@cocorograph/hub-agent 0.8.48 → 0.8.49

package/bin/hub-agent.mjs

@@ -37,8 +37,10 @@ import { resolveSyncTargets, syncBundleTargets } from "../src/hub-bundle.mjs"
 import { loadPlugins } from "../src/plugin-loader.mjs"
 import { uninstallPlugin } from "../src/plugin-uninstall.mjs"
 import {
+  canSuggestForcedRestart,
   installService,
   restartService,
+  restartWithPolicy,
   uninstallService,
 } from "../src/service-install.mjs"
 
@@ -231,18 +233,45 @@ program
 
 program
   .command("restart")
-  .description("install-service 済みの daemon を再起動 (macOS=launchctl kickstart / Linux=systemctl --user restart)")
-  .action(async () => {
+  .description("実行中の作業完了後に daemon を安全に再起動 (--force は即時再起動)")
+  .option("--force", "サービスマネージャーで即時再起動する")
+  .action(async (opts) => {
     try {
-      const r = await restartService()
-      console.log(`restarted: ${r.platform} ${r.path}`)
-      if (r.platform === "darwin") {
-        console.log(`label: ${r.label}`)
+      const restart = await restartWithPolicy({
+        force: !!opts.force,
+        deferredRestart: async () => {
+          const { requestDeferredRestart } = await import("../src/sibling-inject.mjs")
+          return requestDeferredRestart()
+        },
+        immediateRestart: restartService,
+      })
+      if (restart.mode === "immediate") {
+        const r = restart.result
+        console.log(`restarted immediately: ${r.platform} ${r.path}`)
+        if (r.platform === "darwin") {
+          console.log(`label: ${r.label}`)
+        } else {
+          console.log(`unit: ${r.unit}`)
+        }
       } else {
-        console.log(`unit: ${r.unit}`)
+        console.log("restart accepted: daemon will restart after active work completes")
       }
     } catch (err) {
       console.error(`restart failed: ${err.message}`)
+      if (err.code === "service_not_installed") {
+        console.error("Run `hub-agent install-service` before restarting.")
+      } else if (!opts.force && canSuggestForcedRestart(err)) {
+        if (err.code === "restart_rejected" &&
+            (err.daemonError === "invalid_request" || err.daemonError === "restart_unavailable")) {
+          console.error(
+            "The daemon may be an older version or the request contract may be unsupported. " +
+            "No immediate fallback was attempted.",
+          )
+        }
+        console.error(
+          "Check ~/.hub/agent.log first. Use `hub-agent restart --force` only if interrupting active work is acceptable.",
+        )
+      }
       process.exit(1)
     }
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocorograph/hub-agent",
-  "version": "0.8.48",
+  "version": "0.8.49",
   "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの Claude / Codex チャットと tmux セッションを中継する。",
   "type": "module",
   "license": "UNLICENSED",
@@ -18,7 +18,7 @@
   },
   "scripts": {
     "start": "node bin/hub-agent.mjs start",
-    "test": "node --test test/*.test.mjs",
+    "test": "node --test --test-concurrency=1 test/*.test.mjs",
     "check:publish-on-main": "node scripts/check-publish-on-main.mjs",
     "prepublishOnly": "node scripts/check-publish-on-main.mjs && npm test"
   },

package/src/claude-stream-bridge.mjs

@@ -3703,13 +3703,26 @@ export class ClaudeStreamBridge extends EventEmitter {
    *  観測は **通知の台帳**で行い、権威照会 `thread/backgroundTerminals/list` は使わない
    *  （実験 API の有効化が要るうえ、threadId ごとの照会なので子スレッドの背景コマンドを取りこぼす）。 */
   _isSessionProtected(session, now = Date.now()) {
-    if (!session) return false
+    return this._hasSessionWork(session, now) || this._liveTerminalCount(session) >= 2
+  }
+
+  /** warm保護から購読数だけを除いた、実作業の共通判定。 */
+  _hasSessionWork(session, now = Date.now()) {
+    if (!session || session._closed) return false
     if (session._busy) return true
-    if (Array.isArray(session._pendingMessages) && session._pendingMessages.length > 0) {
-      return true
+    if (Array.isArray(session._pendingMessages) && session._pendingMessages.length > 0) return true
+    return !!session._hasLiveTask?.(now)
+  }
+
+  /**
+   * daemon の deferred restart が待つべき実作業があるか。
+   * 多端末 subscribe は warm 保持には必要だが作業ではないため、ここでは数えない。
+   */
+  hasActiveWork(now = Date.now()) {
+    for (const { session } of this._liveCandidatesForCwd()) {
+      if (this._hasSessionWork(session, now)) return true
     }
-    if (session._hasLiveTask?.(now)) return true
-    return this._liveTerminalCount(session) >= 2
+    return false
   }
 
