@cocorograph/hub-agent 0.8.120 → 0.8.122

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocorograph/hub-agent",
-  "version": "0.8.120",
+  "version": "0.8.122",
   "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの Claude / Codex チャットと tmux セッションを中継する。",
   "type": "module",
   "license": "UNLICENSED",

package/src/codex-appserver-client.mjs

@@ -98,6 +98,8 @@ export class CodexAppServerClient extends EventEmitter {
         "COCKPIT_SIBLING_SELF_KIND",
         "COCKPIT_SIBLING_CWD",
         "COCKPIT_SIBLING_TOKEN",
+        "COCKPIT_DELEGATE_DISPLAY_TOKEN",
+        "COCKPIT_DELEGATE_EVENT_ACK_VERSION",
       ]) {
         const val = spawnEnv[key]
         // TOML 文字列としてクォート (パスの空白/特殊文字対策)。値に " は含まれない

package/src/codex-stream-bridge.mjs

@@ -4204,7 +4204,7 @@ export class CodexStreamBridge extends EventEmitter {
   }
 
   /** Display events never start a turn and only target an exact thread in this cwd. */
-  emitToStream(cwd, sessionId, event) {
+  emitToStream(cwd, sessionId, event, notificationName = "cockpit/review_event") {
     if (!cwd || !sessionId) return { status: "not_found" }
     const matches = [...this._liveSessions()].filter((s) => s.cwd === cwd && s.threadId === sessionId)
     if (matches.length !== 1) return { status: matches.length ? "ambiguous" : "not_found" }
@@ -4214,7 +4214,7 @@ export class CodexStreamBridge extends EventEmitter {
       producer_seq: session.seq,
       thread_id: session.threadId,
       cwd: session.cwd,
-      notification: { method: "cockpit/review_event", params: event },
+      notification: { method: notificationName, params: event },
     })
     return { status: "delivered", session: this._describe(session) }
   }

package/src/delegate-display-auth.mjs

@@ -0,0 +1,80 @@
+import fs from "node:fs"
+import path from "node:path"
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto"
+import { paths } from "./config.mjs"
+
+/**
+ * Publish a complete key atomically: write a temp file in the same directory, then link(2) it to
+ * the final name. link fails with EEXIST if another process won, so the published file is always
+ * complete and never overwritten (overwriting would invalidate tokens already handed out).
+ * An existing malformed key is NOT regenerated here; key() rejects it so the failure stays visible.
+ */
+function publishKey(dir, file) {
+  const tmp = path.join(dir, `key.${process.pid}.${randomBytes(8).toString("hex")}.tmp`)
+  try {
+    const fd = fs.openSync(tmp, "wx", 0o600)
+    try {
+      fs.writeFileSync(fd, randomBytes(32))
+      fs.fsyncSync(fd)
+    } finally { fs.closeSync(fd) }
+    try {
+      fs.linkSync(tmp, file)
+    } catch (err) {
+      if (err.code !== "EEXIST") throw new Error("delegate display auth key creation failed")
+    }
+  } finally {
+    try { fs.unlinkSync(tmp) } catch {}
+  }
+}
+
+function key() {
+  const dir = process.env.HUB_DELEGATE_DISPLAY_AUTH_DIR || path.join(paths.configDir, "delegate-display-auth")
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+  const directory = fs.lstatSync(dir)
+  if (!directory.isDirectory() || directory.isSymbolicLink() || process.getuid?.() == null ||
+      directory.uid !== process.getuid() || (directory.mode & 0o777) !== 0o700) {
+    throw new Error("unsafe delegate display auth directory")
+  }
+  const file = path.join(dir, "key")
+  let info
+  try {
+    info = fs.lstatSync(file)
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err
+    publishKey(dir, file)
+    info = fs.lstatSync(file)
+  }
+  if (!info.isFile() || info.isSymbolicLink() || info.uid !== process.getuid() ||
+      (info.mode & 0o777) !== 0o600 || info.size !== 32) {
+    throw new Error("unsafe delegate display auth key")
+  }
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW)
+  try {
+    const opened = fs.fstatSync(fd)
+    if (!opened.isFile() || opened.ino !== info.ino || opened.dev !== info.dev ||
+        opened.uid !== info.uid || (opened.mode & 0o777) !== 0o600 || opened.size !== 32) {
+      throw new Error("delegate display auth key changed while reading")
+    }
+    const bytes = Buffer.alloc(33)
+    let length = 0
+    while (length < bytes.length) {
+      const count = fs.readSync(fd, bytes, length, bytes.length - length, null)
+      if (!count) break
+      length += count
+    }
+    if (length !== 32) throw new Error("invalid delegate display auth key length")
+    return bytes.subarray(0, 32)
+  } finally { fs.closeSync(fd) }
+}
+
+export function displayTokenForCwd(cwd) {
+  if (typeof cwd !== "string" || !cwd) throw new Error("invalid delegate display cwd")
+  return "v1." + createHmac("sha256", key()).update("delegate-event\0" + cwd).digest("base64url")
+}
+
+export function verifyDisplayToken(cwd, token) {
+  if (typeof cwd !== "string" || !cwd || typeof token !== "string" || !/^v1\.[A-Za-z0-9_-]{43}$/.test(token)) return false
+  const expected = Buffer.from(displayTokenForCwd(cwd))
+  const actual = Buffer.from(token)
+  return actual.length === expected.length && timingSafeEqual(actual, expected)
+}

