@cocorograph/hub-agent 0.8.69 → 0.8.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocorograph/hub-agent",
-  "version": "0.8.69",
+  "version": "0.8.71",
   "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの Claude / Codex チャットと tmux セッションを中継する。",
   "type": "module",
   "license": "UNLICENSED",

package/scripts/install.ps1

@@ -103,10 +103,49 @@ function Get-LinuxUserName {
   return $u
 }
 
+# Quote a value as ONE PowerShell single-quoted literal, for text that PowerShell
+# itself will parse later (the RunOnce command line below). PowerShell escapes a quote
+# by doubling it: o'hare -> 'o''hare'.
+#
+# WARNING: this is PowerShell quoting. It is NOT bash quoting, and there is deliberately
+# no bash equivalent in this file any more -- everything handed to wsl.exe goes as plain
+# argv tokens instead (see Invoke-WslInstaller).
+#
+# Doubling the ASCII quote is NOT enough on its own. PowerShell also accepts the
+# typographic quotes as string delimiters, so a value containing U+2019 closes the
+# literal early and the rest of it is parsed as code. Measured 2026-09-10 on pwsh:
+#   "'" + "x<U+2019>; Write-Output INJECTED; #" + "'"  ->  Invoke-Expression ran INJECTED.
+# A double quote is just as bad one level out: it ends the -Command "..." region no
+# matter how the inner value is quoted.
+#
+# So this allows printable ASCII only, minus the double quote, and refuses the rest.
+# Enumerating dangerous characters is the losing side of this; an allowlist is not.
+# An enrollment token and a hub URL are both ASCII, so nothing legitimate is lost.
+#
+# WARNING: the end anchor must be \z, not $. In .NET, $ also matches immediately before a
+# final newline, so '...*$' accepts "tok" plus a trailing LF -- and a token pasted out of
+# a browser or a text file carries exactly that. Measured 2026-09-10 on pwsh:
+#   ("tok" + [char]10) -match '^[\x20\x21\x23-\x7e]*$'   -> True   (leaks through)
+#   ("tok" + [char]10) -match '^[\x20\x21\x23-\x7e]*\z'  -> False  (rejected)
+# The empty string still passes, which is what a run without a token needs.
+#
+# WARNING: the rejection must not echo the value. It carries the enrollment token, and
+# an exception goes to the console, to transcripts and into whatever diagnostics get
+# shared afterwards. Name the setting, not its contents.
+function ConvertTo-PowerShellSingleQuoted($name, $value) {
+  $s = [string]$value
+  if ($s -notmatch '^[\x20\x21\x23-\x7e]*\z') {
+    throw "$name contains a character that cannot be safely embedded in the resume command (allowed: printable ASCII except the double quote)"
+  }
+  return "'" + ($s -replace "'", "''") + "'"
+}
+
 # Register "re-run myself with RESUME=1 after reboot", carrying token/url.
 function Set-ResumeOnReboot {
+  $qTok = ConvertTo-PowerShellSingleQuoted "HUB_AGENT_TOKEN" $Token
+  $qUrl = ConvertTo-PowerShellSingleQuoted "HUB_AGENT_URL" $HubUrl
   $cmd = "powershell -NoProfile -ExecutionPolicy Bypass -Command " +
-         "`"`$env:HUB_AGENT_TOKEN='$Token'; `$env:HUB_AGENT_URL='$HubUrl'; " +
+         "`"`$env:HUB_AGENT_TOKEN=$qTok; `$env:HUB_AGENT_URL=$qUrl; " +
          "`$env:HUB_AGENT_RESUME='1'; irm $PS1_URL | iex`""
   Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce" `
     -Name $RUNONCE_NAME -Value $cmd
@@ -266,44 +305,65 @@ function Register-BootTask($distro, $user) {
   Write-Ok "Logon task '$TASK_NAME' registered (keeps WSL distro alive)"
 }
 