   /** 子⑤: warm 境界超過セッションを reap する（detach の softDetach onTimeout と同じ撤去処理）。 */

package/src/codex-stream-bridge.mjs

@@ -3567,6 +3567,17 @@ export class CodexStreamBridge extends EventEmitter {
     return now - (session.lastActivityMs ?? now) <= this._stuckTurnTtlMs
   }
 
+  /**
+   * daemon の deferred restart が待つべき実作業があるか。
+   * warm 保持とは異なり、購読端末数や detach 状態は作業として数えない。
+   */
+  hasActiveWork(now = Date.now()) {
+    for (const session of this._liveSessions()) {
+      if (this._isProtected(session, now)) return true
+    }
+    return false
+  }
+
   _hasLiveSubagentTurn(session, now = Date.now()) {
     const registry = session?.subagentInterruptRegistry
     if (!registry || registry.size === 0) return false

package/src/main.mjs

@@ -748,6 +748,112 @@ export async function handleBundleSyncRequest(msg, ctx, opts = {}) {
   }
 }
 
+/**
+ * deferred restart の待機状態を一元管理する。要求は同期的に pending 化して即 ACK でき、
+ * Claude/Codex bridge が追跡する turn・queue・command・subagent/background task が
+ * idle → settle → 再確認の後だけ通常 shutdown へ進む。upload/bundle sync はこの
+ * bridge work 契約に含まれず、再送可能な別経路として扱う。
+ */
+export class DeferredRestartCoordinator {
+  constructor({
+    claudeBridge,
+    codexBridge,
+    shutdown,
+    logger,
+    settleMs = 500,
+    pollMs = 50,
+    setTimer = setTimeout,
+    clearTimer = clearTimeout,
+    lifecycle = { restartPending: false, shutdownStarted: false },
+    workProviders = [],
+  } = {}) {
+    this.claudeBridge = claudeBridge
+    this.codexBridge = codexBridge
+    this.shutdown = shutdown
+    this.logger = logger
+    this.settleMs = settleMs
+    this.pollMs = pollMs
+    this.setTimer = setTimer
+    this.clearTimer = clearTimer
+    this.lifecycle = lifecycle
+    this.workProviders = workProviders
+    this.timer = null
+    this.settling = false
+    this.workCheckFailures = 0
+    this.shutdownInvoked = false
+  }
+
+  request() {
+    if (!this.lifecycle.restartPending) {
+      this.lifecycle.restartPending = true
+      this.logger?.info?.({}, "deferred restart accepted")
+      this._schedule(0)
+    }
+    return { ok: true, restart_pending: true }
+  }
+
+  _hasActiveWork() {
+    return !!(
+      this.claudeBridge?.hasActiveWork?.() ||
+      this.codexBridge?.hasActiveWork?.() ||
+      this.workProviders.some((provider) => provider?.hasActiveWork?.())
+    )
+  }
+
+  _schedule(delayMs) {
+    if (this.timer || this.shutdownInvoked || this.lifecycle.shutdownStarted) return
+    this.timer = this.setTimer(() => {
+      this.timer = null
+      void this._check()
+    }, delayMs)
+  }
+
+  async _check() {
+    if (!this.lifecycle.restartPending || this.shutdownInvoked || this.lifecycle.shutdownStarted) return
+    let active
+    try {
+      active = this._hasActiveWork()
+    } catch (err) {
+      // 判定不能時に停止へ倒すと作業を切るため、安全側に待って再試行する。
+      this.workCheckFailures += 1
+      if ((this.workCheckFailures & (this.workCheckFailures - 1)) === 0) {
+        this.logger?.warn?.(
+          { err: err?.message, failures: this.workCheckFailures },
+          "deferred restart work check failed",
+        )
+      }
+      this.settling = false
+      this._schedule(Math.min(this.pollMs * (2 ** (this.workCheckFailures - 1)), 5_000))
+      return
+    }
+    this.workCheckFailures = 0
+    if (active) {
+      this.settling = false
+      this._schedule(this.pollMs)
+      return
+    }
+    if (!this.settling) {
+      this.settling = true
+      this._schedule(this.settleMs)
+      return
+    }
+    // settle 後も idle。main のshutdown が共有 lifecycle を hook await より前に
+    // 更新する。coordinator は二重呼び出しだけを独立に防ぐ。
+    this.shutdownInvoked = true
+    this.logger?.info?.({}, "deferred restart reached idle settle; shutting down")
+    try {
+      await this.shutdown?.("deferred-restart")
+    } catch (err) {
+      this.logger?.error?.({ err: err?.message }, "deferred restart shutdown failed")
+    }
+  }
+
+  stop() {
+    if (this.timer) this.clearTimer(this.timer)
+    this.timer = null
+  }
+}
+
 export async function startDaemon({ version, claudeSdk } = {}) {
   const config = await readConfig()
   if (!config) {
@@ -757,7 +863,9 @@ export async function startDaemon({ version, claudeSdk } = {}) {
   }
 
   const plugins = await loadPlugins(logger)
-  const ctx = { logger, config, plugins }
+  // ctx と dispatchCtx の shallow copy を跨いで共有する lifecycle 正本。
+  const lifecycle = { restartPending: false, shutdownStarted: false }
+  const ctx = { logger, config, plugins, lifecycle }
 
