@cocorograph/hub-agent 0.8.121 → 0.8.122

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocorograph/hub-agent",
-  "version": "0.8.121",
+  "version": "0.8.122",
   "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの Claude / Codex チャットと tmux セッションを中継する。",
   "type": "module",
   "license": "UNLICENSED",

package/src/codex-appserver-client.mjs

@@ -98,6 +98,8 @@ export class CodexAppServerClient extends EventEmitter {
         "COCKPIT_SIBLING_SELF_KIND",
         "COCKPIT_SIBLING_CWD",
         "COCKPIT_SIBLING_TOKEN",
+        "COCKPIT_DELEGATE_DISPLAY_TOKEN",
+        "COCKPIT_DELEGATE_EVENT_ACK_VERSION",
       ]) {
         const val = spawnEnv[key]
         // TOML 文字列としてクォート (パスの空白/特殊文字対策)。値に " は含まれない

package/src/codex-stream-bridge.mjs

@@ -4204,7 +4204,7 @@ export class CodexStreamBridge extends EventEmitter {
   }
 
   /** Display events never start a turn and only target an exact thread in this cwd. */
-  emitToStream(cwd, sessionId, event) {
+  emitToStream(cwd, sessionId, event, notificationName = "cockpit/review_event") {
     if (!cwd || !sessionId) return { status: "not_found" }
     const matches = [...this._liveSessions()].filter((s) => s.cwd === cwd && s.threadId === sessionId)
     if (matches.length !== 1) return { status: matches.length ? "ambiguous" : "not_found" }
@@ -4214,7 +4214,7 @@ export class CodexStreamBridge extends EventEmitter {
       producer_seq: session.seq,
       thread_id: session.threadId,
       cwd: session.cwd,
-      notification: { method: "cockpit/review_event", params: event },
+      notification: { method: notificationName, params: event },
     })
     return { status: "delivered", session: this._describe(session) }
   }

package/src/delegate-display-auth.mjs

@@ -0,0 +1,80 @@
+import fs from "node:fs"
+import path from "node:path"
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto"
+import { paths } from "./config.mjs"
+
+/**
+ * Publish a complete key atomically: write a temp file in the same directory, then link(2) it to
+ * the final name. link fails with EEXIST if another process won, so the published file is always
+ * complete and never overwritten (overwriting would invalidate tokens already handed out).
+ * An existing malformed key is NOT regenerated here; key() rejects it so the failure stays visible.
+ */
+function publishKey(dir, file) {
+  const tmp = path.join(dir, `key.${process.pid}.${randomBytes(8).toString("hex")}.tmp`)
+  try {
+    const fd = fs.openSync(tmp, "wx", 0o600)
+    try {
+      fs.writeFileSync(fd, randomBytes(32))
+      fs.fsyncSync(fd)
+    } finally { fs.closeSync(fd) }
+    try {
+      fs.linkSync(tmp, file)
+    } catch (err) {
+      if (err.code !== "EEXIST") throw new Error("delegate display auth key creation failed")
+    }
+  } finally {
+    try { fs.unlinkSync(tmp) } catch {}
+  }
+}
+
+function key() {
+  const dir = process.env.HUB_DELEGATE_DISPLAY_AUTH_DIR || path.join(paths.configDir, "delegate-display-auth")
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+  const directory = fs.lstatSync(dir)
+  if (!directory.isDirectory() || directory.isSymbolicLink() || process.getuid?.() == null ||
+      directory.uid !== process.getuid() || (directory.mode & 0o777) !== 0o700) {
+    throw new Error("unsafe delegate display auth directory")
+  }
+  const file = path.join(dir, "key")
+  let info
+  try {
+    info = fs.lstatSync(file)
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err
+    publishKey(dir, file)
+    info = fs.lstatSync(file)
+  }
+  if (!info.isFile() || info.isSymbolicLink() || info.uid !== process.getuid() ||
+      (info.mode & 0o777) !== 0o600 || info.size !== 32) {
+    throw new Error("unsafe delegate display auth key")
+  }
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW)
+  try {
+    const opened = fs.fstatSync(fd)
+    if (!opened.isFile() || opened.ino !== info.ino || opened.dev !== info.dev ||
+        opened.uid !== info.uid || (opened.mode & 0o777) !== 0o600 || opened.size !== 32) {
+      throw new Error("delegate display auth key changed while reading")
+    }
+    const bytes = Buffer.alloc(33)
+    let length = 0
+    while (length < bytes.length) {
+      const count = fs.readSync(fd, bytes, length, bytes.length - length, null)
+      if (!count) break
+      length += count
+    }
+    if (length !== 32) throw new Error("invalid delegate display auth key length")
+    return bytes.subarray(0, 32)
+  } finally { fs.closeSync(fd) }
+}
+
+export function displayTokenForCwd(cwd) {
+  if (typeof cwd !== "string" || !cwd) throw new Error("invalid delegate display cwd")
+  return "v1." + createHmac("sha256", key()).update("delegate-event\0" + cwd).digest("base64url")
+}
+
+export function verifyDisplayToken(cwd, token) {
+  if (typeof cwd !== "string" || !cwd || typeof token !== "string" || !/^v1\.[A-Za-z0-9_-]{43}$/.test(token)) return false
+  const expected = Buffer.from(displayTokenForCwd(cwd))
+  const actual = Buffer.from(token)
+  return actual.length === expected.length && timingSafeEqual(actual, expected)
+}