package/src/delegation-event-store.mjs

@@ -0,0 +1,332 @@
+import fs from "node:fs/promises"
+import { constants } from "node:fs"
+import path from "node:path"
+import { createHash, randomUUID } from "node:crypto"
+import { truncateString } from "./truncate-string.mjs"
+import { paths } from "./config.mjs"
+
+export const DELEGATION_RETENTION_MS = 30 * 24 * 60 * 60 * 1000
+export const DELEGATION_SESSION_LIMIT = 1000
+export const DELEGATION_SOFT_BYTES = 4 * 1024 * 1024
+export const DELEGATION_HARD_BYTES = 5 * 1024 * 1024
+const TERMINAL_DELEGATE_PROMPT_MAX_LENGTH = 2_000
+const TERMINAL_DELEGATE_AGENT_MAX_LENGTH = 200
+const TERMINAL_DELEGATE_DESCRIPTION_MAX_LENGTH = 2_000
+
+function compactTerminalEvent(event, includePrompt = false) {
+  const storedEvent = {}
+  for (const field of [
+    "type",
+    "subtype",
+    "delegation_id",
+    "phase",
+    "background",
+    "timestamp",
+  ]) {
+    if (event[field] !== undefined) storedEvent[field] = event[field]
+  }
+
+  if (typeof event.agent === "string") {
+    storedEvent.agent = truncateString(
+      event.agent,
+      TERMINAL_DELEGATE_AGENT_MAX_LENGTH,
+      (length) => `\n\n[エージェント名はここで打ち切られています（全 ${length} 文字）]`,
+    )
+  }
+  if (typeof event.description === "string") {
+    storedEvent.description = truncateString(
+      event.description,
+      TERMINAL_DELEGATE_DESCRIPTION_MAX_LENGTH,
+      (length) => `\n\n[説明はここで打ち切られています（全 ${length} 文字）]`,
+    )
+  }
+  if (includePrompt && typeof event.prompt === "string") {
+    storedEvent.prompt = truncateString(
+      event.prompt,
+      TERMINAL_DELEGATE_PROMPT_MAX_LENGTH,
+      (length) =>
+        `\n\n[終了済み委譲の依頼本文はここで打ち切られています（全 ${length} 文字）]`,
+    )
+  }
+
+  return storedEvent
+}
+
+const FIELDS = new Set([
+  "type", "subtype", "delegation_id", "phase", "agent", "description", "background",
+  "prompt", "pid", "pid_started_at", "timestamp",
+])
+function validEvent(event) {
+  return event && typeof event === "object" && !Array.isArray(event) &&
+    Object.keys(event).every((key) => FIELDS.has(key)) &&
+    event.type === "system" && event.subtype === "codex_delegate" &&
+    typeof event.delegation_id === "string" && event.delegation_id.length > 0 && event.delegation_id.length <= 200 &&
+    ["started", "completed", "failed", "stopped"].includes(event.phase) &&
+    (event.phase !== "started" || (typeof event.agent === "string" && event.agent.length > 0)) &&
+    ["agent", "description", "prompt", "pid_started_at"].every((key) => event[key] === undefined || typeof event[key] === "string") &&
+    (event.background === undefined || typeof event.background === "boolean") &&
+    (event.pid === undefined || (Number.isInteger(event.pid) && event.pid > 0)) &&
+    typeof event.timestamp === "string" && Number.isFinite(Date.parse(event.timestamp))
+}
+
+/**
+ * 既定の保存先。`HUB_DELEGATION_EVENTS_DIR` があればそれを使う（テストが実運用の
+ * `~/.hub/delegation-events` へ書き込まないよう、test/setup-env.mjs が実行ごとの一時ディレクトリへ向ける）。
+ */
+export function defaultDelegationEventsDir() {
+  return process.env.HUB_DELEGATION_EVENTS_DIR || path.join(paths.configDir, "delegation-events")
+}
+
+/** Single daemon writer. All decisions, snapshots and replay checks share this queue. */
+export class DelegationEventStore {
+  constructor(dir = defaultDelegationEventsDir(), now = Date.now, logger) {
+    this.dir = dir
+    this.now = now
+    this.logger = logger
+    this.queue = Promise.resolve()
+    this.lastSweep = -Infinity
+    this.sweeping = false
+  }
+  _serial(operation) {
+    const pending = this.queue.then(operation)
+    this.queue = pending.catch(() => {})
+    return pending
+  }
+  _target(cwd, sessionId, kind = "claude") {
+    if (!["claude", "codex"].includes(kind)) throw new Error("invalid delegation kind")
+    return kind === "codex" ? [cwd, sessionId, kind] : [cwd, sessionId]
+  }
+  _file(cwd, sessionId, kind = "claude") {
+    if ([cwd, sessionId].some((value) => typeof value !== "string" || !value)) throw new Error("invalid delegation target")
+    return path.join(this.dir, createHash("sha256").update(JSON.stringify(this._target(cwd, sessionId, kind))).digest("hex") + ".json")
+  }
+  async _checkDirectory() {
+    const info = await fs.lstat(this.dir)
+    if (!info.isDirectory() || info.isSymbolicLink() || process.getuid?.() == null ||
+        info.uid !== process.getuid() || (info.mode & 0o777) !== 0o700) {
+      throw new Error("unsafe delegation directory")
+    }
+  }
+  async _prepare() {
+    await fs.mkdir(this.dir, { recursive: true, mode: 0o700 })
+    await this._checkDirectory()
+  }
+  async _read(file, target) {
+    await this._checkDirectory()
+    let info
+    try { info = await fs.lstat(file) } catch (err) {
+      if (err.code === "ENOENT") return []
+      throw err
+    }
+    if (!info.isFile() || info.isSymbolicLink() || info.uid !== process.getuid?.() || (info.mode & 0o777) !== 0o600) {
+      throw new Error("unsafe delegation store")
+    }
+    if (info.size > DELEGATION_HARD_BYTES) throw new Error("delegation store exceeds size limit")
+    const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW)
+    let snapshot
+    try {
+      const opened = await handle.stat()
+      if (opened.ino !== info.ino || opened.dev !== info.dev || opened.size > DELEGATION_HARD_BYTES ||
+          opened.uid !== info.uid || (opened.mode & 0o777) !== 0o600) throw new Error("delegation store changed while reading")
+      const buffer = Buffer.alloc(DELEGATION_HARD_BYTES + 1)
+      let length = 0
+      while (length < buffer.length) {
+        const { bytesRead } = await handle.read(buffer, length, buffer.length - length, null)
+        if (!bytesRead) break
+        length += bytesRead
+      }
+      if (length > DELEGATION_HARD_BYTES) throw new Error("delegation store exceeds size limit")
+      snapshot = JSON.parse(buffer.subarray(0, length).toString("utf8"))
+    } finally { await handle.close() }
+    if (!snapshot || snapshot.schema_version !== 1 || !Array.isArray(snapshot.target) ||
+        !(snapshot.target.length === 2 || (snapshot.target.length === 3 && snapshot.target[2] === "codex")) || snapshot.target.some((v) => typeof v !== "string" || !v) ||
+        (target && JSON.stringify(snapshot.target) !== JSON.stringify(target)) ||
+        this._file(...snapshot.target) !== file || !Array.isArray(snapshot.rows)) throw new Error("invalid delegation snapshot")
+    const ids = new Set()
+    for (const row of snapshot.rows) {
+      if (!row || typeof row !== "object" || Array.isArray(row) ||
+          Object.keys(row).some((key) => !["id", "started", "startedAt", "terminal", "at"].includes(key)) ||
+          !Number.isFinite(row.at) || ids.has(row.id) || (!row.started && !row.terminal) ||
+          (row.started ? !Number.isFinite(row.startedAt) : row.startedAt !== undefined)) throw new Error("invalid delegation row")
+      ids.add(row.id)
+      for (const key of ["started", "terminal"]) {
+        if (row[key] !== undefined && (!validEvent(row[key]) || row[key].delegation_id !== row.id ||
+            (key === "started") !== (row[key].phase === "started"))) throw new Error("invalid delegation event")
+      }
+    }
+    return snapshot.rows
+  }
+  _prune(rows, kept = []) {
+    rows = rows.filter((row) => kept.includes(row) || !row.terminal || row.at > this.now() - DELEGATION_RETENTION_MS)
+    const oldest = rows.filter((row) => row.terminal).sort((a, b) => a.at - b.at)
+    const removed = new Set(oldest.filter((row) => !kept.includes(row))
+      .slice(0, Math.max(0, oldest.length - DELEGATION_SESSION_LIMIT)))