   // 起動時: 保存済み active プロファイルの CLAUDE_CONFIG_DIR を反映してから
   // Claude SDK を初期化する。profiles.json が無ければ既定 (~/.claude) のまま。
@@ -1268,8 +1376,14 @@ export async function startDaemon({ version, claudeSdk } = {}) {
   // 相互依頼のためのローカル IPC 受信口。cwd スコープ capability トークン
   // (src/sibling-token.mjs) で検証した要求のみ claudeBridge/codexBridge.sendToCwd()
   // へ橋渡しする。
-  const siblingInjectBridge = new SiblingInjectBridge({ claudeBridge, codexBridge, logger })
-  await siblingInjectBridge.start()
+  let restartCoordinator = null
+  const siblingInjectBridge = new SiblingInjectBridge({
+    claudeBridge,
+    codexBridge,
+    logger,
+    onRestartRequested: () => restartCoordinator.request(),
+    isInputBlocked: () => lifecycle.restartPending || lifecycle.shutdownStarted,
+  })
   ctx.siblingInjectBridge = siblingInjectBridge
 
   // モデル能力レジストリ (2026-07-11): SDK supportedModels() を起動時に引き、effort
@@ -1293,12 +1407,19 @@ export async function startDaemon({ version, claudeSdk } = {}) {
   }
 
   const shutdown = async (signal) => {
+    if (lifecycle.shutdownStarted) return
+    // hook await より前に立てる。deferred/OS signal の競合でも shutdown は一度だけ。
+    lifecycle.shutdownStarted = true
+    // 新しいローカル注入要求も hook 実行中に turn を開始できないよう入口を先に閉じる。
+    siblingInjectBridge.stop()
     logger.info({ signal }, "shutting down")
+    logger.info({ signal }, "agent stop hooks starting")
     await runHookBroadcast(plugins, "onAgentStop", ctx)
+    logger.info({ signal }, "agent stop hooks completed")
     stateLoop.stop()
     sessionEventLoop?.stop?.()
     readinessLoop?.stop?.()
-    siblingInjectBridge.stop()
+    restartCoordinator?.stop?.()
     claudeBridge?.shutdown?.()
     codexBridge?.shutdown?.()
     client.stop()
@@ -1306,6 +1427,15 @@ export async function startDaemon({ version, claudeSdk } = {}) {
     clearInterval(keepaliveTimer)
     process.exit(0)
   }
+  restartCoordinator = new DeferredRestartCoordinator({
+    claudeBridge,
+    codexBridge,
+    shutdown,
+    logger,
+    lifecycle,
+    workProviders: [siblingInjectBridge],
+  })
+  await siblingInjectBridge.start()
   process.on("SIGINT", () => shutdown("SIGINT"))
   process.on("SIGTERM", () => shutdown("SIGTERM"))
   // dispatch から呼べるように shutdown を ctx に載せる (agent.shutdown 用)。
@@ -2968,6 +3098,17 @@ const codexInflightByInputId = new Map()
 // 同一 input_id がキューに 2 件積まれて drain 後も 1 件残る (送信待ちチップが消えない)。
 const claudeInflightByInputId = new Map()
 
+function inputLifecycleRejection(ctx) {
+  if (!ctx.lifecycle?.restartPending && !ctx.lifecycle?.shutdownStarted) return null
+  const reason = ctx.lifecycle.restartPending ? "restart_pending" : "agent_shutting_down"
+  return {
+    reason,
+    message: reason === "restart_pending"
+      ? "restart pending: new input was not accepted"
+      : "agent shutdown in progress: new input was not accepted",
+  }
+}
+
 /**
  * SDK チャット配達保証 (S2, 2026-07-05): `claude.input` を処理し、browser が付与した
  * `input_id` があれば `claude.input.ack` / `claude.input.nack` を返す。無ければ従来
@@ -3011,6 +3152,21 @@ export function handleClaudeChatInput(msg, ctx) {
     )
     return claudeInflightByInputId.get(input_id)
   }
+  const lifecycleRejection = inputLifecycleRejection(ctx)
+  if (lifecycleRejection) {
+    const { reason, message } = lifecycleRejection
+    if (input_id) {
+      ctx.client.send({ type: "claude.input.nack", stream_id, input_id, reason })
+    } else {
+      ctx.client.send({
+        type: "claude.error",
+        stream_id,
+        error: message,
+        reason,
+      })
+    }
+    return undefined
+  }
   const p = ctx.claudeBridge
     .input({
       stream_id,
@@ -3261,6 +3417,20 @@ export function handleCodexChatInput(msg, ctx) {
     ctx.logger?.info?.({ stream_id, input_id }, "codex.input in-flight dedup (join, no re-dispatch)")
     return codexInflightByInputId.get(input_id)
   }
+  const lifecycleRejection = inputLifecycleRejection(ctx)
+  if (lifecycleRejection) {
+    const { reason, message } = lifecycleRejection
+    if (input_id) {
+      ctx.client.send({ type: "codex.input.nack", stream_id, input_id, reason })
+    }
+    ctx.client.send({
+      type: "codex.error",
+      stream_id,
+      error: message,
+      reason,
+    })
+    return undefined
+  }
   const p = ctx.codexBridge
     .input({
       stream_id,

