(h => h.id);
     if (config?.apiKey && failedId !== 'api') options.push('api');
+    if (lastTurnFailure?.kind === 'usage-limit' && lastTurnFailure.harnessId === failedId) {
+      options.push(failedId);
+    }
 
     if (options.length === 0) {
       console.log(`  ${sage('No fallback ready.')} ${slate('Install Codex or Gemini, or add an API key with /key — context would travel automatically.')}`);
@@ -598,8 +611,14 @@ async function main() {
     }
 
     const list = options.map((id, i) =>
-      `${teal(String(i + 1))} ${sage(id === 'api' ? 'direct API (your key)' : HARNESSES[id].label)}`
+      `${teal(String(i + 1))} ${sage(id === 'api'
+        ? 'direct API (your key)'
+        : id === failedId ? HARNESSES[id].label + ' (retry once)' : HARNESSES[id].label)}`
     ).join(slate(' · '));
+    if (lastTurnFailure?.kind === 'usage-limit' && lastTurnFailure.harnessId === failedId) {
+      const codexReady = options.includes('codex');
+      console.log(`  ${sage(codexReady ? '/use codex switches the session now, or retry Claude once below.' : 'You can retry this route once below, or /use another installed route.')}`);
+    }
     console.log(`  ${sage('Retry with your context intact:')} ${list} ${slate('· enter = skip')}`);
     console.log(`  ${slate('prefer auto-switching? phewsh setup sets it once')}`);
     awaitingFallback = { input, fullSystem, options };
@@ -680,13 +699,7 @@ async function main() {
 
   rl.prompt();
 
-  rl.on('line', async (line) => {
-    const input = line.trim();
-
-    if (!input) {
-      rl.prompt();
-      return;
-    }
+  async function handleInput(input) {
 
     // A bare number right after a route failure picks the fallback
     if (awaitingFallback) {
@@ -1547,8 +1560,11 @@ async function main() {
           if (!config?.apiKey) {
             console.log(`  ${ember('!')} ${sage('No API key set — run /key first.')}`);
           } else {
+            config = loadConfig() || {};
+            config.defaultRoute = 'api';
+            saveConfig(config);
             route = { type: 'api' };
-            console.log(`  ${teal('●')} ${sage('Routing via')} ${cream(routeLabel(route, config))}`);
+            console.log(`  ${teal('●')} ${sage('Default route:')} ${cream(routeLabel(route, config))}`);
           }
         } else if (HARNESSES[target]) {
           if (!harnesses.find(h => h.id === target)?.installed) {
@@ -1556,13 +1572,15 @@ async function main() {
           } else if (!HARNESSES[target].args) {
             console.log(`  ${sage(HARNESSES[target].label + ' is interactive-only — drop into it with')} ${cream('/work ' + target)} ${sage('(phewsh records the outcome when you return)')}`);
           } else {
+            config = loadConfig() || {};
+            config.defaultRoute = target;
+            saveConfig(config);
             route = { type: 'harness', id: target };
-            console.log(`  ${teal('●')} ${sage('Routing via')} ${cream(routeLabel(route, config))} ${slate('— no API key, your subscription')}`);
+            console.log(`  ${teal('●')} ${sage('Default route:')} ${cream(routeLabel(route, config))} ${slate('— saved across sessions')}`);
           }
         } else {
           console.log(`  ${sage('Unknown route. Options:')} ${cream(Object.keys(HARNESSES).join(', ') + ', api')}`);
         }
-        console.log(`  ${slate('make it stick across sessions: phewsh setup')}`);
         rl.prompt();
         return;
       }
@@ -1806,9 +1824,19 @@ async function main() {
 
     console.log('');
     rl.prompt();
+  }
+
+  const lineDispatcher = createLineDispatcher(handleInput, {
+    onNoop: () => rl.prompt(),
+    onError: (err) => {
+      console.error(`\n  ${ember('!')} ${sage('Input failed:')} ${err.message}`);
+      rl.prompt();
+    },
   });
+  rl.on('line', lineDispatcher.push);
 