+    return rows.filter((row) => !removed.has(row))
+  }
+  rows(cwd, sessionId, kind = "claude") {
+    return this._serial(async () => {
+      await this._prepare()
+      const file = this._file(cwd, sessionId, kind)
+      return this._prune(await this._read(file, this._target(cwd, sessionId, kind)))
+    })
+  }
+  record(cwd, sessionId, event, kind = "claude") {
+    // Snapshot caller-owned input before waiting for the writer.
+    const copy = structuredClone(event)
+    return this._serial(() => this._record(cwd, sessionId, copy, kind))
+  }
+  async _record(cwd, sessionId, event, kind = "claude") {
+    if (!validEvent(event)) throw new Error("invalid delegation event")
+    await this._prepare()
+    const file = this._file(cwd, sessionId, kind)
+    const target = this._target(cwd, sessionId, kind)
+    const rows = this._prune(await this._read(file, target))
+    const result = this._apply(rows, target, event)
+    if (result.acceptance === "accept") await this._write(file, result.serialized)
+    return result.acceptance
+  }
+  // Apply to a copy so a rejected event cannot partially mutate the caller's rows.
+  _apply(sourceRows, target, event) {
+    const rows = structuredClone(sourceRows)
+    const result = this._mutate(rows, event)
+    if (result.acceptance !== "accept") return result
+    return this._finalize(rows, target, [result.row], event.phase === "started")
+  }
+  /** Mutate rows in place. Rejections return before touching anything. */
+  _mutate(rows, event) {
+    if (!validEvent(event)) throw new Error("invalid delegation event")
+    let row = rows.find((candidate) => candidate.id === event.delegation_id)
+    if (event.phase === "started") {
+      if (row?.terminal) return { acceptance: "stale" }
+      if (row?.started) return { acceptance: "duplicate" }
+    } else if (row?.terminal?.phase === event.phase) return { acceptance: "duplicate" }
+    if (!row) {
+      row = { id: event.delegation_id, at: this.now() }
+      rows.push(row)
+    }
+    row.at = this.now()
+    if (event.phase === "started") {
+      row.started = event
+      row.startedAt = row.at
+    } else {
+      if (row.started && !row.terminal) row.started = compactTerminalEvent(row.started, true)
+      row.terminal = compactTerminalEvent(event)
+    }
+    return { acceptance: "accept", row }
+  }
+  /** Prune, enforce the byte limit and serialize once. `kept` rows are never evicted. */
+  _finalize(rows, target, kept, started) {
+    rows = this._prune(rows, kept)
+    const limit = started ? DELEGATION_SOFT_BYTES : DELEGATION_HARD_BYTES
+    let bytes = Buffer.byteLength(JSON.stringify({ schema_version: 1, target, rows }))
+    if (bytes > limit) {
+      // Keep the incoming terminals: evicting them would immediately lose their tombstones.
+      const evictable = rows.filter((candidate) => !kept.includes(candidate) && candidate.terminal)
+        .sort((a, b) => a.at - b.at)
+      const removed = new Set()
+      // A kept row always remains, so each eviction drops exactly one separating comma.
+      while (bytes > limit && evictable.length) {
+        const oldest = evictable.shift()
+        removed.add(oldest)
+        bytes -= Buffer.byteLength(JSON.stringify(oldest)) + 1
+      }
+      rows = rows.filter((candidate) => !removed.has(candidate))
+    }
+    const serialized = JSON.stringify({ schema_version: 1, target, rows })
+    if (Buffer.byteLength(serialized) > limit) {
+      if (started) return { acceptance: "full" }
+      throw new Error("delegation store exceeds size limit")
+    }
+    return { acceptance: "accept", rows, serialized }
+  }
+  async _write(file, serialized) {
+    const tmp = file + "." + randomUUID() + ".tmp"
+    try {
+      await fs.writeFile(tmp, serialized, { flag: "wx", mode: 0o600 })
+      await this._checkDirectory()
+      await fs.rename(tmp, file)
+    } finally {
+      await fs.unlink(tmp).catch((err) => { if (err.code !== "ENOENT") throw err })
+    }
+  }
+  /** Reconcile the entire liveness plan against one fresh snapshot, then write at most once. */
+  replayPlan(cwd, sessionId, plan, emit, kind = "claude") {
+    return this._serial(async () => {
+      const file = this._file(cwd, sessionId, kind)
+      const target = this._target(cwd, sessionId, kind)
+      const rows = this._prune(await this._read(file, target))
+      const current = new Map(rows.map((row) => [row.id, JSON.stringify(row)]))
+      // One working copy for the whole plan; `current` keeps the snapshot used for matching.
+      const working = structuredClone(rows)
+      const kept = []
+      const deliveries = []
+      for (const { row, stopped } of plan) {
+        if (current.get(row.id) !== JSON.stringify(row)) continue
+        if (stopped) {
+          try {
+            const result = this._mutate(working, stopped)
+            if (result.acceptance === "accept") kept.push(result.row)
+          } catch (err) {
+            this.logger?.warn?.({ error: err?.message, delegation_id: row.id }, "delegation stopped persistence failed")
+          }
+          deliveries.push([stopped])
+        } else {
+          deliveries.push([row.started, row.terminal].filter(Boolean))
+        }
+      }
+      if (kept.length) {
+        try {
+          // Like sequential records, only the last accepted terminal is protected; earlier ones
+          // in the batch stay evictable so an oversized batch still persists what fits.
+          const { serialized } = this._finalize(working, target, kept.slice(-1), false)
+          await this._write(file, serialized)
+        } catch (err) {
+          this.logger?.warn?.({ error: err?.message }, "delegation stopped persistence failed")
+        }
+      }
+      for (const events of deliveries) {
+        try { for (const event of events) emit(event) } catch (err) {
+          this.logger?.warn?.({ error: err?.message, delegation_id: events[0].delegation_id }, "delegation row replay failed")
+        }
+      }
+    })
+  }
+  async sweep() {
+    if (this.sweeping || this.now() - this.lastSweep < 86400 * 1000) return
+    this.sweeping = true
+    try {
+      const names = await this._serial(async () => {
+        try { await this._checkDirectory() } catch (err) {
+          if (err.code === "ENOENT") return []
+          throw err
+        }
+        return fs.readdir(this.dir)
+      })
+      for (const name of names) {
+        try { await this._serial(() => this._sweepFile(name)) } catch (err) {
+          this.logger?.warn?.({ error: err?.message, file: name }, "delegation sweep file failed")
+        }
+      }
+      // Only a completed pass suppresses the next 24 hours; a directory failure retries.
+      this.lastSweep = this.now()
+    } finally {
+      this.sweeping = false
+    }
+  }
+  async _sweepFile(name) {
+    await this._checkDirectory()
+    const file = path.join(this.dir, name)
+    if (/^[a-f0-9]{64}\.json\.[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}\.tmp$/.test(name)) {
+      const info = await fs.lstat(file).catch((err) => { if (err.code !== "ENOENT") throw err })
+      if (info?.isFile() && !info.isSymbolicLink() && info.uid === process.getuid?.() &&
+          info.mtimeMs <= this.now() - 3600 * 1000) await fs.unlink(file)
+      return
+    }
+    if (!/^[a-f0-9]{64}\.json$/.test(name)) return
+    let rows
+    try { rows = await this._read(file) } catch { return }
+    if (rows.length && rows.every((row) => row.terminal && row.at <= this.now() - DELEGATION_RETENTION_MS)) {
+      await fs.unlink(file)
+    }
+  }
+}