package/src/delegation-event-store.mjs

@@ -92,9 +92,13 @@ export class DelegationEventStore {
     this.queue = pending.catch(() => {})
     return pending
   }
-  _file(cwd, sessionId) {
+  _target(cwd, sessionId, kind = "claude") {
+    if (!["claude", "codex"].includes(kind)) throw new Error("invalid delegation kind")
+    return kind === "codex" ? [cwd, sessionId, kind] : [cwd, sessionId]
+  }
+  _file(cwd, sessionId, kind = "claude") {
     if ([cwd, sessionId].some((value) => typeof value !== "string" || !value)) throw new Error("invalid delegation target")
-    return path.join(this.dir, createHash("sha256").update(JSON.stringify([cwd, sessionId])).digest("hex") + ".json")
+    return path.join(this.dir, createHash("sha256").update(JSON.stringify(this._target(cwd, sessionId, kind))).digest("hex") + ".json")
   }
   async _checkDirectory() {
     const info = await fs.lstat(this.dir)
@@ -135,7 +139,7 @@ export class DelegationEventStore {
       snapshot = JSON.parse(buffer.subarray(0, length).toString("utf8"))
     } finally { await handle.close() }
     if (!snapshot || snapshot.schema_version !== 1 || !Array.isArray(snapshot.target) ||
-        snapshot.target.length !== 2 || snapshot.target.some((v) => typeof v !== "string" || !v) ||
+        !(snapshot.target.length === 2 || (snapshot.target.length === 3 && snapshot.target[2] === "codex")) || snapshot.target.some((v) => typeof v !== "string" || !v) ||
         (target && JSON.stringify(snapshot.target) !== JSON.stringify(target)) ||
         this._file(...snapshot.target) !== file || !Array.isArray(snapshot.rows)) throw new Error("invalid delegation snapshot")
     const ids = new Set()
@@ -159,23 +163,23 @@ export class DelegationEventStore {
       .slice(0, Math.max(0, oldest.length - DELEGATION_SESSION_LIMIT)))
     return rows.filter((row) => !removed.has(row))
   }
-  rows(cwd, sessionId) {
+  rows(cwd, sessionId, kind = "claude") {
     return this._serial(async () => {
       await this._prepare()
-      const file = this._file(cwd, sessionId)
-      return this._prune(await this._read(file, [cwd, sessionId]))
+      const file = this._file(cwd, sessionId, kind)
+      return this._prune(await this._read(file, this._target(cwd, sessionId, kind)))
     })
   }
-  record(cwd, sessionId, event) {
+  record(cwd, sessionId, event, kind = "claude") {
     // Snapshot caller-owned input before waiting for the writer.
     const copy = structuredClone(event)
-    return this._serial(() => this._record(cwd, sessionId, copy))
+    return this._serial(() => this._record(cwd, sessionId, copy, kind))
   }
-  async _record(cwd, sessionId, event) {
+  async _record(cwd, sessionId, event, kind = "claude") {
     if (!validEvent(event)) throw new Error("invalid delegation event")
     await this._prepare()
-    const file = this._file(cwd, sessionId)
-    const target = [cwd, sessionId]
+    const file = this._file(cwd, sessionId, kind)
+    const target = this._target(cwd, sessionId, kind)
     const rows = this._prune(await this._read(file, target))
     const result = this._apply(rows, target, event)
     if (result.acceptance === "accept") await this._write(file, result.serialized)
@@ -246,10 +250,10 @@ export class DelegationEventStore {
     }
   }
   /** Reconcile the entire liveness plan against one fresh snapshot, then write at most once. */
-  replayPlan(cwd, sessionId, plan, emit) {
+  replayPlan(cwd, sessionId, plan, emit, kind = "claude") {
     return this._serial(async () => {
-      const file = this._file(cwd, sessionId)
-      const target = [cwd, sessionId]
+      const file = this._file(cwd, sessionId, kind)
+      const target = this._target(cwd, sessionId, kind)
       const rows = this._prune(await this._read(file, target))
       const current = new Map(rows.map((row) => [row.id, JSON.stringify(row)]))
       // One working copy for the whole plan; `current` keeps the snapshot used for matching.

