evolcore 0.0.1 → 0.0.3

package/dist/agents/codex-runner.js

@@ -0,0 +1,2682 @@
+/**
+ * Codex Agent Runner
+ *
+ * Integrates Codex app-server as an agent backend.
+ * Implements the same interface surface as AgentRunner (claude-runner.ts)
+ * so MessageProcessor and CommandHandler can work with it transparently.
+ */
+import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
+import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
+import { normalizePermissionMode } from '../core/permission/mode.js';
+import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
+import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/protected-paths.js';
+import { CodexAppServerClient } from './codex-app-server-client.js';
+import { resolveOpenaiConfig } from './baseagent.js';
+import { logger } from '../utils/logger.js';
+import { isRetryableError } from '../utils/error-utils.js';
+import { renderActionAsText } from '../core/interaction-router.js';
+import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
+import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
+import { compareVersions } from '../utils/npm-ops.js';
+import { resolvePaths, resolveRoot } from '../paths.js';
+import { buildSessionTurnList } from '../core/session/session-turns.js';
+import { execFileSync } from 'child_process';
+import { createHash, randomBytes } from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+// ── MIME → 扩展名映射 ──
+const MIME_EXT = {
+    'image/png': '.png',
+    'image/jpeg': '.jpg',
+    'image/gif': '.gif',
+    'image/webp': '.webp',
+};
+class AsyncEventQueue {
+    queue = [];
+    done = false;
+    error = null;
+    waiting = null;
+    push(item) {
+        if (this.done)
+            return;
+        this.queue.push(item);
+        this.waiting?.();
+    }
+    end() {
+        this.done = true;
+        this.waiting?.();
+    }
+    fail(error) {
+        this.error = error;
+        this.done = true;
+        this.waiting?.();
+    }
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            while (this.queue.length > 0) {
+                yield this.queue.shift();
+            }
+            if (this.error)
+                throw this.error;
+            if (this.done)
+                return;
+            await new Promise((resolve) => {
+                this.waiting = resolve;
+            });
+            this.waiting = null;
+        }
+    }
+}
+const managedTempDirsForExitCleanup = new Map();
+let managedTempExitCleanupRegistered = false;
+function registerManagedTempDirForExitCleanup(directory, parent) {
+    managedTempDirsForExitCleanup.set(directory, parent);
+    if (managedTempExitCleanupRegistered)
+        return;
+    managedTempExitCleanupRegistered = true;
+    process.once('exit', () => {
+        for (const [candidatePath, parentPath] of managedTempDirsForExitCleanup) {
+            try {
+                const parentCandidate = resolveProtectedCandidate(parentPath);
+                const candidate = resolveProtectedCandidate(candidatePath);
+                if (candidate !== parentCandidate && isSameOrDescendant(candidate, parentCandidate)) {
+                    fs.rmSync(candidate, { recursive: true, force: true });
+                }
+            }
+            catch {
+                // Process exit cleanup is best effort; session cleanup logs failures
+                // while the runner is still active.
+            }
+        }
+    });
+}
+function stableSecurityValue(value) {
+    if (value === undefined)
+        return 'undefined';
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? String(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableSecurityValue).join(',')}]`;
+    const record = value;
+    return `{${Object.keys(record).sort().map(key => `${JSON.stringify(key)}:${stableSecurityValue(record[key])}`).join(',')}}`;
+}
+function externalToolConfigFingerprint(config) {
+    return createHash('sha256').update(stableSecurityValue(config)).digest('hex');
+}
+const CODEX_CATALOG_FALLBACK = [
+    { slug: 'gpt-5.5', efforts: ['low', 'medium', 'high', 'xhigh'] },
+    { slug: 'gpt-5.4', efforts: ['low', 'medium', 'high', 'xhigh'] },
+    { slug: 'gpt-5.4-mini', efforts: ['low', 'medium', 'high', 'xhigh'] },
+    { slug: 'gpt-5.3-codex', efforts: ['low', 'medium', 'high', 'xhigh'] },
+    { slug: 'gpt-5.2', efforts: ['low', 'medium', 'high', 'xhigh'] },
+];
+let codexCatalogCache = null;
+// The permission bridge is version-locked to the v2 schema audited below:
+// named profiles, approvalsReviewer, additional/network approval context, and
+// item/permissions/requestApproval must all be present together.