package/src/main.mjs

@@ -4365,6 +4365,15 @@ export async function dispatch(msg, ctx) {
           } catch (err) {
             ctx.logger?.warn?.({ err: err?.message }, "failed to replay review events")
           }
+          try {
+            if (info.threadId) {
+              void ctx.siblingInjectBridge
+                ?.replayDelegations?.(resolvedCwd || process.env.HOME || process.cwd(), info.threadId, "codex")
+                ?.catch((err) => ctx.logger?.warn?.({ err: err?.message }, "failed to replay delegation events"))
+            }
+          } catch (err) {
+            ctx.logger?.warn?.({ err: err?.message }, "failed to replay delegation events")
+          }
           const session = ctx.codexBridge.sessions?.get(stream_id)
           if (session && info.resuming) {
             void loadResumeChatContext(session, "codex").catch(() => {})

package/src/sibling-inject.mjs

@@ -71,6 +71,7 @@
  * 判断材料として **外部契約に残す**。
  */
 
+import { verifyDisplayToken } from "./delegate-display-auth.mjs"
 import { watch } from "node:fs"
 import { chmod, lstat, mkdir, readFile, writeFile, rename, unlink, readdir } from "node:fs/promises"
 import { execFile as execFileCallback } from "node:child_process"
@@ -81,6 +82,8 @@ import path from "node:path"
 import { verifySiblingTokenAny, siblingTokenCwd } from "./sibling-token.mjs"
 import { describeLiveSessionsUnion } from "./live-sessions.mjs"
 import { ReviewEventStore, validReviewEvent } from "./review-event-store.mjs"
+import { truncateString } from "./truncate-string.mjs"
+import { DelegationEventStore } from "./delegation-event-store.mjs"
 import { listChatTargets } from "./chat-targets.mjs"
 
 export const SIBLING_REQUESTS_DIR =
@@ -97,26 +100,13 @@ const SIBLING_SWEEP_DEBOUNCE_MS = 25
  */
 export const SIBLING_BACKSTOP_SWEEP_MS = 1000
 
