@cocorograph/hub-agent 0.8.64 → 0.8.66

package/src/codex-result-mask.mjs

@@ -0,0 +1,187 @@
+import {
+  MASK_ENABLED,
+  redactSecrets,
+  redactSecretsValue,
+  toolResultPlaceholder,
+} from "./tool-result-mask.mjs"
+
+// On masking failures, keep safe protocol identity/status values so approvals
+// and completion events remain routable. Names alone never exempt secret values.
+const CONTROL_KEYS = new Set([
+  "id", "type", "method", "stream_id", "thread_id", "threadId", "turnId",
+  "itemId", "request_id", "callId", "input_id", "delegationId", "delegation_id",
+  "agentThreadId", "agent_thread_id", "parentThreadId", "ownerTurnId",
+  "status", "phase", "kind", "runtime", "success", "exitCode", "code",
+])
+
+const FAILURE_TEXT = "[Codex の表示内容を安全にマスクできなかったため非表示にしました]"
+const DISPLAY_KEYS = new Set([
+  "arguments", "input", "result", "error", "contentItems", "structuredContent",
+  "content", "summary", "text", "prompt", "command", "aggregatedOutput", "changes",
+])
+
+function toolInput(value) {
+  if (typeof value !== "string") return value
+  try { return JSON.parse(value) } catch { return value }
+}
+
+function placeholderForItem(item) {
+  if (item.type === "mcpToolCall" || item.type === "dynamicToolCall") {
+    return toolResultPlaceholder(item.tool, toolInput(item.arguments))
+  }
+  if (item.type === "commandExecution") {
+    return toolResultPlaceholder("exec_command", { command: item.command })
+  }
+  return null
+}
+
+const SCHEMA_CHILDREN = new Set(["items", "oneOf", "anyOf", "allOf", "not", "additionalProperties"])
+const SCHEMA_RESPONSE_VALUES = new Set(["enum", "const", "required", "id"])
+
+/** Field names describe input slots, not supplied credentials. Preserve schema
+ * structure while masking labels and removing hidden defaults (never submit a
+ * redaction placeholder as an answer). Response keys/choice IDs cannot be renamed
+ * without a reverse mapping, so secret-bearing identities disable the form. */
+function maskElicitationSchema(schema, fieldName = "") {
+  if (Array.isArray(schema)) return schema.map((child) => maskElicitationSchema(child, fieldName))
+  if (!schema || typeof schema !== "object") return redactSecretsValue(schema)
+  const entries = []
+  for (const [key, value] of Object.entries(schema)) {
+    if (key === "properties" && value && typeof value === "object" && !Array.isArray(value)) {
+      entries.push([key, Object.fromEntries(Object.entries(value).map(([name, child]) => {
+        if (redactSecrets(name) !== name) throw new Error("secret_schema_identity")
+        return [name, maskElicitationSchema(child, name)]
+      }))])
+    } else if (SCHEMA_CHILDREN.has(key)) {
+      entries.push([key, maskElicitationSchema(value, fieldName)])
+    } else if (SCHEMA_RESPONSE_VALUES.has(key)) {
+      const contextual = fieldName && key !== "required"
+        ? redactSecretsValue({ [fieldName]: value })[fieldName] : value
+      if (contextual !== value || redactSecretsValue(value) !== value) throw new Error("secret_schema_identity")
+      entries.push([key, value])
+    } else if (key === "default" || key === "examples") {
+      const contextKey = fieldName || "default"
+      const safe = redactSecretsValue({ [contextKey]: value })
+      if (schema.writeOnly !== true && schema.format !== "password" && safe[contextKey] === value) {
+        entries.push([key, value])
+      }
+    } else {
+      // Apply the shared key AND value policy to all other schema metadata.