package/src/main.mjs

@@ -4365,6 +4365,15 @@ export async function dispatch(msg, ctx) {
           } catch (err) {
             ctx.logger?.warn?.({ err: err?.message }, "failed to replay review events")
           }
+          try {
+            if (info.threadId) {
+              void ctx.siblingInjectBridge
+                ?.replayDelegations?.(resolvedCwd || process.env.HOME || process.cwd(), info.threadId, "codex")
+                ?.catch((err) => ctx.logger?.warn?.({ err: err?.message }, "failed to replay delegation events"))
+            }
+          } catch (err) {
+            ctx.logger?.warn?.({ err: err?.message }, "failed to replay delegation events")
+          }
           const session = ctx.codexBridge.sessions?.get(stream_id)
           if (session && info.resuming) {
             void loadResumeChatContext(session, "codex").catch(() => {})

package/src/sibling-inject.mjs

@@ -71,6 +71,7 @@
  * 判断材料として **外部契約に残す**。
  */
 
+import { verifyDisplayToken } from "./delegate-display-auth.mjs"
 import { watch } from "node:fs"
 import { chmod, lstat, mkdir, readFile, writeFile, rename, unlink, readdir } from "node:fs/promises"
 import { execFile as execFileCallback } from "node:child_process"
@@ -458,6 +459,12 @@ export class SiblingInjectBridge {
     }
   }
 
+  _emitDelegation(kind, cwd, sessionId, event) {
+    const bridge = kind === "codex" ? this.codexBridge : this.claudeBridge
+    return bridge?.emitToStream?.(cwd, sessionId, event,
+      ...(kind === "codex" ? ["cockpit/delegate_event"] : [])) || { status: "not_found" }
+  }
+
   _liveClaudeSession(cwd, sessionId) {
     const matches = describeLiveSessionsUnion(this._bridges(), {
       cwd,
@@ -497,10 +504,10 @@ export class SiblingInjectBridge {
   }
 
