evolcore 0.0.1 → 0.0.2

package/dist/agents/claude-runner.js

@@ -0,0 +1,2385 @@
+import { query, forkSession as sdkForkSession, getSessionMessages as sdkGetSessionMessages, resolveSettings as sdkResolveSettings } from '@anthropic-ai/claude-agent-sdk';
+import { atomicReadJson, atomicWriteJson, ensureDir } from '../utils/atomic-write.js';
+import { resolveAnthropicConfig } from './baseagent.js';
+import { DEFAULT_PERMISSION_MODE } from '../types.js';
+import { renderActionAsText } from '../core/interaction-router.js';
+import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
+import path from 'path';
+import fs from 'fs';
+import os from 'os';
+import crypto from 'crypto';
+import { logger } from '../utils/logger.js';
+import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
+import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
+import { summarizeToolInput } from '../utils/tool-summary.js';
+import { encodePath } from '../utils/cross-platform.js';
+import { getPackageRoot, resolvePaths } from '../paths.js';
+import { resolveEffective } from '../config/config-manager.js';
+import { sanitizeSessionTitle } from '../core/session/session-title.js';
+import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
+import { normalizePermissionMode } from '../core/permission/mode.js';
+import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
+import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, resolveProtectedCandidate, } from '../core/protected-paths.js';
+import { ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable } from '../core/permission/sandbox-runtime.js';
+import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
+import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
+export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
+// Built-in tools execute inside the Claude runtime and are covered by the
+// runner's filesystem/shell policy. MCP and future unknown tools can perform
+// side effects in another process or service, outside that sandbox, so they
+// must never inherit auto-allow behavior merely because they are not Bash.
+const CLAUDE_BUILTIN_TOOLS = new Set([
+    'Agent',
+    'AskUserQuestion',
+    'Bash',
+    'CronCreate',
+    'CronDelete',
+    'CronList',
+    'Edit',
+    'EnterPlanMode',
+    'ExitPlanMode',
+    'Glob',
+    'Grep',
+    'NotebookEdit',
+    'Read',
+    'SendMessage',
+    'Skill',
+    'Task',
+    'TaskCreate',
+    'TaskGet',
+    'TaskList',
+    'TaskOutput',
+    'TaskStop',
+    'TaskUpdate',
+    'TeamCreate',
+    'TeamDelete',
+    'TodoWrite',
+    'ToolSearch',
+    'WebFetch',
+    'WebSearch',
+    'Write',
+]);
+function isClaudeMcpTool(toolName) {
+    return toolName.startsWith('mcp__');
+}
+function isUnknownClaudeTool(toolName) {
+    return !isClaudeMcpTool(toolName) && !CLAUDE_BUILTIN_TOOLS.has(toolName);
+}
+function stableClaudePermissionValue(value, depth = 0) {
+    if (depth > 8)
+        return '[truncated]';
+    if (value === undefined || value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map(entry => stableClaudePermissionValue(entry, depth + 1));
+    const record = value;
+    return Object.fromEntries(Object.keys(record)
+        .sort()
+        .map(key => [key, stableClaudePermissionValue(record[key], depth + 1)]));
+}
+function collectClaudePermissionStrings(value, output = []) {
+    if (typeof value === 'string') {
+        output.push(value);
+        return output;
+    }
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            collectClaudePermissionStrings(entry, output);
+        return output;
+    }
+    if (!value || typeof value !== 'object')
+        return output;
+    for (const entry of Object.values(value)) {
+        collectClaudePermissionStrings(entry, output);
+    }
+    return output;
+}
+function inspectClaudePermissionExpansion(input, options, projectPath) {
+    const blockedPath = typeof options.blockedPath === 'string' && options.blockedPath.length > 0
+        ? options.blockedPath
+        : undefined;
+    const rawSuggestions = Array.isArray(options.suggestions) ? options.suggestions : [];
+    const suggestions = rawSuggestions.slice(0, 64).map(entry => stableClaudePermissionValue(entry));
+    const directoryPaths = rawSuggestions.flatMap(entry => {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            return [];
+        const record = entry;
+        if (record.type !== 'addDirectories' && record.type !== 'removeDirectories')
+            return [];
+        return Array.isArray(record.directories)
+            ? record.directories.filter((value) => typeof value === 'string' && value.length > 0)
+            : [];
+    });
+    const candidatePaths = [
+        ...(blockedPath ? [blockedPath] : []),
+        ...directoryPaths,
+    ];
+    const canonicalDirectoryPaths = directoryPaths.map(candidate => resolveProtectedCandidate(candidate, projectPath));
+    let protectedReason;
+    for (const candidate of candidatePaths) {
+        const canonical = resolveProtectedCandidate(candidate, projectPath);
+        if (containsHClassReference(candidate) || isHClassPath(canonical, { root: resolvePaths().root })) {
+            protectedReason = '🔒 Claude SDK 权限请求涉及 EvolCore H 类受保护路径，已拒绝';
+            break;
+        }
+        if (containsLClassReference(candidate) || isLClassPath(canonical, { root: resolvePaths().root })) {
+            protectedReason = '🔒 Claude SDK 权限请求涉及 EvolCore L 类受保护路径，已拒绝';
+            break;
+        }
+    }
+    if (!protectedReason && collectClaudePermissionStrings(rawSuggestions).some(containsHClassReference)) {
+        protectedReason = '🔒 Claude SDK 权限规则涉及 EvolCore H 类受保护路径，已拒绝';
+    }
+    const hasDirectoryExpansion = rawSuggestions.some(entry => {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            return false;
+        const type = entry.type;
+        return type === 'addDirectories' || type === 'removeDirectories';
+    });
+    const hasUnknownSuggestion = rawSuggestions.some(entry => {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            return true;
+        return !new Set(['addRules', 'replaceRules', 'removeRules', 'setMode', 'addDirectories', 'removeDirectories'])
+            .has(String(entry.type));
+    });
+    const requiresApproval = !!blockedPath || hasDirectoryExpansion || hasUnknownSuggestion;
+    const permissionContext = {
+        ...(blockedPath ? { blockedPath } : {}),
+        ...(blockedPath ? { canonicalBlockedPath: resolveProtectedCandidate(blockedPath, projectPath) } : {}),
+        ...(canonicalDirectoryPaths.length > 0 ? { canonicalDirectoryPaths } : {}),
+        suggestions,
+    };
+    return {
+        blockedPath,
+        ...(blockedPath ? { canonicalBlockedPath: permissionContext.canonicalBlockedPath } : {}),
+        suggestions,
+        requiresApproval,
+        protectedReason,
+        approvalInput: requiresApproval
+            ? { ...input, __evolcoreClaudePermissionContext: permissionContext }
+            : input,
+    };
+}
+function buildClaudeManagedLockdownSettings(capabilityOptions) {
+    const settings = capabilityOptions?.settings;
+    const rawAllowedMcpServers = settings && typeof settings === 'object' && !Array.isArray(settings)
+        ? settings.allowedMcpServers
+        : undefined;
+    const allowedMcpServers = Array.isArray(rawAllowedMcpServers)
+        ? rawAllowedMcpServers.flatMap(entry => {
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+                return [];
+            const serverName = entry.serverName;
+            return typeof serverName === 'string' && serverName ? [{ serverName }] : [];
+        })
+        : undefined;
+    return {
+        allowManagedHooksOnly: true,
+        disableSkillShellExecution: true,
+        allowedHttpHookUrls: [],
+        allowManagedPermissionRulesOnly: true,
+        ...(allowedMcpServers ? {
+            allowManagedMcpServersOnly: true,
+            allowedMcpServers,
+        } : {}),
+    };
+}
+const CLAUDE_SANDBOX_GLOB_MAGIC = /[*?[\]]/;
+async function assertClaudeSettingSourcesHaveLiteralSandboxPaths(cwd, settingSources, managedSettings) {
+    if (process.platform !== 'linux' || settingSources.length === 0)
+        return;
+    const resolved = await sdkResolveSettings({ cwd, settingSources, managedSettings });
+    for (const source of resolved.sources) {
+        const filesystem = source.settings.sandbox?.filesystem;
+        for (const key of ['denyRead', 'denyWrite', 'allowRead', 'allowWrite']) {
+            for (const target of filesystem?.[key] ?? []) {
+                if (!CLAUDE_SANDBOX_GLOB_MAGIC.test(target))
+                    continue;
+                const origin = source.path ?? source.source;
+                throw new Error(`[ClaudeSandbox] glob path in ${origin} is unsafe on Linux sandbox projections: ${key}=${target}`);
+            }
+        }
+    }
+}
+// ── 模型别名解析 ──
+// SDK 内置的别名表可能落后于代理实际可用的最新模型，
+// 因此优先从 {baseUrl}/models 动态获取各系列最新版本，失败则使用持久化的最近成功值。
+// 已验证可用但尚未出现在 /models 列表中的模型 ID 会被注入候选列表，
+// 等列表更新后注入自动变为 no-op。
+const MODEL_FAMILIES = ['opus', 'sonnet', 'haiku'];
+/** 已验证可用但可能尚未出现在 /models 列表中的模型 ID（注入候选） */
+const INJECTED_MODELS = [];
+/** 启动默认值：某网关尚无任何成功刷新记录时使用。 */
+const BOOTSTRAP_MODEL_ALIASES = {
+    'opus': 'claude-opus-4-8',
+    'sonnet': 'claude-sonnet-4-6',
+    'haiku': 'claude-haiku-4-5-20251001',
+};
+const MODEL_ALIAS_TTL_MS = 5 * 60 * 1000; // 5min
+const MODEL_ALIAS_STORE_VERSION = 1;
+const modelAliasCache = new Map(); // key: baseUrl
+const modelAliasFallbacks = new Map(); // key: baseUrl，最近一次成功解析值
+const modelAliasInFlight = new Set(); // 去重并发刷新
+const loadedModelAliasFallbacks = new Set(); // key: store path + gateway hash
+function normalizeModelGatewayUrl(baseUrl) {
+    return baseUrl.trim().replace(/\/+$/, '');
+}
+function modelGatewayKey(baseUrl) {
+    return crypto.createHash('sha256').update(normalizeModelGatewayUrl(baseUrl)).digest('hex');
+}
+function modelAliasStorePath() {
+    return resolvePaths().claudeModelCache;
+}
+function sanitizeModelAliases(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const aliases = {};
+    for (const family of MODEL_FAMILIES) {
+        const model = value[family];
+        if (typeof model !== 'string')
+            continue;
+        const pattern = new RegExp(`^claude-${family}-[A-Za-z0-9._-]+$`);
+        if (pattern.test(model))
+            aliases[family] = model;
+    }
+    return aliases;
+}
+function readPersistedAliasStore() {
+    try {
+        const value = atomicReadJson(modelAliasStorePath());
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+            return { $schema_version: MODEL_ALIAS_STORE_VERSION, gateways: {} };
+        }
+        const raw = value;
+        if (raw.$schema_version !== MODEL_ALIAS_STORE_VERSION || !raw.gateways || typeof raw.gateways !== 'object' || Array.isArray(raw.gateways)) {
+            return { $schema_version: MODEL_ALIAS_STORE_VERSION, gateways: {} };
+        }
+        const gateways = {};
+        for (const [key, entry] of Object.entries(raw.gateways)) {
+            if (!/^[a-f0-9]{64}$/.test(key) || !entry || typeof entry !== 'object' || Array.isArray(entry))
+                continue;
+            const record = entry;
+            const aliases = sanitizeModelAliases(record.aliases);
+            if (Object.keys(aliases).length === 0)
+                continue;
+            gateways[key] = {
+                aliases,
+                updatedAt: typeof record.updatedAt === 'number' && Number.isFinite(record.updatedAt) ? record.updatedAt : 0,
+            };
+        }
+        return { $schema_version: MODEL_ALIAS_STORE_VERSION, gateways };
+    }
+    catch (error) {
+        logger.warn(`[AgentRunner] Failed to load persisted model aliases: ${error instanceof Error ? error.message : String(error)}`);
+        return { $schema_version: MODEL_ALIAS_STORE_VERSION, gateways: {} };
+    }
+}
+function loadPersistedModelAliases(baseUrl) {
+    const cacheKey = normalizeModelGatewayUrl(baseUrl);
+    const storePath = modelAliasStorePath();
+    const gatewayKey = modelGatewayKey(cacheKey);
+    const loadKey = `${storePath}\0${gatewayKey}`;
+    if (loadedModelAliasFallbacks.has(loadKey))
+        return;
+    loadedModelAliasFallbacks.add(loadKey);
+    const persisted = readPersistedAliasStore().gateways[gatewayKey];
+    if (!persisted)
+        return;
+    modelAliasFallbacks.set(cacheKey, persisted.aliases);
+    logger.info(`[AgentRunner] Loaded persisted model aliases: ${JSON.stringify(persisted.aliases)}`);
+}
+function persistModelAliases(baseUrl, aliases, updatedAt) {
+    try {
+        const store = readPersistedAliasStore();
+        store.gateways[modelGatewayKey(baseUrl)] = { aliases, updatedAt };
+        atomicWriteJson(modelAliasStorePath(), store);
+    }
+    catch (error) {
+        logger.warn(`[AgentRunner] Failed to persist model aliases: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+// ── 网关价格缓存（从 /v1/models 的 pricing/effective_pricing 提取）─────────────
+// 与别名刷新同范式：按 baseUrl 缓存，1h TTL，stale-while-revalidate（缺失/过期时
+// fire-and-forget 触发刷新，本轮先用旧值或回退，不阻塞查询）。
+const GATEWAY_PRICING_TTL_MS = 60 * 60 * 1000; // 1h
+const gatewayPricingCache = new Map(); // key: baseUrl
+const gatewayPricingInFlight = new Set(); // 去重并发刷新
+/** 把 /v1/models 单个 model 的价格对象转为 PriceQuad（与 gateway-control 的 apiPricingToQuad 等价）。
+ *  单位假设：接口价与 model-prices.jsonl 同口径（USD per 1M token），不做换算。 */
