@cocorograph/hub-agent 0.8.63 → 0.8.65

package/README.md

@@ -77,6 +77,23 @@ hub-agent plugins uninstall <name>    # ~/.hub/plugins/<prio>-<name>/ を削除
 
 ## 構成
 
+### チャット表示のマスク
+
+Claude / Codex のチャットは、既定で表示・WebSocket 配信用コピーをマスクします。
+`get_skill_prompt`、`skill/`・`エージェント/` の内部本文取得、デプロイ接続情報取得の
+結果を非表示にし、通常の本文・引数・エラー・差分に含まれる既知の秘密値も伏せます。
+一般のナレッジ取得や通常のツール結果は表示します。
+
+- 分割された秘密値の漏出を防ぐため、文字単位の途中出力ではなく完成済み本文を表示します。
+- コード実行ラッパーに対象ツール名が明記されている場合、その実行結果全体を非表示にします。
+  動的に組み立てたツール名や、任意の文章に埋め込まれた未知形式の秘密を完全検出する機能ではありません。
+- 許可確認には伏せた入力を渡し、変更されなかった伏せ字を元の入力へ戻して実行します。
+  一意に復元できない編集は拒否します。マスク失敗時に生の本文へ戻すことはしません。
+- Codex のモデル入力・再開用 rollout 原本は変更しません。Claude の既存の終了後 JSONL
+  マスクは継続します。ターミナル表示や過去に配信済みのデータを遡って消すものではありません。
+- 緊急時の切り戻し設定 `HUB_AGENT_TOOL_RESULT_MASK=0` は、秘密値を含め無加工で配信します。
+  通常運用では無効化しないでください。
+
 ```
 hub-agent/
 ├── bin/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocorograph/hub-agent",
-  "version": "0.8.63",
+  "version": "0.8.65",
   "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの Claude / Codex チャットと tmux セッションを中継する。",
   "type": "module",
   "license": "UNLICENSED",

package/src/claude-display-mask.mjs

@@ -0,0 +1,89 @@
+import { createEventMasker, MASK_ENABLED, redactSecretsValue } from "./tool-result-mask.mjs"
+
+/** Also cover errors, ready metadata and permission copies outside SDK _emit.
+ * Recheck the complete envelope deliberately: ready/history can combine already
+ * masked events with newly added metadata. A type-based bypass would trust those
+ * unrelated fields too. Do not trade this boundary for a size-based raw fallback. */
+export function installClaudeDisplayMask(client) {
+  const send = client.send.bind(client)
+  client.send = (payload, ...args) => {
+    if (!MASK_ENABLED || !payload?.type?.startsWith("claude.")) return send(payload, ...args)
+    let masked
+    try {
+      masked = redactSecretsValue(payload)
+    } catch {
+      masked = {
+        type: "claude.error",
+        stream_id: payload.stream_id,
+        session_id: payload.session_id,
+        error: "[本文を安全にマスクできないため表示を省略しました]",
+      }
+    }
+    return send(masked, ...args)
+  }
+  return client
+}
+
+/**
+ * A partial string cannot be redacted independently: a key or a quoted value may
+ * straddle notifications. Keep lifecycle notifications, but publish text,
+ * thinking and tool arguments only with the complete assistant message. The
+ * SDK/model input and the original event are never modified here.
+ */
+export function createClaudeDisplayMasker(initialToolNames) {
+  const mask = createEventMasker(initialToolNames)
+  return (event) => {
+    if (!MASK_ENABLED) return event
+    if (event?.type === "stream_event") {
+      const partial = event.event
+      if (partial?.type === "content_block_delta") {
+        return null
+      }
+      if (partial?.type === "content_block_start") {
+        const block = partial.content_block
+        return mask({
+          ...event,
+          event: {
+            type: partial.type,
+            index: partial.index,
+            content_block: {
+              type: block?.type,
+              ...(block?.id ? { id: block.id } : {}),
+              ...(block?.name ? { name: block.name } : {}),
+            },
+          },
+        })
+      }
+    }
+    return mask(event)
+  }
+}
+
+/** Failure must not disclose either the source payload or an exception message. */
+export function claudeMaskFailure(event) {
+  const notice = "[本文を安全にマスクできないため表示を省略しました]"
+  if (event?.type === "result") {
+    return {
+      type: "result",
+      subtype: event.subtype,
+      is_error: event.is_error,
+      session_id: event.session_id,
+      result: notice,
+    }
+  }
+  if (event?.type === "system" && event.subtype === "session_state_changed") {
+    return { type: "system", subtype: event.subtype, state: event.state }
+  }
+  if (event?.type === "assistant" || event?.type === "user") {
+    // Keep a renderable completed message and numeric accounting only. Do not
+    // copy arbitrary usage/provider metadata from the failed source envelope.
+    const usage = Object.fromEntries([
+      "input_tokens", "output_tokens", "cache_creation_input_tokens", "cache_read_input_tokens",
+    ].filter(key => typeof event.message?.usage?.[key] === "number" && Number.isFinite(event.message.usage[key]))
+      .map(key => [key, event.message.usage[key]]))
+    return { type: event.type, message: { role: event.type,
+      content: [{ type: "text", text: notice }], ...(Object.keys(usage).length ? { usage } : {}),
+    } }
+  }
+  return { type: "system", subtype: "mask_error", message: notice }
+}

package/src/claude-stream-bridge.mjs

@@ -27,9 +27,10 @@ import { jsonlPath } from "./claude-history.mjs"
 import { watchSessionFile } from "./claude-history-watch.mjs"
 import {
   MASK_ENABLED,
-  createEventMasker,
   maskJsonlFileAtRest,
 } from "./tool-result-mask.mjs"
+import { createClaudeDisplayMasker, claudeMaskFailure } from "./claude-display-mask.mjs"
+import { copyPermissionInput, preparePermissionInput, restorePermissionInput, PERMISSION_MASK_DENIAL } from "./permission-display-mask.mjs"
 import { getOrCreateSiblingToken } from "./sibling-token.mjs"
 import { recordInjectSourcePersistent } from "./inject-source-store.mjs"
 import { readPositiveIntEnv, sanitizePositiveInt } from "./positive-int-env.mjs"
@@ -563,6 +564,9 @@ export class ClaudeStreamSession {
      *  メッセージが後着して実行される「ゴースト実行」を防ぐ)。到着で消費 (delete)。
      *  無限増加を避けるため上限で全クリアする (キャンセルは低頻度)。 */
     this._canceledInputIds = new Set()
+    /** 取消成功した input_id の直近リング。accepted は配達確認と二重実行防止の根拠なので外さず、
+     *  browser が「accepted ＋ キュー不在」のバブル昇格から取消済み id を除外する別軸にする。 */
+    this._cancelledInputIds = []
     /** 改修3: 直近 browser へ通知した queue 署名 (件数 + id 列)。変化時のみ emit する。
      *  空キューの署名 ("0:") で初期化し、空→空の冗長 emit を抑止する。 */
     this._lastEmittedQueueSig = "0:"
@@ -690,7 +694,7 @@ export class ClaudeStreamSession {
     /** マスク (2026-06-23): ライブ stream / watch 用のステートフル masker。tool_use_id→name を
      *  蓄積し、tool_result の秘匿情報 / 非公開スキルプロンプト本文を表示・配信前に伏せる。
      *  モデル消費後のコピーに作用するためスキル実行は壊れない。 */
-    this._eventMasker = createEventMasker()
+    this._eventMasker = createClaudeDisplayMasker()
     /** オンディスク jsonl をマスク済みか (close 時の二重書き換えを防ぐ冪等ガード)。 */
     this._jsonlMasked = false
 
@@ -699,7 +703,7 @@ export class ClaudeStreamSession {
   }
 
   /** マスク済みイベントを onEvent へ流す共通経路。秘匿情報 / 非公開スキルプロンプト本文を
-   *  表示・WS 配信前に伏せる。マスク失敗時は素のイベントを流す (表示が止まるより素通し優先)。 */
+   *  表示・WS 配信前に伏せる。マスク失敗時も元の本文へ戻さない。 */
   /** 連携カード種別 (Phase 2): 注入本文と source を FIFO に控える。sendToCwd/sendToStream が
    *  session.sendMessage() を呼ぶ直前に記録し、**drain 昇格時に _emitQueueState が started 本文
    *  一致で消費**して startedSources として frontend へ載せる。