   /** attach/再接続時に同じ cwd+session の進行中・終了済み委譲を開始順で再送する。 */
-  async replayDelegations(cwd, sessionId) {
+  async replayDelegations(cwd, sessionId, kind = "claude") {
     if (!cwd || !sessionId) return
     try {
-      const snapshot = await this.delegationEvents.rows(cwd, sessionId)
+      const snapshot = await this.delegationEvents.rows(cwd, sessionId, kind)
       const rows = snapshot.filter((row) => row.started).sort((a, b) => a.startedAt - b.startedAt)
       const plan = []
       for (const row of rows) {
@@ -526,7 +533,7 @@ export class SiblingInjectBridge {
         }
       }
       await this.delegationEvents.replayPlan(cwd, sessionId, plan,
-        (event) => this.claudeBridge?.emitToStream?.(cwd, sessionId, event))
+        (event) => this._emitDelegation(kind, cwd, sessionId, event), kind)
     } catch (err) {
       this.logger?.warn?.({ error: err?.message }, "delegation replay failed")
     }
@@ -749,6 +756,8 @@ export class SiblingInjectBridge {
       pid,
       pid_started_at,
       request_ack,
+      display_auth,
+      ack_capability,
     } = body || {}
     // 連携カード種別 (Phase 2, 2026-07-23): 注入を受け手画面で専用カード表示させるためのタグ。
     // 既知値 ('peer'|'orchestrator') のみ通し、未知値/未指定は undefined に落とす (未知の source を
@@ -758,6 +767,15 @@ export class SiblingInjectBridge {
     const isList = op === "list"
     const isExplicit = op === "inject"
     const isDelegateEvent = op === "delegate-event"
+    const ackV2 = isDelegateEvent && request_ack === true && ack_capability === "persisted-delivered-v2"
+    const delegateKind = target_cli_kind === undefined ? "claude" : target_cli_kind
+    let displayAuthorized = false
+    const hasDisplayAuth = isDelegateEvent && Object.hasOwn(body, "display_auth")
+    if (hasDisplayAuth) {
+      try { displayAuthorized = verifyDisplayToken(cwd, display_auth) } catch {
+        this.logger?.warn?.({}, "delegate display auth unavailable")
+      }
+    }
     const isReviewEvent = op === "review-event"
     const hasRequestAck = Object.prototype.hasOwnProperty.call(body || {}, "request_ack")
     const isRestart = op === "restart"
@@ -765,6 +783,13 @@ export class SiblingInjectBridge {
     const badKind = !["claude", "codex", "grok"].includes(target_cli_kind)
     const delegatePhases = new Set(["started", "completed", "failed", "stopped"])
     const badDelegateBody =
+      !["claude", "codex"].includes(delegateKind) ||
+      (target_session_id !== undefined && typeof target_session_id !== "string") ||
+      Object.keys(body || {}).some((key) => ![
+        "op", "cwd", "target_cli_kind", "token", "target_session_id", "delegation_id", "phase",
+        "agent", "description", "background", "prompt", "timestamp", "pid", "pid_started_at",
+        "request_ack", "display_auth", "ack_capability",
+      ].includes(key)) ||
       typeof delegation_id !== "string" ||
       !delegation_id ||
       delegation_id.length > DELEGATION_ID_MAX_LENGTH ||
@@ -782,7 +807,7 @@ export class SiblingInjectBridge {
     const badBody = isReviewEvent
       ? !validReviewEvent(body.event) || typeof target_session_id !== "string" || !target_session_id ||
         typeof cwd !== "string" || !path.isAbsolute(cwd) ||
-        Object.keys(body).some((key) => !["op", "token", "cwd", "target_cli_kind", "target_session_id", "event"].includes(key)) ||
+        Object.keys(body).some((key) => !["op", "token", "cwd", "target_cli_kind", "target_session_id", "event", "display_auth", "ack_capability"].includes(key)) ||
         !requestInfo.isFile() || requestInfo.isSymbolicLink() || requestInfo.uid !== process.getuid?.() ||
         (requestInfo.mode & 0o777) !== 0o600
       : isDelegateEvent
@@ -833,7 +858,7 @@ export class SiblingInjectBridge {
       }
     } else if (!cwd || (!isDelegateEvent && badKind) || badBody) {
       result = { ok: false, error: "invalid_request" }
-    } else if (!verifySiblingTokenAny(token)) {
+    } else if (hasDisplayAuth ? !displayAuthorized : !verifySiblingTokenAny(token)) {
       // 2026-07-23 統一再設計 1-2: 認可を「ターゲット cwd 所有」→「いずれかの cwd の有効トークン
       // 所有 (= 同一ユーザーの spawn 済みセッション)」へ緩和し、クロス cwd 連携を解禁する。
       // cwd は引き続きターゲット解決のスコープとして使う (誤 cwd 着弾・情報漏洩は解決側で担保)。
@@ -895,18 +920,32 @@ export class SiblingInjectBridge {
           let acceptance
           let persisted = true
           try {
-            acceptance = await this.delegationEvents.record(cwd, target_session_id, event)
+            acceptance = await this.delegationEvents.record(cwd, target_session_id, event, delegateKind)
           } catch (err) {
             persisted = false
             this.logger?.warn?.({ request_id, error: err?.message }, "delegation persistence failed")
           }
-          if (acceptance === "duplicate") {
+          if (ackV2) {
+            persisted = persisted && acceptance !== "full"
+            const delivery = acceptance === "stale" ? { status: "not_found" }
+              : this._emitDelegation(delegateKind, cwd, target_session_id, event)
+            const delivered = delivery.status === "delivered"
+            result = !persisted
+              ? { ok: false, ack_version: 2, persisted: false, delivered,
+                  error: acceptance === "full" ? "delegation_store_full" : "delegation_persistence_failed", retryable: true }
+              : { ok: true, ack_version: 2, persisted: true, delivered,
+                  ...(acceptance === "duplicate" ? { duplicate: true } : {}),
+                  ...(acceptance === "stale" ? { stale: true } : {}),
+                  ...(!delivered && acceptance !== "stale" && acceptance !== "duplicate"
+                    ? { delivery_status: delivery.status } : {}) }
+          } else if (acceptance === "duplicate") {
             // ACK は「過去に受理した」だけでなく、対象 stream が現在も live であることも示す。
             // 台帳だけで成功を返すと、宛先消失後の retry を受理済みと誤認させる。
-            const live = this._liveClaudeSession(cwd, target_session_id)
+            const live = delegateKind === "claude" ? this._liveClaudeSession(cwd, target_session_id)
+              : { status: "delivered" }
             // 保存後に未配送のまま切断した可能性があるため、duplicate も再配送する。
             const delivered = live.status === "delivered"
-              ? this.claudeBridge?.emitToStream?.(cwd, target_session_id, event) || { status: "not_found" }
+              ? this._emitDelegation(delegateKind, cwd, target_session_id, event)
               : live
             result = delivered.status === "delivered"
               ? { ok: true, duplicate: true }
@@ -916,9 +955,7 @@ export class SiblingInjectBridge {
           } else if (acceptance === "full") {
             result = { ok: false, error: "delegation_store_full" }
           } else {
-            const r = this.claudeBridge?.emitToStream
-              ? this.claudeBridge.emitToStream(cwd, target_session_id, event)
-              : { status: "not_found" }
+            const r = this._emitDelegation(delegateKind, cwd, target_session_id, event)
             if (r.status === "delivered") {
               result = { ok: true, delivered_to: r.session }
             } else {
@@ -1109,6 +1146,10 @@ export class SiblingInjectBridge {
       }
     }
 