+export const MIN_CODEX_CLI_VERSION = '0.144.1';
+export function parseCodexCliVersion(output) {
+    const match = output.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/);
+    return match?.[1] ?? null;
+}
+export function isCodexCliVersionSupported(version) {
+    return compareVersions(version, MIN_CODEX_CLI_VERSION) >= 0;
+}
+export function getCodexCliVersion() {
+    try {
+        const output = execFileSync('codex', ['--version'], {
+            encoding: 'utf-8',
+            timeout: 3000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return parseCodexCliVersion(output);
+    }
+    catch {
+        return null;
+    }
+}
+export function getCodexAppServerAvailability() {
+    const version = getCodexCliVersion();
+    const upgradeHint = '请升级 Codex CLI：npm install -g @openai/codex@latest';
+    if (!version) {
+        return { available: false, reason: `未检测到可用 Codex CLI。${upgradeHint}` };
+    }
+    if (!isCodexCliVersionSupported(version)) {
+        return {
+            available: false,
+            version,
+            reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。${upgradeHint}`,
+        };
+    }
+    try {
+        execFileSync('codex', ['app-server', '--help'], {
+            encoding: 'utf-8',
+            timeout: 3000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return { available: true, version };
+    }
+    catch {
+        return { available: false, version, reason: `Codex CLI ${version} 不支持 app-server。${upgradeHint}` };
+    }
+}
+export function isCodexAppServerAvailable() {
+    return getCodexAppServerAvailability().available;
+}
+function fetchCodexCatalog() {
+    if (codexCatalogCache)
+        return codexCatalogCache;
+    try {
+        const output = execFileSync('codex', ['debug', 'models'], {
+            encoding: 'utf-8',
+            timeout: 5000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const catalog = JSON.parse(output);
+        const models = catalog.models
+            .filter(m => m.visibility === 'list')
+            .map(m => ({
+            slug: m.slug,
+            efforts: (m.supported_reasoning_levels || []).map(l => l.effort),
+        }));
+        if (models.length > 0) {
+            codexCatalogCache = models;
+            return models;
+        }
+    }
+    catch (e) {
+        logger.debug(`[CodexRunner] Failed to fetch model catalog, using fallback: ${e}`);
+    }
+    return CODEX_CATALOG_FALLBACK;
+}
+export function getCodexEfforts(model) {
+    const catalog = fetchCodexCatalog();
+    const entry = catalog.find(m => m.slug === model);
+    return entry?.efforts ?? catalog[0]?.efforts ?? ['low', 'medium', 'high'];
+}
+// ── Codex Runner ──
+export class CodexRunner {
+    name = 'codex';
+    capabilities;
+    model;
+    effort;
+    activeAbortControllers = new Map();
+    activeStreams = new Map();
+    activeSessions = new Map(); // sessionId → threadId
+    activeTurns = new Map();
+    threadProjectPaths = new Map();
+    sessionTempDirs = new Map();
+    managedTempNonce = randomBytes(16).toString('hex');
+    threadExternalToolFingerprints = new Map();
+    threadExternalToolBoundaries = new Map();
+    trackedApprovalItems = new Map();
+    pendingInterrupts = new Map();
+    appServerClient = null;
+    onSessionIdUpdate;
+    onCompactStart;
+    permissionGateway;
+    sendPromptFn;
+    permissionContexts = new Map();
+    resolvedConfig;
+    pendingInterruptTtlMs = 30_000;
+    constructor(config, callbacks) {
+        this.resolvedConfig = resolveOpenaiConfig(config);
+        this.resolvedConfig.evolcoreAgentAid = config.agents?.codex?.evolcoreAgentAid;
+        this.resolvedConfig.evolcoreAgentConfig = config.agents?.codex?.evolcoreAgentConfig;
+        this.capabilities = {
+            clear: false,
+            compact: true,
+            fork: true,
+            forkAtTurn: true,
+            // Requires Codex CLI feature flag: default_mode_request_user_input.
+            askUserQuestion: this.resolvedConfig.enableRequestUserInput === true,
+            // Codex app-server exposes plan streaming, but not Claude-style ExitPlanMode approval.
+            planApproval: false,
+            // Current file rewind is intentionally degraded: it restores touched files from Git HEAD.