-# Quote a value as ONE POSIX-shell word, so a quote inside it cannot end the
-# quoting and turn the rest of the value into shell syntax. `'` becomes `'\''`
-# (close, escaped quote, reopen): o'hare -> 'o'\''hare'.
-#
-# WARNING: this is bash quoting only. Do NOT reuse it for the PowerShell that
-# Register-BootTask generates -- that text is parsed by PowerShell, not by a shell,
-# and these escapes would be passed through literally.
-function ConvertTo-BashSingleQuoted($value) {
-  return "'" + (([string]$value) -replace "'", "'\''") + "'"
-}
-
 # Run the existing install.sh inside WSL.
 #
-# NOTE: do NOT use `curl ... | bash` here. A pipeline's exit status is the LAST
-# command's, so curl failing (DNS, 404, proxy) still leaves $LASTEXITCODE at 0 and
-# the guard below can never fire. That is exactly how this stayed broken: every run
-# printed "[OK] Setup complete" while install.sh had not run at all (2026-09-09).
-# Downloading to a file first makes curl's failure propagate through `&&`, and makes
-# $LASTEXITCODE install.sh's own exit code. It also keeps install.sh's stdin free
-# instead of handing it the script text.
+# WARNING: do not build a shell expression and hand it to wsl.exe. 0.8.69 shipped
+#   bash -lc 't=$(mktemp) || exit 1; trap ...; curl -fsSL <url> -o "$t" && ... bash "$t"'
+# and on a real Windows 11 host install.sh never ran: curl died with
+# `option -o: is badly used here` (2026-09-10).
+#
+# What is measured, and what is not -- keep these apart, the inference below is what
+# sent the first investigation into install.sh, which had not even been downloaded:
+#   - measured: curl 8.5.0 emits that message only when -o gets an empty *quoted*
+#     argument. So by the time bash ran curl, $t was empty.
+#   - measured: in the same failing run, the other `bash -lc` calls in this file
+#     (Set-Systemd, which contains && and ||) went through without error. The only
+#     thing that set the broken call apart was DOUBLE QUOTES inside the argument.
+#   - INFERRED, not confirmed: that the assignment got separated from the curl.
+#   - NOT measured: which layer re-quoted it. Windows PowerShell 5.1 and wsl.exe both
+#     re-quote native arguments and neither can be reproduced on a non-Windows test bed.
+#
+# So do not rely on knowing the rule -- rely on not needing one. One wsl.exe call per
+# step, every argument a plain token, $LASTEXITCODE checked after each. Splitting the
+# steps is also what makes failures propagate at all: the original `curl ... | bash`
+# reported the pipeline's last exit status, so a failed download still left
+# $LASTEXITCODE at 0 and every broken run printed "[OK] Setup complete" (2026-09-09).
 #
-# The EXIT trap removes the temp file when the run is interrupted. That one trap is
-# enough: a bash waiting on a foreground job handles SIGTERM after that job returns,
-# and exits through the normal path, so the EXIT trap runs and the exit code stays
-# non-zero. WARNING: do NOT add `trap ... TERM` on top of it. A TERM trap that only
-# cleans up and returns makes bash exit 0, i.e. a killed run would be reported as
-# success -- the very failure mode fixed above (both measured 2026-09-10, bash 5.2.21).
+# Each throw names its own step, so a download failure cannot be read as install.sh
+# failing. That confusion cost a release.
 function Invoke-WslInstaller($distro, $user) {
   Write-Step "Setting up hub-agent inside WSL (existing install.sh)"
   $tok = if ($Token) { $Token } else { "" }
-  # Single-quoted here so $t stays literal for bash; '' is a literal quote.
-  # `|| exit 1` covers mktemp failing before there is anything to clean up.
-  $fmt = 't=$(mktemp) || exit 1; trap ''rm -f "$t"'' EXIT; curl -fsSL {0} -o "$t" && HUB_AGENT_TOKEN={1} HUB_AGENT_URL={2} bash "$t"'
-  $inner = $fmt -f (ConvertTo-BashSingleQuoted $INSTALL_SH),
-                   (ConvertTo-BashSingleQuoted $tok),
-                   (ConvertTo-BashSingleQuoted $HubUrl)
-  wsl.exe -d $distro -u $user -- bash -lc $inner
-  if ($LASTEXITCODE -ne 0) { throw "install.sh inside WSL failed (exit $LASTEXITCODE)" }
+
+  # Ask the distro where HOME is instead of assuming /home/<user>. Download into HOME,
+  # not /tmp: a name under a world-writable directory can be pre-created by any other
+  # local account, and we are about to execute whatever lands there.
+  $wslHome = (wsl.exe -d $distro -u $user -- printenv HOME | Out-String)
+  if ($LASTEXITCODE -ne 0) { throw "could not resolve HOME for '$user' inside WSL (exit $LASTEXITCODE)" }
+  $wslHome = ($wslHome -replace "`r", "").Trim()
+  if (-not $wslHome) { throw "could not resolve HOME for '$user' inside WSL (empty)" }
+
+  # One name per run. With a fixed name, two concurrent runs corrupt each other: one
+  # curl truncates the file the other is already executing (bash reads a script as it
+  # goes, so the loser runs half an installer), and whichever finishes first deletes
+  # the other's script. HOME is not world-writable, so the only possible collision is
+  # with ourselves -- a GUID settles it without another round trip for mktemp.
+  $script = "$wslHome/.hub-agent-install." + [guid]::NewGuid().ToString("N") + ".sh"
+
+  try {
+    wsl.exe -d $distro -u $user -- curl -fsSL $INSTALL_SH -o $script
+    if ($LASTEXITCODE -ne 0) { throw "downloading install.sh inside WSL failed (exit $LASTEXITCODE)" }
+
+    # `env` carries the settings as plain argv tokens. Interpolating them into a shell
+    # string is what broke above, and argv also keeps the token out of shell history.
+    wsl.exe -d $distro -u $user -- env "HUB_AGENT_TOKEN=$tok" "HUB_AGENT_URL=$HubUrl" bash $script
+    if ($LASTEXITCODE -ne 0) { throw "install.sh inside WSL failed (exit $LASTEXITCODE)" }
+  } finally {
+    # Inside try so a partial download is reclaimed too. Best effort: a run killed from
+    # outside PowerShell leaves one .hub-agent-install.<guid>.sh in the user's own home.
+    # Never delete by wildcard here -- that would collect a concurrent run's script.
+    wsl.exe -d $distro -u $user -- rm -f $script | Out-Null
+  }
 }
 