+function apiPricingToQuad(p) {
+    if (!p || typeof p !== 'object')
+        return undefined;
+    const n = (v) => (typeof v === 'number' && isFinite(v) ? v : undefined);
+    const quad = {
+        input: n(p.input),
+        output: n(p.output),
+        cache_read: n(p.cache_read),
+        cache_write: n(p.cache_write),
+    };
+    // 全空则视为无价
+    if (quad.input === undefined && quad.output === undefined
+        && quad.cache_read === undefined && quad.cache_write === undefined)
+        return undefined;
+    return quad;
+}
+/** 拉取网关 /v1/models 的官方价(pricing) + 网关价(effective_pricing)，写入 gatewayPricingCache。
+ *  失败静默——保持回退到本地价表 / official。 */
+async function refreshGatewayPricing(baseUrl, apiKey) {
+    if (gatewayPricingInFlight.has(baseUrl))
+        return;
+    gatewayPricingInFlight.add(baseUrl);
+    try {
+        const url = `${baseUrl.replace(/\/+$/, '')}/v1/models`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 5000);
+        const resp = await fetch(url, {
+            signal: controller.signal,
+            headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+        });
+        clearTimeout(timer);
+        if (!resp.ok)
+            return;
+        const json = await resp.json();
+        const arr = Array.isArray(json?.data) ? json.data
+            : Array.isArray(json?.models) ? json.models : [];
+        const official = new Map();
+        const gateway = new Map();
+        for (const m of arr) {
+            const id = typeof m === 'string' ? m : (m?.id || m?.name || m?.model);
+            if (!id || typeof m !== 'object')
+                continue;
+            const off = apiPricingToQuad(m.pricing);
+            if (off)
+                official.set(id, off);
+            const gw = apiPricingToQuad(m.effective_pricing);
+            if (gw)
+                gateway.set(id, gw);
+        }
+        // 汇率：接口 usd_to_cny，缺失则留空（计费层默认用 7）
+        const usdToCny = (typeof json?.usd_to_cny === 'number' && json.usd_to_cny > 0) ? json.usd_to_cny : undefined;
+        if (official.size > 0 || gateway.size > 0) {
+            gatewayPricingCache.set(baseUrl, { cache: { official, gateway, usdToCny }, fetchedAt: Date.now() });
+            logger.info(`[AgentRunner] Refreshed gateway pricing from ${url}: official=${official.size} gateway=${gateway.size} usd_to_cny=${usdToCny ?? '(default 7)'}`);
+        }
+    }
+    catch {
+        // 网络/解析失败：保持回退，不打断查询
+    }
+    finally {
+        gatewayPricingInFlight.delete(baseUrl);
+    }
+}
+/** 从模型 ID 列表中提取各 claude 系列的最新版本（按 major.minor 取最高，minor 可省略） */
+function deriveAliasesFromModelIds(ids) {
+    // 注入已验证可用的模型（如果列表中已有则去重无影响）
+    const allIds = [...new Set([...ids, ...INJECTED_MODELS])];
+    const best = {};
+    for (const id of allIds) {
+        const m = id.match(/^claude-(opus|sonnet|haiku)-(\d+)(?:-(\d+))?/);
+        if (!m)
+            continue;
+        const [, family, majorStr, minorStr] = m;
+        const major = parseInt(majorStr, 10);
+        const minor = minorStr ? parseInt(minorStr, 10) : 0;
+        const cur = best[family];
+        if (!cur || major > cur.major || (major === cur.major && minor > cur.minor)) {
+            best[family] = { id, major, minor };
+        }
+    }
+    const aliases = {};
+    for (const family of MODEL_FAMILIES) {
+        const info = best[family];
+        if (info)
+            aliases[family] = info.id;
+    }
+    return aliases;
+}
+/** 异步刷新某 baseUrl 的别名缓存（失败静默，不抛出） */
+async function refreshModelAliases(baseUrl, apiKey) {
+    const cacheKey = normalizeModelGatewayUrl(baseUrl);
+    if (modelAliasInFlight.has(cacheKey))
+        return;
+    modelAliasInFlight.add(cacheKey);
+    loadPersistedModelAliases(cacheKey);
+    try {
+        const url = `${cacheKey}/models`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 5000);
+        const resp = await fetch(url, {
+            signal: controller.signal,
+            headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+        });
+        clearTimeout(timer);
+        if (!resp.ok)
+            return;
+        const json = await resp.json();
+        const ids = Array.isArray(json?.data)
+            ? json.data.map((m) => m?.id).filter((x) => typeof x === 'string')
+            : [];
+        const aliases = deriveAliasesFromModelIds(ids);
+        if (ids.length > 0 || Object.keys(aliases).length > 0) {
+            const updatedAt = Date.now();
+            modelAliasCache.set(cacheKey, { aliases, ids, fetchedAt: updatedAt });
+            if (Object.keys(aliases).length > 0) {
+                const previousAliases = modelAliasFallbacks.get(cacheKey) || {};
+                const latestAliases = { ...previousAliases, ...aliases };
+                modelAliasFallbacks.set(cacheKey, latestAliases);
+                persistModelAliases(cacheKey, latestAliases, updatedAt);
+            }
+            logger.info(`[AgentRunner] Refreshed models from ${url}: ${ids.length} ids, aliases ${JSON.stringify(aliases)}`);
+        }
+    }
+    catch {
+        // 网络/解析失败：保留该网关最近一次成功结果，不打断查询
+    }
+    finally {
+        modelAliasInFlight.delete(cacheKey);
+    }
+}
+/** 将短别名展开为完整 model ID，已是完整 ID 则原样返回 */
+function resolveModelAlias(model, baseUrl) {
+    // 非短别名（已经是完整 ID）直接返回
+    if (!MODEL_FAMILIES.includes(model))
+        return model;
+    const family = model;
+    // 优先使用动态缓存
+    if (baseUrl) {
+        const cacheKey = normalizeModelGatewayUrl(baseUrl);
+        loadPersistedModelAliases(cacheKey);
+        const cached = modelAliasCache.get(cacheKey);
+        if (cached && (Date.now() - cached.fetchedAt < MODEL_ALIAS_TTL_MS)) {
+            return cached.aliases[family] || modelAliasFallbacks.get(cacheKey)?.[family] || BOOTSTRAP_MODEL_ALIASES[family];
+        }
+        return modelAliasFallbacks.get(cacheKey)?.[family] || BOOTSTRAP_MODEL_ALIASES[family];
+    }
+    return BOOTSTRAP_MODEL_ALIASES[family];
+}
+/**
+ * 为支持 1M 上下文的模型追加 `[1m]` 后缀——仅在交给 SDK query() 时调用。
+ * 目录与校验层始终使用不带后缀的基础 ID，避免与网关 /models 返回值（无 `[1m]`）冲突。
+ */
+function applyContextWindow(modelId) {
+    if (/\[1m\]$/.test(modelId))
+        return modelId; // 已带后缀
+    if (isOneMillionContextModel(modelId))
+        return `${modelId}[1m]`;
+    return modelId;
+}
+/** 解析别名 + 追加 1M 后缀，得到最终交给 SDK 的 model 串。 */
+function resolveSdkModel(model, baseUrl) {
+    return applyContextWindow(resolveModelAlias(model, baseUrl));
+}
+class MessageStream {
+    queue = [];
+    waiting = null;
+    done = false;
+    push(text, images, inputId = crypto.randomUUID()) {
+        let content;
+        if (images && images.length > 0) {
+            logger.debug('[MessageStream] Creating multimodal message with', images.length, 'images');
+            content = [
+                { type: 'text', text },
+                ...images.map((img) => ({
+                    type: 'image',
+                    source: {
+                        type: 'base64',
+                        media_type: img.mimeType || 'image/png',
+                        data: img.data,
+                    },
+                })),
+            ];
+        }
+        else {
+            content = text;
+        }
+        const message = {
+            type: 'user',
+            message: { role: 'user', content },
+            parent_tool_use_id: null,
+            uuid: inputId,
+            session_id: '',
+        };
+        this.queue.push(message);
+        this.waiting?.();
+        return inputId;
+    }
+    end() {
+        this.done = true;
+        this.waiting?.();
+    }
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            while (this.queue.length > 0) {
+                yield this.queue.shift();
+            }
+            if (this.done)
+                return;
+            await new Promise((r) => {
+                this.waiting = r;
+            });
+            this.waiting = null;
+        }
+    }
+}
+export class AgentRunner {
+    name = 'claude';
+    capabilities = { clear: true, compact: true, fork: true, forkAtTurn: true, askUserQuestion: true, planApproval: true, fileRewind: 'checkpoint' };
+    apiKey;
+    model;
+    effort;
+    permissionMode = DEFAULT_PERMISSION_MODE;
+    baseUrl;
+    config;
+    activeSessions = new Map();
+    activeStreams = new Map();
+    activeMessageStreams = new Map();
+    interruptFns = new Map();
+    activeQueries = new Map();
+    streamDone = new Map();
+    streamDoneResolvers = new Map();
+    onSessionIdUpdate;
+    onCompactStart;
+    permissionGateway;
+    sendPromptFn;
+    permissionContexts = new Map();
+    claudeExecutablePath;
+    /** 每个 session 最近的子进程 stderr 行（环形缓冲），用于子进程崩溃时还原真正原因 */
+    recentStderr = new Map();
+    static STDERR_BUFFER_MAX = 80;
+    constructor(apiKey, model, onSessionIdUpdate, baseUrl, config) {
+        this.apiKey = apiKey;
+        this.model = model || 'sonnet';
+        this.effort = undefined;
+        this.baseUrl = baseUrl;
+        this.config = config;
+        this.onSessionIdUpdate = onSessionIdUpdate;
+        if (config) {
+            const anthropic = resolveAnthropicConfig(config);
+            this.claudeExecutablePath = anthropic.pathToClaudeCodeExecutable;
+        }
+    }
+    getAgentEnv(runtimeEnv, evolcoreSessionId) {
+        const env = {
+            ...process.env,
+            ANTHROPIC_AUTH_TOKEN: this.apiKey,
+            PATH: process.env.PATH,
+            DISABLE_AUTOUPDATER: '1',
+            ...(this.baseUrl ? { ANTHROPIC_BASE_URL: this.baseUrl } : {}),
+            ...(evolcoreSessionId ? { EVOLCORE_SESSION_ID: evolcoreSessionId } : {}),
+            ...(runtimeEnv ?? {}),
+        };
+        const bubblewrapPath = resolveBubblewrapPath();
+        return bubblewrapPath
+            ? prependExecutableDirectory(env, bubblewrapPath)
+            : env;
+    }
+    setModel(model) {
+        this.model = model;
+    }
+    getModel() {
+        return this.model;
+    }
+    /** 返回当前网关 /v1/models 的价格缓存（1h TTL，stale-while-revalidate）。
+     *  缺失/过期时 fire-and-forget 触发刷新，本轮先返回旧值或 undefined（回退本地价表）。 */
+    getGatewayPricing() {
+        if (!this.baseUrl)
+            return undefined;
+        const entry = gatewayPricingCache.get(this.baseUrl);
+        if (!entry || Date.now() - entry.fetchedAt > GATEWAY_PRICING_TTL_MS) {
+            refreshGatewayPricing(this.baseUrl, this.apiKey); // 不 await，stale-while-revalidate
+        }
+        return entry?.cache;
+    }
+    async resolveCapabilityRunOptions(projectPath) {
+        const claudeConfig = this.config?.agents?.claude;
+        let agentConfig = claudeConfig?.evolcoreAgentConfig;
+        if (claudeConfig?.evolcoreAgentAid) {
+            try {
+                agentConfig = resolveEffective({ self: claudeConfig.evolcoreAgentAid }, { cache: true });
+            }
+            catch { }
+        }
+        return await resolveClaudeCapabilityRunOptionsForProject(agentConfig, projectPath, 'claude');
+    }
+    async listModels() {
+        if (this.baseUrl) {
+            const cacheKey = normalizeModelGatewayUrl(this.baseUrl);
+            loadPersistedModelAliases(cacheKey);
+            let cached = modelAliasCache.get(cacheKey);
+            const stale = !cached || (Date.now() - cached.fetchedAt > MODEL_ALIAS_TTL_MS);
+            // 缓存为空（首次打开）→ 等待刷新；缓存仅过期 → 后台刷新不阻塞
+            if (!cached) {
+                await refreshModelAliases(this.baseUrl, this.apiKey);
+                cached = modelAliasCache.get(cacheKey);
+            }
+            else if (stale) {
+                refreshModelAliases(this.baseUrl, this.apiKey);
+            }
+            // 有缓存时返回网关 /models 的全量原始 ID
+            if (cached && cached.ids.length > 0)
+                return cached.ids;
+        }
+        // 无 baseUrl / 刷新超时或失败 → 回退短别名
+        const fallback = this.baseUrl ? modelAliasFallbacks.get(normalizeModelGatewayUrl(this.baseUrl)) : undefined;
+        return Object.values({ ...BOOTSTRAP_MODEL_ALIASES, ...fallback });
+    }
+    /** 将短别名解析为当前代理实际使用的完整 model ID（仅用于展示，不改变持久化值） */
+    resolveModelId(model) {
+        return resolveModelAlias(model, this.baseUrl);
+    }
+    setEffort(effort) {
+        this.effort = effort;
+    }
+    getEffort() {
+        return this.effort;
+    }
+    // ── PermissionController 接口 ──
+    setMode(mode) {
+        this.permissionMode = mode;
+    }
+    getMode() {
+        return normalizePermissionMode(this.permissionMode).mode;
+    }
+    listModes() {
+        return [
+            { key: 'readonly', nameZh: '只读', description: '只读操作自动执行，写入直接拒绝', available: true },
+            { key: 'auto', nameZh: '自动', description: '常规操作自动执行，危险操作自动拒绝', available: true },
+            { key: 'request', nameZh: '审批', description: '默认能力自动执行，缺失能力进入人工审批', available: true },
+            { key: 'bypass', nameZh: '放行', description: 'owner 关闭任务沙盒，危险操作和硬边界仍受控', available: true },
+        ];
+    }
+    setPermissionGateway(gateway) {
+        this.permissionGateway = gateway;
+    }
+    setSendPrompt(fn) {
+        this.sendPromptFn = fn;
+    }
+    setPermissionContext(sessionId, context) {
+        this.permissionContexts.set(sessionId, context);
+    }
+    toSdkPermissionMode(mode) {
+        const normalized = normalizePermissionMode(mode ?? this.permissionMode);
+        // Public permission policy is enforced by PreToolUse. Keeping the SDK in
+        // default mode preserves canUseTool reachability for request mode.