-  rl.on('close', () => {
+  rl.on('close', async () => {
+    await lineDispatcher.drain();
     console.log(`\n  ${sage('session ended')}\n`);
     process.exit(0);
   });

package/commands/setup.js

@@ -10,6 +10,7 @@ const os = require('os');
 const readline = require('readline');
 const ui = require('../lib/ui');
 const { HARNESSES, listHarnesses } = require('../lib/harnesses');
+const configFile = require('../lib/config-file');
 
 const { b, teal, sage, slate, cream, ember, green } = ui;
 
@@ -17,12 +18,11 @@ const CONFIG_DIR = path.join(os.homedir(), '.phewsh');
 const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
 
 function loadConfig() {
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return {}; }
+  return configFile.loadConfig(CONFIG_PATH, {});
 }
 
 function saveConfig(config) {
-  fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 function ask(rl, prompt) {
@@ -58,10 +58,19 @@ module.exports = async function setup() {
   console.log('');
 
   // Agent-run (no TTY): auto-configure instead of asking questions nobody
-  // can answer. Pick the first installed harness; humans can change it later.
+  // can answer. Keep an existing valid route; otherwise pick the first
+  // installed harness.
   const chatCapable = installed.filter(h => h.headless);
   if (!process.stdin.isTTY) {
-    if (chatCapable.length > 0) {
+    const configuredHarness = chatCapable.find(h => h.id === config.defaultRoute);
+    if (configuredHarness) {
+      if (!config.fallback) config.fallback = 'ask';
+      saveConfig(config);
+      console.log(`  ${teal('●')} ${sage('Kept configured default route:')} ${cream(configuredHarness.label)} ${slate('— no API key needed')}`);
+    } else if (config.defaultRoute === 'api' && config.apiKey) {
+      saveConfig(config);
+      console.log(`  ${teal('●')} ${sage('Kept configured default route: API (existing key found)')}`);
+    } else if (chatCapable.length > 0) {
       config.defaultRoute = chatCapable[0].id;
       if (!config.fallback) config.fallback = 'ask';
       saveConfig(config);

package/commands/style.js

@@ -6,6 +6,7 @@ const path = require('path');
 const os = require('os');
 const readline = require('readline');
 const { select, upsert, SUPABASE_URL, SUPABASE_ANON_KEY } = require('../lib/supabase');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 const STYLE_CACHE_DIR = path.join(os.homedir(), '.phewsh', 'styletree');
@@ -18,7 +19,7 @@ const c = (s) => `\x1b[36m${s}\x1b[0m`;
 const y = (s) => `\x1b[33m${s}\x1b[0m`;
 
 function loadConfig() {
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function ask(rl, q) {

package/commands/sync.js

@@ -7,6 +7,7 @@ const os = require('os');
 const crypto = require('crypto');
 const { select, upsert, refreshSession } = require('../lib/supabase');
 const { readPPS, writePPS } = require('../lib/pps');
+const configFile = require('../lib/config-file');
 
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
 const INTENT_DIR = path.join(process.cwd(), '.intent');
@@ -15,14 +16,11 @@ const FILE_TO_KIND = { 'vision.md': 'vision', 'plan.md': 'plan', 'next.md': 'nex
 const KIND_TO_FILE = { vision: 'vision.md', plan: 'plan.md', next: 'next.md' };
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function saveConfig(config) {
-  const dir = path.dirname(CONFIG_PATH);
-  fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 function genProjectId() {

package/commands/watch.js

@@ -13,6 +13,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const configFile = require('../lib/config-file');
 
 const INTENT_DIR = path.join(process.cwd(), '.intent');
 const CONFIG_PATH = path.join(os.homedir(), '.phewsh', 'config.json');
@@ -38,14 +39,11 @@ const red = (s) => `\x1b[31m${s}\x1b[0m`;
 // ── Config + Auth ──────────────────────────────────────────────────────────
 
 function loadConfig() {
-  if (!fs.existsSync(CONFIG_PATH)) return null;
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return null; }
+  return configFile.loadConfig(CONFIG_PATH);
 }
 
 function saveConfig(config) {
-  const dir = path.dirname(CONFIG_PATH);
-  fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  configFile.saveConfig(CONFIG_PATH, config);
 }
 