@@ -843,15 +847,15 @@ export class ClaudeStreamSession {
     if (MASK_ENABLED) {
       try {
         out = this._eventMasker(event)
-      } catch (err) {
+      } catch {
         this.logger?.warn(
-          { err: err?.message, stream_id: this.stream_id },
+          { stream_id: this.stream_id },
           "event mask failed",
         )
-        out = event
+        out = claudeMaskFailure(event)
       }
     }
-    this.onEvent(out)
+    if (out != null) this.onEvent(out)
   }
 
   /** セッション終了時にオンディスク jsonl をマスク書き換えする (冪等)。Claude CLI が当該
@@ -944,18 +948,25 @@ export class ClaudeStreamSession {
   /** SDK options.canUseTool: tool 起動を許可するかを browser に問い合わせる。 */
   async _canUseTool(toolName, input) {
     if (!this.onPermission) return { behavior: "allow", updatedInput: input }
+    let displayState
+    try {
+      displayState = MASK_ENABLED ? preparePermissionInput(input, { toolName }) : null
+    } catch {
+      return { behavior: "deny", message: PERMISSION_MASK_DENIAL }
+    }
     const request_id = randomUUID()
     return await new Promise((resolve) => {
       this._permissionResolvers.set(request_id, {
         resolve,
         tool_name: toolName,
         input,
+        displayState,
       })
       try {
-        this.onPermission({ tool_name: toolName, input, request_id })
+        this.onPermission({ tool_name: toolName, input: displayState ? copyPermissionInput(displayState.displayInput) : input, request_id })
       } catch (err) {
         this.logger?.warn(
-          { err: err.message, stream_id: this.stream_id, tool: toolName },
+          { stream_id: this.stream_id },
           "onPermission callback threw",
         )
         this._permissionResolvers.delete(request_id)
@@ -1011,6 +1022,16 @@ export class ClaudeStreamSession {
     this._permissionResolvers.delete(request_id)
     // B11: 現 primary 端末からの permission 応答を活性として記録する。
     this.touch(this.stream_id)
+    if (!["allow", "deny"].includes(decision?.behavior)) {
+      decision = { behavior: "deny", message: PERMISSION_MASK_DENIAL }
+    }
+    if (MASK_ENABLED && decision?.behavior === "allow" && r.displayState) {
+      try {
+        decision = { ...decision, updatedInput: restorePermissionInput(r.displayState.originalInput, r.displayState.displayInput, decision.updatedInput, { toolName: r.tool_name }) }
+      } catch {
+        decision = { behavior: "deny", message: PERMISSION_MASK_DENIAL }
+      }
+    }
     r.resolve(decision)
     return true
   }
@@ -1059,12 +1080,19 @@ export class ClaudeStreamSession {
     if (!this.onPermission || this._permissionResolvers.size === 0) return
     for (const [request_id, r] of this._permissionResolvers) {
       try {
-        this.onPermission({ tool_name: r.tool_name, input: r.input, request_id })
+        this.onPermission({ tool_name: r.tool_name, input: r.displayState ? copyPermissionInput(r.displayState.displayInput) : r.input, request_id })
       } catch (err) {
         this.logger?.warn(
-          { err: err.message, stream_id: this.stream_id, request_id },
+          { stream_id: this.stream_id, request_id },
           "replay permission failed",
         )
+        this._permissionResolvers.delete(request_id)
+        r.resolve({ behavior: "deny", message: PERMISSION_MASK_DENIAL })
+        try {
+          this.onPermissionCancel?.({ request_ids: [request_id], reason: "replay failed" })
+        } catch {
+          this.logger?.warn({ stream_id: this.stream_id, request_id }, "permission cancel callback failed")
+        }
       }
     }
   }
@@ -1313,7 +1341,10 @@ export class ClaudeStreamSession {
     // チップを固着させる。ack を返す条件 (accepted) と同じ場所で 1 回だけ記録する。
     const inputId =
       typeof opts?.input_id === "string" && opts.input_id ? opts.input_id : null
-    if (inputId && result?.accepted) this._recordAcceptedInput(inputId)
+    if (inputId && result?.accepted) {
+      this._recordAcceptedInput(inputId)
+      if (result.preCancelled) this._recordCancelledInput(inputId)
+    }
     return result
   }
 
@@ -1336,7 +1367,7 @@ export class ClaudeStreamSession {
         { stream_id: this.stream_id, input_id: inputId },
         "dropped pre-canceled input (cancel arrived before input)",
       )
-      return { accepted: true }
+      return { accepted: true, preCancelled: true }
     }
 
     // ultracode ワンショット (0.6.28): このターンのみ xhigh effort + 常時 dynamic-workflow
@@ -1713,6 +1744,8 @@ export class ClaudeStreamSession {
    *  snapshot の `accepted` として browser へ載せ、ack 喪失時の自己回復に使う。 */
   _recordAcceptedInput(inputId) {
     if (typeof inputId !== "string" || !inputId) return
+    const cancelledAt = this._cancelledInputIds.indexOf(inputId)
+    if (cancelledAt !== -1) this._cancelledInputIds.splice(cancelledAt, 1)
     const at = this._acceptedInputIds.indexOf(inputId)
     if (at !== -1) this._acceptedInputIds.splice(at, 1)
     this._acceptedInputIds.push(inputId)
@@ -1724,6 +1757,19 @@ export class ClaudeStreamSession {
     }
   }
 
+  _recordCancelledInput(inputId) {
+    if (typeof inputId !== "string" || !inputId) return
+    const at = this._cancelledInputIds.indexOf(inputId)
+    if (at !== -1) this._cancelledInputIds.splice(at, 1)
+    this._cancelledInputIds.push(inputId)
+    if (this._cancelledInputIds.length > ACCEPTED_INPUT_ID_RING_MAX) {
+      this._cancelledInputIds.splice(
+        0,
+        this._cancelledInputIds.length - ACCEPTED_INPUT_ID_RING_MAX,
+      )
+    }
+  }
+
   /** キャンセル機能 (0.6.26): browser から id 指定で送信待ちメッセージを 1 件取り消す。
    *  実行開始済み (既に drain された) メッセージは pending に残っていないので no-op になる。
    *  削除に成功したら queue_state を再 emit して送信待ちチップを更新する。 */
@@ -1740,6 +1786,8 @@ export class ClaudeStreamSession {
     this._pendingMessages = this._pendingMessages.filter((m) => m.id !== id)
     const removed = before !== this._pendingMessages.length
     if (removed) {
+      this._canceledInputIds.delete(id)
+      this._recordCancelledInput(id)
       this.logger?.info(
         { stream_id: this.stream_id, id, queued: this._pendingMessages.length },
         "queued message canceled",
@@ -1855,6 +1903,7 @@ export class ClaudeStreamSession {
       // と判定して楽観チップを消し、「キューに無い ＋ ここにも無い ＝ 未配達」なら
       // 消さずに再送導線を出す (無言削除の回帰を作らないための 2 軸判定)。
       accepted: [...this._acceptedInputIds],
+      cancelled: [...this._cancelledInputIds],
     }
   }
 

package/src/codex-result-mask.mjs

@@ -0,0 +1,187 @@
+import {
+  MASK_ENABLED,
+  redactSecrets,
+  redactSecretsValue,
+  toolResultPlaceholder,
+} from "./tool-result-mask.mjs"
+
+// On masking failures, keep safe protocol identity/status values so approvals
+// and completion events remain routable. Names alone never exempt secret values.