package/src/service-install.mjs

@@ -314,28 +314,19 @@ export async function installService({ bin } = {}) {
   throw new Error(`unsupported platform: ${process.platform}`)
 }
 
-/**
- * install-service 済みの hub-agent を再起動する。
- *
- * - macOS: `launchctl kickstart -k gui/<uid>/<label>` で SIGTERM + 再起動
- * - Linux: `systemctl --user restart hub-agent.service`
- *
- * service が install されていない場合は分かりやすい error を投げる。
- * (cockpit web UI から `hub-agent restart` 案内が出ても、enroll 直後の
- *  ユーザーが叩くケースを想定)
- */
-export async function restartService() {
+/** install-service 済みかを検査し、後続のrestartが使うservice descriptorを返す。 */
+export async function requireInstalledService() {
   if (process.platform === "darwin") {
     const dest = macPlistPath()
     try {
       await fs.access(dest)
     } catch {
-      throw new Error(
+      const err = new Error(
         `service not installed (${dest} not found). run \`hub-agent install-service\` first`,
       )
+      err.code = "service_not_installed"
+      throw err
     }
-    const uid = ensureUnixUid()
-    run("launchctl", ["kickstart", "-k", `gui/${uid}/${PLIST_LABEL}`])
     return { platform: "darwin", path: dest, label: PLIST_LABEL }
   }
 
@@ -344,15 +335,58 @@ export async function restartService() {
     try {
       await fs.access(dest)
     } catch {
-      throw new Error(
+      const err = new Error(
         `service not installed (${dest} not found). run \`hub-agent install-service\` first`,
       )
+      err.code = "service_not_installed"
+      throw err
     }
-    run("systemctl", ["--user", "restart", SYSTEMD_UNIT_NAME])
     return { platform: "linux", path: dest, unit: SYSTEMD_UNIT_NAME }
   }
 
-  throw new Error(`unsupported platform: ${process.platform}`)
+  const err = new Error(`unsupported platform: ${process.platform}`)
+  err.code = "unsupported_platform"
+  throw err
+}
+
+/** CLI が作業中断を伴う --force を案内してよい失敗か。 */
+export function canSuggestForcedRestart(err) {
+  return err?.code !== "service_not_installed" && err?.code !== "unsupported_platform"
+}
+
+/** 検査済みdescriptor、またはローカル検査結果のserviceを即時再起動する。 */
+export async function restartService(service = null) {
+  const installed = service || await requireInstalledService()
+  if (installed.platform === "darwin") {
+    const uid = ensureUnixUid()
+    run("launchctl", ["kickstart", "-k", `gui/${uid}/${PLIST_LABEL}`])
+  } else if (installed.platform === "linux") {
+    run("systemctl", ["--user", "restart", SYSTEMD_UNIT_NAME])
+  } else {
+    const err = new Error(`unsupported platform: ${installed.platform}`)
+    err.code = "unsupported_platform"
+    throw err
+  }
+  return installed
+}
+
+/** CLI の restart 方針をテスト可能な形に分離する。即時経路は force 明示時だけ選ぶ。 */
+export async function restartWithPolicy({
+  force = false,
+  deferredRestart,
+  immediateRestart = restartService,
+  requireInstalled = requireInstalledService,
+} = {}) {
+  // deferred でも daemon は正常終了するため、KeepAlive/Restart の登録が無ければ先に拒否する。
+  // 判定結果を即時経路へ渡し、同じ filesystem access を二重実行しない。
+  const service = await requireInstalled()
+  if (force) {
+    return { mode: "immediate", result: await immediateRestart(service) }
+  }
+  if (typeof deferredRestart !== "function") {
+    throw new Error("deferred restart transport is unavailable")
+  }
+  return { mode: "deferred", result: await deferredRestart(), service }
 }
 