+    if (ackV2 && result.ack_version !== 2) {
+      result = { ok: false, ack_version: 2, persisted: false, delivered: false,
+        error: result.error, retryable: false }
+    }
     this.logger?.[result.ok ? "info" : "warn"]?.(
       {
         request_id,

package/src/sibling-token.mjs

@@ -24,6 +24,8 @@
  * 範囲がこの cwd 限定トークンより大きくなるため。
  */
 
+import { displayTokenForCwd } from "./delegate-display-auth.mjs"
+
 import { randomBytes } from "node:crypto"
 
 /** @type {Map<string, string>} cwd -> token */
@@ -126,6 +128,14 @@ export function buildSiblingEnv(cwd, { selfKind, delegateEventAck = false, strip
     ...(delegateEventAck ? { COCKPIT_DELEGATE_EVENT_ACK: "1" } : {}),
     COCKPIT_SIBLING_SELF_KIND: selfKind,
   }
+  delete env.COCKPIT_DELEGATE_DISPLAY_TOKEN
+  delete env.COCKPIT_DELEGATE_EVENT_ACK_VERSION
+  try {
+    env.COCKPIT_DELEGATE_DISPLAY_TOKEN = displayTokenForCwd(cwd)
+    env.COCKPIT_DELEGATE_EVENT_ACK_VERSION = "2"
+  } catch {
+    console.warn("delegate display auth unavailable; display capability omitted")
+  }
   // ACK を付けない CLI では、継承元に ACK があっても子へ持ち込まない。
   if (!delegateEventAck) delete env.COCKPIT_DELEGATE_EVENT_ACK
   if (stripParentSessionIds) {