+const CONTROL_KEYS = new Set([
+  "id", "type", "method", "stream_id", "thread_id", "threadId", "turnId",
+  "itemId", "request_id", "callId", "input_id", "delegationId", "delegation_id",
+  "agentThreadId", "agent_thread_id", "parentThreadId", "ownerTurnId",
+  "status", "phase", "kind", "runtime", "success", "exitCode", "code",
+])
+
+const FAILURE_TEXT = "[Codex の表示内容を安全にマスクできなかったため非表示にしました]"
+const DISPLAY_KEYS = new Set([
+  "arguments", "input", "result", "error", "contentItems", "structuredContent",
+  "content", "summary", "text", "prompt", "command", "aggregatedOutput", "changes",
+])
+
+function toolInput(value) {
+  if (typeof value !== "string") return value
+  try { return JSON.parse(value) } catch { return value }
+}
+
+function placeholderForItem(item) {
+  if (item.type === "mcpToolCall" || item.type === "dynamicToolCall") {
+    return toolResultPlaceholder(item.tool, toolInput(item.arguments))
+  }
+  if (item.type === "commandExecution") {
+    return toolResultPlaceholder("exec_command", { command: item.command })
+  }
+  return null
+}
+
+const SCHEMA_CHILDREN = new Set(["items", "oneOf", "anyOf", "allOf", "not", "additionalProperties"])
+const SCHEMA_RESPONSE_VALUES = new Set(["enum", "const", "required", "id"])
+
+/** Field names describe input slots, not supplied credentials. Preserve schema
+ * structure while masking labels and removing hidden defaults (never submit a
+ * redaction placeholder as an answer). Response keys/choice IDs cannot be renamed
+ * without a reverse mapping, so secret-bearing identities disable the form. */
+function maskElicitationSchema(schema, fieldName = "") {
+  if (Array.isArray(schema)) return schema.map((child) => maskElicitationSchema(child, fieldName))
+  if (!schema || typeof schema !== "object") return redactSecretsValue(schema)
+  const entries = []
+  for (const [key, value] of Object.entries(schema)) {
+    if (key === "properties" && value && typeof value === "object" && !Array.isArray(value)) {
+      entries.push([key, Object.fromEntries(Object.entries(value).map(([name, child]) => {
+        if (redactSecrets(name) !== name) throw new Error("secret_schema_identity")
+        return [name, maskElicitationSchema(child, name)]
+      }))])
+    } else if (SCHEMA_CHILDREN.has(key)) {
+      entries.push([key, maskElicitationSchema(value, fieldName)])
+    } else if (SCHEMA_RESPONSE_VALUES.has(key)) {
+      const contextual = fieldName && key !== "required"
+        ? redactSecretsValue({ [fieldName]: value })[fieldName] : value
+      if (contextual !== value || redactSecretsValue(value) !== value) throw new Error("secret_schema_identity")
+      entries.push([key, value])
+    } else if (key === "default" || key === "examples") {
+      const contextKey = fieldName || "default"
+      const safe = redactSecretsValue({ [contextKey]: value })
+      if (schema.writeOnly !== true && schema.format !== "password" && safe[contextKey] === value) {
+        entries.push([key, value])
+      }
+    } else {
+      // Apply the shared key AND value policy to all other schema metadata.
+      entries.push(...Object.entries(redactSecretsValue({ [key]: value })))
+    }
+  }
+  return Object.fromEntries(entries)
+}
+
+function preserveElicitationSchema(original, masked) {
+  if (original.type !== "codex.permission.request" || original.method !== "mcpServer/elicitation/request"
+      || !original.params?.requestedSchema) return masked
+  try {
+    return { ...masked, params: { ...masked.params, requestedSchema: maskElicitationSchema(original.params.requestedSchema) } }
+  } catch {
+    // The existing frontend rejects accept for an unsupported mode, but still
+    // offers decline/cancel, addressing the unchanged pending request ID.
+    return { ...masked, params: { ...masked.params,
+      mode: "masked",
+      message: "秘密を含む回答キー・選択値があるため、このフォームは表示できません。拒否またはキャンセルしてください。",
+      requestedSchema: {},
+    } }
+  }
+}
+
+function failedDisplayCopy(value, protocol = true, seen = new WeakSet()) {
+  if (!value || typeof value !== "object") return typeof value === "string" ? FAILURE_TEXT : value
+  if (seen.has(value)) return FAILURE_TEXT
+  seen.add(value)
+  const next = Array.isArray(value) ? [] : Object.create(null)
+  const keys = new Set()
+  for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+    if (!descriptor.enumerable) continue
+    const safeKey = Array.isArray(value) ? key : redactSecrets(key)
+    if (keys.has(safeKey)) return FAILURE_TEXT
+    keys.add(safeKey)
+    const raw = descriptor.value
+    next[safeKey] = !Object.hasOwn(descriptor, "value") ? FAILURE_TEXT
+      : protocol && CONTROL_KEYS.has(key) && (raw === null || typeof raw !== "object")
+        ? redactSecrets(raw)
+        : failedDisplayCopy(raw, protocol && !DISPLAY_KEYS.has(key), seen)
+  }
+  seen.delete(value)
+  return next
+}
+
+/** Apply item policy using original arguments, after shared recursive redaction. */
+function maskItems(original, redacted, protocol = true) {
+  // Display subtrees have already been sanitized, including object keys and
+  // key-collision placeholders. Never rebuild them from the original keys.
+  if (!protocol) return redacted
+  if (!original || typeof original !== "object") return redacted
+  if (!redacted || typeof redacted !== "object") return redacted
+  if (Array.isArray(original)) return original.map((value, index) => maskItems(value, redacted[index], protocol))
+  const next = Object.fromEntries(Object.entries(redacted).map(([key, masked]) => {
+    // A renamed key cannot be a known protocol field; retain its sanitized
+    // value directly rather than recovering the old (potentially secret) key.
+    if (!Object.hasOwn(original, key)) return [key, masked]
+    const value = original[key]
+    return [key, maskItems(value, masked, !DISPLAY_KEYS.has(key))]
+  }))
+  const placeholder = protocol ? placeholderForItem(original) : null
+  if (placeholder) {
+    // Discard the entire result/error envelope, including provider extensions.
+    if (original.result != null) next.result = { content: [{ type: "text", text: placeholder }] }
+    if (original.error != null) next.error = { message: placeholder }
+    if (original.contentItems != null) next.contentItems = [{ type: "inputText", text: placeholder }]
+    if (original.aggregatedOutput != null) next.aggregatedOutput = placeholder
+  }
+  return next
+}
+
+/** Outgoing display copies only. Raw bridge history and model inputs stay untouched. */
+export function maskCodexDisplayPayload(payload) {
+  if (!MASK_ENABLED) return payload
+  try {
+    if (typeof payload?.type !== "string" || !payload.type.startsWith("codex.")) return payload
+    const method = payload.event?.method
+    // A secret may span arbitrarily many chunks. Completed items are authoritative;
+    // do not try regex masking isolated fragments (including future *Delta methods).