+        return normalized.workflow === 'plan' ? 'plan' : 'default';
+    }
+    // ── Compactable 接口 ──
+    async compact(sessionId, agentSessionId, projectPath) {
+        return this.compactSession(sessionId, agentSessionId, projectPath);
+    }
+    syncFromUserSettings() {
+        try {
+            const settingsPath = path.join(os.homedir(), '.claude', 'settings.json');
+            if (!fs.existsSync(settingsPath))
+                return;
+            const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+            // agent config 显式配置优先，不被 settings.json 覆盖
+            const configModel = this.config?.agents?.claude?.model;
+            if (!configModel && settings.model && settings.model !== this.model) {
+                logger.info(`[AgentRunner] Synced model from ~/.claude/settings.json: ${settings.model}`);
+                this.model = settings.model;
+            }
+            const configEffort = this.config?.agents?.claude?.effort;
+            if (!configEffort) {
+                const newEffort = settings.effortLevel || undefined;
+                if (newEffort !== this.effort) {
+                    logger.info(`[AgentRunner] Synced effort from ~/.claude/settings.json: ${newEffort ?? 'auto'}`);
+                    this.effort = newEffort;
+                }
+            }
+        }
+        catch (error) {
+            logger.debug(`[AgentRunner] Failed to sync from ~/.claude/settings.json:`, error);
+        }
+    }
+    setCompactStartCallback(callback) {
+        this.onCompactStart = callback;
+    }
+    /**
+     * 处理 AskUserQuestion 工具调用：将 SDK 问题转换为飞书 action 卡片，逐个收集用户答案
+     * SDK 期望返回 updatedInput 中包含 answers 字段：{ [questionText]: selectedLabel | selectedLabel[] }
+     */
+    async handleAskUserQuestion(sessionId, input, options) {
+        const questions = input.questions;
+        // 没有交互上下文（无渠道适配器），回退到纯文本
+        const permCtx = this.permissionContexts.get(sessionId);
+        if (usesUnattendedInteractions(permCtx)) {
+            logger.info(`[AgentRunner] interaction.auto_resolved kind=ask_user session=${sessionId}`);
+            const unattendedAnswer = '当前为无人值守 Trigger，请基于已有上下文选择最安全合理的方案并继续执行。';
+            const answers = {};
+            for (const question of questions ?? []) {
+                answers[question.question] = question.multiSelect ? [unattendedAnswer] : unattendedAnswer;
+            }
+            return {
+                behavior: 'allow',
+                updatedInput: { ...input, answers },
+                decisionClassification: 'user_temporary',
+            };
+        }
+        if (!permCtx?.adapter || !permCtx?.channelId) {
+            return this.handleAskUserQuestionFallback(sessionId, input, questions, options);
+        }
+        const adapterHasInteractionPath = !!permCtx.adapter.send;
+        if (!adapterHasInteractionPath || !permCtx.interactionRouter) {
+            return this.handleAskUserQuestionFallback(sessionId, input, questions, options);
+        }
+        // 立即暂停 idle 监控，不等卡片发完再 register
+        permCtx.interactionRouter?.markWaiting(sessionId);
+        let waitMarked = true;
+        const answers = {};
+        const sendPrompt = permCtx.adapter && permCtx.channelId
+            ? async (text) => permCtx.adapter.send(buildEnvelope({ channel: permCtx.adapter.channelName, channelId: permCtx.channelId, replyContext: permCtx.replyContext }), { kind: 'result.text', text, isFinal: true })
+            : this.sendPromptFn;
+        for (let i = 0; i < questions.length; i++) {
+            const q = questions[i];
+            const requestId = `ask-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const cardTitle = q.header ? `💬 ${q.header}` : `💬 问题 ${i + 1}/${questions.length}`;
+            let interaction;
+            if (q.multiSelect) {
+                // 多选：使用 checkers + form 提交（JSON 2.0 CardKit 路径）
+                interaction = {
+                    type: 'interaction',
+                    id: requestId,
+                    kind: {
+                        kind: 'action',
+                        title: cardTitle,
+                        body: q.question,
+                        checkers: q.options.map(opt => ({
+                            key: opt.label,
+                            label: opt.label,
+                            description: opt.description,
+                        })),
+                        buttons: [
+                            { key: 'submit', label: '✅ 确认选择', style: 'primary' },
+                        ],
+                        allowCustomInput: true,
+                    },
+                    channelId: permCtx.channelId,
+                    sessionId,
+                };
+            }
+            else {
+                // 单选：保持按钮模式
+                const bodyLines = [q.question];
+                if (q.options.some(opt => opt.description)) {
+                    bodyLines.push('');
+                    q.options.forEach((opt, idx) => {
+                        bodyLines.push(`${idx + 1}. **${opt.label}**${opt.description ? ` — ${opt.description}` : ''}`);
+                    });
+                }
+                interaction = {
+                    type: 'interaction',
+                    id: requestId,
+                    kind: {
+                        kind: 'action',
+                        title: cardTitle,
+                        body: bodyLines.join('\n'),
+                        buttons: q.options.map(opt => ({
+                            key: opt.label,
+                            label: opt.label,
+                            style: 'default',
+                        })),
+                        allowCustomInput: true,
+                    },
+                    channelId: permCtx.channelId,
+                    sessionId,
+                };
+            }
+            let cardSent = false;
+            try {
+                await permCtx.flushPending?.();
+                const envelope = buildEnvelope({
+                    taskId: permCtx.taskId,
+                    channel: permCtx.channel ?? permCtx.adapter.channelName,
+                    channelId: permCtx.channelId,
+                    agentName: permCtx.agentName,
+                    chatmode: permCtx.chatmode,
+                    replyContext: permCtx.replyContext,
+                });
+                const optionLines = q.options.map((o, idx) => `  ${idx + 1}. ${o.label}${o.description ? ` — ${o.description}` : ''}`).join('\n');
+                const fallbackText = `💬 ${q.header || q.question}\n${q.header ? q.question + '\n' : ''}${optionLines}`;
+                const result = await sendInteractionPayload(permCtx.adapter, envelope, interaction, fallbackText, permCtx.replyContext);
+                cardSent = !!result;
+            }
+            catch (err) {
+                logger.warn(`[AgentRunner] AskUserQuestion card send failed for q${i}:`, err);
+            }
+            if (!cardSent) {
+                await permCtx.flushPending?.();
+                const firstLabel = q.options[0]?.label || '';
+                answers[q.question] = q.multiSelect ? [firstLabel] : firstLabel;
+                if (sendPrompt) {
+                    const optText = q.options.map((o, idx) => `  ${idx + 1}. ${o.label}${o.description ? ` — ${o.description}` : ''}`).join('\n');
+                    await sendPrompt(`💬 ${q.header || q.question}\n${q.header ? q.question + '\n' : ''}${optText}\n  → 自动选择：${firstLabel}`);
+                }
+                continue;
+            }
+            try {
+                await permCtx.turn?.onInteractionOpen?.({
+                    interactionId: requestId,
+                    kind: 'ask_user',
+                    toolUseId: options.toolUseID,
+                    requestId: options.requestId,
+                    expiresAt: Date.now() + 20 * 60 * 1000,
+                });
+            }
+            catch (error) {
+                logger.warn(`[AgentRunner] Failed to persist AskUserQuestion open interaction: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            // 等待用户交互：回答、取消、超时和 AbortSignal 只能结算一次。
+            let closeCancellation;
+            const cancellationClosed = new Promise(resolve => { closeCancellation = resolve; });
+            const settlement = await new Promise((resolve) => {
+                let settled = false;
+                const finish = (value) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    options.signal.removeEventListener('abort', onAbort);
+                    resolve(value);
+                };
+                const onAbort = () => {
+                    void permCtx?.interactionRouter?.cancel(requestId);
+                    finish({ kind: 'cancelled', reason: 'aborted' });
+                };
+                permCtx?.interactionRouter?.register(requestId, sessionId, (action, values) => {
+                    if (action === 'cancel') {
+                        finish({ kind: 'cancelled', reason: 'explicit_cancel' });
+                    }
+                    else if (action === '_custom_input') {
+                        const customText = values?.custom_text;
+                        finish({ kind: 'answered', value: typeof customText === 'string' && customText.trim() ? customText.trim() : null });
+                    }
+                    else if (action === '_show_input') {
+                        if (permCtx?.interceptNextMessage) {
+                            permCtx.interactionRouter?.markWaiting(sessionId);
+                            sendPrompt?.('✏️ 请直接发送你的自定义回复').catch(() => { });
+                            permCtx.interceptNextMessage(sessionId, (msg) => {
+                                permCtx.interactionRouter?.unmarkWaiting(sessionId);
+                                const text = (msg.content || '').trim();
+                                finish({ kind: 'answered', value: text || null });
+                            });
+                        }
+                        else {
+                            finish({ kind: 'cancelled', reason: 'explicit_cancel' });
+                        }
+                    }
+                    else if (action === 'submit' && q.multiSelect && values) {
+                        const selected = [];
+                        q.options.forEach((opt, idx) => {
+                            if (values[`opt_${idx}`] === true)
+                                selected.push(opt.label);
+                        });
+                        finish({ kind: 'answered', value: selected.length > 0 ? selected : null });
+                    }
+                    else {
+                        finish({ kind: 'answered', value: action });
+                    }
+                }, {
+                    initiatorId: permCtx.userId,
+                    fallbackCommand: 'ask',
+                    timeoutMs: 20 * 60 * 1000,
+                    onCancel: async (reason) => {
+                        finish({ kind: 'cancelled', reason });
+                        await cancellationClosed;
+                    },
+                });
+                if (options.signal.aborted)
+                    onAbort();
+                else
+                    options.signal.addEventListener('abort', onAbort, { once: true });
+                if (waitMarked) {
+                    permCtx?.interactionRouter?.unmarkWaiting(sessionId);
+                    waitMarked = false;
+                }
+            });
+            if (settlement.kind === 'cancelled') {
+                try {
+                    permCtx.cancelIntercept?.(sessionId);
+                    try {
+                        await permCtx.turn?.onInteractionSettled?.(requestId, settlement.reason === 'timeout' ? 'timed_out' : 'cancelled');
+                    }
+                    catch (error) {
+                        logger.warn(`[AgentRunner] Failed to persist AskUserQuestion cancellation: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    return {
+                        behavior: 'deny',
+                        message: `用户交互已取消（${settlement.reason}）`,
+                        interrupt: true,
+                        decisionClassification: 'user_reject',
+                    };
+                }
+                finally {
+                    closeCancellation();
+                }
+            }
+            closeCancellation();
+            answers[q.question] = settlement.value ?? '';
+            try {
+                await permCtx.turn?.onInteractionSettled?.(requestId, 'answered');
+            }
+            catch (error) {
+                logger.warn(`[AgentRunner] Failed to persist AskUserQuestion answer: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        if (waitMarked) {
+            permCtx?.interactionRouter?.unmarkWaiting(sessionId);
+        }
+        const updatedInput = { ...input, answers };
+        return { behavior: 'allow', updatedInput, decisionClassification: 'user_temporary' };
+    }
+    /**
+     * AskUserQuestion 纯文本 fallback：发送选项列表，等待用户通过 /ask 命令选择
+     * 注册到 interactionRouter，用户回复 /ask 1 或 /ask 自定义内容
+     */
+    async handleAskUserQuestionFallback(sessionId, input, questions, options) {
+        const permCtx = this.permissionContexts.get(sessionId);
+        const sendPrompt = permCtx?.adapter && permCtx?.channelId
+            ? async (text) => permCtx.adapter.send(buildEnvelope({ channel: permCtx.adapter.channelName, channelId: permCtx.channelId, replyContext: permCtx.replyContext }), { kind: 'result.text', text, isFinal: true })
+            : this.sendPromptFn;
+        const answers = {};