 export async function uninstallService() {

package/src/sibling-inject.mjs

@@ -20,8 +20,10 @@
  * postinstall 等) はどの cwd のトークンも持たないため排除される核心は維持。ターゲット
  * 解決は引き続き要求の cwd でスコープする (誤 cwd 着弾・別 workspace 情報漏洩を防ぐ)。
  * トークンが一致しない要求は無視し (実行せず削除)、warn ログのみ残す。
+ * 例外は同一UIDのサービス再起動 control (`op:"restart"`) だけで、本文を持たず、所有者限定
+ * directory/file (0700/0600) を境界にする。他の op の token 要件は緩めない。
  *
- * 契約: request file `<request_id>.json` は op で 3 形態 (2026-07-19 / T06271):
+ * 契約: request file `<request_id>.json` は op で用途を明示する (2026-07-19 / T06271):
  *   - 通常注入 (op 無し): `{cwd, target_cli_kind, text, token}`
  *       cwd 内が 1 本なら注入、複数なら黙って推測せず `ambiguous_target` + 候補一覧。
  *   - 明示注入: `{op:"inject", cwd, target_cli_kind, token, target_session_id, message}`
@@ -32,6 +34,8 @@
  *   - 一覧: `{op:"list", cwd, target_cli_kind, token}` → `{ok, live_sessions}` (--list 用)。
  *   - 全一覧: `{op:"list-all", token}` → `{ok, live_sessions}` (全 cwd・両 CLI。クロス cwd
  *       宛先探索用、2026-07-23。cwd/target_cli_kind 不要、token のみ必須)。
+ *   - 安全な再起動: `{op:"restart"}` → `{ok:true, restart_pending:true}`。本文と token を持たず、
+ *       所有者限定の IPC directory/request file (0700/0600) だけを境界として扱う。
  * 処理後は必ず削除し (成否問わず)、通常 IPC は呼び出し側が待ち受けられるよう
  * `<request_id>.result.json` = `{ok, error?, delivered_to?, candidates?, live_sessions?, hint?,
  * candidates_nameable?}` を書く (`candidates_nameable` は曖昧系エラーのときのみ。CLI が
@@ -60,8 +64,9 @@
  */
 
 import { watch } from "node:fs"
-import { chmod, lstat, mkdir, readFile, writeFile, rename, stat, unlink, readdir } from "node:fs/promises"
+import { chmod, lstat, mkdir, readFile, writeFile, rename, unlink, readdir } from "node:fs/promises"
 import { execFile as execFileCallback } from "node:child_process"
+import { randomUUID } from "node:crypto"
 import { promisify } from "node:util"
 import path from "node:path"
 
@@ -71,6 +76,10 @@ import { describeLiveSessionsUnion } from "./live-sessions.mjs"
 export const SIBLING_REQUESTS_DIR =
   process.env.COCKPIT_SIBLING_REQUESTS_DIR || "/tmp/cockpit_sibling_requests"
 
+const RESTART_REQUEST_TIMEOUT_MS = 5_000
+const RESTART_RESULT_POLL_MS = 20
+const SIBLING_SWEEP_DEBOUNCE_MS = 25
+
 export const ACTIVE_DELEGATIONS_PER_SESSION_LIMIT = 100
 export const DELEGATION_LEDGER_RETENTION_MS = 24 * 60 * 60 * 1000
 const SIBLING_REQUEST_MAX_BYTES = 1024 * 1024
@@ -155,6 +164,69 @@ export async function defaultPidStartedAt(pid, exec = execFile) {
   return normalizeProcessStartedAt(stdout)
 }
 