+    if (typeof method === "string" && /delta$/i.test(method)) return null
+    return preserveElicitationSchema(payload, maskItems(payload, redactSecretsValue(payload)))
+  } catch {
+    // Keep transport routing, but never retry a failed mask with the original body.
+    // Failure to inspect a malformed payload also falls back to dropping it.
+    try {
+      return failedDisplayCopy(payload)
+    } catch { return null }
+  }
+}
+
+/** Install once, before any bridge listeners/dispatch sends are registered. */
+export function installCodexDisplayMask(client) {
+  const send = client.send.bind(client)
+  client.send = (payload, ...args) => {
+    const masked = maskCodexDisplayPayload(payload)
+    if (!masked) return false
+    const event = masked.event
+    const item = event?.params?.item
+    // Root reasoning is rendered only from deltas by the existing browser. Send
+    // one already-masked completed body in that shape; child completion has its
+    // own renderer and must not consume the parent's thinking buffer.
+    if (MASK_ENABLED && masked.type === "codex.event" && event?.method === "item/completed"
+        && item?.type === "reasoning"
+        && !(item._hubSubagent?.runtime === "codex"
+          && typeof item._hubSubagent.delegationId === "string"
+          && item._hubSubagent.delegationId.trim())) {
+      const pick = (value) => Array.isArray(value) ? value.filter((part) => typeof part === "string") : []
+      const text = [...pick(item.content), ...pick(item.summary)].join("\n").trim()
+      if (text) send({
+        ...masked,
+        event: {
+          method: "item/reasoning/summaryTextDelta",
+          params: { ...event.params, itemId: item.id, delta: text },
+        },
+      }, ...args)
+    }
+    return send(masked, ...args)
+  }
+  return client
+}

package/src/codex-stream-bridge.mjs

@@ -973,6 +973,9 @@ export class CodexStreamBridge extends EventEmitter {
       queueStateSeq: 0,
       /** ack 喪失からの自己回復用、受理済み browser input_id の bounded ring。 */
       acceptedInputIds: [],
+      /** 取消成功 id は accepted（二重実行ガード）から外さず、browser が「accepted ＋キュー不在」
+       *  のバブル昇格から除外するための別軸として保持する。 */
+      cancelledInputIds: [],
       /** @type {{resolve: Function, timer: any} | null} round3 major#2: turn/start 後に turn/started
        *  (activeTurnId 確定) を待つ barrier の待機者。timeout 付きでハングを防ぐ。 */
       _turnActiveWaiter: null,
@@ -2062,6 +2065,9 @@ export class CodexStreamBridge extends EventEmitter {
 
   _recordAcceptedInput(session, inputId) {
     if (!session || typeof inputId !== "string" || !inputId) return
+    const cancelledIds = session.cancelledInputIds || (session.cancelledInputIds = [])
+    const cancelledAt = cancelledIds.indexOf(inputId)
+    if (cancelledAt !== -1) cancelledIds.splice(cancelledAt, 1)
     const ids = session.acceptedInputIds || (session.acceptedInputIds = [])
     const at = ids.indexOf(inputId)
     if (at !== -1) ids.splice(at, 1)
@@ -2071,6 +2077,17 @@ export class CodexStreamBridge extends EventEmitter {
     }
   }
 
+  _recordCancelledInput(session, inputId) {
+    if (!session || typeof inputId !== "string" || !inputId) return
+    const ids = session.cancelledInputIds || (session.cancelledInputIds = [])
+    const at = ids.indexOf(inputId)
+    if (at !== -1) ids.splice(at, 1)
+    ids.push(inputId)
+    if (ids.length > ACCEPTED_INPUT_ID_RING_MAX) {
+      ids.splice(0, ids.length - ACCEPTED_INPUT_ID_RING_MAX)
+    }
+  }
+
   /**
    * 重複ガードの台帳から id を取り消す (2026-08-05)。
    *
@@ -2103,6 +2120,7 @@ export class CodexStreamBridge extends EventEmitter {
       seq: session.queueStateSeq || 0,
       generation: session.seq,
       accepted: [...(session.acceptedInputIds || [])],
+      cancelled: [...(session.cancelledInputIds || [])],
     }
   }
 
@@ -2121,6 +2139,7 @@ export class CodexStreamBridge extends EventEmitter {
       return false
     }
     const [item] = session.inputQueue.splice(index, 1)
+    this._recordCancelledInput(session, item.inputId || item.deliveryId)
     if (!item.acceptedAsQueued) {
       const err = Object.assign(new Error("codex queued input cancelled"), {
         reason: "cancelled",

package/src/main.mjs

@@ -48,8 +48,10 @@ import { WsClient } from "./ws-client.mjs"
 import { DispatchScheduler } from "./dispatch-scheduler.mjs"
 import { AsyncTtlCache } from "./async-ttl-cache.mjs"
 import { ClaudeStreamBridge } from "./claude-stream-bridge.mjs"
+import { installClaudeDisplayMask } from "./claude-display-mask.mjs"
 import { CodexMcpControl } from "./codex-mcp-control.mjs"
 import { CodexStreamBridge, classifyCodexInputError } from "./codex-stream-bridge.mjs"
+import { installCodexDisplayMask } from "./codex-result-mask.mjs"
 import {
   quotePosixShellArg,
   resolveCodexBinary,
@@ -999,7 +1001,7 @@ export async function startDaemon({ version, claudeSdk } = {}) {
     )
   }
 
-  const client = new WsClient(config, {
+  const client = installCodexDisplayMask(new WsClient(config, {
     logger,
     version,
     hostKey,
@@ -1009,7 +1011,8 @@ export async function startDaemon({ version, claudeSdk } = {}) {
     bundleVersionProvider: readBundleVersionSync,
     bundleStatusProvider,
     bundleManifestPath: BUNDLE_MANIFEST_PATH,
-  })
+  }))
+  installClaudeDisplayMask(client)
 
   // EventEmitter の 'error' は listener が無いと process が落ちる。
   // ws-client は close 側で reconnect を予約しているので、ここでは log だけ。

package/src/permission-display-mask.mjs

@@ -0,0 +1,142 @@
+import { isDeepStrictEqual } from "node:util"
+import { redactSecrets, redactSecretsValue, SECRET_PLACEHOLDER } from "./tool-result-mask.mjs"
+
+export const PERMISSION_MASK_DENIAL =
+  "伏せ字を含む引数を復元できません。該当項目を再入力して、もう一度実行してください。"
+
+/** Permission payloads must be JSON values, without cycles or accessors. */
+export function copyPermissionInput(value, ancestors = new Set()) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value
+  if (typeof value === "number" && Number.isFinite(value)) return value
+  if (!value || typeof value !== "object" || ancestors.has(value)) throw new Error(PERMISSION_MASK_DENIAL)
+  if (!Array.isArray(value) && ![Object.prototype, null].includes(Object.getPrototypeOf(value))) throw new Error(PERMISSION_MASK_DENIAL)
+  ancestors.add(value)
+  try {
+    if (Object.getOwnPropertySymbols(value).length) throw new Error(PERMISSION_MASK_DENIAL)
+    const entries = Object.entries(Object.getOwnPropertyDescriptors(value))
+      .filter(([key]) => !(Array.isArray(value) && key === "length"))
+      .map(([key, descriptor]) => {