+        if (questions?.length) {
+            for (const q of questions) {
+                if (sendPrompt && permCtx?.interactionRouter) {
+                    const requestId = `ask-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+                    const interaction = {
+                        type: 'interaction',
+                        id: requestId,
+                        channelId: permCtx.channelId || '',
+                        sessionId,
+                        initiatorId: permCtx.userId,
+                        kind: {
+                            kind: 'action',
+                            title: `💬 ${q.question}`,
+                            body: q.options.map((o, i) => `${i + 1}. ${o.label}${o.description ? ` — ${o.description}` : ''}`).join('\n'),
+                            buttons: q.options.map((o, i) => ({ key: `opt-${i}`, label: o.label })),
+                        },
+                        fallback: {
+                            command: 'ask',
+                            buttonArgMap: Object.fromEntries(q.options.map((_, i) => [`opt-${i}`, String(i + 1)])),
+                            acceptFreeText: true,
+                            freeTextHint: '或回复 /ask <自定义内容>',
+                        },
+                    };
+                    await sendPrompt(renderActionAsText(interaction));
+                    try {
+                        await permCtx.turn?.onInteractionOpen?.({
+                            interactionId: requestId,
+                            kind: 'ask_user',
+                            toolUseId: options.toolUseID,
+                            requestId: options.requestId,
+                            expiresAt: Date.now() + 20 * 60 * 1000,
+                        });
+                    }
+                    catch (error) {
+                        logger.warn(`[AgentRunner] Failed to persist AskUserQuestion fallback open interaction: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    let closeCancellation;
+                    const cancellationClosed = new Promise(resolve => { closeCancellation = resolve; });
+                    const settlement = await new Promise((resolve) => {
+                        let settled = false;
+                        const finish = (value) => {
+                            if (settled)
+                                return;
+                            settled = true;
+                            options.signal.removeEventListener('abort', onAbort);
+                            resolve(value);
+                        };
+                        const onAbort = () => {
+                            void permCtx.interactionRouter?.cancel(requestId);
+                            finish({ kind: 'cancelled', reason: 'aborted' });
+                        };
+                        permCtx.interactionRouter.register(requestId, sessionId, (action) => {
+                            const num = parseInt(action.trim(), 10);
+                            if (num >= 1 && num <= q.options.length) {
+                                finish({ kind: 'answered', value: q.options[num - 1].label });
+                            }
+                            else {
+                                finish({ kind: 'answered', value: action.trim() });
+                            }
+                        }, {
+                            initiatorId: permCtx.userId,
+                            fallbackCommand: 'ask',
+                            timeoutMs: 20 * 60 * 1000,
+                            onCancel: async (reason) => {
+                                finish({ kind: 'cancelled', reason });
+                                await cancellationClosed;
+                            },
+                        });
+                        if (options.signal.aborted)
+                            onAbort();
+                        else
+                            options.signal.addEventListener('abort', onAbort, { once: true });
+                    });
+                    if (settlement.kind === 'cancelled') {
+                        try {
+                            try {
+                                await permCtx.turn?.onInteractionSettled?.(requestId, settlement.reason === 'timeout' ? 'timed_out' : 'cancelled');
+                            }
+                            catch (error) {
+                                logger.warn(`[AgentRunner] Failed to persist AskUserQuestion fallback cancellation: ${error instanceof Error ? error.message : String(error)}`);
+                            }
+                            return {
+                                behavior: 'deny',
+                                message: `用户交互已取消（${settlement.reason}）`,
+                                interrupt: true,
+                                decisionClassification: 'user_reject',
+                            };
+                        }
+                        finally {
+                            closeCancellation();
+                        }
+                    }
+                    closeCancellation();
+                    answers[q.question] = settlement.value;
+                    try {
+                        await permCtx.turn?.onInteractionSettled?.(requestId, 'answered');
+                    }
+                    catch (error) {
+                        logger.warn(`[AgentRunner] Failed to persist AskUserQuestion fallback answer: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                }
+                else {
+                    const firstLabel = q.options[0]?.label || '';
+                    answers[q.question] = firstLabel;
+                    if (sendPrompt) {
+                        const optText = q.options.map((o, i) => `  ${i + 1}. ${o.label}${o.description ? ` — ${o.description}` : ''}`).join('\n');
+                        await sendPrompt(`💬 ${q.question}\n${optText}\n\n  → 自动选择：${firstLabel}`);
+                    }
+                }
+            }
+        }
+        const updatedInput = { ...input, answers };
+        return { behavior: 'allow', updatedInput, decisionClassification: 'user_temporary' };
+    }
+    /**
+     * 处理 ExitPlanMode 工具调用：plan mode 审批，等待用户批准后才继续执行
+     */
+    async handleExitPlanMode(sessionId, input, options) {
+        const permCtx = this.permissionContexts.get(sessionId);
+        if (usesUnattendedInteractions(permCtx)) {
+            logger.info(`[AgentRunner] interaction.auto_resolved kind=plan_approval session=${sessionId}`);
+            return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_temporary' };
+        }
+        const sendPrompt = permCtx?.adapter && permCtx?.channelId
+            ? async (text) => permCtx.adapter.send(buildEnvelope({ channel: permCtx.adapter.channelName, channelId: permCtx.channelId, replyContext: permCtx.replyContext }), { kind: 'result.text', text, isFinal: true })
+            : this.sendPromptFn;
+        // 无任何交互能力，直接 allow
+        if (!permCtx?.channelId || !sendPrompt) {
+            return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_temporary' };
+        }
+        // 立即暂停 idle 监控，不等卡片发完再 register
+        permCtx.interactionRouter?.markWaiting(sessionId);
+        const waitForPlanDecision = async (requestId) => {
+            const router = permCtx.interactionRouter;
+            try {
+                await permCtx.turn?.onInteractionOpen?.({
+                    interactionId: requestId,
+                    kind: 'plan_approval',
+                    toolUseId: options.toolUseID,
+                    requestId: options.requestId,
+                    expiresAt: Date.now() + 20 * 60 * 1000,
+                });
+            }
+            catch (error) {
+                logger.warn(`[AgentRunner] Failed to persist ExitPlanMode open interaction: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            let closeCancellation;
+            const cancellationClosed = new Promise(resolve => { closeCancellation = resolve; });
+            const settlement = await new Promise(resolve => {
+                let settled = false;
+                const finish = (value) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    options.signal.removeEventListener('abort', onAbort);
+                    resolve(value);
+                };
+                const deny = (message) => finish({
+                    kind: 'decision',
+                    state: 'denied',
+                    response: { behavior: 'deny', message, decisionClassification: 'user_reject' },
+                });
+                const onAbort = () => {
+                    void router.cancel(requestId);
+                    finish({ kind: 'cancelled', reason: 'aborted' });
+                };
+                router.register(requestId, sessionId, (action, values) => {
+                    const trimmed = action.trim();
+                    if (trimmed === 'cancel') {
+                        finish({ kind: 'cancelled', reason: 'explicit_cancel' });
+                    }
+                    else if (trimmed === '_custom_input') {
+                        const feedback = typeof values?.custom_text === 'string' ? values.custom_text.trim() : '';
+                        deny(feedback || '用户提交了反馈');
+                    }
+                    else if (trimmed === '_show_input') {
+                        if (permCtx.interceptNextMessage) {
+                            router.markWaiting(sessionId);
+                            sendPrompt?.('✏️ 请直接发送你的反馈意见').catch(() => { });
+                            permCtx.interceptNextMessage(sessionId, msg => {
+                                router.unmarkWaiting(sessionId);
+                                const feedback = (msg.content || '').trim();
+                                deny(feedback || '用户提交了反馈');
+                            });
+                        }
+                        else {
+                            deny('用户提交了反馈');
+                        }
+                    }
+                    else if (trimmed === '2' || trimmed.toLowerCase() === 'reject' || trimmed === '拒绝') {
+                        deny('用户拒绝了计划');
+                    }
+                    else {
+                        finish({
+                            kind: 'decision',
+                            state: 'answered',
+                            response: { behavior: 'allow', updatedInput: input, decisionClassification: 'user_temporary' },
+                        });
+                    }
+                }, {
+                    initiatorId: permCtx.userId,
+                    fallbackCommand: 'ask',
+                    timeoutMs: 20 * 60 * 1000,
+                    onCancel: async (reason) => {
+                        finish({ kind: 'cancelled', reason });
+                        await cancellationClosed;
+                    },
+                });
+                if (options.signal.aborted)
+                    onAbort();
+                else
+                    options.signal.addEventListener('abort', onAbort, { once: true });
+            });
+            try {
+                if (settlement.kind === 'cancelled') {
+                    permCtx.cancelIntercept?.(sessionId);
+                    try {
+                        await permCtx.turn?.onInteractionSettled?.(requestId, settlement.reason === 'timeout' ? 'timed_out' : 'cancelled');
+                    }
+                    catch (error) {
+                        logger.warn(`[AgentRunner] Failed to persist ExitPlanMode cancellation: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    return {
+                        behavior: 'deny',
+                        message: `计划审批已取消（${settlement.reason}）`,
+                        interrupt: true,
+                        decisionClassification: 'user_reject',
+                    };
+                }
+                try {
+                    await permCtx.turn?.onInteractionSettled?.(requestId, settlement.state);
+                }
+                catch (error) {
+                    logger.warn(`[AgentRunner] Failed to persist ExitPlanMode decision: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                return settlement.response;
+            }
+            finally {
+                closeCancellation();
+            }
+        };
+        // 尝试发送交互卡片
+        let cardSent = false;
+        if (permCtx.adapter?.send) {
+            // 发送计划内容：找 plans 目录中最新修改的 .md 文件
+            if (sendPrompt) {
+                try {
+                    const plansDir = path.join(process.env.HOME || '/root', '.claude', 'plans');
+                    const files = fs.readdirSync(plansDir)
+                        .filter((f) => f.endsWith('.md'))
+                        .map((f) => ({ name: f, mtime: fs.statSync(path.join(plansDir, f)).mtimeMs }))
+                        .sort((a, b) => b.mtime - a.mtime);
+                    if (files.length > 0) {
+                        const planContent = fs.readFileSync(path.join(plansDir, files[0].name), 'utf-8');
+                        if (planContent.trim()) {
+                            await sendPrompt(`📋 **计划内容**\n\n${planContent}`);
+                        }
+                    }
+                }
+                catch {
+                    // 读取失败不影响后续审批流程
+                }
+            }
+            const requestId = `plan-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const interaction = {
+                type: 'interaction',
+                id: requestId,
+                kind: {
+                    kind: 'action',
+                    title: '📋 计划审批',
