Fix Command Center chats on native desktop hosts

.github/workflows/ci.yml

@@ -120,6 +120,36 @@ jobs:
       - name: Test resource monitor
         run: cargo test --locked --manifest-path native/resource-monitor/Cargo.toml
 
+  command_center_native_isolation:
+    name: Command Center Native Isolation (${{ matrix.label }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: macOS
+            os: macos-26
+          - label: Windows
+            os: windows-2025
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Test native Command Center isolation
+        run: >-
+          vp test run
+          apps/server/src/provider/security/CommandCenterProviderIsolation.test.ts
+          apps/server/src/provider/Layers/CodexSessionRuntime.test.ts
+          apps/server/src/command-center/RunDispatcher.test.ts
+
   mobile_native_static_analysis:
     name: Mobile Native Static Analysis
     runs-on: macos-26

apps/server/src/command-center/CommandCenterAcceptance.test.ts

@@ -363,6 +363,7 @@ const makeDispatcherHarness = (
           projectId: row.projectId,
           threadId: row.threadId,
           executionAuthorizedAt: row.executionAuthorizedAt,
+          parentRunId: null,
           state: row.state,
           route: submitted.route,
           command,

apps/server/src/command-center/RunDispatcher.test.ts

@@ -104,6 +104,7 @@ function makeFixture(
     readonly resolveTargetProject?: DispatcherDependencies["resolveTargetProject"];
     readonly space?: StoredSpace;
     readonly executionAuthorized?: boolean;
+    readonly parentRunId?: string;
     readonly priorContext?: ReadonlyArray<{
       readonly commandText: string;
       readonly responseText?: string;
@@ -117,6 +118,7 @@ function makeFixture(
     projectId: null,
     threadId: null,
     executionAuthorizedAt: options.executionAuthorized === false ? null : fixtureTime,
+    parentRunId: options.parentRunId ?? null,
     state: "queued",
     route,
     command,
@@ -279,15 +281,15 @@ it.effect("links one fresh thread and registers the exact Space and repository s
 
     expect(first).toMatchObject({
       projectId: targetProject.id,
-      threadId: ThreadId.make("cc:thread-example"),
+      threadId: ThreadId.make("cc:interactive:thread-example"),
       state: "running",
       sequence: 42,
       duplicate: false,
     });
     expect(duplicate.duplicate).toBe(true);
     expect(state.dispatchCount).toBe(1);
     expect(state.recordedSequence).toBe(42);
-    expect(state.registeredThread).toBe(ThreadId.make("cc:thread-example"));
+    expect(state.registeredThread).toBe(ThreadId.make("cc:interactive:thread-example"));
     expect(state.registeredScope?.spaceId).toBe(spaceId);
     expect(state.registeredScope?.repositoryId).toBe(repositoryId);
     expect(state.registeredScope?.memoryWriteMode).toBe("propose");
@@ -309,6 +311,20 @@ it.effect("links one fresh thread and registers the exact Space and repository s
   }),
 );
 
+it.effect("marks automation child threads as unattended before provider dispatch", () =>
+  Effect.gen(function* () {
+    const fixture = makeFixture(readyRoute, { parentRunId: "automation-execution-example" });
+
+    const result = yield* fixture.dispatcher.dispatch({
+      runId,
+      dispatchCommand: fixture.dispatch(),
+    });
+
+    expect(result.threadId).toBe(ThreadId.make("cc:automation:thread-example"));
+    expect(fixture.read().registeredThread).toBe(ThreadId.make("cc:automation:thread-example"));
+  }),
+);
+
 it.effect("refuses pre-ack dispatch and recovery without changing the admitted Run", () =>
   Effect.gen(function* () {
     const fixture = makeFixture(readyRoute, { executionAuthorized: false });
@@ -371,7 +387,7 @@ it.effect("persists dispatch failure and revokes the linked thread scope", () =>
     expect(failure.reason).toBe("dispatch-failed");
     expect(state.storedRun.state).toBe("failed");
     expect(state.failedError?.reason).toBe("dispatch-failed");
-    expect(state.unregisteredThread).toBe(ThreadId.make("cc:thread-example"));
+    expect(state.unregisteredThread).toBe(ThreadId.make("cc:interactive:thread-example"));
   }),
 );
 

apps/server/src/command-center/RunDispatcher.ts

@@ -48,6 +48,10 @@ import {
   isProvisionableRepositoryRemote,
 } from "./RepositoryProvisioningPolicy.ts";
 import { makeRunLifecyclePersistence } from "./RunLifecycle.ts";
+import {
+  COMMAND_CENTER_AUTOMATION_THREAD_ID_PREFIX,
+  COMMAND_CENTER_INTERACTIVE_THREAD_ID_PREFIX,
+} from "../provider/security/CommandCenterProviderIsolation.ts";
 