-export const ACTIVE_DELEGATIONS_PER_SESSION_LIMIT = 100
-export const DELEGATION_LEDGER_RETENTION_MS = 24 * 60 * 60 * 1000
 export const SIBLING_RESULT_RETENTION_MS = 24 * 60 * 60 * 1000
 const SIBLING_REQUEST_MAX_BYTES = 1024 * 1024
 const DELEGATE_PROMPT_MAX_LENGTH = 64_000
-const TERMINAL_DELEGATE_PROMPT_MAX_LENGTH = 2_000
-const TERMINAL_DELEGATE_AGENT_MAX_LENGTH = 200
-const TERMINAL_DELEGATE_DESCRIPTION_MAX_LENGTH = 2_000
 const DELEGATION_ID_MAX_LENGTH = 200
 
 const execFile = promisify(execFileCallback)
 
-function truncateString(value, maxLength, truncationNote) {
-  if (value.length <= maxLength) return value
-  let end = maxLength
-  const lastCodeUnit = value.charCodeAt(end - 1)
-  if (lastCodeUnit >= 0xd800 && lastCodeUnit <= 0xdbff) end -= 1
-  return value.slice(0, end) + truncationNote(value.length)
-}
-
 function truncateDelegatePrompt(prompt) {
   return truncateString(
     prompt,
@@ -125,45 +115,6 @@ function truncateDelegatePrompt(prompt) {
   )
 }
 
-function compactTerminalEvent(event, includePrompt = false) {
-  const storedEvent = {}
-  for (const field of [
-    "type",
-    "subtype",
-    "delegation_id",
-    "phase",
-    "background",
-    "timestamp",
-  ]) {
-    if (event[field] !== undefined) storedEvent[field] = event[field]
-  }
-
-  if (typeof event.agent === "string") {
-    storedEvent.agent = truncateString(
-      event.agent,
-      TERMINAL_DELEGATE_AGENT_MAX_LENGTH,
-      (length) => `\n\n[エージェント名はここで打ち切られています（全 ${length} 文字）]`,
-    )
-  }
-  if (typeof event.description === "string") {
-    storedEvent.description = truncateString(
-      event.description,
-      TERMINAL_DELEGATE_DESCRIPTION_MAX_LENGTH,
-      (length) => `\n\n[説明はここで打ち切られています（全 ${length} 文字）]`,
-    )
-  }
-  if (includePrompt && typeof event.prompt === "string") {
-    storedEvent.prompt = truncateString(
-      event.prompt,
-      TERMINAL_DELEGATE_PROMPT_MAX_LENGTH,
-      (length) =>
-        `\n\n[終了済み委譲の依頼本文はここで打ち切られています（全 ${length} 文字）]`,
-    )
-  }
-
-  return storedEvent
-}
-
 /**
  * `ps` の起動時刻を送受信双方で比較する契約形へ正規化する。
  * 先頭・末尾の Unicode 空白だけを除去し、日時本体の内部空白は変更しない。
@@ -455,6 +406,7 @@ export class SiblingInjectBridge {
     isInputBlocked,
     starter,
     watchFn = watch,
+    delegationDir,
   } = {}) {
     this.dir = dir
     this.claudeBridge = claudeBridge
@@ -478,10 +430,7 @@ export class SiblingInjectBridge {
     this._starter = starter
     this._watchFn = watchFn
     this._newTurnInFlight = 0
-    /** @type {Map<string, Map<string, {event: object, recordedAt: number}>>} cwd+session ごとの進行中委譲。 */
-    this._activeDelegations = new Map()
-    /** @type {Map<string, Map<string, {startedEvent?: object, terminalEvent: object, startedAt?: number, recordedAt: number}>>} 終了済み委譲の再送情報を兼ねた墓標。 */
-    this._terminalDelegations = new Map()
+    this.delegationEvents = new DelegationEventStore(delegationDir, now, logger)
   }
 
   /** restart coordinator が通常/明示注入の bridge await 中を観測する。 */
@@ -510,91 +459,10 @@ export class SiblingInjectBridge {
     }
   }
 