+                    body: 'AI 已完成规划，等待审批。\n请查看以上计划内容后决定。',
+                    buttons: [
+                        { key: 'approve', label: '✅ 批准执行', style: 'primary' },
+                        { key: 'reject', label: '❌ 拒绝', style: 'danger' },
+                    ],
+                    allowCustomInput: true,
+                },
+                channelId: permCtx.channelId,
+                sessionId,
+                initiatorId: permCtx.userId,
+                fallback: {
+                    command: 'ask',
+                    buttonArgMap: { approve: '1', reject: '2' },
+                },
+            };
+            try {
+                await permCtx.flushPending?.();
+                const envelope = buildEnvelope({
+                    taskId: permCtx.taskId,
+                    channel: permCtx.channel ?? permCtx.adapter.channelName,
+                    channelId: permCtx.channelId,
+                    agentName: permCtx.agentName,
+                    chatmode: permCtx.chatmode,
+                    replyContext: permCtx.replyContext,
+                });
+                const fallbackText = '📋 计划审批：AI 已完成规划，等待审批。\n回复 /ask 1 批准 / /ask 2 拒绝';
+                const result = await sendInteractionPayload(permCtx.adapter, envelope, interaction, fallbackText, permCtx.replyContext);
+                cardSent = !!result;
+            }
+            catch (err) {
+                logger.warn('[AgentRunner] ExitPlanMode card send failed:', err);
+            }
+            if (cardSent && permCtx.interactionRouter) {
+                permCtx.interactionRouter?.unmarkWaiting(sessionId);
+                return await waitForPlanDecision(requestId);
+            }
+        }
+        // 文本 fallback：注册到 interactionRouter，等待用户 /ask 回复
+        if (permCtx.interactionRouter) {
+            const fallbackRequestId = `plan-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const fallbackInteraction = {
+                type: 'interaction',
+                id: fallbackRequestId,
+                channelId: permCtx.channelId || '',
+                sessionId,
+                initiatorId: permCtx.userId,
+                kind: {
+                    kind: 'action',
+                    title: '📋 计划审批',
+                    body: 'AI 已完成规划，等待审批。',
+                    buttons: [
+                        { key: 'approve', label: '✅ 批准执行', style: 'primary' },
+                        { key: 'reject', label: '❌ 拒绝', style: 'danger' },
+                    ],
+                },
+                fallback: {
+                    command: 'ask',
+                    buttonArgMap: { approve: '1', reject: '2' },
+                },
+            };
+            await permCtx.flushPending?.();
+            await sendPrompt(renderActionAsText(fallbackInteraction));
+            permCtx.interactionRouter.unmarkWaiting(sessionId);
+            return await waitForPlanDecision(fallbackRequestId);
+        }
+        // 无交互能力，发提示后直接 allow
+        permCtx?.interactionRouter?.unmarkWaiting(sessionId);
+        await permCtx.flushPending?.();
+        await sendPrompt('📋 计划审批\nAI 已完成规划，自动批准执行。');
+        return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_temporary' };
+    }
+    /**
+     * SDK 原始事件 → 标准 AgentEvent 转换
+     * 所有 SDK 特有的事件类型引用封装在此方法内
+     */
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel) {
+        let lastSessionId;
+        // tool_use_id → tool_name 映射，用于从 SDKUserMessage 的 tool_result 块中还原工具名
+        const toolUseNames = new Map();
+        let turnCount = 0;
+        const seenMessageIds = new Set();
+        let lastModelCall;
+        let lastAssistantUuid;
+        // 流式收集各次大模型调用（fallback：SDK iterations 为空时使用）
+        const collectedCalls = [];
+        try {
+            for await (const event of sdkStream) {
+                // 提取 session_id（任意 SDK 事件都可能携带）
+                if (event.session_id && event.session_id !== lastSessionId) {
+                    lastSessionId = event.session_id;
+                    this.updateSessionId(sessionId, event.session_id);
+                    yield { type: 'session_id', sessionId: event.session_id };
+                }
+                if (event.type === 'user' && event.uuid === inputId) {
+                    yield { type: 'input_accepted', inputId };
+                }
+                if (event.type === 'stream_event') {
+                    const streamEvent = event.event;
+                    if (streamEvent?.type === 'message_start' && streamEvent.message?.usage) {
+                        lastModelCall = {
+                            uuid: event.uuid,
+                            model: streamEvent.message.model,
+                            tokenUsage: streamEvent.message.usage,
+                        };
+                        // 流式收集：每个 message_start = 一次新的大模型调用
+                        collectedCalls.push({
+                            call_index: collectedCalls.length,
+                            model: streamEvent.message.model ?? callModel ?? this.model,
+                            request_id: event.request_id,
+                            tokenUsage: { ...streamEvent.message.usage },
+                        });
+                    }
+                    else if (streamEvent?.type === 'message_delta' && streamEvent.usage) {
+                        lastModelCall = {
+                            ...lastModelCall,
+                            uuid: lastModelCall?.uuid ?? event.uuid,
+                            tokenUsage: {
+                                ...(lastModelCall?.tokenUsage ?? {}),
+                                ...streamEvent.usage,
+                            },
+                        };
+                        // 将 message_delta 的 usage 合并进当前(最后一次)收集的调用
+                        const last = collectedCalls[collectedCalls.length - 1];
+                        if (last)
+                            last.tokenUsage = { ...last.tokenUsage, ...streamEvent.usage };
+                    }
+                    continue;
+                }
+                // system: compact_boundary → compact
+                if (event.type === 'system' && event.subtype === 'compact_boundary') {
+                    yield {
+                        type: 'compact',
+                        preTokens: event.compact_metadata?.pre_tokens || 0,
+                        postTokens: event.compact_metadata?.post_tokens,
+                        durationMs: event.compact_metadata?.duration_ms,
+                    };
+                }
+                // system: task_progress → task_progress
+                if (event.type === 'system' && event.subtype === 'task_progress') {
+                    yield {
+                        type: 'task_progress',
+                        summary: event.summary,
+                        toolUses: event.tool_uses,
+                        durationMs: event.duration_ms,
+                    };
+                }
+                // system: session_state_changed → state_changed
+                if (event.type === 'system' && event.subtype === 'session_state_changed') {
+                    yield { type: 'state_changed', state: event.state };
+                }
+                // assistant: 提取 tool_use 和文本（仅无 text_delta 时提取文本）
+                if (event.type === 'assistant' && event.message?.content) {
+                    lastAssistantUuid = event.uuid ?? lastAssistantUuid;
+                    const msgId = event.message.id;
+                    if (!msgId || !seenMessageIds.has(msgId)) {
+                        if (msgId)
+                            seenMessageIds.add(msgId);
+                        turnCount++;
+                    }
+                    if (event.message.usage) {
+                        lastModelCall = {
+                            ...lastModelCall,
+                            messageId: event.message.id,
+                            requestId: event.request_id,
+                            model: event.message.model,
+                            tokenUsage: {
+                                ...event.message.usage,
+                                ...(lastModelCall?.tokenUsage ?? {}),
+                            },
+                        };
+                    }
+                    // 统计本轮 base agent 全部输出字符数（text + tool_use input）
+                    let turnOutputChars = 0;
+                    for (const content of event.message.content) {
+                        if (content.type === 'tool_use') {
+                            const inputStr = typeof content.input === 'string' ? content.input : JSON.stringify(content.input || '');
+                            turnOutputChars += inputStr.length;
+                        }
+                        else if (content.type === 'text' && content.text) {
+                            turnOutputChars += content.text.length;
+                        }
+                    }
+                    for (const content of event.message.content) {
+                        if (content.type === 'tool_use') {
+                            if (content.id)
+                                toolUseNames.set(content.id, content.name);
+                            yield { type: 'tool_use', name: content.name, input: content.input, callId: content.id, turn: turnCount, outputTokens: turnOutputChars, assistantUuid: event.uuid };
+                        }
+                        else if (content.type === 'text' && content.text) {
+                            yield { type: 'text', text: content.text, outputTokens: turnOutputChars, turn: turnCount, assistantUuid: event.uuid };
+                        }
+                    }
+                }
+                // user: 提取 tool_result 块（SDK 将工具结果嵌套在 SDKUserMessage 中）
+                if (event.type === 'user' && event.message?.content) {
+                    const contentArray = Array.isArray(event.message.content) ? event.message.content : [];
+                    for (const block of contentArray) {
+                        if (typeof block === 'object' && block !== null && block.type === 'tool_result') {
+                            const toolName = toolUseNames.get(block.tool_use_id) || '';
+                            const resultContent = typeof block.content === 'string'
+                                ? block.content
+                                : block.content != null ? JSON.stringify(block.content) : '';
+                            yield {
+                                type: 'tool_result',
+                                name: toolName,
+                                result: resultContent,
+                                isError: block.is_error === true,
+                                error: block.is_error === true ? resultContent : undefined,
+                                callId: block.tool_use_id,
+                            };
+                        }
+                    }
+                }
+                // result → complete（含 permission_denials 提取）
+                if (event.type === 'result') {
+                    // 先发出被拒绝的权限事件
+                    if (Array.isArray(event.permission_denials)) {
+                        for (const denial of event.permission_denials) {
+                            yield {
+                                type: 'tool_result',
+                                name: denial.tool_name || '',
+                                result: '',
+                                isError: true,
+                                error: `权限被拒绝: ${denial.tool_name}`,
+                            };
+                        }
+                    }
+                    // 剥离 SDK result 中混入的 <thinking>...</thinking> 块
+                    const cleanResult = typeof event.result === 'string'
+                        ? event.result.replace(/<thinking>[\s\S]*?<\/thinking>\s*/g, '').trim()
+                        : event.result;
+                    // 从 usage 求当前上下文占用。
+                    // Claude：input_tokens 是净输入（不含 cache），三项求和 = 实际上下文长度。
+                    // 非 Claude（DeepSeek/OpenAI 兼容）：cache_read 是服务端 KV cache 不占上下文窗口，
+                    // input_tokens 本身就是完整的上下文输入量。
+                    const u = event.usage;
+                    const effectiveModel = callModel ?? this.model;
+                    const isClaudeModel = isClaudeContextUsageModel(effectiveModel);
+                    const totalTokens = contextTokensForUsage(u, !!isClaudeModel);
+                    const contextWindowTokens = realContextWindowForModel(sdkModel);
+                    const autoCompactTokens = autoCompactWindowForModel(sdkModel);
+                    const contextUsage = totalTokens > 0 ? {
+                        totalTokens,
+                        maxTokens: contextWindowTokens,
+                        percentage: Math.round((totalTokens / contextWindowTokens) * 100),
+                        autoCompactTokens,
+                        model: callModel ?? this.model,
+                        effort: callEffort ?? this.effort,
+                    } : undefined;
+                    if (lastModelCall?.tokenUsage) {
+                        const lastUsageForContext = usageForContext(lastModelCall.tokenUsage);
+                        const lastTotalTokens = contextTokensForUsage(lastUsageForContext, !!isClaudeModel);
+                        lastModelCall = {
+                            ...lastModelCall,
+                            contextUsage: lastTotalTokens > 0 ? {
+                                totalTokens: lastTotalTokens,
+                                maxTokens: contextWindowTokens,
+                                percentage: Math.round((lastTotalTokens / contextWindowTokens) * 100),