 // ── Context Generation (mirrors context.js) ────────────────────────────────

package/lib/config-file.js

@@ -0,0 +1,36 @@
+const fs = require('fs');
+const path = require('path');
+
+function hardenConfigPath(configPath) {
+  const dir = path.dirname(configPath);
+  if (fs.existsSync(dir)) {
+    try { fs.chmodSync(dir, 0o700); } catch { /* best effort on non-POSIX filesystems */ }
+  }
+  if (fs.existsSync(configPath)) {
+    try { fs.chmodSync(configPath, 0o600); } catch { /* best effort on non-POSIX filesystems */ }
+  }
+}
+
+function loadConfig(configPath, fallback = null) {
+  if (!fs.existsSync(configPath)) return fallback;
+  hardenConfigPath(configPath);
+  try {
+    return JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+  } catch {
+    return fallback;
+  }
+}
+
+function saveConfig(configPath, config) {
+  const dir = path.dirname(configPath);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(dir, 0o700); } catch { /* best effort on non-POSIX filesystems */ }
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(configPath, 0o600); } catch { /* existing files keep their prior mode */ }
+}
+
+module.exports = {
+  hardenConfigPath,
+  loadConfig,
+  saveConfig,
+};

package/lib/cors.js

@@ -0,0 +1,48 @@
+const DEFAULT_ALLOWED_ORIGINS = new Set([
+  'https://phewsh.com',
+  'https://www.phewsh.com',
+  'http://localhost:3000',
+  'http://127.0.0.1:3000',
+  'http://[::1]:3000',
+]);
+
+function allowedOrigins() {
+  const origins = new Set(DEFAULT_ALLOWED_ORIGINS);
+  for (const origin of (process.env.PHEWSH_ALLOWED_ORIGINS || '').split(',')) {
+    const trimmed = origin.trim();
+    if (trimmed) origins.add(trimmed);
+  }
+  return origins;
+}
+
+function requestOrigin(req) {
+  const origin = req.headers.origin;
+  return Array.isArray(origin) ? origin[0] : origin;
+}
+
+function isAllowedRequest(req) {
+  const origin = requestOrigin(req);
+  if (origin) return allowedOrigins().has(origin);
+
+  // CLI clients do not send browser fetch metadata. A browser can omit Origin
+  // on some cross-site requests, so reject those before they reach any route.
+  return req.headers['sec-fetch-site'] !== 'cross-site';
+}
+
+function corsHeaders(req) {
+  const origin = requestOrigin(req);
+  if (!origin || !allowedOrigins().has(origin)) return {};
+
+  return {
+    'Access-Control-Allow-Origin': origin,
+    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Phewsh-Runtime',
+    'Access-Control-Max-Age': '600',
+    Vary: 'Origin',
+  };
+}
+
+module.exports = {
+  corsHeaders,
+  isAllowedRequest,
+};

package/lib/harnesses.js

@@ -21,7 +21,7 @@ const { execSync, spawn } = require('child_process');
 // model flag ignore the preference and use their own config.
 const HARNESSES = {
   'claude-code': { bin: 'claude',       label: 'Claude Code',  role: 'writes code',          auth: 'Claude subscription / Console', models: true, modelHints: ['sonnet', 'opus', 'haiku', 'fable'], args: (p, m) => ['-p', p, '--output-format', 'text', ...(m ? ['--model', m] : [])] },
-  'codex':       { bin: 'codex',        label: 'Codex CLI',    role: 'reasons & reviews',    auth: 'ChatGPT plan',                  models: true, args: (p, m) => ['exec', ...(m ? ['-m', m] : []), p] },
+  'codex':       { bin: 'codex',        label: 'Codex CLI',    role: 'reasons & reviews',    auth: 'ChatGPT plan',                  models: true, args: (p, m) => ['exec', '--skip-git-repo-check', ...(m ? ['-m', m] : []), p] },
   'gemini':      { bin: 'gemini',       label: 'Gemini CLI',   role: "another model's take", auth: 'Google login',                  models: true, args: (p, m) => ['-p', p, ...(m ? ['-m', m] : [])] },
   'cursor':      { bin: 'cursor-agent', label: 'Cursor Agent', role: 'edits files',          auth: 'Cursor account',                models: true, args: (p, m) => ['-p', p, '--output-format', 'text', ...(m ? ['--model', m] : [])] },
   'opencode':    { bin: 'opencode',     label: 'OpenCode',     role: 'general agent',        auth: 'OpenCode Zen / configured',     args: (p) => ['run', p] },