-  _delegationSessionKey(cwd, sessionId) {
-    return `${cwd}\u0000${sessionId}`
-  }
-
-  _pruneDelegations() {
-    const cutoff = this._now() - DELEGATION_LEDGER_RETENTION_MS
-    for (const [sessionKey, entries] of this._activeDelegations) {
-      for (const [delegationId, entry] of entries) {
-        if (entry.recordedAt < cutoff) entries.delete(delegationId)
-      }
-      if (entries.size === 0) this._activeDelegations.delete(sessionKey)
-    }
-    for (const [sessionKey, entries] of this._terminalDelegations) {
-      for (const [delegationId, entry] of entries) {
-        if (entry.recordedAt < cutoff) entries.delete(delegationId)
-      }
-      if (entries.size === 0) this._terminalDelegations.delete(sessionKey)
-    }
-  }
-
-  _recordDelegateEvent(cwd, sessionId, event, { prune = true } = {}) {
-    if (prune) this._pruneDelegations()
-    const sessionKey = this._delegationSessionKey(cwd, sessionId)
-    if (event.phase !== "started") {
-      const activeEntry = this._activeDelegations.get(sessionKey)?.get(event.delegation_id)
-      const existingTerminalEntry = this._terminalDelegations
-        .get(sessionKey)
-        ?.get(event.delegation_id)
-      this._activeDelegations.get(sessionKey)?.delete(event.delegation_id)
-      if (this._activeDelegations.get(sessionKey)?.size === 0) {
-        this._activeDelegations.delete(sessionKey)
-      }
-      let terminalEntries = this._terminalDelegations.get(sessionKey)
-      if (!terminalEntries) {
-        terminalEntries = new Map()
-        this._terminalDelegations.set(sessionKey, terminalEntries)
-      }
-      terminalEntries.delete(event.delegation_id)
-      terminalEntries.set(event.delegation_id, {
-        ...(activeEntry
-          ? {
-              startedEvent: compactTerminalEvent(activeEntry.event, true),
-              startedAt: activeEntry.recordedAt,
-            }
-          : existingTerminalEntry?.startedEvent && existingTerminalEntry.startedAt !== undefined
-            ? {
-                startedEvent: existingTerminalEntry.startedEvent,
-                startedAt: existingTerminalEntry.startedAt,
-              }
-            : {}),
-        terminalEvent: compactTerminalEvent(event),
-        recordedAt: this._now(),
-      })
-      while (terminalEntries.size > ACTIVE_DELEGATIONS_PER_SESSION_LIMIT) {
-        terminalEntries.delete(terminalEntries.keys().next().value)
-      }
-      return
-    }
-    if (this._terminalDelegations.get(sessionKey)?.has(event.delegation_id)) return
-    let entries = this._activeDelegations.get(sessionKey)
-    if (!entries) {
-      entries = new Map()
-      this._activeDelegations.set(sessionKey, entries)
-    }
-    entries.delete(event.delegation_id)
-    entries.set(event.delegation_id, { event, recordedAt: this._now() })
-    while (entries.size > ACTIVE_DELEGATIONS_PER_SESSION_LIMIT) {
-      entries.delete(entries.keys().next().value)
-    }
-  }
-
-  _delegateEventAcceptance(cwd, sessionId, event) {
-    this._pruneDelegations()
-    const sessionKey = this._delegationSessionKey(cwd, sessionId)
-    const terminal = this._terminalDelegations.get(sessionKey)?.get(event.delegation_id)
-    if (event.phase === "started") {
-      if (terminal) return "stale"
-      return this._activeDelegations.get(sessionKey)?.has(event.delegation_id)
-        ? "duplicate"
-        : "accept"
-    }
-    if (!terminal) return "accept"
-    // terminal 同士は後から届いた実イベントを最新終端として上書きできる。
-    // 例: replay が PID 消失から stopped を合成した後に producer の completed が届く。
-    return terminal.terminalEvent?.phase === event.phase ? "duplicate" : "accept"
+  _emitDelegation(kind, cwd, sessionId, event) {
+    const bridge = kind === "codex" ? this.codexBridge : this.claudeBridge
+    return bridge?.emitToStream?.(cwd, sessionId, event,
+      ...(kind === "codex" ? ["cockpit/delegate_event"] : [])) || { status: "not_found" }
   }
 
   _liveClaudeSession(cwd, sessionId) {
@@ -636,54 +504,38 @@ export class SiblingInjectBridge {
   }
 
   /** attach/再接続時に同じ cwd+session の進行中・終了済み委譲を開始順で再送する。 */
-  async replayDelegations(cwd, sessionId) {
+  async replayDelegations(cwd, sessionId, kind = "claude") {
     if (!cwd || !sessionId) return
-    this._pruneDelegations()
-    const sessionKey = this._delegationSessionKey(cwd, sessionId)
-    const replayEntries = [
-      ...[...(this._activeDelegations.get(sessionKey) || [])].map(([delegationId, entry]) => ({
-        delegationId,
-        entry,
-        kind: "active",
-        startedAt: entry.recordedAt,
-      })),
-      ...[...(this._terminalDelegations.get(sessionKey) || [])]
-        .filter(([, entry]) => entry.startedEvent && entry.startedAt !== undefined)
-        .map(([delegationId, entry]) => ({
-          delegationId,
-          entry,
-          kind: "terminal",
-          startedAt: entry.startedAt,
-        })),
-    ].sort((a, b) => a.startedAt - b.startedAt)
-
-    for (const { delegationId, entry, kind } of replayEntries) {
-      if (kind === "terminal") {
-        if (this._terminalDelegations.get(sessionKey)?.get(delegationId) !== entry) continue
-        this.claudeBridge?.emitToStream?.(cwd, sessionId, entry.startedEvent)
-        this.claudeBridge?.emitToStream?.(cwd, sessionId, entry.terminalEvent)
-        continue
-      }
-      const alive = await this._delegateProcessAlive(entry.event)
-      // 生存確認中に終端が届いた場合、古い snapshot の started/stopped を後から流さない。
-      if (this._activeDelegations.get(sessionKey)?.get(delegationId) !== entry) continue
-      if (alive) {
-        this.claudeBridge?.emitToStream?.(cwd, sessionId, entry.event)
-        continue
-      }
-      const stopped = {
-        type: "system",
-        subtype: "codex_delegate",
-        delegation_id: delegationId,
-        phase: "stopped",
-        ...(entry.event.agent !== undefined ? { agent: entry.event.agent } : {}),
-        ...(entry.event.description !== undefined
-          ? { description: entry.event.description }
-          : {}),
-        timestamp: new Date(this._now()).toISOString(),
+    try {
+      const snapshot = await this.delegationEvents.rows(cwd, sessionId, kind)
+      const rows = snapshot.filter((row) => row.started).sort((a, b) => a.startedAt - b.startedAt)
+      const plan = []
+      for (const row of rows) {
+        let alive = true
+        try {
+          alive = row.terminal || await this._delegateProcessAlive(row.started)
+        } catch (err) {
+          this.logger?.warn?.({ error: err?.message, delegation_id: row.id }, "delegation PID check failed")
+        }
+        try {
+          const stopped = alive ? null : {
+            type: "system",
+            subtype: "codex_delegate",
+            delegation_id: row.id,
+            phase: "stopped",
+            ...(row.started.agent !== undefined ? { agent: row.started.agent } : {}),
+            ...(row.started.description !== undefined ? { description: row.started.description } : {}),
+            timestamp: new Date(this._now()).toISOString(),
+          }
+          plan.push({ row, stopped })
+        } catch (err) {
+          this.logger?.warn?.({ error: err?.message, delegation_id: row.id }, "delegation row replay failed")
+        }
       }
-      this._recordDelegateEvent(cwd, sessionId, stopped)
-      this.claudeBridge?.emitToStream?.(cwd, sessionId, stopped)
+      await this.delegationEvents.replayPlan(cwd, sessionId, plan,
+        (event) => this._emitDelegation(kind, cwd, sessionId, event), kind)
+    } catch (err) {
+      this.logger?.warn?.({ error: err?.message }, "delegation replay failed")
     }
   }
 