+        if (!descriptor.enumerable || !Object.hasOwn(descriptor, "value")) throw new Error(PERMISSION_MASK_DENIAL)
+        return [key, copyPermissionInput(descriptor.value, ancestors)]
+      })
+    if (Array.isArray(value)) {
+      if (entries.length !== value.length || entries.some(([key], index) => key !== String(index))) throw new Error(PERMISSION_MASK_DENIAL)
+      return entries.map(([, item]) => item)
+    }
+    return Object.fromEntries(entries)
+  } finally {
+    ancestors.delete(value)
+  }
+}
+
+function questionKeyMap(originalInput, displayInput) {
+  const keys = new Map()
+  if (!Array.isArray(originalInput.questions) || !Array.isArray(displayInput.questions)) return keys
+  originalInput.questions.forEach((question, index) => {
+    const raw = question?.question
+    const shown = displayInput.questions[index]?.question
+    if (typeof raw !== "string" || typeof shown !== "string") return
+    if (keys.has(shown) && keys.get(shown) !== raw) throw new Error(PERMISSION_MASK_DENIAL)
+    keys.set(shown, raw)
+  })
+  return keys
+}
+
+function questionLabelMaps(originalInput, displayInput) {
+  const questions = new Map()
+  if (!Array.isArray(originalInput.questions) || !Array.isArray(displayInput.questions)) return questions
+  originalInput.questions.forEach((question, index) => {
+    if (typeof question?.question !== "string" || !Array.isArray(question.options)) return
+    const labels = questions.get(question.question) ?? new Map()
+    const shownOptions = displayInput.questions[index]?.options
+    question.options.forEach((option, optionIndex) => {
+      const raw = option?.label
+      const shown = shownOptions?.[optionIndex]?.label
+      if (typeof raw !== "string" || typeof shown !== "string") return
+      if (labels.has(shown) && labels.get(shown) !== raw) throw new Error(PERMISSION_MASK_DENIAL)
+      labels.set(shown, raw)
+    })
+    questions.set(question.question, labels)
+  })
+  return questions
+}
+
+export function preparePermissionInput(input, { toolName } = {}) {
+  const originalInput = copyPermissionInput(input)
+  if (!originalInput || Array.isArray(originalInput) || typeof originalInput !== "object") throw new Error(PERMISSION_MASK_DENIAL)
+  const displayInput = copyPermissionInput(redactSecretsValue(originalInput))
+  if (!displayInput || typeof displayInput !== "object" || Array.isArray(displayInput)) throw new Error(PERMISSION_MASK_DENIAL)
+  // AskUserQuestion's UI indexes answers by the displayed question text.
+  // Reject ambiguous display labels before the user is asked to choose.
+  if (toolName === "AskUserQuestion") {
+    questionKeyMap(originalInput, displayInput)
+    questionLabelMaps(originalInput, displayInput)
+  }
+  return { originalInput, displayInput }
+}
+
+/** Restore only unchanged masked values at the same path. Never interpolate secrets. */
+export function restorePermissionInput(originalInput, displayInput, updatedInput, { toolName } = {}) {
+  const updated = copyPermissionInput(updatedInput)
+  if (!updated || Array.isArray(updated) || typeof updated !== "object") throw new Error(PERMISSION_MASK_DENIAL)
+  function containsMarker(value) {
+    if (typeof value === "string") return value.includes(SECRET_PLACEHOLDER)
+    return value && typeof value === "object" && Object.entries(value).some(([key, item]) => key.includes(SECRET_PLACEHOLDER) || containsMarker(item))
+  }
+  function restore(original, display, next, path = []) {
+    const wasMasked = !isDeepStrictEqual(original, display)
+    if (wasMasked && isDeepStrictEqual(next, display)) return copyPermissionInput(original)
+    if (wasMasked && (typeof next === "string" || typeof display === "string") && containsMarker(next)) throw new Error(PERMISSION_MASK_DENIAL)
+    if (!next || typeof next !== "object") return next
+    // A wholly hidden object has no editable key correspondence. A complete
+    // replacement without markers is ordinary new input, not a restoration.
+    if (wasMasked && typeof display === "string") return next
+    const keyMap = new Map()
+    if (original && typeof original === "object" && display && typeof display === "object") {
+      for (const key of Object.keys(original)) {
+        const shown = Array.isArray(original) ? key : redactSecrets(key)
+        if (keyMap.has(shown)) throw new Error(PERMISSION_MASK_DENIAL)
+        keyMap.set(shown, key)
+      }
+    }
+    const hasMaskedKeys = [...keyMap].some(([shown, raw]) => shown !== raw)
+    const destinations = new Set()
+    const entries = Object.entries(next).map(([key, value]) => {
+      const originalKey = keyMap.get(key) ?? key
+      const questionAnswerKey = toolName === "AskUserQuestion" && path.length === 1 && path[0] === "answers"
+      if (hasMaskedKeys && key.includes(SECRET_PLACEHOLDER) && !keyMap.has(key) && !questionAnswerKey) throw new Error(PERMISSION_MASK_DENIAL)
+      if (destinations.has(originalKey)) throw new Error(PERMISSION_MASK_DENIAL)
+      destinations.add(originalKey)
+      return [originalKey, restore(
+        original && typeof original === "object" && Object.hasOwn(original, originalKey) ? original[originalKey] : undefined,
+        display && typeof display === "object" && Object.hasOwn(display, key) ? display[key] : undefined,
+        value, [...path, originalKey],
+      )]
+    })
+    return Array.isArray(next) ? entries.map(([, value]) => value) : Object.fromEntries(entries)
+  }
+  const restored = restore(originalInput, displayInput, updated)
+  if (toolName === "AskUserQuestion" && Object.hasOwn(restored, "answers")) {
+    if (!restored.answers || typeof restored.answers !== "object" || Array.isArray(restored.answers)) throw new Error(PERMISSION_MASK_DENIAL)
+    const keys = questionKeyMap(originalInput, displayInput)
+    const questionLabels = questionLabelMaps(originalInput, displayInput)
+    const answers = new Map()
+    for (const [key, value] of Object.entries(restored.answers)) {
+      const originalKey = keys.get(key) ?? key
+      if (key.includes(SECRET_PLACEHOLDER) && !keys.has(key) && !Object.values(originalInput.questions ?? []).some(q => q?.question === key)) throw new Error(PERMISSION_MASK_DENIAL)
+      if (answers.has(originalKey)) throw new Error(PERMISSION_MASK_DENIAL)
+      const labels = questionLabels.get(originalKey)
+      const restoreLabel = (answer) => {
+        if (typeof answer !== "string") throw new Error(PERMISSION_MASK_DENIAL)
+        // The UI returns either a selected label or free input in this field.
+        // Only a complete, unique label match is interpretable as that option.