 # =============================================================================

package/src/codex-session-operations.mjs

@@ -0,0 +1,83 @@
+import { createReadStream } from "node:fs"
+import { createInterface } from "node:readline"
+import path from "node:path"
+import os from "node:os"
+
+export function validateCodexSessionOperation({ operation, cwd, session_id, title, configDir }) {
+  if (typeof cwd !== "string" || !path.isAbsolute(cwd)) return "cwd required"
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(session_id)) return "invalid session_id"
+  if (typeof configDir !== "string" || !path.isAbsolute(configDir)) return "unknown profile"
+  if (operation !== "rename" && operation !== "delete") return "unsupported operation"
+  if (operation === "rename") {
+    if (typeof title !== "string") return "title must be a string"
+    const name = title.trim().replace(/\s+/g, " ")
+    if (!name) return "title required"
+    if (Array.from(name).length > 200) return "title too long"
+  }
+  return null
+}
+
+/** Use only the selected profile's app-server. Never fall back to archive or local deletion. */
+export async function operateCodexSession(options) {
+  const error = validateCodexSessionOperation(options)
+  if (error) return { ok: false, error }
+  const { operation, cwd, session_id, title, configDir, clientFactory, beforeMutation, logger } = options
+  let client
+  try {
+    client = clientFactory({ cwd, env: { ...process.env, CODEX_HOME: configDir } })
+    client.on("error", (err) => {
+      logger?.warn?.({ operation, code: err?.code, reason: err?.reason }, "codex session client error")
+    })
+    client.start()
+    await client.request("initialize", { clientInfo: { name: "cockpit-session-operations", version: "1.0.0" } })
+    client.notify("initialized", {})
+    const result = await client.request("thread/read", { threadId: session_id, includeTurns: false })
+    if (result?.thread?.id !== session_id || result.thread.cwd !== cwd) {
+      return { ok: false, error: "session context mismatch" }
+    }
+    const blocked = beforeMutation?.()
+    if (blocked) return { ok: false, error: blocked }
+    if (operation === "rename") {
+      const custom_title = title.trim().replace(/\s+/g, " ")
+      await client.request("thread/name/set", { threadId: session_id, name: custom_title })
+      return { ok: true, custom_title }
+    }
+    await client.request("thread/delete", { threadId: session_id })
+    return { ok: true }
+  } catch (err) {
+    // RPC errors may include paths or user data. Return a fixed public error only.
+    logger?.warn?.({ operation, code: err?.code, reason: err?.reason }, "codex session operation failed")
+    return { ok: false, error: err?.code === -32601 ? "session operation unsupported" : `${operation} failed` }
+  } finally {
+    client?.stop()
+  }
+}
+
+/** Titles are persisted by Codex in the profile's append-only session index. */
+export async function addCodexSessionTitles(sessions, sessionsDir) {
+  const root = path.resolve(sessionsDir || process.env.HUB_CODEX_SESSIONS_DIR || path.join(process.env.CODEX_HOME || path.join(os.homedir(), ".codex"), "sessions"))
+  const wanted = new Set(sessions.map((session) => session.thread_id))
+  if (!wanted.size) return sessions
+  const titles = new Map()
+  const input = createReadStream(path.join(path.dirname(root), "session_index.jsonl"), { encoding: "utf8" })
+  const lines = createInterface({ input, crlfDelay: Infinity })
+  try {
+    for await (const line of lines) {
+      let row
+      try { row = JSON.parse(line) } catch { continue }
+      if (!wanted.has(row?.id) || typeof row.thread_name !== "string") continue
+      const time = Date.parse(row.updated_at)
+      if (!Number.isFinite(time)) continue