package/lib/session-input.js

@@ -0,0 +1,67 @@
+function createLineDispatcher(handleInput, {
+  onError = (err) => { throw err; },
+  onNoop = () => {},
+  schedule = setImmediate,
+} = {}) {
+  let pendingLines = [];
+  let scheduled = false;
+  let chain = Promise.resolve();
+
+  function flush() {
+    scheduled = false;
+    const lines = pendingLines;
+    pendingLines = [];
+    const input = lines.join('\n').trim();
+    if (!input) {
+      onNoop();
+      return;
+    }
+    chain = chain.then(() => handleInput(input)).catch(onError);
+  }
+
+  function push(line) {
+    pendingLines.push(String(line));
+    if (scheduled) return;
+    scheduled = true;
+    schedule(flush);
+  }
+
+  async function drain() {
+    if (scheduled) flush();
+    await chain;
+  }
+
+  return { push, drain };
+}
+
+function createFailureTracker() {
+  const seen = new Map();
+
+  function classify(harnessId, message) {
+    const text = String(message || '').trim();
+    const firstLine = text.split('\n')[0].trim();
+    const isClaudeUsageLimit = harnessId === 'claude-code'
+      && /(usage|rate|session|weekly|monthly)?\s*(limit|quota)|exhaust|resets?\s/i.test(text);
+
+    if (!isClaudeUsageLimit) {
+      return { kind: 'failure', duplicate: false, key: null };
+    }
+
+    const normalized = text.toLowerCase().replace(/\s+/g, ' ').slice(0, 300);
+    const key = `${harnessId}:${normalized}`;
+    const count = (seen.get(key) || 0) + 1;
+    seen.set(key, count);
+    return {
+      kind: 'usage-limit',
+      duplicate: count > 1,
+      key,
+    };
+  }
+
+  return { classify };
+}
+
+module.exports = {
+  createFailureTracker,
+  createLineDispatcher,
+};

package/mcp/http-server.js

@@ -27,6 +27,7 @@ import { URL } from "url";
 
 import { readFileSync, readdirSync } from "fs";
 import { join } from "path";
+import corsPolicy from "../lib/cors.js";
 
 import {
   loadProjects, recordResult, recordSession, updateLocalStatusMd,
@@ -35,6 +36,8 @@ import {
 import * as runtimes from "./lib/runtime-registry.js";
 import * as queue from "./lib/dispatch-queue.js";
 
+const { corsHeaders, isAllowedRequest } = corsPolicy;
+
 // Version comes from the phewsh package this server ships inside — never hardcode it.
 const VERSION = (() => {
   try {
@@ -49,23 +52,16 @@ const DEFAULT_HOST = "127.0.0.1";
 
 // ─── HTTP helpers ───────────────────────────────────────────────────────────
 
-const CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-  "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Phewsh-Runtime",
-  "Access-Control-Max-Age": "600",
-};
-
-function json(res, status, body) {
+function json(req, res, status, body) {
   res.writeHead(status, {
     "Content-Type": "application/json",
-    ...CORS_HEADERS,
+    ...corsHeaders(req),
   });
   res.end(JSON.stringify(body));
 }
 
-function text(res, status, body) {
-  res.writeHead(status, { "Content-Type": "text/plain", ...CORS_HEADERS });
+function text(req, res, status, body) {
+  res.writeHead(status, { "Content-Type": "text/plain", ...corsHeaders(req) });
   res.end(body);
 }
 