@@ -794,6 +646,9 @@ export class SiblingInjectBridge {
 
   /** 起動時 / 取りこぼし保険: dir 内の全要求ファイルを読む。 */
   async _sweep({ startup = false } = {}) {
+    void this.delegationEvents.sweep().catch((err) => {
+      this.logger?.warn?.({ error: err?.message }, "delegation sweep failed")
+    })
     let names = []
     try {
       names = await readdir(this.dir)
@@ -901,6 +756,8 @@ export class SiblingInjectBridge {
       pid,
       pid_started_at,
       request_ack,
+      display_auth,
+      ack_capability,
     } = body || {}
     // 連携カード種別 (Phase 2, 2026-07-23): 注入を受け手画面で専用カード表示させるためのタグ。
     // 既知値 ('peer'|'orchestrator') のみ通し、未知値/未指定は undefined に落とす (未知の source を
@@ -910,6 +767,15 @@ export class SiblingInjectBridge {
     const isList = op === "list"
     const isExplicit = op === "inject"
     const isDelegateEvent = op === "delegate-event"
+    const ackV2 = isDelegateEvent && request_ack === true && ack_capability === "persisted-delivered-v2"
+    const delegateKind = target_cli_kind === undefined ? "claude" : target_cli_kind
+    let displayAuthorized = false
+    const hasDisplayAuth = isDelegateEvent && Object.hasOwn(body, "display_auth")
+    if (hasDisplayAuth) {
+      try { displayAuthorized = verifyDisplayToken(cwd, display_auth) } catch {
+        this.logger?.warn?.({}, "delegate display auth unavailable")
+      }
+    }
     const isReviewEvent = op === "review-event"
     const hasRequestAck = Object.prototype.hasOwnProperty.call(body || {}, "request_ack")
     const isRestart = op === "restart"
@@ -917,6 +783,13 @@ export class SiblingInjectBridge {
     const badKind = !["claude", "codex", "grok"].includes(target_cli_kind)
     const delegatePhases = new Set(["started", "completed", "failed", "stopped"])
     const badDelegateBody =
+      !["claude", "codex"].includes(delegateKind) ||
+      (target_session_id !== undefined && typeof target_session_id !== "string") ||
+      Object.keys(body || {}).some((key) => ![
+        "op", "cwd", "target_cli_kind", "token", "target_session_id", "delegation_id", "phase",
+        "agent", "description", "background", "prompt", "timestamp", "pid", "pid_started_at",
+        "request_ack", "display_auth", "ack_capability",
+      ].includes(key)) ||
       typeof delegation_id !== "string" ||
       !delegation_id ||
       delegation_id.length > DELEGATION_ID_MAX_LENGTH ||
@@ -934,7 +807,7 @@ export class SiblingInjectBridge {
     const badBody = isReviewEvent
       ? !validReviewEvent(body.event) || typeof target_session_id !== "string" || !target_session_id ||
         typeof cwd !== "string" || !path.isAbsolute(cwd) ||
-        Object.keys(body).some((key) => !["op", "token", "cwd", "target_cli_kind", "target_session_id", "event"].includes(key)) ||
+        Object.keys(body).some((key) => !["op", "token", "cwd", "target_cli_kind", "target_session_id", "event", "display_auth", "ack_capability"].includes(key)) ||
         !requestInfo.isFile() || requestInfo.isSymbolicLink() || requestInfo.uid !== process.getuid?.() ||
         (requestInfo.mode & 0o777) !== 0o600
       : isDelegateEvent
@@ -985,7 +858,7 @@ export class SiblingInjectBridge {
       }
     } else if (!cwd || (!isDelegateEvent && badKind) || badBody) {
       result = { ok: false, error: "invalid_request" }
-    } else if (!verifySiblingTokenAny(token)) {
+    } else if (hasDisplayAuth ? !displayAuthorized : !verifySiblingTokenAny(token)) {
       // 2026-07-23 統一再設計 1-2: 認可を「ターゲット cwd 所有」→「いずれかの cwd の有効トークン
       // 所有 (= 同一ユーザーの spawn 済みセッション)」へ緩和し、クロス cwd 連携を解禁する。
       // cwd は引き続きターゲット解決のスコープとして使う (誤 cwd 着弾・情報漏洩は解決側で担保)。
@@ -1044,29 +917,51 @@ export class SiblingInjectBridge {
             ...(pid_started_at !== undefined ? { pid_started_at } : {}),
             timestamp: timestamp || new Date().toISOString(),
           }
-          // 墓標確認から配送成功時の台帳反映まで await を挟まない同期区間に閉じる。
-          // 配送失敗した started は台帳へ残さず、終端後に遅着した started は配送前に拒否する。
-          const acceptance = this._delegateEventAcceptance(cwd, target_session_id, event)
-          if (acceptance === "duplicate") {
+          let acceptance
+          let persisted = true
+          try {
+            acceptance = await this.delegationEvents.record(cwd, target_session_id, event, delegateKind)
+          } catch (err) {
+            persisted = false
+            this.logger?.warn?.({ request_id, error: err?.message }, "delegation persistence failed")
+          }
+          if (ackV2) {
+            persisted = persisted && acceptance !== "full"
+            const delivery = acceptance === "stale" ? { status: "not_found" }
+              : this._emitDelegation(delegateKind, cwd, target_session_id, event)
+            const delivered = delivery.status === "delivered"
+            result = !persisted
+              ? { ok: false, ack_version: 2, persisted: false, delivered,
+                  error: acceptance === "full" ? "delegation_store_full" : "delegation_persistence_failed", retryable: true }
+              : { ok: true, ack_version: 2, persisted: true, delivered,
+                  ...(acceptance === "duplicate" ? { duplicate: true } : {}),
+                  ...(acceptance === "stale" ? { stale: true } : {}),
+                  ...(!delivered && acceptance !== "stale" && acceptance !== "duplicate"
+                    ? { delivery_status: delivery.status } : {}) }
+          } else if (acceptance === "duplicate") {
             // ACK は「過去に受理した」だけでなく、対象 stream が現在も live であることも示す。
             // 台帳だけで成功を返すと、宛先消失後の retry を受理済みと誤認させる。
-            const live = this._liveClaudeSession(cwd, target_session_id)
-            result = live.status === "delivered"
+            const live = delegateKind === "claude" ? this._liveClaudeSession(cwd, target_session_id)
+              : { status: "delivered" }
+            // 保存後に未配送のまま切断した可能性があるため、duplicate も再配送する。
+            const delivered = live.status === "delivered"
+              ? this._emitDelegation(delegateKind, cwd, target_session_id, event)
+              : live
+            result = delivered.status === "delivered"
               ? { ok: true, duplicate: true }
-              : this._delegateTargetFailure(live)
+              : this._delegateTargetFailure(delivered)
           } else if (acceptance === "stale") {
             result = { ok: false, error: "stale_delegate_event" }
+          } else if (acceptance === "full") {
+            result = { ok: false, error: "delegation_store_full" }
           } else {
-            const r = this.claudeBridge?.emitToStream
-              ? this.claudeBridge.emitToStream(cwd, target_session_id, event)
-              : { status: "not_found" }
+            const r = this._emitDelegation(delegateKind, cwd, target_session_id, event)
             if (r.status === "delivered") {
-              // acceptance 直前に prune 済み。同じ同期区間で二重 prune しない。
-              this._recordDelegateEvent(cwd, target_session_id, event, { prune: false })
               result = { ok: true, delivered_to: r.session }
             } else {
-              result = this._delegateTargetFailure(r)
+              result = { ...this._delegateTargetFailure(r), persisted }
             }
+            if (!persisted) result.persisted = false
           }
         }
       } else if (isList) {
@@ -1251,6 +1146,10 @@ export class SiblingInjectBridge {
       }
     }
 