+      const previous = titles.get(row.id)
+      if (!previous || time >= previous.time) titles.set(row.id, { title: row.thread_name, time })
+    }
+  } catch {
+    return sessions
+  } finally {
+    lines.close()
+    input.destroy()
+  }
+  return sessions.map((session) => titles.has(session.thread_id)
+    ? { ...session, title: titles.get(session.thread_id).title }
+    : session)
+}

package/src/codex-stream-bridge.mjs

@@ -42,11 +42,14 @@
  */
 import { EventEmitter } from "node:events"
 import { randomUUID } from "node:crypto"
+import path from "node:path"
 
 import { recordInjectSourcePersistent } from "./inject-source-store.mjs"
 
 import { AsyncTtlCache } from "./async-ttl-cache.mjs"
 import { CodexAppServerClient } from "./codex-appserver-client.mjs"
+import { addCodexSessionTitles, operateCodexSession, validateCodexSessionOperation } from "./codex-session-operations.mjs"
+import { defaultCodexDir } from "./codex-profiles.mjs"
 import {
   buildCodexArtifactTemplatePickerConfig,
   preflightCodexArtifactTemplatePicker,
@@ -949,6 +952,7 @@ export class CodexStreamBridge extends EventEmitter {
       // #1 in-memory reattach のキー。attach 試行を跨いで安定 (WS 再接続で stream_id は変わる)。
       attachId: attachId || null,
       client,
+      codexHome: client.env?.CODEX_HOME || process.env.CODEX_HOME || defaultCodexDir(),
       threadId: null,
       // 新規 thread/start は、最初の usage.response を受け取るまで context 使用量が 0%。
       // state loop が同じ cwd の古い TUI 値を拾って上書きしないための境界マーカー。
@@ -1961,7 +1965,42 @@ export class CodexStreamBridge extends EventEmitter {
     // Phase 3 (Read-plane スライス2a): app-server を spawn せず rollout の disk 走査で一覧を作る。
     // updated_at_ms は rollout ファイルの mtime (= 最終書き込み時刻 = ターン境界に相当) で、
     // claude 側 ClaudeSessionSummary.mtime と単位・意味を揃える。並びは mtime desc。
-    return this._listThreadsFromDisk({ cwd, limit, sessionsDir, logger: this.logger })
+    const sessions = await this._listThreadsFromDisk({ cwd, limit, sessionsDir, logger: this.logger })
+    return addCodexSessionTitles(sessions, sessionsDir)
+  }
+
+  async operateSession(options) {
+    const invalid = validateCodexSessionOperation(options)
+    if (invalid) return { ok: false, error: invalid }
+    const { operation, cwd, session_id, configDir } = options
+    const candidates = () => this._liveSessions().filter((session) =>
+      session.cwd === cwd && (session.threadId || session.resumeThreadId) === session_id)
+    const matching = () => candidates().filter((session) =>
+      path.resolve(session.codexHome) === path.resolve(configDir))
+    const busy = () => {
+      const live = candidates()
+      const selected = matching()
+      // Shared rollout paths mean a profile mismatch is not proof that deletion is safe.
+      if (live.length !== selected.length) return "session busy"
+      return operation === "delete" && selected.some((session) =>
+        session.activeTurnId || this._isProtected(session, Date.now())) ? "session busy" : null
+    }
+    const blocked = busy()
+    if (blocked) return { ok: false, error: blocked }
+    const result = await operateCodexSession({
+      ...options,
+      clientFactory: (opts) => this._clientFactory({ ...opts, codexCmd: this.codexCmd, logger: this.logger }),
+      logger: this.logger,
+      beforeMutation: busy,
+    })
+    if (!result.ok) return result
+    const deletedLive = operation === "delete" ? matching() : []
+    const response = { ...result, ...(operation === "delete" ? { stopped: deletedLive.length } : {}) }
+    this._invalidateListThreadsCacheForCwd(cwd)
+    // The request must settle before exit clears the browser's pending requests.
+    options.onSuccess?.(response)
+    for (const session of deletedLive) this._reapSession(session, Date.now(), "session-deleted")
+    return response
   }
 