@@ -85,7 +81,7 @@ async function readJsonBody(req) {
 
 function handleHealth(req, res) {
   const connected = runtimes.list();
-  json(res, 200, {
+  json(req, res, 200, {
     status: "ok",
     runtimes: connected,
     version: VERSION,
@@ -97,7 +93,7 @@ async function handleDispatch(req, res) {
   try {
     const body = await readJsonBody(req);
     if (!body.packet || !body.packet.objective) {
-      return json(res, 400, { error: "Missing packet.objective" });
+      return json(req, res, 400, { error: "Missing packet.objective" });
     }
 
     // Auto-register the target runtime as "expected" so /health reflects
@@ -122,26 +118,26 @@ async function handleDispatch(req, res) {
       taskSummary: body.packet?.objective?.task?.slice(0, 120),
     });
 
-    json(res, 200, { jobId: job.jobId, status: job.status });
+    json(req, res, 200, { jobId: job.jobId, status: job.status });
   } catch (err) {
-    json(res, 400, { error: err.message });
+    json(req, res, 400, { error: err.message });
   }
 }
 
-function handleStatus(res, jobId) {
+function handleStatus(req, res, jobId) {
   const job = queue.getStatus(jobId);
-  if (!job) return json(res, 404, { error: "Job not found" });
+  if (!job) return json(req, res, 404, { error: "Job not found" });
   const { packet, ...rest } = job;
-  json(res, 200, rest);
+  json(req, res, 200, rest);
 }
 
-function handleResult(res, jobId) {
+function handleResult(req, res, jobId) {
   const job = queue.getStatus(jobId);
-  if (!job) return json(res, 404, { error: "Job not found" });
+  if (!job) return json(req, res, 404, { error: "Job not found" });
   if (job.status !== "done" && job.status !== "error") {
-    return json(res, 202, { status: job.status, message: "Job not yet complete" });
+    return json(req, res, 202, { status: job.status, message: "Job not yet complete" });
   }
-  json(res, 200, {
+  json(req, res, 200, {
     jobId: job.jobId,
     status: job.status,
     result: job.result,
@@ -150,7 +146,7 @@ function handleResult(res, jobId) {
   });
 }
 
-function handleReceipts(res, url) {
+function handleReceipts(req, res, url) {
   // The merged proof trail: every claim an agent made, with the evidence file
   // behind it. Same data `phewsh receipts` shows in the terminal — exposed
   // here so the web app can render it.
@@ -213,13 +209,13 @@ function handleReceipts(res, url) {
     if (e.kind === "dispatch_enqueued") counts.dispatched++;
   }
 
-  json(res, 200, {
+  json(req, res, 200, {
     summary: { ...counts, totalEvents: filtered.length },
     events: filtered.slice(0, limit),
   });
 }
 
-function handleJobsList(res, url) {
+function handleJobsList(req, res, url) {
   const limit = Math.min(parseInt(url.searchParams.get("limit") || "50", 10), 200);
   const statusFilter = url.searchParams.get("status") || undefined;
   const jobs = queue.list({ limit, status: statusFilter }).map(j => {
@@ -229,20 +225,20 @@ function handleJobsList(res, url) {
       summary: packet?.objective?.task?.slice(0, 140) || null,
     };
   });
-  json(res, 200, { jobs });
+  json(req, res, 200, { jobs });
 }
 
-function handleNextForRuntime(res, url, req) {
+function handleNextForRuntime(req, res, url) {
   const runtimeId = url.searchParams.get("runtime") || req.headers["x-phewsh-runtime"];
-  if (!runtimeId) return json(res, 400, { error: "Missing ?runtime= or X-Phewsh-Runtime header" });
+  if (!runtimeId) return json(req, res, 400, { error: "Missing ?runtime= or X-Phewsh-Runtime header" });
 
   runtimes.register({ id: runtimeId, label: runtimeId, transport: "http" });
 
   const job = queue.nextForRuntime(runtimeId);
-  if (!job) return json(res, 204, null);
+  if (!job) return json(req, res, 204, null);
 