+      entries.push(...Object.entries(redactSecretsValue({ [key]: value })))
+    }
+  }
+  return Object.fromEntries(entries)
+}
+
+function preserveElicitationSchema(original, masked) {
+  if (original.type !== "codex.permission.request" || original.method !== "mcpServer/elicitation/request"
+      || !original.params?.requestedSchema) return masked
+  try {
+    return { ...masked, params: { ...masked.params, requestedSchema: maskElicitationSchema(original.params.requestedSchema) } }
+  } catch {
+    // The existing frontend rejects accept for an unsupported mode, but still
+    // offers decline/cancel, addressing the unchanged pending request ID.
+    return { ...masked, params: { ...masked.params,
+      mode: "masked",
+      message: "秘密を含む回答キー・選択値があるため、このフォームは表示できません。拒否またはキャンセルしてください。",
+      requestedSchema: {},
+    } }
+  }
+}
+
+function failedDisplayCopy(value, protocol = true, seen = new WeakSet()) {
+  if (!value || typeof value !== "object") return typeof value === "string" ? FAILURE_TEXT : value
+  if (seen.has(value)) return FAILURE_TEXT
+  seen.add(value)
+  const next = Array.isArray(value) ? [] : Object.create(null)
+  const keys = new Set()
+  for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+    if (!descriptor.enumerable) continue
+    const safeKey = Array.isArray(value) ? key : redactSecrets(key)
+    if (keys.has(safeKey)) return FAILURE_TEXT
+    keys.add(safeKey)
+    const raw = descriptor.value
+    next[safeKey] = !Object.hasOwn(descriptor, "value") ? FAILURE_TEXT
+      : protocol && CONTROL_KEYS.has(key) && (raw === null || typeof raw !== "object")
+        ? redactSecrets(raw)
+        : failedDisplayCopy(raw, protocol && !DISPLAY_KEYS.has(key), seen)
+  }
+  seen.delete(value)
+  return next
+}
+
+/** Apply item policy using original arguments, after shared recursive redaction. */
+function maskItems(original, redacted, protocol = true) {
+  // Display subtrees have already been sanitized, including object keys and
+  // key-collision placeholders. Never rebuild them from the original keys.
+  if (!protocol) return redacted
+  if (!original || typeof original !== "object") return redacted
+  if (!redacted || typeof redacted !== "object") return redacted
+  if (Array.isArray(original)) return original.map((value, index) => maskItems(value, redacted[index], protocol))
+  const next = Object.fromEntries(Object.entries(redacted).map(([key, masked]) => {
+    // A renamed key cannot be a known protocol field; retain its sanitized
+    // value directly rather than recovering the old (potentially secret) key.
+    if (!Object.hasOwn(original, key)) return [key, masked]
+    const value = original[key]
+    return [key, maskItems(value, masked, !DISPLAY_KEYS.has(key))]
+  }))
+  const placeholder = protocol ? placeholderForItem(original) : null
+  if (placeholder) {
+    // Discard the entire result/error envelope, including provider extensions.
+    if (original.result != null) next.result = { content: [{ type: "text", text: placeholder }] }
+    if (original.error != null) next.error = { message: placeholder }
+    if (original.contentItems != null) next.contentItems = [{ type: "inputText", text: placeholder }]
+    if (original.aggregatedOutput != null) next.aggregatedOutput = placeholder
+  }
+  return next
+}
+
+/** Outgoing display copies only. Raw bridge history and model inputs stay untouched. */
+export function maskCodexDisplayPayload(payload) {
+  if (!MASK_ENABLED) return payload
+  try {
+    if (typeof payload?.type !== "string" || !payload.type.startsWith("codex.")) return payload
+    const method = payload.event?.method
+    // A secret may span arbitrarily many chunks. Completed items are authoritative;
+    // do not try regex masking isolated fragments (including future *Delta methods).
+    if (typeof method === "string" && /delta$/i.test(method)) return null
+    return preserveElicitationSchema(payload, maskItems(payload, redactSecretsValue(payload)))
+  } catch {
+    // Keep transport routing, but never retry a failed mask with the original body.