   /**
@@ -4572,7 +4611,7 @@ export class CodexStreamBridge extends EventEmitter {
       producer_seq: session.seq,
       thread_id: session.threadId,
       code: 0,
-      reason: "idle-reaped",
+      reason: reason === "session-deleted" ? "session-deleted" : "idle-reaped",
     })
   }
 

package/src/main.mjs

@@ -4884,6 +4884,7 @@ export async function dispatch(msg, ctx) {
             epoch,
             profile_id: profileId,
             sessions: withLive,
+            session_operations: true,
           })
         } catch (err) {
           ctx.client.send({
@@ -4898,6 +4899,43 @@ export async function dispatch(msg, ctx) {
         }
         return
       }
+      case "codex.session.rename":
+      case "codex.session.delete": {
+        const operation = msg.type === "codex.session.rename" ? "rename" : "delete"
+        const context = {
+          request_id: typeof msg.request_id === "string" ? msg.request_id : undefined,
+          stream_id: msg.stream_id,
+          cwd: typeof msg.cwd === "string" ? msg.cwd : "",
+          session_id: typeof msg.session_id === "string" ? msg.session_id : "",
+          profile_id: typeof msg.profile_id === "string" ? msg.profile_id : undefined,
+        }
+        let result = { ok: false, error: "unknown profile" }
+        let responded = false
+        const respond = (response) => {
+          ctx.client.send({ type: `${msg.type}.response`, ...context, ...response })
+          responded = true
+        }
+        try {
+          const profileApi = ctx.codexProfiles || codexProfiles
+          const resolved = context.profile_id ? await profileApi.resolveConfigDir(context.profile_id) : null
+          const active = resolved?.resolved ? await profileApi.getActiveProfile() : null
+          if (resolved?.resolved && resolved.profileId === context.profile_id && active?.id === resolved.profileId) {
+            result = ctx.codexBridge
+              ? await ctx.codexBridge.operateSession({
+                operation, cwd: context.cwd, session_id: context.session_id,
+                title: msg.title, configDir: resolved.configDir,
+                onSuccess: respond,
+              })
+              : { ok: false, error: "codex unavailable" }
+          } else if (resolved?.resolved && active?.id !== resolved.profileId) {
+            result = { ok: false, error: "inactive profile" }
+          }
+        } catch {
+          result = { ok: false, error: `${operation} failed` }
+        }
+        if (!responded) respond(result)
+        return
+      }
       case "codex.history.request": {
         const stream_id = msg.stream_id
         const thread_id = msg.thread_id