+                                autoCompactTokens,
+                                model: callModel ?? this.model,
+                                effort: callEffort ?? this.effort,
+                            } : undefined,
+                        };
+                    }
+                    const contextUsageForCall = (usage) => {
+                        const callTotalTokens = contextTokensForUsage(usageForContext(usage), !!isClaudeModel);
+                        return callTotalTokens > 0 ? {
+                            totalTokens: callTotalTokens,
+                            maxTokens: contextWindowTokens,
+                            percentage: Math.round((callTotalTokens / contextWindowTokens) * 100),
+                            autoCompactTokens,
+                            model: callModel ?? this.model,
+                            effort: callEffort ?? this.effort,
+                        } : undefined;
+                    };
+                    // 组装 modelCalls：优先 SDK iterations，fallback 流式收集，兜底降级单行。
+                    const callModel_ = callModel ?? this.model;
+                    let modelCalls;
+                    const iterArr = Array.isArray(u?.iterations) && u.iterations.length > 0 ? u.iterations : null;
+                    if (iterArr) {
+                        modelCalls = iterArr.map((it, i) => ({
+                            call_index: i, model: callModel_, tokenUsage: it, contextUsage: contextUsageForCall(it),
+                        }));
+                    }
+                    else if (collectedCalls.length > 0) {
+                        modelCalls = collectedCalls.map(call => ({
+                            ...call,
+                            contextUsage: contextUsageForCall(call.tokenUsage),
+                        }));
+                    }
+                    else if (u) {
+                        // 降级：无逐次数据，写一条累计行
+                        modelCalls = [{ call_index: 0, model: callModel_, tokenUsage: u, contextUsage: contextUsageForCall(u), degraded: true }];
+                    }
+                    yield {
+                        type: 'complete',
+                        result: cleanResult,
+                        subtype: event.subtype,
+                        isError: event.is_error,
+                        errors: event.errors,
+                        durationMs: event.duration_ms,
+                        ttftMs: event.ttft_ms,
+                        costUsd: event.total_cost_usd,
+                        terminalReason: event.terminal_reason,
+                        sessionTitle: event.session_title,
+                        numTurns: event.num_turns,
+                        tokenUsage: event.usage,
+                        contextUsage,
+                        lastModelCall,
+                        modelCalls,
+                        assistantUuid: lastAssistantUuid,
+                    };
+                    // result 是 SDK 流的终结事件，不再等待后续（防止 interrupt 后流不关闭导致挂起）
+                    return;
+                }
+            }
+        }
+        catch (err) {
+            // 子进程崩溃（如 exited with code 1）时，把缓冲的 stderr 打出来还原真实原因。
+            // SDK 包装后的错误信息不含子进程实际报错，缓冲区才是根因所在。
+            const buf = this.recentStderr.get(sessionId);
+            if (buf && buf.length > 0) {
+                logger.error(`[AgentRunner] Subprocess stream failed (session=${sessionId}). Last ${buf.length} stderr line(s):\n${buf.join('\n')}`);
+            }
+            else {
+                logger.error(`[AgentRunner] Subprocess stream failed (session=${sessionId}) with no captured stderr.`);
+            }
+            throw err;
+        }
+        finally {
+            this.recentStderr.delete(sessionId);
+        }
+    }
+    async runQuery(sessionId, prompt, projectPath, initialClaudeSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
+        // 记录当前 evolcore session ID，用于 Agent ctl 环境变量注入
+        // 同步用户级配置到内存
+        this.syncFromUserSettings();
+        // 异步刷新模型别名缓存（fire-and-forget，不阻塞查询）
+        if (this.baseUrl) {
+            const cacheKey = normalizeModelGatewayUrl(this.baseUrl);
+            const cached = modelAliasCache.get(cacheKey);
+            if (!cached || (Date.now() - cached.fetchedAt > MODEL_ALIAS_TTL_MS)) {
+                refreshModelAliases(this.baseUrl, this.apiKey);
+            }
+            // 顺带预热网关价格缓存（1h TTL），让本轮结束写库时已就绪
+            const pricing = gatewayPricingCache.get(this.baseUrl);
+            if (!pricing || (Date.now() - pricing.fetchedAt > GATEWAY_PRICING_TTL_MS)) {
+                refreshGatewayPricing(this.baseUrl, this.apiKey);
+            }
+        }
+        ensureDir(projectPath);
+        ensureDir(path.join(projectPath, '.claude'));
+        // 优先使用传入的 agentSessionId（从数据库恢复），否则使用内存中的
+        let agentSessionId = initialClaudeSessionId || this.activeSessions.get(sessionId);
+        // 验证会话文件是否存在且有效（仅在有 agentSessionId 时）
+        if (agentSessionId) {
+            const homeDir = os.homedir();
+            const encodedProjectPath = encodePath(projectPath);
+            const sessionFile = path.join(homeDir, '.claude', 'projects', encodedProjectPath, `${agentSessionId}.jsonl`);
+            let isValid = false;
+            if (fs.existsSync(sessionFile)) {
+                try {
+                    const content = fs.readFileSync(sessionFile, 'utf-8');
+                    const lines = content.split('\n').filter(l => l.trim());
+                    // 查找第一个包含 sessionId 和 version 的行（跳过 queue-operation）
+                    for (const line of lines) {
+                        try {
+                            const data = JSON.parse(line);
+                            if (data.sessionId && data.version) {
+                                isValid = true;
+                                break;
+                            }
+                        }
+                        catch { }
+                    }
+                    if (!isValid) {
+                        logger.warn(`[AgentRunner] Session file missing session data: ${sessionFile}`);
+                    }
+                }
+                catch (error) {
+                    logger.warn(`[AgentRunner] Session file corrupted: ${sessionFile}`);
+                }
+            }
+            if (!isValid) {
+                logger.warn(`[AgentRunner] Invalid session file, starting new session`);
+                agentSessionId = undefined;
+                this.activeSessions.delete(sessionId);
+                if (this.onSessionIdUpdate) {
+                    this.onSessionIdUpdate(sessionId, '');
+                }
+            }
+        }
+        // PreCompact Hook - 在压缩开始时触发
+        const preCompactHook = async () => {
+            if (this.onCompactStart) {
+                this.onCompactStart(sessionId);
+            }
+            return {};
+        };
+        // 本次调用使用的权限模式：优先 permissionModeOverride（message-processor 按 关系>角色>出厂默认 解析后传入），
+        // 缺省回落 agent 级 this.permissionMode。作为 per-call 入参（hook/canUseTool 闭包捕获），
+        // 不写实例字段，多对端并发互不污染（与 model/effort 同构）。
+        const requestedPermissionMode = modelOverride?.permissionMode || this.permissionMode;
+        const normalizedPermission = normalizePermissionMode(requestedPermissionMode);
+        const callPermissionMode = normalizedPermission.mode;
+        const runPermissionContext = this.permissionContexts.get(sessionId);
+        const executionSandbox = resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
+        const permissionPrompt = runPermissionContext?.sendPrompt ?? this.sendPromptFn;
+        const permissionContext = (signal) => {
+            const context = this.permissionContexts.get(sessionId);
+            return context && signal ? { ...context, abortSignal: signal } : context;
+        };
+        const hookDecision = (decision, reason, updatedInput) => ({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: decision,
+                ...(reason ? { permissionDecisionReason: reason } : {}),
+                ...(updatedInput ? { updatedInput } : {}),
+            },
+        });
+        // A rewritten helper command is trusted only after this hook produced its
+        // random one-shot payload from a validated output wrapper.
+        const trustedSafeOutputCommands = new Set();
+        // PreToolUse Hook - 黑名单检查 + input 修正（不可绕过，所有模式都走）
+        const preToolUseHook = async (input) => {
+            const toolName = input.tool_name;
+            const originalInput = (input.tool_input || {});
+            let toolInput = originalInput;
+            if (toolName === 'Bash' && 'dangerouslyDisableSandbox' in toolInput) {
+                toolInput = { ...toolInput };
+                delete toolInput.dangerouslyDisableSandbox;
+            }
+            // Remove fields known to be rejected by the SDK schema without granting
+            // permission as a side effect. The cleaned input still goes through the
+            // complete policy below.
+            const sanitizeRules = {
+                'EnterPlanMode': ['reason'],
+                'ExitPlanMode': ['reason'],
+                'ExitWorktree': ['reason'],
+            };
+            const fieldsToRemove = sanitizeRules[toolName];
+            if (fieldsToRemove?.some(field => field in toolInput)) {
+                toolInput = { ...toolInput };
+                for (const field of fieldsToRemove)
+                    delete toolInput[field];
+            }
+            if (toolName === 'Read' && toolInput.pages === '') {
+                if (toolInput === originalInput)
+                    toolInput = { ...toolInput };
+                delete toolInput.pages;
+            }
+            let updatedInput = toolInput === originalInput ? undefined : toolInput;
+            const preparedSafeOutputCommand = toolName === 'Bash' && typeof toolInput.command === 'string'
+                ? toolInput.command
+                : undefined;
+            if (preparedSafeOutputCommand && trustedSafeOutputCommands.has(preparedSafeOutputCommand)) {
+                return hookDecision('allow', undefined, {
+                    ...toolInput,
+                    dangerouslyDisableSandbox: true,
+                });
+            }
+            // proactive 模式行为策略（首次工具调用必须是 ec msg send）
+            const policyResult = this.permissionContexts.get(sessionId)?.policyHook?.(toolName, toolInput);
+            if (policyResult?.block) {
+                return hookDecision('deny', policyResult.reason || '当前会话策略拒绝此工具调用', updatedInput);
+            }
+            const permCtx = this.permissionContexts.get(sessionId);
+            const commandBeforePreflight = toolName === 'Bash' && typeof toolInput.command === 'string'
+                ? toolInput.command
+                : undefined;
+            const preflight = evaluateToolPreflight(toolName, toolInput, {
+                sessionId,
+                channel: permCtx?.channel,
+                userId: permCtx?.userId,
+                role: permCtx?.role,
+                permissionMode: callPermissionMode,
+                allowHostProcessCommands: true,
+                safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
+                projectPath,
+            });
+            toolInput = preflight.input;
+            if (toolInput !== originalInput)
+                updatedInput = toolInput;
+            if (preflight.behavior === 'deny')
+                return hookDecision('deny', preflight.message, updatedInput);
+            if (preflight.behavior === 'allow') {
+                const commandAfterPreflight = typeof toolInput.command === 'string' ? toolInput.command : undefined;
+                if (commandAfterPreflight && commandAfterPreflight !== commandBeforePreflight) {
+                    trustedSafeOutputCommands.add(commandAfterPreflight);
+                }
+                return hookDecision('allow', undefined, {
+                    ...toolInput,
+                    dangerouslyDisableSandbox: true,
+                });
+            }
+            // These tools need the dedicated canUseTool interaction handlers below.
+            if (toolName === 'AskUserQuestion' || toolName === 'ExitPlanMode') {
+                return hookDecision('defer', undefined, updatedInput);
+            }
+            if (callPermissionMode === 'readonly') {
+                const permCtx = this.permissionContexts.get(sessionId);
+                const readonlyContext = {
+                    sessionId,
+                    channel: permCtx?.channel,
+                    peerId: permCtx?.userId,
+                    role: permCtx?.role,
+                    allowLiteralReadShell: true,
+                };
+                const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
+                if (roResult.behavior === 'deny') {
+                    return hookDecision('deny', roResult.message, updatedInput);
+                }
+                return hookDecision('allow', undefined, updatedInput);
+            }
+            if (isClaudeMcpTool(toolName)) {
+                return hookDecision('allow', undefined, updatedInput);
+            }
+            if (isUnknownClaudeTool(toolName)) {
+                if (callPermissionMode === 'auto') {
+                    return hookDecision('deny', `auto 模式拒绝未知工具 ${toolName}：该工具不受 Claude 本地 sandbox 的完整约束`, updatedInput);
+                }
+                // request/bypass only receive external tools admitted by the session's
+                // capability configuration. Admission is server/app-wide, not per tool.