 export {
   isManagedRepositoryWorkspacePath,
@@ -130,6 +134,7 @@ export interface StoredRun {
   readonly projectId: string | null;
   readonly threadId: string | null;
   readonly executionAuthorizedAt: string | null;
+  readonly parentRunId: string | null;
   readonly state:
     | "queued"
     | "running"
@@ -840,7 +845,11 @@ export const makeWithDependencies = (deps: DispatcherDependencies): RunDispatche
                     cause,
                   ),
           });
-          const threadId = ThreadId.make(`cc:${yield* deps.randomUUID}`);
+          const threadPrefix =
+            run.parentRunId === null
+              ? COMMAND_CENTER_INTERACTIVE_THREAD_ID_PREFIX
+              : COMMAND_CENTER_AUTOMATION_THREAD_ID_PREFIX;
+          const threadId = ThreadId.make(`${threadPrefix}${yield* deps.randomUUID}`);
           const claimed = yield* deps.claim({ runId: run.id, projectId: project.id, threadId });
           if (!claimed) {
             const current = yield* deps.loadRun(run.id);
@@ -976,6 +985,7 @@ interface RunRow {
   readonly projectId: string | null;
   readonly threadId: string | null;
   readonly executionAuthorizedAt: string | null;
+  readonly parentRunId: string | null;
   readonly state: StoredRun["state"];
   readonly routeJson: string;
   readonly inputJson: string;
@@ -1027,6 +1037,7 @@ const make = Effect.gen(function* () {
           SELECT id, command_id AS "commandId", space_id AS "spaceId",
             project_id AS "projectId", thread_id AS "threadId", state,
             execution_authorized_at AS "executionAuthorizedAt",
+            parent_run_id AS "parentRunId",
             route_json AS "routeJson", input_json AS "inputJson"
           FROM command_center_runs
           WHERE id = ${runId}
@@ -1058,6 +1069,7 @@ const make = Effect.gen(function* () {
         projectId: row.projectId,
         threadId: row.threadId,
         executionAuthorizedAt: row.executionAuthorizedAt,
+        parentRunId: row.parentRunId,
         state: row.state,
         route,
         command,

apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts

@@ -34,7 +34,10 @@ import { afterEach, describe, expect, it, vi } from "vite-plus/test";
 
 import { deriveServerPaths, ServerConfig } from "../../config.ts";
 import { TextGenerationError } from "@t3tools/contracts";
-import { ProviderAdapterRequestError } from "../../provider/Errors.ts";
+import {
+  ProviderAdapterRequestError,
+  ProviderAdapterValidationError,
+} from "../../provider/Errors.ts";
 import { OrchestrationEventStoreLive } from "../../persistence/Layers/OrchestrationEventStore.ts";
 import { OrchestrationCommandReceiptRepositoryLive } from "../../persistence/Layers/OrchestrationCommandReceipts.ts";
 import { SqlitePersistenceMemory } from "../../persistence/Layers/Sqlite.ts";
@@ -150,7 +153,10 @@ describe("ProviderCommandReactor", () => {
     readonly titleRegenerationBeforeStart?: "one" | "two";
     readonly startSessionEffect?: (
       session: ProviderSession,
-    ) => Effect.Effect<ProviderSession, ProviderAdapterRequestError>;
+    ) => Effect.Effect<
+      ProviderSession,
+      ProviderAdapterRequestError | ProviderAdapterValidationError
+    >;
   }) {
     const now = "2026-01-01T00:00:00.000Z";
     const baseDir =
@@ -623,8 +629,10 @@ describe("ProviderCommandReactor", () => {
         waitFor(async () => {
           const readModel = await harness.readModel();
           return (
-            readModel.threads.find((entry) => entry.id === ThreadId.make("thread-1"))?.session
-              ?.status === "error"
+            readModel.threads
+              .find((entry) => entry.id === ThreadId.make("thread-1"))
+              ?.activities.some((activity) => activity.kind === "provider.turn.start.failed") ??
+            false
           );
         }),
       );
@@ -657,6 +665,59 @@ describe("ProviderCommandReactor", () => {
     }),
   );
 