+            fileRewind: 'git-head',
+        };
+        this.model = this.resolvedConfig.model;
+        if (this.resolvedConfig.effort)
+            this.effort = this.resolvedConfig.effort;
+        this.onSessionIdUpdate = callbacks.onSessionIdUpdate;
+    }
+    getAppServerClient() {
+        if (!this.appServerClient) {
+            const client = new CodexAppServerClient({
+                apiKey: this.resolvedConfig.apiKey,
+                baseUrl: this.resolvedConfig.baseUrl,
+                model: this.model,
+                effort: this.effort,
+                enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,
+                approvalsReviewer: 'user',
+                onServerRequest: request => this.handleAppServerRequest(request),
+            });
+            client.onNotification(notification => this.trackApprovalItemNotification(notification));
+            this.appServerClient = client;
+        }
+        return this.appServerClient;
+    }
+    resetAppServerClient() {
+        const client = this.appServerClient;
+        this.appServerClient = null;
+        this.threadExternalToolFingerprints.clear();
+        this.threadExternalToolBoundaries.clear();
+        this.trackedApprovalItems.clear();
+        client?.close().catch(error => {
+            logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
+        });
+    }
+    mergeThreadConfig(...configs) {
+        const merged = {};
+        for (const config of configs) {
+            if (!config)
+                continue;
+            for (const [key, value] of Object.entries(config)) {
+                const current = merged[key];
+                if (value
+                    && typeof value === 'object'
+                    && !Array.isArray(value)
+                    && current
+                    && typeof current === 'object'
+                    && !Array.isArray(current)) {
+                    merged[key] = this.mergeThreadConfig(current, value) ?? {};
+                }
+                else {
+                    merged[key] = value;
+                }
+            }
+        }
+        return Object.keys(merged).length > 0 ? merged : null;
+    }
+    async resolveCapabilityThreadConfig(projectPath) {
+        const agentConfig = this.resolvedConfig.evolcoreAgentConfig;
+        if (!agentConfig)
+            return {};
+        try {
+            return await resolveCodexCapabilityThreadConfigForProject(agentConfig, projectPath, 'codex');
+        }
+        catch (error) {
+            logger.warn(`[CodexRunner] Failed to resolve Codex capability thread config: ${error}`);
+            return {};
+        }
+    }
+    configRecord(value) {
+        return value && typeof value === 'object' && !Array.isArray(value)
+            ? value
+            : undefined;
+    }
+    projectConfigKeys(source, aliases) {
+        const result = {};
+        for (const [inputKey, outputKey] of Object.entries(aliases)) {
+            const value = source[inputKey];
+            if (value !== undefined && value !== null && result[outputKey] === undefined)
+                result[outputKey] = value;
+        }
+        return result;
+    }
+    projectMcpServerConfig(entry) {
+        const projected = this.projectConfigKeys(entry, {
+            command: 'command',
+            args: 'args',
+            env: 'env',
+            env_vars: 'env_vars',
+            envVars: 'env_vars',
+            cwd: 'cwd',
+            url: 'url',
+            serverUrl: 'url',
+            bearer_token_env_var: 'bearer_token_env_var',
+            bearerTokenEnvVar: 'bearer_token_env_var',
+            http_headers: 'http_headers',
+            httpHeaders: 'http_headers',
+            env_http_headers: 'env_http_headers',
+            envHttpHeaders: 'env_http_headers',
+            startup_timeout_sec: 'startup_timeout_sec',
+            startupTimeoutSec: 'startup_timeout_sec',
+            startup_timeout_ms: 'startup_timeout_ms',
+            startupTimeoutMs: 'startup_timeout_ms',
+            tool_timeout_sec: 'tool_timeout_sec',
+            toolTimeoutSec: 'tool_timeout_sec',
+            enabled: 'enabled',
+            required: 'required',
+            enabled_tools: 'enabled_tools',
+            enabledTools: 'enabled_tools',
+            disabled_tools: 'disabled_tools',
+            disabledTools: 'disabled_tools',
+            scopes: 'scopes',
+            auth: 'auth',
+            oauth_resource: 'oauth_resource',
+            oauthResource: 'oauth_resource',
+            experimental_environment: 'experimental_environment',
+            experimentalEnvironment: 'experimental_environment',
+            default_tools_approval_mode: 'default_tools_approval_mode',
+            defaultToolsApprovalMode: 'default_tools_approval_mode',
+            tools: 'tools',
+        });
+        const tools = this.configRecord(projected.tools);
+        if (tools) {
+            projected.tools = Object.fromEntries(Object.entries(tools).map(([tool, config]) => [tool, {
+                    ...this.projectConfigKeys(this.configRecord(config) ?? {}, {