+                return hookDecision('allow', undefined, updatedInput);
+            }
+            const danger = checkDangerousCommand(toolName, toolInput);
+            if (danger.isDangerous) {
+                if (callPermissionMode === 'auto') {
+                    return hookDecision('deny', `危险操作已由 auto 模式拒绝：${danger.reason}`, updatedInput);
+                }
+                if (callPermissionMode === 'request' || callPermissionMode === 'bypass') {
+                    const approval = await requestDangerousCommandPermission(this.permissionGateway, sessionId, toolName, toolInput, permissionPrompt, permissionContext(), `claude:${callPermissionMode}`, callPermissionMode);
+                    if (approval.matched && approval.decision === 'deny') {
+                        return hookDecision('deny', '危险操作未获人工批准', updatedInput);
+                    }
+                }
+                return hookDecision('allow', undefined, updatedInput);
+            }
+            if (callPermissionMode === 'auto' || callPermissionMode === 'request' || callPermissionMode === 'bypass') {
+                return hookDecision('allow', undefined, updatedInput);
+            }
+            return hookDecision('deny', '未知权限模式已拒绝工具调用', updatedInput);
+        };
+        // PermissionDenied Hook - auto 模式下 SDK 拒绝操作时通知用户
+        const permissionDeniedHook = async (input) => {
+            if (callPermissionMode === 'auto' && permissionPrompt) {
+                const toolName = input.tool_name || '未知工具';
+                const reason = input.reason || 'AI 判断此操作有风险';
+                const message = `⚠️ 操作已自动拦截\n工具: ${toolName}\n原因: ${reason}`;
+                try {
+                    await permissionPrompt(message);
+                }
+                catch (err) {
+                    logger.error('[PermissionDenied] Failed to send notification:', err);
+                }
+            }
+            return {};
+        };
+        // SDK-level canUseTool 回调：接入 PermissionGateway 的用户审批入口
+        // 黑名单已在 PreToolUse hook 拦截，危险命令在此处进入审批流程
+        const canUseToolCallback = async (toolName, input, options) => {
+            // 特殊处理：AskUserQuestion 工具（SDK 内置的用户交互工具）
+            // 这不是权限审批，而是收集用户答案，需要构造表单卡片
+            if (toolName === 'AskUserQuestion') {
+                return await this.handleAskUserQuestion(sessionId, input, options);
+            }
+            // 特殊处理：ExitPlanMode 工具（plan mode 审批）
+            if (toolName === 'ExitPlanMode') {
+                return await this.handleExitPlanMode(sessionId, input, options);
+            }
+            if (toolName === 'Bash' && 'dangerouslyDisableSandbox' in input) {
+                input = { ...input };
+                delete input.dangerouslyDisableSandbox;
+            }
+            const preparedSafeOutputCommand = toolName === 'Bash' && typeof input.command === 'string'
+                ? input.command
+                : undefined;
+            if (preparedSafeOutputCommand && trustedSafeOutputCommands.delete(preparedSafeOutputCommand)) {
+                return {
+                    behavior: 'allow',
+                    updatedInput: { ...input, dangerouslyDisableSandbox: true },
+                    decisionClassification: 'user_permanent',
+                };
+            }
+            const permCtx = this.permissionContexts.get(sessionId);
+            const preflight = evaluateToolPreflight(toolName, input, {
+                sessionId,
+                channel: permCtx?.channel,
+                userId: permCtx?.userId,
+                role: permCtx?.role,
+                permissionMode: callPermissionMode,
+                allowHostProcessCommands: true,
+                safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
+                projectPath,
+            });
+            input = preflight.input;
+            if (preflight.behavior === 'deny') {
+                return { behavior: 'deny', message: preflight.message, decisionClassification: 'user_reject' };
+            }
+            if (preflight.behavior === 'allow') {
+                return {
+                    behavior: 'allow',
+                    updatedInput: { ...input, dangerouslyDisableSandbox: true },
+                    decisionClassification: 'user_permanent',
+                };
+            }
+            const permissionExpansion = inspectClaudePermissionExpansion(input, options, projectPath);
+            if (permissionExpansion.protectedReason) {
+                return {
+                    behavior: 'deny',
+                    message: permissionExpansion.protectedReason,
+                    decisionClassification: 'user_reject',
+                };
+            }
+            if (permissionExpansion.requiresApproval) {
+                if (callPermissionMode === 'readonly' || callPermissionMode === 'auto') {
+                    return {
+                        behavior: 'deny',
+                        message: `${callPermissionMode} 模式拒绝 Claude SDK 文件系统或未知权限扩权请求`,
+                        decisionClassification: 'user_reject',
+                    };
+                }
+                if (callPermissionMode === 'request' || callPermissionMode === 'bypass') {
+                    if (!this.permissionGateway || !permissionPrompt) {
+                        return {
+                            behavior: 'deny',
+                            message: '扩权审批通道不可用，操作已拒绝',
+                            decisionClassification: 'user_reject',
+                        };
+                    }
+                    const expansionSummary = options.title
+                        || options.description
+                        || summarizeToolInput(toolName, input);
+                    const expansionDecision = await this.permissionGateway.requestPermission(sessionId, toolName, permissionExpansion.approvalInput, permissionPrompt, permissionContext(options.signal), expansionSummary, options.decisionReason || 'Claude SDK 请求扩大当前会话权限', `claude:${callPermissionMode}`);
+                    if (expansionDecision === 'deny') {
+                        return {
+                            behavior: 'deny',
+                            message: 'Claude SDK 扩权未获人工批准',
+                            decisionClassification: 'user_reject',
+                        };
+                    }
+                    return {
+                        behavior: 'allow',
+                        updatedInput: input,
+                        decisionClassification: 'user_temporary',
+                    };
+                }
+            }
+            // Defensive duplicate of PreToolUse enforcement for SDK edge cases.
+            if (callPermissionMode === 'readonly') {
+                const permCtx = this.permissionContexts.get(sessionId);
+                const readonlyContext = {
+                    sessionId,
+                    channel: permCtx?.channel,
+                    peerId: permCtx?.userId,
+                    role: permCtx?.role,
+                    allowLiteralReadShell: true,
+                };
+                const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
+                if (roResult.behavior === 'deny') {
+                    return { behavior: 'deny', message: roResult.message, decisionClassification: 'user_reject' };
+                }
+                return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
+            }
+            if (isClaudeMcpTool(toolName)) {
+                return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
+            }
+            if (isUnknownClaudeTool(toolName)) {
+                if (callPermissionMode === 'auto') {
+                    return {
+                        behavior: 'deny',
+                        message: `auto 模式拒绝未知工具 ${toolName}：该工具不受 Claude 本地 sandbox 的完整约束`,
+                        decisionClassification: 'user_reject',
+                    };
+                }
+                return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
+            }
+            const danger = checkDangerousCommand(toolName, input);
+            if (danger.isDangerous) {
+                if (callPermissionMode === 'auto') {
+                    return { behavior: 'deny', message: `auto 模式拒绝危险操作：${danger.reason}`, decisionClassification: 'user_reject' };
+                }
+                if (callPermissionMode === 'request' || callPermissionMode === 'bypass') {
+                    const dangerDecision = await requestDangerousCommandPermission(this.permissionGateway, sessionId, toolName, input, permissionPrompt, permissionContext(options.signal), `claude:${callPermissionMode}`, callPermissionMode);
+                    if (dangerDecision.matched && dangerDecision.decision === 'deny') {
+                        return { behavior: 'deny', message: '危险操作未获人工批准', decisionClassification: 'user_reject' };
+                    }
+                    return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_temporary' };
+                }
+                return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
+            }
+            if (callPermissionMode === 'auto' || callPermissionMode === 'bypass') {
+                return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
+            }
+            // request mode must fail closed if the EvolCore approval channel is not
+            // installed; otherwise the SDK escalation callback becomes a bypass.
+            if (!this.permissionGateway || !permissionPrompt) {
+                return { behavior: 'deny', message: '审批通道不可用，操作已拒绝', decisionClassification: 'user_reject' };
+            }
+            const summary = options.title
+                || options.description
+                || summarizeToolInput(toolName, input);
+            const decision = await this.permissionGateway.requestPermission(sessionId, toolName, input, permissionPrompt, permissionContext(options.signal), summary, options.decisionReason, `claude:${callPermissionMode}`);
+            if (decision === 'deny') {
+                return { behavior: 'deny', message: '用户拒绝或审批超时', decisionClassification: 'user_reject' };
+            }
+            return {
+                behavior: 'allow',
+                updatedInput: input,
+                decisionClassification: 'user_temporary'
+            };
+        };
+        const useSettingSources = this.config?.agents?.claude?.useSettingSources !== false;
+        const settingSources = useSettingSources ? ['project', 'user'] : [];
+        const enableSummaries = this.config?.agents?.claude?.agentProgressSummaries !== false;
+        const excludeDynamic = this.config?.agents?.claude?.excludeDynamicSections === true;
+        // 公共 options（新旧模式共用）
+        const sdkPermissionMode = this.toSdkPermissionMode(requestedPermissionMode);
+        // 本次调用使用的模型/强度：优先 modelOverride（message-processor 按 关系>agent>全局 解析后传入），
+        // 缺省回落 agent 级 this.model。作为 per-call 入参传入，无共享状态，多对端并发互不污染。
+        const callModel = modelOverride?.model || this.model;
+        const callEffort = (modelOverride?.effort ?? this.effort);
+        const callSessionTitle = sanitizeSessionTitle(modelOverride?.sessionTitle);
+        logger.info(`[AgentRunner] runQuery model=${callModel} effort=${callEffort ?? 'auto'} ` +
+            `permMode=${requestedPermissionMode}->${callPermissionMode} role=${runPermissionContext?.role ?? 'none'} ` +
+            `sandbox=${executionSandbox.state} sdkMode=${sdkPermissionMode}`);
+        if (systemPromptAppend) {
+            logger.info(`[AgentRunner] systemPromptAppend: ${systemPromptAppend.length} chars`);
+        }
+        else {
+            logger.info(`[AgentRunner] systemPromptAppend: none`);
+        }
+        const sdkModel = resolveSdkModel(callModel, this.baseUrl);
+        const capabilityOptions = await this.resolveCapabilityRunOptions(projectPath);
+        const managedSettings = buildClaudeManagedLockdownSettings(capabilityOptions);
+        const sandboxOptions = executionSandbox.state === 'off'
+            ? { enabled: false }
+            : await (async () => {
+                const sandboxProjectionStartedAt = Date.now();
+                ensureClaudeGitWorktreeConfig(projectPath);
+                const sandboxFilesystem = buildClaudeProtectedFilesystem(resolvePaths().root);
+                const sandboxUnixSockets = buildClaudeUnixSocketAllowlist(projectPath, {
+                    role: runPermissionContext?.role,
+                });
+                await assertClaudeSettingSourcesHaveLiteralSandboxPaths(projectPath, [...settingSources], managedSettings);
+                const sandboxProjectionDurationMs = Date.now() - sandboxProjectionStartedAt;
+                if (sandboxProjectionDurationMs > 2_000) {
+                    throw new Error(`[ClaudeSandbox] protected filesystem projection exceeded 2000ms: ${sandboxProjectionDurationMs}ms`);
+                }
+                logger.info(`[ClaudeSandbox] projection ready denyRead=${sandboxFilesystem.denyRead.length} ` +
+                    `denyWrite=${sandboxFilesystem.denyWrite.length} durationMs=${sandboxProjectionDurationMs}`);
+                return {
+                    enabled: true,
+                    failIfUnavailable: shouldFailIfClaudeSandboxUnavailable(),
+                    allowUnsandboxedCommands: true,
+                    network: {
+                        allowUnixSockets: sandboxUnixSockets,
+                        allowAllUnixSockets: false,
+                        allowLocalBinding: false,
+                    },
+                    filesystem: sandboxFilesystem,
+                };
+            })();
+        if (executionSandbox.state === 'off') {
+            logger.info('[ClaudeSandbox] disabled for authenticated owner bypass task');
+        }
+        const commonOptions = {
+            cwd: projectPath,
+            model: sdkModel,
+            ...capabilityOptions,
+            strictMcpConfig: false,
+            managedSettings,
+            ...(callEffort ? { effort: callEffort } : {}),
+            ...(this.claudeExecutablePath ? { pathToClaudeCodeExecutable: this.claudeExecutablePath } : {}),
+            autoCompactWindow: autoCompactWindowForModel(sdkModel),
+            advisorModel: 'haiku',
+            canUseTool: canUseToolCallback,
+            permissionMode: sdkPermissionMode,
+            sandbox: sandboxOptions,
+            persistSession: true,
+            includePartialMessages: true,
+            enableFileCheckpointing: true,
+            hooks: {
+                PreCompact: [{ matcher: '.*', hooks: [preCompactHook] }],
+                PreToolUse: [{ matcher: '.*', hooks: [preToolUseHook] }],
+                PermissionDenied: [{ matcher: '.*', hooks: [permissionDeniedHook] }]
+            },
+            ...(enableSummaries ? { agentProgressSummaries: true } : {}),
+            stderr: (msg) => {
+                const trimmed = msg.trim();
+                if (trimmed) {
+                    // 环形缓冲：保留最近 N 行，供子进程崩溃时还原真实原因
+                    let buf = this.recentStderr.get(sessionId);
+                    if (!buf) {
+                        buf = [];
+                        this.recentStderr.set(sessionId, buf);
+                    }
+                    buf.push(trimmed);
+                    if (buf.length > AgentRunner.STDERR_BUFFER_MAX)
+                        buf.shift();
+                }
+                if (msg.includes('[ERROR]') || msg.includes('[WARN]') || msg.includes('Stream started')) {
+                    logger.info(`[Claude-stderr] ${trimmed}`);
+                }
+                else {
+                    logger.debug(`[Claude-stderr] ${trimmed}`);
+                }
+            },
+            env: this.getAgentEnv(runtimeEnv, sessionId)
+        };
+        const createQuery = (promptInput, resumeSessionId, resumeAt) => {
+            if (useSettingSources) {