+  effectIt.effect("shows validation issues without exposing provider stack traces", () =>
+    Effect.gen(function* () {
+      const harness = yield* Effect.promise(() =>
+        createHarness({
+          startSessionEffect: () =>
+            Effect.fail(
+              new ProviderAdapterValidationError({
+                provider: "codex",
+                operation: "startSession",
+                issue: "Native Windows sandbox setup is required.",
+              }),
+            ),
+        }),
+      );
+      yield* harness.engine.dispatch({
+        type: "thread.turn.start",
+        commandId: CommandId.make("cmd-turn-start-validation-failure"),
+        threadId: ThreadId.make("thread-1"),
+        message: {
+          messageId: asMessageId("user-message-validation-failure"),
+          role: "user",
+          text: "start",
+          attachments: [],
+        },
+        interactionMode: DEFAULT_PROVIDER_INTERACTION_MODE,
+        runtimeMode: "approval-required",
+        createdAt: "2026-01-01T00:00:00.000Z",
+      });
+
+      yield* Effect.promise(() =>
+        waitFor(async () => {
+          const readModel = await harness.readModel();
+          return (
+            readModel.threads
+              .find((entry) => entry.id === ThreadId.make("thread-1"))
+              ?.activities.some((activity) => activity.kind === "provider.turn.start.failed") ??
+            false
+          );
+        }),
+      );
+      const readModel = yield* Effect.promise(() => harness.readModel());
+      const thread = readModel.threads.find((entry) => entry.id === ThreadId.make("thread-1"));
+      const failureActivity = thread?.activities.find(
+        (activity) => activity.kind === "provider.turn.start.failed",
+      );
+      expect(failureActivity).toMatchObject({
+        payload: { detail: "Native Windows sandbox setup is required." },
+      });
+      expect(thread?.session?.lastError).toBe("Native Windows sandbox setup is required.");
+      expect(thread?.session?.lastError).not.toContain("ProviderAdapterValidationError");
+      expect(thread?.session?.lastError).not.toContain(" at ");
+    }),
+  );
   it("generates a thread title on the first turn", async () => {
     const harness = await createHarness();
     const now = "2026-01-01T00:00:00.000Z";

apps/server/src/orchestration/Layers/ProviderCommandReactor.ts

@@ -31,7 +31,11 @@ import { makeDrainableWorker } from "@t3tools/shared/DrainableWorker";
 
 import { resolveThreadWorkspaceCwd } from "../../checkpointing/Utils.ts";
 import { increment, orchestrationEventsProcessedTotal } from "../../observability/Metrics.ts";
-import { ProviderAdapterRequestError } from "../../provider/Errors.ts";
+import {
+  ProviderAdapterProcessError,
+  ProviderAdapterRequestError,
+  ProviderAdapterValidationError,
+} from "../../provider/Errors.ts";
 import type { ProviderServiceError } from "../../provider/Errors.ts";
 import { COMMAND_PRODUCED_NO_EVENTS_DETAIL } from "../Errors.ts";
 import { TextGeneration } from "../../textGeneration/TextGeneration.ts";
@@ -60,6 +64,8 @@ import {
 import { VcsStatusBroadcaster } from "../../vcs/VcsStatusBroadcaster.ts";
 import { GitWorkflowService } from "../../git/GitWorkflowService.ts";
 const isProviderAdapterRequestError = Schema.is(ProviderAdapterRequestError);
+const isProviderAdapterProcessError = Schema.is(ProviderAdapterProcessError);
+const isProviderAdapterValidationError = Schema.is(ProviderAdapterValidationError);
 const isProviderDriverKind = Schema.is(ProviderDriverKind);
 
 // Structural (by value) comparison of two model selections. `ModelSelection`
@@ -416,13 +422,13 @@ const make = Effect.gen(function* () {
 
   const formatFailureDetail = (cause: Cause.Cause<unknown>): string => {
     const failReason = cause.reasons.find(Cause.isFailReason);
-    const providerError = isProviderAdapterRequestError(failReason?.error)
-      ? failReason.error
-      : undefined;
-    if (providerError) {
-      return providerError.detail;
+    const failure = failReason?.error;
+    if (isProviderAdapterValidationError(failure)) return failure.issue;
+    if (isProviderAdapterRequestError(failure) || isProviderAdapterProcessError(failure)) {
+      return failure.detail;
     }
-    return Cause.pretty(cause);
+    if (failure instanceof Error && failure.message.trim().length > 0) return failure.message;
+    return "The provider operation failed. Check the server logs for technical details.";
   };
 
   const setThreadSession = (input: {
@@ -2000,11 +2006,14 @@ const make = Effect.gen(function* () {
         return Effect.void;
       }
       const detail = formatFailureDetail(cause);
-      return setThreadSessionErrorOnTurnStartFailure({
-        threadId: event.payload.threadId,
-        detail,
-        createdAt: event.payload.createdAt,
-      }).pipe(
+      return Effect.logError("Provider turn start failed.", { cause }).pipe(
+        Effect.andThen(
+          setThreadSessionErrorOnTurnStartFailure({
+            threadId: event.payload.threadId,
+            detail,
+            createdAt: event.payload.createdAt,
+          }),
+        ),
         Effect.flatMap(() =>
           appendProviderFailureActivity({
             threadId: event.payload.threadId,