A Session ID Is Not a Work Room

The first Claude Code browser test appeared to pass. O Chat showed a claude_code tool card, the tool ran for six seconds, and the assistant returned the requested text. Expanding the card revealed an even stronger signal: a real Claude provider envelope with status: completed, exit_code: 0, and a UUID session ID.

There was still no Open Work Room button.

The temptation was to fix that in React. The browser had the tool name and the JSON result, so it could parse the envelope, recognize claude_code, manufacture a provider card, and infer which later calls belonged to it. That would make one screenshot look right. It would also put protocol reconstruction in the least authoritative layer.

Codex showed the intended boundary. co ai installed CodexPlugin, which owns a provider invocation from start to finish. It emits a stable invocation ID, the parent tool-call ID, provider name, permission mode, terminal status, elapsed time, result, error, and resumable session ID. Child commands carry the same correlation. React normalizes those events, and O Chat only presents them.

Claude had all the difficult pieces — a bounded streaming reader, structured results, cancellation, nested tool activity, and session resume — but co ai registered it as a plain function. The streaming reader could correlate child activity with the outer tool call. No owner existed to emit the parent provider lifecycle, so the browser correctly rendered the only contract it received: a generic tool card.

The fix was not a Claude-shaped frontend exception. co ai now installs ClaudeCodePlugin beside CodexPlugin. Both adapters emit the same provider lifecycle while keeping their provider-specific transports and policies. The model-visible Claude signature remains prompt, explicit cwd, optional session_id, model, and timeout. OIP still carries normalized events rather than provider CLI output.

That symmetry could not weaken the hosted security boundary. Claude's plan mode is provider behavior, not a process sandbox, so an invited contact still cannot start the operator's local Claude CLI. The plugin checks the signature-verified requester before resolving cwd; a non-admin therefore cannot launch Claude or probe operator paths. An admin's Read only, workspace, or bounded Full access choice maps to Claude manual, Accept Edits, or Auto mode. The browser never chooses those modes, and resuming reapplies the current Host ceiling.

The acceptance test measured the whole path, not just the presence of a button. A real admin browser sent one OIP request through the production relay. The card rendered Claude Code · Completed · Open Work Room. Opening the room showed the provider UUID as its target. A follow-up typed inside that room reached the same outer OIP session, caused co ai to call Claude with that exact UUID, and returned the second requested result. Ninety focused unit and security tests passed before the browser run.

The lesson is the same one that makes protocol adapters worth having: data being available is not the same as semantics being owned. A session ID inside an opaque result can be displayed. A Work Room needs a lifecycle — identity, parentage, status, authority, continuation, and replay — emitted by the layer that actually controls the provider.