+                return query({
+                    prompt: promptInput,
+                    options: {
+                        ...commonOptions,
+                        ...(!resumeSessionId && callSessionTitle ? { title: callSessionTitle } : {}),
+                        settingSources: [...settingSources],
+                        systemPrompt: {
+                            type: 'preset',
+                            preset: 'claude_code',
+                            ...(excludeDynamic ? { excludeDynamicSections: true } : {}),
+                            ...(systemPromptAppend ? { append: systemPromptAppend } : {})
+                        },
+                        ...(resumeSessionId ? { resume: resumeSessionId } : {}),
+                        ...(resumeAt ? { resumeSessionAt: resumeAt } : {}),
+                    }
+                });
+            }
+            else {
+                const globalClaudeMd = (() => {
+                    try {
+                        const globalPath = path.join(os.homedir(), '.claude', 'CLAUDE.md');
+                        if (fs.existsSync(globalPath)) {
+                            return fs.readFileSync(globalPath, 'utf-8').trim();
+                        }
+                    }
+                    catch { }
+                    return '';
+                })();
+                const projectClaudeMds = [
+                    path.join(projectPath, 'CLAUDE.md'),
+                    path.join(projectPath, '.claude', 'CLAUDE.md'),
+                ].map(p => {
+                    try {
+                        return fs.existsSync(p) ? fs.readFileSync(p, 'utf-8').trim() : '';
+                    }
+                    catch {
+                        return '';
+                    }
+                }).filter(Boolean);
+                const fullAppend = [
+                    ...projectClaudeMds,
+                    globalClaudeMd,
+                    systemPromptAppend,
+                ].filter(Boolean).join('\n\n');
+                return query({
+                    prompt: promptInput,
+                    options: {
+                        ...commonOptions,
+                        ...(!resumeSessionId && callSessionTitle ? { title: callSessionTitle } : {}),
+                        settingSources: [],
+                        ...(resumeSessionId ? { resume: resumeSessionId } : {}),
+                        ...(resumeAt ? { resumeSessionAt: resumeAt } : {}),
+                        ...(fullAppend ? {
+                            systemPrompt: {
+                                type: 'preset',
+                                preset: 'claude_code',
+                                append: fullAppend
+                            }
+                        } : {}),
+                    }
+                });
+            }
+        };
+        // 检查待处理的 resumeAt（由 /rewind N chat 设置）
+        let resumeAt;
+        if (sessionManager && agentSessionId) {
+            try {
+                const currentSession = await sessionManager.getSessionById?.(sessionId);
+                if (currentSession?.metadata?.resumeAt) {
+                    resumeAt = currentSession.metadata.resumeAt;
+                    const newMeta = { ...currentSession.metadata };
+                    delete newMeta.resumeAt;
+                    await sessionManager.updateSession(sessionId, { metadata: newMeta });
+                    logger.info(`[AgentRunner] Consuming resumeAt: ${resumeAt}`);
+                }
+            }
+            catch (err) {
+                logger.warn('[AgentRunner] Failed to check resumeAt:', err);
+            }
+        }
+        let sdkStream;
+        const msgStream = new MessageStream();
+        const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
+        if (images && images.length > 0) {
+            logger.info('[AgentRunner] Creating query with images:', images.length, 'first image size:', images[0]?.data?.length ?? 0);
+            logger.debug('[AgentRunner] Skipping resume for image message to avoid history conflict');
+            msgStream.push(prompt, images, inputId);
+            msgStream.end();
+            sdkStream = createQuery(msgStream);
+        }
+        else {
+            logger.debug('[AgentRunner] Creating query with text only, agentSessionId:', initialClaudeSessionId);
+            msgStream.push(prompt, undefined, inputId);
+            sdkStream = createQuery(msgStream, agentSessionId, resumeAt);
+        }
+        this.activeMessageStreams.set(sessionId, msgStream);
+        this.activeQueries.set(sessionId, sdkStream);
+        const donePromise = new Promise(resolve => this.streamDoneResolvers.set(sessionId, resolve));
+        this.streamDone.set(sessionId, donePromise);
+        // 保存 interrupt 能力（不写 activeStreams，由 registerStream 管理活跃状态）
+        if ('interrupt' in sdkStream && typeof sdkStream.interrupt === 'function') {
+            this.interruptFns.set(sessionId, () => sdkStream.interrupt());
+        }
+        // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel);
+        const self = this;
+        return (async function* () {
+            try {
+                yield* transformed;
+            }
+            finally {
+                self.streamDoneResolvers.get(sessionId)?.();
+                self.streamDoneResolvers.delete(sessionId);
+                self.streamDone.delete(sessionId);
+                self.activeQueries.delete(sessionId);
+            }
+        })();
+    }
+    async interrupt(sessionId) {
+        const fn = this.interruptFns.get(sessionId);
+        const query = this.activeQueries.get(sessionId);
+        const cancelledInputIds = [];
+        let stillQueued;
+        if (fn) {
+            try {
+                const receipt = await fn();
+                stillQueued = Array.isArray(receipt?.still_queued) ? receipt.still_queued.filter((id) => typeof id === 'string') : undefined;
+                if (stillQueued && query && typeof query.cancelAsyncMessage === 'function') {
+                    for (const inputId of stillQueued) {
+                        try {
+                            if (await query.cancelAsyncMessage(inputId))
+                                cancelledInputIds.push(inputId);
+                        }
+                        catch (error) {
+                            logger.debug(`[AgentRunner] Failed to cancel queued input ${inputId}: ${error}`);
+                        }
+                    }
+                }
+                logger.info(`[AgentRunner] Interrupted session: ${sessionId}`);
+            }
+            catch (error) {
+                logger.warn(`[AgentRunner] Interrupt failed (transport closed): ${sessionId}`);
+            }
+        }
+        this.activeMessageStreams.get(sessionId)?.end();
+        if (query && typeof query.close === 'function')
+            query.close();
+        const done = this.streamDone.get(sessionId);
+        if (done) {
+            await Promise.race([done, new Promise(resolve => setTimeout(resolve, 5_000))]);
+        }
+        this.interruptFns.delete(sessionId);
+        this.activeStreams.delete(sessionId);
+        return { stillQueued, cancelledInputIds, closed: true };
+    }
+    hasActiveStream(sessionId) {
+        return this.activeStreams.has(sessionId);
+    }
+    registerStream(key, stream) {
+        this.activeStreams.set(key, stream);
+    }
+    cleanupStream(sessionId) {
+        this.activeMessageStreams.get(sessionId)?.end();
+        this.activeMessageStreams.delete(sessionId);
+        this.activeStreams.delete(sessionId);
+        this.interruptFns.delete(sessionId);
+        this.activeQueries.delete(sessionId);
+        this.recentStderr.delete(sessionId);
+    }
+    injectUserMessage(sessionId, text) {
+        this.activeMessageStreams.get(sessionId)?.push(text);
+    }
+    updateSessionId(sessionId, agentSessionId) {
+        logger.info(`[AgentRunner] updateSessionId called: sessionId=${sessionId}, agentSessionId=${agentSessionId}`);
+        this.activeSessions.set(sessionId, agentSessionId);
+        if (this.onSessionIdUpdate) {
+            this.onSessionIdUpdate(sessionId, agentSessionId);
+        }
+    }
+    runSessionCommand(prompt, agentSessionId, projectPath) {
+        return query({
+            prompt,
+            options: {
+                cwd: projectPath,
+                model: resolveSdkModel(this.model, this.baseUrl),
+                resume: agentSessionId,
+                maxTurns: 1,
+                tools: [],
+                skills: [],
+                mcpServers: {},
+                strictMcpConfig: true,
+                settingSources: [],
+                managedSettings: buildClaudeManagedLockdownSettings(),
+                permissionMode: this.toSdkPermissionMode(),
+                env: this.getAgentEnv()
+            }
+        });
+    }
+    /**
+     * 主动压缩会话上下文
+     */
+    async compactSession(sessionId, agentSessionId, projectPath) {
+        try {
+            logger.info(`[AgentRunner] Compacting session: ${agentSessionId}`);
+            const stream = this.runSessionCommand('/compact', agentSessionId, projectPath);
+            this.activeStreams.set(sessionId, stream);
+            try {
+                let receivedBoundary = false;
+                for await (const event of stream) {
+                    if (event.type === 'system' && event.subtype === 'compact_boundary') {
+                        logger.info(`[AgentRunner] Compact completed, pre_tokens: ${event.compact_metadata?.pre_tokens}`);
+                        receivedBoundary = true;
+                    }
+                }
+                if (!receivedBoundary) {
+                    logger.warn(`[AgentRunner] Compact stream ended without compact_boundary event`);
+                }
+                return receivedBoundary;
+            }
+            finally {
+                this.activeStreams.delete(sessionId);
+            }
+        }
+        catch (error) {
+            logger.error('[AgentRunner] Compact failed:', error);
+            return false;
+        }
+    }
+    /**
+     * 通过 SDK /clear 命令清空会话历史
+     */
+    async clearSession(sessionId, agentSessionId, projectPath) {
+        try {
+            logger.info(`[AgentRunner] Clearing session via SDK: ${agentSessionId}`);
+            const stream = this.runSessionCommand('/clear', agentSessionId, projectPath);
+            this.activeStreams.set(sessionId, stream);
+            try {
+                let cleared = false;
+                for await (const event of stream) {
+                    logger.debug(`[AgentRunner] Clear event: type=${event.type}, subtype=${event.subtype || 'none'}`);
+                    if (event.session_id && event.session_id !== agentSessionId) {
+                        cleared = true;
+                    }
+                }
+                if (cleared) {
+                    this.activeSessions.delete(sessionId);
+                    this.onSessionIdUpdate?.(sessionId, '');
+                }
+                else {
+                    logger.warn('[AgentRunner] Clear stream ended without session reset signal');
+                }
+                return cleared;
+            }
+            finally {
+                this.activeStreams.delete(sessionId);
+            }
+        }
+        catch (error) {
+            logger.error('[AgentRunner] Clear session failed:', error);
+            return false;
+        }
+    }
+    async closeSession(sessionId) {
+        const query = this.activeQueries.get(sessionId);
+        if (query && typeof query.close === 'function')
+            query.close();
+        this.activeSessions.delete(sessionId);
+        this.activeStreams.delete(sessionId);
+        this.interruptFns.delete(sessionId);
+        this.activeQueries.delete(sessionId);
+        this.permissionContexts.delete(sessionId);
+    }
+    resolveSessionFile(agentSessionId, projectPath) {
+        const encodedProjectPath = encodePath(projectPath);
+        const sessionFile = path.join(os.homedir(), '.claude', 'projects', encodedProjectPath, `${agentSessionId}.jsonl`);
+        return fs.existsSync(sessionFile) ? sessionFile : null;
+    }
+    async forkSession(agentSessionId, projectPath, title) {
+        const result = await sdkForkSession(agentSessionId, { dir: projectPath, title });
+        return result.sessionId;
+    }
+    async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title) {
+        const result = await sdkForkSession(agentSessionId, {
+            dir: projectPath,
+            upToMessageId: assistantMessageId,
+            title,
+        });
+        return result.sessionId;
+    }
+    async getSessionMessages(agentSessionId, projectPath) {
+        return sdkGetSessionMessages(agentSessionId, { dir: projectPath });
+    }
+    async rewindFiles(agentSessionId, projectPath, userMessageId) {
+        logger.info(`[RewindFiles] agentSessionId=${agentSessionId} userMessageId=${userMessageId}`);
+        const stderrChunks = [];
+        const tempQuery = query({
+            prompt: '',
+            options: {
+                cwd: projectPath,
+                resume: agentSessionId,
+                enableFileCheckpointing: true,
+                tools: [],
+                skills: [],
+                mcpServers: {},
+                strictMcpConfig: true,
+                settingSources: [],
+                managedSettings: buildClaudeManagedLockdownSettings(),
+                permissionMode: this.toSdkPermissionMode(),
+                stderr: (data) => { stderrChunks.push(data); },
+                env: this.getAgentEnv(),
+            }
+        });
+        try {
+            for await (const _msg of tempQuery) {
+                const dryResult = await tempQuery.rewindFiles(userMessageId, { dryRun: true });
+                logger.info('[RewindFiles] dryRun result:', JSON.stringify(dryResult));
+                if (!dryResult.canRewind)
+                    return dryResult;
+                const result = await tempQuery.rewindFiles(userMessageId);
+                logger.info('[RewindFiles] rewind result:', JSON.stringify(result));
+                return {
+                    ...result,
+                    filesChanged: dryResult.filesChanged ?? result.filesChanged,
+                    insertions: dryResult.insertions ?? result.insertions,
+                    deletions: dryResult.deletions ?? result.deletions,
+                };
+            }
+            throw new Error('Query stream ended before rewindFiles could be called');
+        }
+        catch (error) {
+            if (stderrChunks.length > 0) {
+                logger.error('[RewindFiles] subprocess stderr:', stderrChunks.join(''));
+            }
+            throw error;
+        }
+        finally {
+            tempQuery.close();
+        }
+    }
+}
+function usesUnattendedInteractions(context) {
+    return context?.approvalInteractionPolicy === 'deny';
+}
+// Plugin implementation
+export class ClaudeAgentPlugin {
+    name = 'claude';
+    isEnabled(agent) {
+        return !!agent.config.baseagents?.claude;
+    }
+    createAgent(agent, callbacks) {
+        const override = agent.config.baseagents?.claude;
+        const syntheticConfig = { agents: { claude: override } };
+        const anthropic = resolveAnthropicConfig(syntheticConfig, override);
+        const merged = {
+            agents: { claude: { ...(override || {}), evolcoreAgentAid: agent.aid, evolcoreAgentConfig: agent.config } },
+        };
+        const agentRunner = new AgentRunner(anthropic.apiKey, anthropic.model, callbacks.onSessionIdUpdate, anthropic.baseUrl, merged);
+        if (anthropic.effort) {
+            agentRunner.setEffort(anthropic.effort);
+        }
+        return { evolagentName: agent.name, baseagent: 'claude', agent: agentRunner };
+    }
+}