+        if (labels?.has(answer)) return labels.get(answer)
+        if (answer.includes(SECRET_PLACEHOLDER)) throw new Error(PERMISSION_MASK_DENIAL)
+        return answer
+      }
+      answers.set(originalKey, Array.isArray(value) ? value.map(restoreLabel) : restoreLabel(value))
+    }
+    restored.answers = Object.fromEntries(answers)
+  }
+  return restored
+}

package/src/tool-result-mask.mjs

@@ -8,23 +8,20 @@
  * jsonl へ流れていた。さらに Hub ナレッジに格納した **非公開スキルプロンプト本文**
  * (`get_skill_prompt` MCP の戻り値) も毎回リザルトに露出していた。
  *
- * 本モジュールは「表示・配信・記録されるコピー」だけをマスクする。モデルが実際に受け取る
- * 入力は SDK stream の上流 (Claude CLI) で確定しており、hub-agent に届くのは **モデルが
- * 消費した後** のイベントなので、ここでマスクしてもモデルの動作・スキル実行は壊れない
- * (詳細は claude-stream-bridge.mjs の emit 経路コメント参照)。
+ * ライブ表示は SDK / app-server のイベントのコピーをマスクし、実行中のモデル入力を変更しない。
+ * Claude の終了後 JSONL 書き換えは従来の対象・正規表現を別 helper で維持する。再開時にはマスク済みの
+ * 内容が読まれる。Codex の再開用 rollout 原本には適用しない。
  *
  * 2 種類のマスク:
  *  - 秘匿情報: 正規表現で既知トークン形 / sensitive な KEY=VALUE 代入を伏せ字化する。
- *    モデルは元々不要なので、オンディスク jsonl をマスクしても resume は無傷。
+ *    表示コピーでは JSON の秘密フィールドにも適用する。保存用の対象は拡大しない。
  *  - スキルプロンプト本文: `get_skill_prompt` (MCP 名前空間込み) の tool_result 本文を
  *    まるごとプレースホルダへ置換する。tool_use → tool_result の id 対応が必要なため、
  *    stream にはステートフルな masker (createEventMasker)、jsonl 一括には 1 パスの
  *    maskJsonlText を用意する。
  *
- * ⚠️ 限定事項 (v1): includePartialMessages の **部分デルタ (stream_event)** はマスク
- * しない。秘匿情報の主出所である tool_result / .env ダンプは完成済みメッセージとして
- * 届くためここで捕捉でき、最終メッセージ・jsonl・hydrate も全てマスクされる。アシスタント
- * が逐次生成する途中テキストにシークレットが現れる確率は低いと判断し v1 では対象外。
+ * 部分デルタは claude-display-mask / codex-result-mask が表示前に抑止し、
+ * 分割された秘密値を連結・表示しない。本文は完成済みメッセージから表示する。
  */
 import { readFile, rename, rm, stat, utimes, writeFile } from "node:fs/promises"
 
@@ -54,12 +51,14 @@ export const DEPLOY_CRED_PLACEHOLDER =
  * 既知の秘匿情報パターン (誤検知を抑えるため、形が明確なトークンに限定する)。
  * 各要素は global フラグ付き RegExp。replace で SECRET_PLACEHOLDER に置換する。
  */
+const DISPLAY_OPENAI_PATTERN = /\bsk-(?:(?:proj|svcacct)-)?[A-Za-z0-9_-]{20,}/g
+const AT_REST_OPENAI_PATTERN = /sk-[A-Za-z0-9]{20,}/g
 const SECRET_PATTERNS = [
   // PEM 秘密鍵ブロック (複数行)。RSA/EC/OPENSSH/DSA/PGP の修飾子に対応。
   /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g,
   // Anthropic / OpenAI 系 API キー (sk-ant-... を先に置換するため先頭に)。
   /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  /sk-[A-Za-z0-9]{20,}/g,
+  DISPLAY_OPENAI_PATTERN,
   // AWS アクセスキー ID。
   /\bAKIA[0-9A-Z]{16}\b/g,
   // GitHub トークン (ghp_/gho_/ghu_/ghs_/ghr_ と fine-grained PAT)。
@@ -79,10 +78,16 @@ const SECRET_PATTERNS = [
 /**
  * sensitive な名前の KEY=VALUE / KEY: VALUE 代入を伏せ字化する。キー名は残し値だけ消す
  * (例: `DB_PASSWORD=hunter2` → `DB_PASSWORD=[REDACTED]`)。.env ダンプ / 環境変数出力対策。
- * 値は 4 文字以上のとき対象 (短い値の誤検知回避)。引用符は維持する。
+ * キーの完全な構成要素で判定し、短い値も対象にする。引用符は維持する。
  */
 const ASSIGN_PATTERN =
-  /\b([A-Za-z0-9_]*(?:PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|CLIENT[_-]?SECRET|AUTH[_-]?TOKEN)[A-Za-z0-9_]*)(\s*[=:]\s*)(['"]?)([^\s'"]{4,})\3/gi
+  /(["']?)\b([A-Za-z_][A-Za-z0-9_-]*)\1(\s*[=:]\s*)("(?:\\.|[^"\\])*"|'[^']*'|\[REDACTED\]|[^\s,;{}\[\]"']+|["'][^\r\n]*)/g
+
+// Match complete key components, not substrings such as tokenUsage / tokenizer.
+function isSecretKey(key) {
+  const normalized = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/-/g, "_").toLowerCase()
+  return /(?:^|_)(?:password|passwd|secret|token|api_key|access_key|private_key|client_secret|authorization|cookie|set_cookie)$/.test(normalized)
+}
 
 /**
  * 文字列中の秘匿情報を伏せ字化する。マスク対象が無ければ同一文字列をそのまま返す。
@@ -91,17 +96,113 @@ const ASSIGN_PATTERN =
  */
 export function redactSecrets(text) {
   if (typeof text !== "string" || text.length === 0) return text
+  // Decode JSON (including JSON encoded inside a JSON string) before inspecting
+  // keys. Keep the original bytes when no redaction is needed.
+  if (/^\s*[\[{\"]/.test(text)) {
+    try {
+      const parsed = JSON.parse(text)
+      const masked = redactSecretsValue(parsed)
+      return masked !== parsed ? JSON.stringify(masked) : text
+    } catch { /* Plain text and incomplete JSON use the patterns below. */ }
+  }
   let out = text
   for (const re of SECRET_PATTERNS) {
     out = out.replace(re, SECRET_PLACEHOLDER)
   }
+  out = out.replace(/\b(Authorization\s*:\s*)(?:Bearer|Basic)\s+[^\s,"'}]+/gi, `$1${SECRET_PLACEHOLDER}`)
   out = out.replace(
     ASSIGN_PATTERN,
-    (_m, key, sep, quote, _val) => `${key}${sep}${quote}${SECRET_PLACEHOLDER}${quote}`,
+    (match, keyQuote, key, sep, value) => {
+      if (!isSecretKey(key)) return match
+      const quote = /^["']/.test(value) ? value[0] : ""
+      return `${keyQuote}${key}${keyQuote}${sep}${quote}${SECRET_PLACEHOLDER}${quote}`
+    },
   )
+  out = out.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+:[^\s/@]+@/gi, `$1${SECRET_PLACEHOLDER}@`)
   return out
 }
 
+/** Recursively sanitize a display copy; unchanged branches retain identity. */
+export function redactSecretsValue(value) {
+  if (typeof value === "string") return redactSecrets(value)
+  if (!value || typeof value !== "object") return value
+  let changed = false
+  const keys = new Set()
+  let collision = false
+  const entries = Object.entries(value).map(([key, original]) => {
+    const safeKey = Array.isArray(value) ? key : redactSecrets(key)
+    if (keys.has(safeKey)) collision = true
+    keys.add(safeKey)
+    const presenceFlag = typeof original === "boolean" && /^has(?:_|[A-Z])/.test(key)
+    const masked = !Array.isArray(value) && !presenceFlag && isSecretKey(key)
+      ? SECRET_PLACEHOLDER : redactSecretsValue(original)
+    if (masked !== original || safeKey !== key) changed = true
+    return [safeKey, masked]
+  })
+  if (collision) return SECRET_PLACEHOLDER
+  if (!changed) return value
+  return Array.isArray(value) ? entries.map(([, item]) => item) : Object.fromEntries(entries)
+}
+
+/** Only recognize a real, explicit helper invocation, not echo/documentation. */
+function isDeployHelperCommand(command, allowShellWrapper = true) {
+  if (typeof command !== "string") return false
+  const tokens = command.match(/"(?:\\.|[^"\\])*"|'[^']*'|&&|\|\||[;\n|]|[^\s;&|]+/g) ?? []
+  let start = 0
+  for (let end = 0; end <= tokens.length; end++) {
+    if (end < tokens.length && !/^(?:&&|\|\||[;\n|])$/.test(tokens[end])) continue
+    const words = tokens.slice(start, end).map((word) => word.replace(/^(["'])([\s\S]*)\1$/, "$2"))
+    start = end + 1
+    while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0] ?? "")) words.shift()
+    // Unwrap one explicit shell command only; do not evaluate arbitrary shell code.