+async function assertOwnedIpcPath(fp, { type, mode }) {
+  const info = await lstat(fp)
+  if (info.isSymbolicLink()) throw new Error(`${type} must not be a symbolic link`)
+  if (type === "IPC directory" ? !info.isDirectory() : !info.isFile()) {
+    throw new Error(`${type} has an unexpected file type`)
+  }
+  const uid = process.getuid?.()
+  if (uid == null || info.uid !== uid) throw new Error(`${type} is not owned by the current user`)
+  if ((info.mode & 0o777) !== mode) {
+    throw new Error(`${type} permissions must be ${mode.toString(8).padStart(4, "0")}`)
+  }
+}
+
+/**
+ * 所有者限定ファイル IPC で、稼働中 daemon へ deferred restart を要求する。
+ * restart op だけは capability token を使わず、既存 IPC の所有者・mode を認可境界にする。
+ */
+export async function requestDeferredRestart({
+  dir = SIBLING_REQUESTS_DIR,
+  timeoutMs = RESTART_REQUEST_TIMEOUT_MS,
+  pollMs = RESTART_RESULT_POLL_MS,
+} = {}) {
+  await assertOwnedIpcPath(dir, { type: "IPC directory", mode: 0o700 })
+  const requestId = `restart-${process.pid}-${randomUUID()}`
+  const requestPath = path.join(dir, `${requestId}.json`)
+  const resultPath = path.join(dir, `${requestId}.result.json`)
+  const tmpPath = `${requestPath}.tmp`
+  try {
+    await writeFile(tmpPath, JSON.stringify({ op: "restart" }), { mode: 0o600, flag: "wx" })
+    await rename(tmpPath, requestPath)
+    const deadline = Date.now() + timeoutMs
+    while (Date.now() < deadline) {
+      try {
+        await assertOwnedIpcPath(resultPath, { type: "IPC result", mode: 0o600 })
+        const result = JSON.parse(await readFile(resultPath, "utf-8"))
+        if (!result?.ok) {
+          const daemonError = result?.error || "unknown"
+          const rejected = new Error(`daemon rejected deferred restart: ${daemonError}`)
+          // filesystem ENOENT 等とdaemon契約エラーのnamespaceを分離する。
+          rejected.code = "restart_rejected"
+          rejected.daemonError = daemonError
+          throw rejected
+        }
+        return result
+      } catch (err) {
+        if (err?.code !== "ENOENT") throw err
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollMs))
+    }
+    const timeout = new Error(
+      "deferred restart acknowledgement timed out. If the daemon was just starting, the request " +
+      "may have been discarded; wait a few seconds and retry. It may also already have been accepted, " +
+      "so check the daemon log before deciding whether interruption with --force is acceptable.",
+    )
+    timeout.code = "restart_timeout"
+    throw timeout
+  } finally {
+    await unlink(tmpPath).catch(() => {})
+    await unlink(requestPath).catch(() => {})
+    await unlink(resultPath).catch(() => {})
+  }
+}
+
 const DELIVERY_UNCONFIRMED_HINT =
   "turn RPC は受理されましたが userMessage echo を確認できませんでした。既に届いている可能性があり、" +
   "再送すると重複配送になります。再送前に対象セッションの受信状態または rollout 監査を確認してください。"
@@ -337,7 +409,8 @@ export class SiblingInjectBridge {
   /**
    * @param {{dir?: string, claudeBridge?: object, codexBridge?: object, logger?: object,
    *   now?: () => number, processKill?: (pid: number, signal: number) => void,
-   *   pidStartedAt?: (pid: number) => Promise<string>}} [opts]
+   *   pidStartedAt?: (pid: number) => Promise<string>, onRestartRequested?: () => object,
+   *   isInputBlocked?: () => boolean, watchFn?: typeof watch}} [opts]
    */
   constructor({
     dir = SIBLING_REQUESTS_DIR,
@@ -347,6 +420,9 @@ export class SiblingInjectBridge {
     now = Date.now,
     processKill = process.kill.bind(process),
     pidStartedAt = defaultPidStartedAt,
+    onRestartRequested,
+    isInputBlocked,
+    watchFn = watch,
   } = {}) {
     this.dir = dir
     this.claudeBridge = claudeBridge
@@ -355,15 +431,46 @@ export class SiblingInjectBridge {
     /** @type {Set<string>} 二重処理防止 (request_id) */
     this._seen = new Set()
     this._watcher = null
+    this._sweepTimer = null
     this._now = now
     this._processKill = processKill
     this._pidStartedAt = pidStartedAt
+    this._onRestartRequested = onRestartRequested
+    this._isInputBlocked = isInputBlocked
+    this._watchFn = watchFn
+    this._newTurnInFlight = 0
     /** @type {Map<string, Map<string, {event: object, recordedAt: number}>>} cwd+session ごとの進行中委譲。 */
     this._activeDelegations = new Map()
     /** @type {Map<string, Map<string, {startedEvent?: object, terminalEvent: object, startedAt?: number, recordedAt: number}>>} 終了済み委譲の再送情報を兼ねた墓標。 */
     this._terminalDelegations = new Map()
   }
 
+  /** restart coordinator が通常/明示注入の bridge await 中を観測する。 */
+  hasActiveWork() {
+    return this._newTurnInFlight > 0
+  }
+
+  async _withNewTurnInFlight(operation) {
+    this._newTurnInFlight += 1
+    try {
+      return await operation()
+    } finally {
+      this._newTurnInFlight -= 1
+    }
+  }
+
+  async _sendNewTurn(operation, fields) {
+    try {
+      return await this._withNewTurnInFlight(operation)
+    } catch (err) {
+      this.logger?.error?.(
+        { ...fields, err: err?.message, stack: err?.stack },
+        "sibling-inject bridge delivery failed",
+      )
+      return { status: "internal_error" }
+    }
+  }
+
   _delegationSessionKey(cwd, sessionId) {
     return `${cwd}\u0000${sessionId}`
   }
@@ -551,6 +658,7 @@ export class SiblingInjectBridge {
 