+                        enabled: 'enabled',
+                        approval_mode: 'approval_mode',
+                        approvalMode: 'approval_mode',
+                    }),
+                }]));
+        }
+        return projected;
+    }
+    projectAppConfig(entry) {
+        const projected = this.projectConfigKeys(entry, {
+            enabled: 'enabled',
+            approvals_reviewer: 'approvals_reviewer',
+            approvalsReviewer: 'approvals_reviewer',
+            destructive_enabled: 'destructive_enabled',
+            destructiveEnabled: 'destructive_enabled',
+            open_world_enabled: 'open_world_enabled',
+            openWorldEnabled: 'open_world_enabled',
+            default_tools_approval_mode: 'default_tools_approval_mode',
+            defaultToolsApprovalMode: 'default_tools_approval_mode',
+            default_tools_enabled: 'default_tools_enabled',
+            defaultToolsEnabled: 'default_tools_enabled',
+            tools: 'tools',
+        });
+        const tools = this.configRecord(projected.tools);
+        if (tools) {
+            projected.tools = Object.fromEntries(Object.entries(tools).map(([tool, config]) => [tool, {
+                    ...this.projectConfigKeys(this.configRecord(config) ?? {}, {
+                        enabled: 'enabled',
+                        approval_mode: 'approval_mode',
+                        approvalMode: 'approval_mode',
+                    }),
+                }]));
+        }
+        return projected;
+    }
+    externalToolApprovalPolicy(entry, approvalMode, includeReviewer = false) {
+        const tools = this.configRecord(entry?.tools);
+        return {
+            ...(entry ?? {}),
+            ...(includeReviewer ? { approvals_reviewer: 'user' } : {}),
+            default_tools_approval_mode: approvalMode,
+            ...(tools && Object.keys(tools).length > 0 ? {
+                tools: Object.fromEntries(Object.entries(tools).map(([tool, config]) => [tool, {
+                        ...(this.configRecord(config) ?? {}),
+                        approval_mode: approvalMode,
+                    }])),
+            } : {}),
+        };
+    }
+    buildExternalToolApprovalConfig(effectiveConfig, capabilityConfig, mode = 'readonly') {
+        const sources = [effectiveConfig, capabilityConfig];
+        const result = {};
+        const allowMcpTools = mode !== 'readonly';
+        const allowApps = mode === 'request' || mode === 'bypass';
+        const mcpApprovalMode = allowMcpTools ? 'approve' : 'prompt';
+        const appApprovalMode = allowApps ? 'approve' : 'prompt';
+        const mcpSections = sources.map(source => this.configRecord(source.mcp_servers)).filter(Boolean);
+        const mcpIds = new Set(mcpSections.flatMap(section => Object.keys(section)));
+        if (mcpIds.size > 0) {
+            const mcpOverrides = {};
+            for (const id of mcpIds) {
+                const mergedEntry = this.mergeThreadConfig(...mcpSections.map(section => this.configRecord(section[id]))) ?? {};
+                const entry = this.projectMcpServerConfig(mergedEntry);
+                mcpOverrides[id] = this.externalToolApprovalPolicy(entry, mcpApprovalMode);
+            }
+            result.mcp_servers = mcpOverrides;
+        }
+        const appSections = sources.map(source => this.configRecord(source.apps)).filter(Boolean);
+        const appIds = new Set(appSections.flatMap(section => Object.keys(section)).filter(id => id !== '_default'));
+        const appDefault = this.projectAppConfig(this.mergeThreadConfig(...appSections.map(section => this.configRecord(section._default))) ?? {});
+        const appOverrides = {
+            _default: this.externalToolApprovalPolicy(allowApps && appDefault.enabled === true
+                ? appDefault
+                : { ...appDefault, enabled: false }, appApprovalMode, true),
+        };
+        for (const id of appIds) {
+            const entry = this.projectAppConfig(this.mergeThreadConfig(...appSections.map(section => this.configRecord(section[id]))) ?? {});
+            appOverrides[id] = this.externalToolApprovalPolicy(allowApps ? entry : { ...entry, enabled: false }, appApprovalMode, true);
+        }
+        result.apps = appOverrides;
+        return result;
+    }
+    bindExternalToolBoundary(threadId, config) {
+        const deniedMcpServers = new Set();
+        const deniedApps = new Set();
+        const allowedApps = new Set();
+        const mcpServers = this.configRecord(config.mcp_servers) ?? {};
+        for (const [serverId, rawEntry] of Object.entries(mcpServers)) {
+            const entry = this.configRecord(rawEntry);
+            if (entry?.enabled === false)
+                deniedMcpServers.add(serverId);
+        }
+        const apps = this.configRecord(config.apps) ?? {};
+        for (const [appId, rawEntry] of Object.entries(apps)) {
+            if (appId === '_default')
+                continue;
+            const entry = this.configRecord(rawEntry);
+            if (entry?.enabled === false)
+                deniedApps.add(appId);
+            else