+    if (allowShellWrapper && /(?:^|\/)(?:bash|sh|zsh)$/.test(words[0] ?? "")
+        && /^-(?:c|lc|cl)$/.test(words[1] ?? "") && words.length === 3
+        && isDeployHelperCommand(words[2], false)) return true
+    if (/(?:^|\/)python(?:3(?:\.\d+)?)?$/.test(words[0] ?? "")) {
+      words.shift()
+      while (/^-(?:u|B)$/.test(words[0] ?? "")) words.shift()
+    }
+    if (/(?:^|\/)hub_helper\.py$/.test(words[0] ?? "") && words[1] === "deploy_creds") return true
+  }
+  return false
+}
+
+/** Shared Claude/Codex policy. Input is consulted before it is redacted. */
+export function toolResultPlaceholder(name, input) {
+  if (isSkillPromptTool(name)) return SKILL_PROMPT_PLACEHOLDER
+  if (isDeployCredentialTool(name)) return DEPLOY_CRED_PLACEHOLDER
+  const shortName = typeof name === "string" ? name.split(/__|\./).at(-1) : ""
+  if (shortName === "exec") {
+    const source = typeof input === "string" ? input : input?.code ?? input?.source
+    // Code-mode aggregates inner results without a reliable per-result tool ID.
+    // A visible reference to a protected tool therefore makes the entire wrapper
+    // result private, including other results from that same execution. This is
+    // deliberately conservative (also covers bracket access/aliases), not a JS
+    // interpreter or a claim to detect dynamically constructed tool names.
+    if (typeof source === "string") {
+      if (/(?:\b|__)get_skill_prompt\b/.test(source)
+          || (/(?:\b|__)(?:get_knowledge_page|get_session_log)\b/.test(source)
+            && /(?:skill|エージェント)\//.test(source))) return SKILL_PROMPT_PLACEHOLDER
+      if (/(?:\b|__)(?:get_deploy_target|deploy_creds)\b/.test(source)) return DEPLOY_CRED_PLACEHOLDER
+    }
+  }
+  if (["get_knowledge_page", "get_session_log"].includes(shortName)
+      && typeof input?.slug === "string" && /^(?:skill|エージェント)\//.test(input.slug)) {
+    return SKILL_PROMPT_PLACEHOLDER
+  }
+  if (["Bash", "exec_command"].includes(shortName)
+      && isDeployHelperCommand(input?.command ?? input?.cmd)) return DEPLOY_CRED_PLACEHOLDER
+  return null
+}
+
+function classifiedToolName(block) {
+  if (isSkillPromptTool(block.name) || isDeployCredentialTool(block.name)) return block.name
+  const placeholder = toolResultPlaceholder(block.name, block.input)
+  if (placeholder === SKILL_PROMPT_PLACEHOLDER) return "get_skill_prompt"
+  if (placeholder === DEPLOY_CRED_PLACEHOLDER) return "deploy_creds"
+  return block.name
+}
+
 /**
  * tool 名が非公開スキルプロンプト取得ツールか判定する。MCP 名前空間が付くため
  * (`mcp__hub__get_skill_prompt` / `mcp__hub_staff__get_skill_prompt`)、末尾一致でも拾う。
@@ -132,28 +233,6 @@ export function isDeployCredentialTool(name) {
   )
 }
 
-/** tool_result の content (string | block[]) をプレースホルダ 1 本へ潰す。 */
-function skillPlaceholderContent() {
-  return [{ type: "text", text: SKILL_PROMPT_PLACEHOLDER }]
-}
-
-/** tool_result の content をデプロイ接続情報プレースホルダ 1 本へ潰す。 */
-function deployCredPlaceholderContent() {
-  return [{ type: "text", text: DEPLOY_CRED_PLACEHOLDER }]
-}
-
-/** content blocks 配列の text を redactSecrets で処理した新配列を返す (非破壊)。 */
-function redactBlocks(blocks) {
-  if (!Array.isArray(blocks)) return blocks
-  return blocks.map((b) => {
-    if (b && b.type === "text" && typeof b.text === "string") {
-      const masked = redactSecrets(b.text)
-      return masked === b.text ? b : { ...b, text: masked }
-    }
-    return b
-  })
-}
-
 /**
  * SDK message 形 (jsonl 1 行 / live event) のオブジェクトをマスクした **コピー** を返す。
  * 変更が無ければ元オブジェクトをそのまま返す (参照同一で「変化なし」を呼び出し側が判定可)。
@@ -165,104 +244,33 @@ function redactBlocks(blocks) {
 export function maskMessageObject(obj, toolNames) {
   if (!MASK_ENABLED) return obj
   if (!obj || typeof obj !== "object") return obj
-
-  if (obj.type === "system" && obj.subtype === "codex_delegate") {
-    let changed = false
-    const next = { ...obj }
-    for (const field of ["prompt", "description"]) {
-      if (typeof obj[field] !== "string") continue
-      const masked = redactSecrets(obj[field])
-      if (masked !== obj[field]) {
-        next[field] = masked
-        changed = true
-      }
-    }
-    return changed ? next : obj
+  collectToolUseNames(obj, toolNames)
+  obj = redactSecretsValue(obj)
+  // Some SDK/user envelopes duplicate tool output outside message.content.