+    // Failure to inspect a malformed payload also falls back to dropping it.
+    try {
+      return failedDisplayCopy(payload)
+    } catch { return null }
+  }
+}
+
+/** Install once, before any bridge listeners/dispatch sends are registered. */
+export function installCodexDisplayMask(client) {
+  const send = client.send.bind(client)
+  client.send = (payload, ...args) => {
+    const masked = maskCodexDisplayPayload(payload)
+    if (!masked) return false
+    const event = masked.event
+    const item = event?.params?.item
+    // Root reasoning is rendered only from deltas by the existing browser. Send
+    // one already-masked completed body in that shape; child completion has its
+    // own renderer and must not consume the parent's thinking buffer.
+    if (MASK_ENABLED && masked.type === "codex.event" && event?.method === "item/completed"
+        && item?.type === "reasoning"
+        && !(item._hubSubagent?.runtime === "codex"
+          && typeof item._hubSubagent.delegationId === "string"
+          && item._hubSubagent.delegationId.trim())) {
+      const pick = (value) => Array.isArray(value) ? value.filter((part) => typeof part === "string") : []
+      const text = [...pick(item.content), ...pick(item.summary)].join("\n").trim()
+      if (text) send({
+        ...masked,
+        event: {
+          method: "item/reasoning/summaryTextDelta",
+          params: { ...event.params, itemId: item.id, delta: text },
+        },
+      }, ...args)
+    }
+    return send(masked, ...args)
+  }
+  return client
+}

package/src/main.mjs

@@ -48,8 +48,10 @@ import { WsClient } from "./ws-client.mjs"
 import { DispatchScheduler } from "./dispatch-scheduler.mjs"
 import { AsyncTtlCache } from "./async-ttl-cache.mjs"
 import { ClaudeStreamBridge } from "./claude-stream-bridge.mjs"
+import { installClaudeDisplayMask } from "./claude-display-mask.mjs"
 import { CodexMcpControl } from "./codex-mcp-control.mjs"
 import { CodexStreamBridge, classifyCodexInputError } from "./codex-stream-bridge.mjs"
+import { installCodexDisplayMask } from "./codex-result-mask.mjs"
 import {
   quotePosixShellArg,
   resolveCodexBinary,
@@ -999,7 +1001,7 @@ export async function startDaemon({ version, claudeSdk } = {}) {
     )
   }
 
-  const client = new WsClient(config, {
+  const client = installCodexDisplayMask(new WsClient(config, {
     logger,
     version,
     hostKey,
@@ -1009,7 +1011,8 @@ export async function startDaemon({ version, claudeSdk } = {}) {
     bundleVersionProvider: readBundleVersionSync,
     bundleStatusProvider,
     bundleManifestPath: BUNDLE_MANIFEST_PATH,
-  })
+  }))
+  installClaudeDisplayMask(client)
 
   // EventEmitter の 'error' は listener が無いと process が落ちる。
   // ws-client は close 側で reconnect を予約しているので、ここでは log だけ。

package/src/permission-display-mask.mjs

@@ -0,0 +1,142 @@
+import { isDeepStrictEqual } from "node:util"
+import { redactSecrets, redactSecretsValue, SECRET_PLACEHOLDER } from "./tool-result-mask.mjs"
+
+export const PERMISSION_MASK_DENIAL =
+  "伏せ字を含む引数を復元できません。該当項目を再入力して、もう一度実行してください。"
+
+/** Permission payloads must be JSON values, without cycles or accessors. */
+export function copyPermissionInput(value, ancestors = new Set()) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value