package/src/usage.mjs

@@ -23,6 +23,7 @@ import path from "node:path"
 import { StringDecoder } from "node:string_decoder"
 
 import { encodeCwdToDirName } from "./claude-history.mjs"
+import { redactSecrets } from "./tool-result-mask.mjs"
 
 function configPath(envKey, ...fallback) {
   return process.env[envKey] || path.join(...fallback)
@@ -1468,7 +1469,7 @@ export async function codexRolloutPresence(threadId) {
 // 4 フィールド (thread_id / cwd / preview / updated_at_ms) はすべて rollout から安価に取れる:
 //   - thread_id: session_meta.session_id (無ければファイル名末尾の UUID)
 //   - cwd:       session_meta.payload.cwd (先頭行)
-//   - preview:   先頭近傍の最初の event_msg/user_message.message (clean な生プロンプト)
+//   - preview:   先頭近傍の user_message または response_item の実ユーザー本文
 //   - updated_at_ms: ファイル mtime (Claude 側 listSessions の mtime と単位を揃える)
 // ---------------------------------------------------------------------------
 
@@ -1482,6 +1483,23 @@ function threadIdFromRolloutFilename(fp) {
 const CODEX_ROLLOUT_HEAD_CHUNK_BYTES = 32 * 1024
 const CODEX_ROLLOUT_PREVIEW_MAX_BYTES = 1024 * 1024
 
+function codexUserPreviewText(text) {
+  if (typeof text !== "string") return ""
+  let remaining = text.trim()
+  // Codex は初期コンテキストも role=user の input_text に保存する。
+  // 既知の注入ブロックだけを先頭から除き、後続に依頼文があれば残す。
+  while (remaining) {
+    if (/^# AGENTS\.md instructions(?:\s|$)/.test(remaining)) return ""
+    const injected = /^<(recommended_plugins|environment_context|user_instructions|skills_instructions)>/.exec(remaining)
+    if (!injected) break
+    const endTag = `</${injected[1]}>`
+    const end = remaining.indexOf(endTag, injected[0].length)
+    if (end < 0) return ""
+    remaining = remaining.slice(end + endTag.length).trimStart()
+  }
+  return redactSecrets(remaining).replace(/\s+/g, " ").trim()
+}
+
 // sessionsDir ごとの派生インデックス。rollout 自体が正本なので永続化は不要。
 // _codexTokenCountMemo と同じ mtime+size 無効化規約で、変更ファイルだけを再解析する。
 // 共通 helper 化は usage 集計側への回帰範囲を広げるため、一覧用 index として独立させる。
@@ -1561,14 +1579,24 @@ async function parseCodexRolloutHead(fp, expectedCwd = "", testHooks = null) {
         subagent != null &&
         typeof subagent === "object" &&
         Object.prototype.hasOwnProperty.call(subagent, "thread_spawn")
-    } else if (
-      !preview &&
-      o.type === "event_msg" &&
-      o.payload &&
-      o.payload.type === "user_message" &&
-      typeof o.payload.message === "string"
-    ) {
-      preview = o.payload.message.slice(0, 80)
+    } else if (!preview) {
+      let userText = ""
+      if (o.type === "event_msg" && o.payload?.type === "user_message") {
+        userText = codexUserPreviewText(o.payload.message)
+      } else if (
+        o.type === "response_item" &&
+        o.payload?.type === "message" &&
+        o.payload.role === "user" &&
+        Array.isArray(o.payload.content)
+      ) {
+        userText = o.payload.content
+          .filter((block) => block?.type === "input_text")
+          .map((block) => codexUserPreviewText(block.text))
+          .filter(Boolean)
+          .join(" ")
+      }
+      // code point 単位で切り、絵文字などのサロゲートペアを壊さない。
+      preview = Array.from(userText).slice(0, 80).join("")
     }
   }
 

package/src/ws-client.mjs

@@ -81,6 +81,8 @@ const BUFFERED_CTRL_TYPES = new Set([
   "codex.permission.request",
   "codex.input.ack",
   "codex.input.nack",
+  "codex.session.rename.response",
+  "codex.session.delete.response",
   "session.event",
 ])
 // 制御/イベントバッファの上限。低頻度なので frames は小さめ。