   /** 監視ディレクトリを作成し、既存要求を sweep してから fs.watch を張る。 */
   async start() {
+    this.stop()
     try {
       await this._prepareDir()
     } catch (err) {
@@ -560,14 +668,19 @@ export class SiblingInjectBridge {
       )
       return
     }
-    await this._sweep()
+    await this._sweep({ startup: true })
     try {
-      this._watcher = watch(this.dir, (_event, filename) => {
-        if (filename && filename.endsWith(".json") && !filename.endsWith(".result.json")) {
-          this._ingest(filename).catch((err) => {
-            this.logger?.warn({ err: err?.message, filename }, "sibling-inject ingest failed")
+      this._watcher = this._watchFn(this.dir, () => {
+        // fs.watch のfilenameはOS都合で欠落・統合されうる。tmp作成とrenameを
+        // 短くまとめ、通知された1件でディレクトリ全体を正本として再走査する。
+        if (this._sweepTimer) clearTimeout(this._sweepTimer)
+        this._sweepTimer = setTimeout(() => {
+          this._sweepTimer = null
+          this._sweep().catch((err) => {
+            this.logger?.warn({ err: err?.message }, "sibling-inject event sweep failed")
           })
-        }
+        }, SIBLING_SWEEP_DEBOUNCE_MS)
+        this._sweepTimer.unref?.()
       })
     } catch (err) {
       this.logger?.warn(
@@ -578,7 +691,7 @@ export class SiblingInjectBridge {
   }
 
   /** 起動時 / 取りこぼし保険: dir 内の全要求ファイルを読む。 */
-  async _sweep() {
+  async _sweep({ startup = false } = {}) {
     let names = []
     try {
       names = await readdir(this.dir)
@@ -587,7 +700,7 @@ export class SiblingInjectBridge {
     }
     for (const n of names) {
       if (n.endsWith(".json") && !n.endsWith(".result.json")) {
-        await this._ingest(n).catch((err) => {
+        await this._ingest(n, { startup }).catch((err) => {
           this.logger?.warn({ err: err?.message, filename: n }, "sibling-inject sweep failed")
         })
       }
@@ -599,17 +712,18 @@ export class SiblingInjectBridge {
    * 成否によらず要求ファイルは削除する。delegate-event 以外は結果ファイルも書く。
    * @param {string} filename `<request_id>.json`
    */
-  async _ingest(filename) {
+  async _ingest(filename, { startup = false } = {}) {
     const request_id = filename.slice(0, -".json".length)
     if (this._seen.has(request_id)) return
     this._seen.add(request_id)
     const fp = path.join(this.dir, filename)
     let body
+    let requestInfo
     try {
-      const fileStat = await stat(fp)
-      if (fileStat.size > SIBLING_REQUEST_MAX_BYTES) {
+      requestInfo = await lstat(fp)
+      if (requestInfo.size > SIBLING_REQUEST_MAX_BYTES) {
         this.logger?.warn(
-          { filename, size: fileStat.size, max_size: SIBLING_REQUEST_MAX_BYTES },
+          { filename, size: requestInfo.size, max_size: SIBLING_REQUEST_MAX_BYTES },
           "sibling-inject: request file rejected because it exceeds the size limit",
         )
         // ⚠️ **結果ファイルを必ず書く**。ここで書かずに戻ると、結果をポーリングしている
@@ -620,7 +734,7 @@ export class SiblingInjectBridge {
         await this._writeResult(request_id, {
           ok: false,
           error: "request_too_large",
-          size: fileStat.size,
+          size: requestInfo.size,
           max_size: SIBLING_REQUEST_MAX_BYTES,
         })
         try {
@@ -637,10 +751,11 @@ export class SiblingInjectBridge {
       return
     }
 