+  if (typeof value === "number" && Number.isFinite(value)) return value
+  if (!value || typeof value !== "object" || ancestors.has(value)) throw new Error(PERMISSION_MASK_DENIAL)
+  if (!Array.isArray(value) && ![Object.prototype, null].includes(Object.getPrototypeOf(value))) throw new Error(PERMISSION_MASK_DENIAL)
+  ancestors.add(value)
+  try {
+    if (Object.getOwnPropertySymbols(value).length) throw new Error(PERMISSION_MASK_DENIAL)
+    const entries = Object.entries(Object.getOwnPropertyDescriptors(value))
+      .filter(([key]) => !(Array.isArray(value) && key === "length"))
+      .map(([key, descriptor]) => {
+        if (!descriptor.enumerable || !Object.hasOwn(descriptor, "value")) throw new Error(PERMISSION_MASK_DENIAL)
+        return [key, copyPermissionInput(descriptor.value, ancestors)]
+      })
+    if (Array.isArray(value)) {
+      if (entries.length !== value.length || entries.some(([key], index) => key !== String(index))) throw new Error(PERMISSION_MASK_DENIAL)
+      return entries.map(([, item]) => item)
+    }
+    return Object.fromEntries(entries)
+  } finally {
+    ancestors.delete(value)
+  }
+}
+
+function questionKeyMap(originalInput, displayInput) {
+  const keys = new Map()
+  if (!Array.isArray(originalInput.questions) || !Array.isArray(displayInput.questions)) return keys
+  originalInput.questions.forEach((question, index) => {
+    const raw = question?.question
+    const shown = displayInput.questions[index]?.question
+    if (typeof raw !== "string" || typeof shown !== "string") return
+    if (keys.has(shown) && keys.get(shown) !== raw) throw new Error(PERMISSION_MASK_DENIAL)
+    keys.set(shown, raw)
+  })
+  return keys
+}
+
+function questionLabelMaps(originalInput, displayInput) {
+  const questions = new Map()
+  if (!Array.isArray(originalInput.questions) || !Array.isArray(displayInput.questions)) return questions
+  originalInput.questions.forEach((question, index) => {
+    if (typeof question?.question !== "string" || !Array.isArray(question.options)) return
+    const labels = questions.get(question.question) ?? new Map()
+    const shownOptions = displayInput.questions[index]?.options
+    question.options.forEach((option, optionIndex) => {
+      const raw = option?.label
+      const shown = shownOptions?.[optionIndex]?.label
+      if (typeof raw !== "string" || typeof shown !== "string") return
+      if (labels.has(shown) && labels.get(shown) !== raw) throw new Error(PERMISSION_MASK_DENIAL)
+      labels.set(shown, raw)
+    })
+    questions.set(question.question, labels)
+  })
+  return questions
+}
+
+export function preparePermissionInput(input, { toolName } = {}) {
+  const originalInput = copyPermissionInput(input)
+  if (!originalInput || Array.isArray(originalInput) || typeof originalInput !== "object") throw new Error(PERMISSION_MASK_DENIAL)
+  const displayInput = copyPermissionInput(redactSecretsValue(originalInput))
+  if (!displayInput || typeof displayInput !== "object" || Array.isArray(displayInput)) throw new Error(PERMISSION_MASK_DENIAL)
+  // AskUserQuestion's UI indexes answers by the displayed question text.
+  // Reject ambiguous display labels before the user is asked to choose.