   queue.markExecuting(job.jobId, runtimeId, "Picked up by HTTP harness");
-  json(res, 200, { jobId: job.jobId, actionId: job.actionId, packet: job.packet });
+  json(req, res, 200, { jobId: job.jobId, actionId: job.actionId, packet: job.packet });
 }
 
 async function handleJobComplete(req, res, jobId) {
@@ -251,7 +247,7 @@ async function handleJobComplete(req, res, jobId) {
     const { success = true, result = "", issues, agentId, projectId } = body;
 
     const job = queue.getStatus(jobId);
-    if (!job) return json(res, 404, { error: "Job not found" });
+    if (!job) return json(req, res, 404, { error: "Job not found" });
 
     const updated = success
       ? queue.complete(jobId, result)
@@ -279,9 +275,9 @@ async function handleJobComplete(req, res, jobId) {
 
     if (agentId) runtimes.touch(agentId);
 
-    json(res, 200, { jobId, status: updated.status });
+    json(req, res, 200, { jobId, status: updated.status });
   } catch (err) {
-    json(res, 400, { error: err.message });
+    json(req, res, 400, { error: err.message });
   }
 }
 
@@ -289,8 +285,12 @@ async function handleJobComplete(req, res, jobId) {
 
 export function startHttpServer({ port = DEFAULT_PORT, host = DEFAULT_HOST } = {}) {
   const server = createServer(async (req, res) => {
+    if (!isAllowedRequest(req)) {
+      return json(req, res, 403, { error: "Origin not allowed" });
+    }
+
     if (req.method === "OPTIONS") {
-      res.writeHead(204, CORS_HEADERS);
+      res.writeHead(204, corsHeaders(req));
       return res.end();
     }
 
@@ -302,26 +302,26 @@ export function startHttpServer({ port = DEFAULT_PORT, host = DEFAULT_HOST } = {
       if (req.method === "POST" && pathname === "/dispatch") return await handleDispatch(req, res);
       if (req.method === "GET" && pathname.startsWith("/status/")) {
         const jobId = pathname.slice("/status/".length);
-        return handleStatus(res, jobId);
+        return handleStatus(req, res, jobId);
       }
       if (req.method === "GET" && pathname.startsWith("/result/")) {
         const jobId = pathname.slice("/result/".length);
-        return handleResult(res, jobId);
+        return handleResult(req, res, jobId);
       }
-      if (req.method === "GET" && pathname === "/jobs") return handleJobsList(res, url);
-      if (req.method === "GET" && pathname === "/receipts") return handleReceipts(res, url);
-      if (req.method === "GET" && pathname === "/next") return handleNextForRuntime(res, url, req);
+      if (req.method === "GET" && pathname === "/jobs") return handleJobsList(req, res, url);
+      if (req.method === "GET" && pathname === "/receipts") return handleReceipts(req, res, url);
+      if (req.method === "GET" && pathname === "/next") return handleNextForRuntime(req, res, url);
       if (req.method === "POST" && pathname.match(/^\/jobs\/[^/]+\/complete$/)) {
         const jobId = pathname.split("/")[2];
         return await handleJobComplete(req, res, jobId);
       }
       if (req.method === "GET" && pathname === "/") {
-        return text(res, 200, `PHEWSH MCP HTTP transport v${VERSION}\nEndpoints: /health /dispatch /status/:id /result/:id /jobs /receipts /next /jobs/:id/complete\n`);
+        return text(req, res, 200, `PHEWSH MCP HTTP transport v${VERSION}\nEndpoints: /health /dispatch /status/:id /result/:id /jobs /receipts /next /jobs/:id/complete\n`);
       }
-      return json(res, 404, { error: `No route for ${req.method} ${pathname}` });
+      return json(req, res, 404, { error: `No route for ${req.method} ${pathname}` });
     } catch (err) {
       console.error("[http]", err);
-      return json(res, 500, { error: err.message });
+      return json(req, res, 500, { error: err.message });
     }
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phewsh",
-  "version": "0.15.1",
+  "version": "0.15.3",
   "description": "Turn intent into action. Structure your thinking, execute your next step.",
   "bin": {
     "phewsh": "bin/phewsh.js"