+    if (ackV2 && result.ack_version !== 2) {
+      result = { ok: false, ack_version: 2, persisted: false, delivered: false,
+        error: result.error, retryable: false }
+    }
     this.logger?.[result.ok ? "info" : "warn"]?.(
       {
         request_id,

package/src/sibling-token.mjs

@@ -24,6 +24,8 @@
  * 範囲がこの cwd 限定トークンより大きくなるため。
  */
 
+import { displayTokenForCwd } from "./delegate-display-auth.mjs"
+
 import { randomBytes } from "node:crypto"
 
 /** @type {Map<string, string>} cwd -> token */
@@ -126,6 +128,14 @@ export function buildSiblingEnv(cwd, { selfKind, delegateEventAck = false, strip
     ...(delegateEventAck ? { COCKPIT_DELEGATE_EVENT_ACK: "1" } : {}),
     COCKPIT_SIBLING_SELF_KIND: selfKind,
   }
+  delete env.COCKPIT_DELEGATE_DISPLAY_TOKEN
+  delete env.COCKPIT_DELEGATE_EVENT_ACK_VERSION
+  try {
+    env.COCKPIT_DELEGATE_DISPLAY_TOKEN = displayTokenForCwd(cwd)
+    env.COCKPIT_DELEGATE_EVENT_ACK_VERSION = "2"
+  } catch {
+    console.warn("delegate display auth unavailable; display capability omitted")
+  }
   // ACK を付けない CLI では、継承元に ACK があっても子へ持ち込まない。
   if (!delegateEventAck) delete env.COCKPIT_DELEGATE_EVENT_ACK
   if (stripParentSessionIds) {

package/src/truncate-string.mjs

@@ -0,0 +1,7 @@
+export function truncateString(value, maxLength, truncationNote) {
+  if (value.length <= maxLength) return value
+  let end = maxLength
+  const lastCodeUnit = value.charCodeAt(end - 1)
+  if (lastCodeUnit >= 0xd800 && lastCodeUnit <= 0xdbff) end -= 1
+  return value.slice(0, end) + truncationNote(value.length)
+}