-    // 契約の 3 形態を op で判別する:
+    // 注入・一覧・control の契約形を op で判別する:
     //   - op:"list"   → 候補列挙 (top-level text 無し)
     //   - op:"inject" → 明示宛先 (target_session_id + message、top-level text は **持たない**)
     //   - op 無し     → 通常 (cwd 最新、top-level text あり) ← 旧 agent と後方互換
+    //   - op:"restart" → 本文なしの deferred restart control
     // ⚠️ 明示宛先を「op:inject + message (top-level text 無し)」にするのが fail-closed の肝
     //    (T06271 レビュー major①): 旧 hub-agent は `!text` で invalid_request を返すため、
     //    未知フィールドを無視して sendToCwd 推測注入する事故が **単一リクエストで原理的に
@@ -672,6 +787,7 @@ export class SiblingInjectBridge {
     const isList = op === "list"
     const isExplicit = op === "inject"
     const isDelegateEvent = op === "delegate-event"
+    const isRestart = op === "restart"
     let result
     const badKind = target_cli_kind !== "claude" && target_cli_kind !== "codex"
     const delegatePhases = new Set(["started", "completed", "failed", "stopped"])
@@ -696,7 +812,29 @@ export class SiblingInjectBridge {
       : isExplicit
         ? !target_session_id || !message // 明示は id と message 必須 (空指定 fail-open を防ぐ)
         : !text // 通常は top-level text 必須 (＝旧契約)
-    if (isListAll) {
+    if (isRestart) {
+      // restart は同一ユーザーが所有する 0700/0600 IPC だけを認可境界にする専用 control op。
+      // 本文・token・cwd 等を許すと他 op の契約へ認証緩和が波及するため、op 単独だけを受理する。
+      const uid = process.getuid?.()
+      const unsafeRequestFile =
+        requestInfo.isSymbolicLink() ||
+        !requestInfo.isFile() ||
+        uid == null ||
+        requestInfo.uid !== uid ||
+        (requestInfo.mode & 0o777) !== 0o600
+      const hasBody = Object.keys(body || {}).some((key) => key !== "op")
+      if (unsafeRequestFile || hasBody) {
+        result = { ok: false, error: "invalid_request" }
+      } else if (startup) {
+        // 前プロセスがACK前に落ちて残した要求を、次のdaemon起動時に勝手に実行しない。
+        // live watcher到着分だけがrestartを開始できる。
+        result = { ok: false, error: "restart_stale" }
+      } else if (typeof this._onRestartRequested !== "function") {
+        result = { ok: false, error: "restart_unavailable" }
+      } else {
+        result = this._onRestartRequested()
+      }
+    } else if (isListAll) {
       // op:"list-all" (2026-07-23 統一再設計 1-2: クロス cwd 宛先探索): 全 cwd・両 CLI の
       // ライブセッションを列挙する。cwd / target_cli_kind / 本文は不要 (token のみ必須)。
       // 認可は verifySiblingTokenAny (同一ユーザーの spawn 済みセッションであれば全 cwd を
@@ -783,15 +921,23 @@ export class SiblingInjectBridge {
             cliKind: target_cli_kind,
           }),
         }
+      } else if (this._isInputBlocked?.()) {
+        // token検証後にのみ状態を返す。delegate-event/list/controlは新turnを作らないため通す。
+        result = { ok: false, error: "restart_pending" }
       } else if (isExplicit) {
         // 明示宛先: session_id (claude) / stream_id|thread_id (codex) で cwd 一致下に確定解決。
         // sendToStream は {status:"delivered"|"not_found"|"ambiguous"} を返す。
         // request_id を渡すのは、bridge 側が配送 ID を **決定的に** 導出して同一依頼の再処理を
         // 重複ガードで止められるようにするため (claude bridge は余分な引数を無視する)。
         const r = bridge?.sendToStream
-          ? await bridge.sendToStream(cwd, target_session_id, message, injectSource, request_id)
+          ? await this._sendNewTurn(
+            () => bridge.sendToStream(cwd, target_session_id, message, injectSource, request_id),
+            { request_id, cwd, target_cli_kind, op: "inject" },
+          )
           : { status: "not_found" }
-        if (r.status === "delivered") {
+        if (r.status === "internal_error") {
+          result = { ok: false, error: "internal_error" }
+        } else if (r.status === "delivered") {
           result = {
             ok: true,
             delivered_to: r.session,
@@ -857,9 +1003,14 @@ export class SiblingInjectBridge {
         //    あった。sendToCwd を status 返却にして解決と配送を 1 呼び出しに統合し、delivered_to は
         //    **実配送先 (r.session)** を返す。
         const r = bridge?.sendToCwd
-          ? await bridge.sendToCwd(cwd, text, injectSource, request_id)
+          ? await this._sendNewTurn(
+            () => bridge.sendToCwd(cwd, text, injectSource, request_id),
+            { request_id, cwd, target_cli_kind, op: "normal" },
+          )
           : { status: "not_found" }
-        if (r.status === "delivered") {
+        if (r.status === "internal_error") {
+          result = { ok: false, error: "internal_error" }
+        } else if (r.status === "delivered") {
           result = {
             ok: true,
             delivered_to: r.session ?? null,
@@ -933,7 +1084,8 @@ export class SiblingInjectBridge {
             : "sibling-inject dispatched"
         : "sibling-inject failed",
     )
-    if (!isDelegateEvent) await this._writeResult(request_id, result)
+    // startup sweep 由来の restart には待受者がいない。孤児 result を残さない。
+    if (!isDelegateEvent && !(isRestart && startup)) await this._writeResult(request_id, result)
     // 要求ファイルは処理後に必ず削除する (成否問わず、再処理させないため)。
     try {
       await unlink(fp)
@@ -989,6 +1141,8 @@ export class SiblingInjectBridge {
       /* ignore */
     }
     this._watcher = null
+    if (this._sweepTimer) clearTimeout(this._sweepTimer)
+    this._sweepTimer = null
   }
 }