+  if (toolName === "AskUserQuestion") {
+    questionKeyMap(originalInput, displayInput)
+    questionLabelMaps(originalInput, displayInput)
+  }
+  return { originalInput, displayInput }
+}
+
+/** Restore only unchanged masked values at the same path. Never interpolate secrets. */
+export function restorePermissionInput(originalInput, displayInput, updatedInput, { toolName } = {}) {
+  const updated = copyPermissionInput(updatedInput)
+  if (!updated || Array.isArray(updated) || typeof updated !== "object") throw new Error(PERMISSION_MASK_DENIAL)
+  function containsMarker(value) {
+    if (typeof value === "string") return value.includes(SECRET_PLACEHOLDER)
+    return value && typeof value === "object" && Object.entries(value).some(([key, item]) => key.includes(SECRET_PLACEHOLDER) || containsMarker(item))
+  }
+  function restore(original, display, next, path = []) {
+    const wasMasked = !isDeepStrictEqual(original, display)
+    if (wasMasked && isDeepStrictEqual(next, display)) return copyPermissionInput(original)
+    if (wasMasked && (typeof next === "string" || typeof display === "string") && containsMarker(next)) throw new Error(PERMISSION_MASK_DENIAL)
+    if (!next || typeof next !== "object") return next
+    // A wholly hidden object has no editable key correspondence. A complete
+    // replacement without markers is ordinary new input, not a restoration.
+    if (wasMasked && typeof display === "string") return next
+    const keyMap = new Map()
+    if (original && typeof original === "object" && display && typeof display === "object") {
+      for (const key of Object.keys(original)) {
+        const shown = Array.isArray(original) ? key : redactSecrets(key)
+        if (keyMap.has(shown)) throw new Error(PERMISSION_MASK_DENIAL)
+        keyMap.set(shown, key)
+      }
+    }
+    const hasMaskedKeys = [...keyMap].some(([shown, raw]) => shown !== raw)
+    const destinations = new Set()
+    const entries = Object.entries(next).map(([key, value]) => {
+      const originalKey = keyMap.get(key) ?? key
+      const questionAnswerKey = toolName === "AskUserQuestion" && path.length === 1 && path[0] === "answers"
+      if (hasMaskedKeys && key.includes(SECRET_PLACEHOLDER) && !keyMap.has(key) && !questionAnswerKey) throw new Error(PERMISSION_MASK_DENIAL)
+      if (destinations.has(originalKey)) throw new Error(PERMISSION_MASK_DENIAL)
+      destinations.add(originalKey)
+      return [originalKey, restore(
+        original && typeof original === "object" && Object.hasOwn(original, originalKey) ? original[originalKey] : undefined,
+        display && typeof display === "object" && Object.hasOwn(display, key) ? display[key] : undefined,
+        value, [...path, originalKey],
+      )]
+    })
+    return Array.isArray(next) ? entries.map(([, value]) => value) : Object.fromEntries(entries)
+  }
+  const restored = restore(originalInput, displayInput, updated)
+  if (toolName === "AskUserQuestion" && Object.hasOwn(restored, "answers")) {
+    if (!restored.answers || typeof restored.answers !== "object" || Array.isArray(restored.answers)) throw new Error(PERMISSION_MASK_DENIAL)
+    const keys = questionKeyMap(originalInput, displayInput)
+    const questionLabels = questionLabelMaps(originalInput, displayInput)
+    const answers = new Map()
+    for (const [key, value] of Object.entries(restored.answers)) {
+      const originalKey = keys.get(key) ?? key
+      if (key.includes(SECRET_PLACEHOLDER) && !keys.has(key) && !Object.values(originalInput.questions ?? []).some(q => q?.question === key)) throw new Error(PERMISSION_MASK_DENIAL)
+      if (answers.has(originalKey)) throw new Error(PERMISSION_MASK_DENIAL)
+      const labels = questionLabels.get(originalKey)
+      const restoreLabel = (answer) => {
+        if (typeof answer !== "string") throw new Error(PERMISSION_MASK_DENIAL)
+        // The UI returns either a selected label or free input in this field.
+        // Only a complete, unique label match is interpretable as that option.
+        if (labels?.has(answer)) return labels.get(answer)
+        if (answer.includes(SECRET_PLACEHOLDER)) throw new Error(PERMISSION_MASK_DENIAL)
+        return answer
+      }
+      answers.set(originalKey, Array.isArray(value) ? value.map(restoreLabel) : restoreLabel(value))
+    }
+    restored.answers = Object.fromEntries(answers)
+  }
+  return restored
+}