+  if (obj.type === "user" && Object.hasOwn(obj, "tool_use_result") && Array.isArray(obj.message?.content)) {
+    const placeholder = obj.message.content.reduce((found, block) => found ||
+      (block?.type === "tool_result" ? toolResultPlaceholder(toolNames.get(block.tool_use_id)) : null), null)
+    if (placeholder && obj.tool_use_result !== placeholder) obj = { ...obj, tool_use_result: placeholder }
   }
 
   const message = obj.message
-  if (!message || typeof message !== "object") return obj
-  const content = message.content
-
-  // assistant: tool_use の id→name を記録しつつ text ブロックの秘匿情報を伏せる。
-  if (obj.type === "assistant") {
-    if (Array.isArray(content)) {
-      for (const b of content) {
-        if (b && b.type === "tool_use" && typeof b.id === "string") {
-          toolNames.set(b.id, b.name)
-        }
-      }
-      const masked = redactBlocks(content)
-      if (masked !== content && masked.some((b, i) => b !== content[i])) {
-        return { ...obj, message: { ...message, content: masked } }
-      }
-    } else if (typeof content === "string") {
-      const masked = redactSecrets(content)
-      if (masked !== content) {
-        return { ...obj, message: { ...message, content: masked } }
-      }
-    }
-    return obj
-  }
-
-  // user: tool_result をスキル判定 or 秘匿情報マスク。素のテキスト発言も秘匿情報を伏せる。
-  if (obj.type === "user") {
-    if (Array.isArray(content)) {
-      let changed = false
-      const next = content.map((b) => {
-        if (b && b.type === "tool_result") {
-          const name = toolNames.get(b.tool_use_id)
-          if (isSkillPromptTool(name)) {
-            changed = true
-            return { ...b, content: skillPlaceholderContent() }
-          }
-          if (isDeployCredentialTool(name)) {
-            changed = true
-            return { ...b, content: deployCredPlaceholderContent() }
-          }
-          // 非スキル tool_result: 中身 (string | block[]) の秘匿情報を伏せる。
-          if (typeof b.content === "string") {
-            const masked = redactSecrets(b.content)
-            if (masked !== b.content) {
-              changed = true
-              return { ...b, content: masked }
-            }
-            return b
-          }
-          if (Array.isArray(b.content)) {
-            const mc = redactBlocks(b.content)
-            if (mc.some((x, i) => x !== b.content[i])) {
-              changed = true
-              return { ...b, content: mc }
-            }
-            return b
-          }
-          return b
-        }
-        if (b && b.type === "text" && typeof b.text === "string") {
-          const masked = redactSecrets(b.text)
-          if (masked !== b.text) {
-            changed = true
-            return { ...b, text: masked }
-          }
-        }
-        return b
-      })
-      if (changed) return { ...obj, message: { ...message, content: next } }
-    } else if (typeof content === "string") {
-      const masked = redactSecrets(content)
-      if (masked !== content) {
-        return { ...obj, message: { ...message, content: masked } }
-      }
-    }
-    return obj
-  }
-
-  return obj
+  if (obj.type !== "user" || !Array.isArray(message?.content)) return obj
+  let changed = false
+  const content = message.content.map((block) => {
+    if (block?.type !== "tool_result") return block
+    const placeholder = toolResultPlaceholder(toolNames.get(block.tool_use_id))
+    if (!placeholder) return block
+    if (Array.isArray(block.content) && block.content.length === 1
+        && block.content[0]?.type === "text" && block.content[0].text === placeholder) return block
+    changed = true
+    return { ...block, content: [{ type: "text", text: placeholder }] }
+  })
+  return changed ? { ...obj, message: { ...message, content } } : obj
 }
 
 /**
- * assistant メッセージ obj から tool_use の id→name を toolNames Map へ記録する
+ * assistant メッセージ obj から tool_use の id→表示用分類名を toolNames Map へ記録する。
+ * 値は実際の tool 名とは限らず、引数から分類した get_skill_prompt / deploy_creds も含む。
  * (マスクはしない)。履歴 hydrate で「tool_use 行が表示スライスの外へ truncate されても
  * tool_result のスキル判定が効く」よう、全行を事前走査して id→name を集めるのに使う。
  * @param {Record<string, unknown>} obj
@@ -272,12 +280,75 @@ export function collectToolUseNames(obj, toolNames) {
   if (obj?.type === "assistant" && Array.isArray(obj.message?.content)) {
     for (const b of obj.message.content) {
       if (b && b.type === "tool_use" && typeof b.id === "string") {
-        toolNames.set(b.id, b.name)
+        toolNames.set(b.id, classifiedToolName(b))
       }
     }
   }
 }
 
+// 保存用は従来の token regex と 4 文字以上の代入だけ。表示用の JSON/key/URI
+// 拡張を呼ばないことで、Claude resume が読む原本の変更範囲を維持する。
+const AT_REST_ASSIGN_PATTERN =
+  /\b([A-Za-z0-9_]*(?:PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|CLIENT[_-]?SECRET|AUTH[_-]?TOKEN)[A-Za-z0-9_]*)(\s*[=:]\s*)(['"]?)([^\s'"]{4,})\3/gi
+
+function redactAtRestText(text) {
+  let out = text
+  for (const pattern of SECRET_PATTERNS) {
+    out = out.replace(pattern === DISPLAY_OPENAI_PATTERN ? AT_REST_OPENAI_PATTERN : pattern, SECRET_PLACEHOLDER)
+  }
+  return out.replace(AT_REST_ASSIGN_PATTERN,
+    (_match, key, sep, quote) => `${key}${sep}${quote}${SECRET_PLACEHOLDER}${quote}`)
+}
+
+function redactAtRestTextBlock(block) {
+  if (block?.type !== "text" || typeof block.text !== "string") return block
+  const text = redactAtRestText(block.text)
+  return text === block.text ? block : { ...block, text }
+}
+
+/** Existing at-rest message scope; tool names are real names, never display classifications. */
+function maskAtRestMessage(obj, toolNames) {
+  if (!obj || typeof obj !== "object") return obj
+  if (obj.type === "system" && obj.subtype === "codex_delegate") {
+    let next = obj
+    for (const field of ["prompt", "description"]) {
+      if (typeof obj[field] !== "string") continue
+      const masked = redactAtRestText(obj[field])
+      if (masked !== obj[field]) next = { ...next, [field]: masked }
+    }
+    return next
+  }
+  const message = obj.message
+  if (!message || typeof message !== "object" || !["assistant", "user"].includes(obj.type)) return obj
+  const content = message.content
+  let next = content
+  if (typeof content === "string") next = redactAtRestText(content)
+  else if (Array.isArray(content)) {
+    next = content.map((block) => {
+      if (obj.type === "assistant" && block?.type === "tool_use" && typeof block.id === "string") {
+        toolNames.set(block.id, block.name)
+      }
+      if (obj.type !== "user" || block?.type !== "tool_result") return redactAtRestTextBlock(block)
+      const name = toolNames.get(block.tool_use_id)
+      const placeholder = isSkillPromptTool(name) ? SKILL_PROMPT_PLACEHOLDER
+        : isDeployCredentialTool(name) ? DEPLOY_CRED_PLACEHOLDER : null
+      // Keep the legacy rewrite behavior even for an already masked result.
+      if (placeholder) return { ...block, content: [{ type: "text", text: placeholder }] }
+      if (typeof block.content === "string") {
+        const masked = redactAtRestText(block.content)
+        return masked === block.content ? block : { ...block, content: masked }
+      }
+      if (Array.isArray(block.content)) {
+        const masked = block.content.map(redactAtRestTextBlock)
+        if (masked.some((item, i) => item !== block.content[i])) return { ...block, content: masked }
+      }
+      return block
+    })
+    if (next.every((block, i) => block === content[i])) return obj
+  }
+  return next === content ? obj : { ...obj, message: { ...message, content: next } }
+}
+
 /**
  * ライブ stream / watch 用のステートフル masker を生成する。tool_use → tool_result が
  * 別イベントで届くため、id→name を内部 Map に蓄積しながら 1 イベントずつマスクする。
@@ -297,7 +368,7 @@ export function createEventMasker(initialToolNames) {
 }
 
 /**
- * jsonl ファイル全文 (改行区切り JSON) を 1 パスでマスクした文字列を返す。
+ * 保存用の従来 policy で jsonl ファイル全文をマスクする。表示は maskMessageObject を使う。
  * tool_use を先に通すと id→name が貯まるので、行順 (assistant→user) のまま走査すれば
  * tool_result のスキル判定が成立する。マスク対象が 1 件も無ければ null を返す
  * (呼び出し側が「書き換え不要」を判定して mtime を温存できる)。
@@ -321,7 +392,7 @@ export function maskJsonlText(text) {
     } catch {
       return line // パース不能行はそのまま (壊さない)
     }
-    const masked = maskMessageObject(obj, toolNames)
+    const masked = maskAtRestMessage(obj, toolNames)
     if (masked !== obj) {
       changed = true
       return JSON.stringify(masked)