+                allowedApps.add(appId);
+        }
+        const appDefault = this.configRecord(apps._default);
+        this.threadExternalToolFingerprints.set(threadId, externalToolConfigFingerprint(config));
+        this.threadExternalToolBoundaries.set(threadId, {
+            deniedMcpServers,
+            deniedApps,
+            allowedApps,
+            allowAnyApp: appDefault?.enabled === true,
+        });
+    }
+    unbindExternalToolBoundary(threadId) {
+        if (!threadId)
+            return;
+        this.threadExternalToolFingerprints.delete(threadId);
+        this.threadExternalToolBoundaries.delete(threadId);
+    }
+    async resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, mode = 'readonly') {
+        const configRead = appServer.configRead;
+        if (typeof configRead !== 'function') {
+            return this.buildExternalToolApprovalConfig({}, capabilityConfig, mode);
+        }
+        try {
+            const response = await configRead.call(appServer, projectPath);
+            const effectiveConfig = this.configRecord(response?.config) ?? {};
+            return this.buildExternalToolApprovalConfig(effectiveConfig, capabilityConfig, mode);
+        }
+        catch (error) {
+            logger.warn(`[CodexRunner] config/read failed; preserving inherited MCP defaults: ${error}`);
+            return this.buildExternalToolApprovalConfig({}, capabilityConfig, mode);
+        }
+    }
+    // ── ModelSwitcher ──
+    setModel(model) { this.model = model; this.resetAppServerClient(); }
+    getModel() { return this.model; }
+    async listModels() {
+        try {
+            const response = await this.getAppServerClient().modelList(false);
+            const ids = (response.data ?? [])
+                .map(model => model.id || model.slug || model.name || model.model)
+                .filter((id) => typeof id === 'string' && id.length > 0);
+            if (ids.length > 0)
+                return ids;
+        }
+        catch (error) {
+            logger.debug(`[CodexRunner] app-server model/list failed, using catalog fallback: ${error}`);
+        }
+        return fetchCodexCatalog().map(m => m.slug);
+    }
+    // ── Effort ──
+    setEffort(effort) { this.effort = effort; this.resetAppServerClient(); }
+    getEffort() { return this.effort; }
+    // ── Permission ──
+    currentMode = 'readonly';
+    // per-call/per-session 权限模式：runQuery 按本次解析结果写入，审批回调（异步、按 sessionKey 路由）据此判定。
+    // 避免多会话共享 this.currentMode 时的并发污染（与 claude-runner 的 per-call permissionMode 同构）。
+    chatModes = new Map();
+    /** 将权限模式映射为 Codex app-server 的 approvalPolicy（纯函数，无副作用，供 per-call 派生用）。 */
+    toApprovalPolicy(mode) {
+        // `untrusted` guarantees that commands outside Codex's trusted read-only
+        // set reach the EvolCore bridge for EvolCore's per-mode decision.
+        void mode;
+        return 'untrusted';
+    }
+    permissionProfileName(sessionId) {
+        const normalized = sessionId.replace(/[^A-Za-z0-9_-]/g, '_');
+        if (normalized && normalized === sessionId && normalized.length <= 64) {
+            return `__evolcore_${normalized}_hclass_v1`;
+        }
+        // Sanitizing and truncating alone can collapse distinct EvolCore sessions
+        // onto one Codex profile (for example `a/b` and `a?b`). Keep a readable
+        // prefix, but bind every lossy name to the original session id with a
+        // collision-resistant suffix.
+        const label = normalized.slice(0, 40) || 'session';
+        const digest = createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
+        return `__evolcore_${label}_${digest}_hclass_v1`;
+    }
+    resolveGitMetadataWriteRules(projectPath, mode) {
+        if (mode === 'readonly')
+            return {};
+        const project = path.resolve(projectPath);
+        const marker = path.join(project, '.git');
+        const paths = new Set();
+        const looksLikeGitMetadataDirectory = (candidate) => {
+            if (path.dirname(candidate) === candidate)
+                return false;
+            return ['HEAD', 'config', 'commondir', 'gitdir'].some(name => fs.existsSync(path.join(candidate, name)));
+        };
+        const addDirectory = (candidate) => {
+            if (!candidate)
+                return;
+            try {
+                if (!fs.statSync(candidate).isDirectory())
+                    return;
+            }
+            catch {
+                return;
+            }
+            const resolved = path.resolve(candidate);
+            if (!looksLikeGitMetadataDirectory(resolved))
+                return;
+            paths.add(resolved);
+            paths.add(path.join(resolved, '**'));
+        };
+        try {
+            const stat = fs.statSync(marker);
+            if (stat.isDirectory()) {
+                addDirectory(marker);
+            }
+            else if (stat.isFile()) {
+                const match = fs.readFileSync(marker, 'utf8').match(/^gitdir:\s*(.+?)\s*$/m);
+                if (match)
+                    addDirectory(path.resolve(project, match[1]));
+            }
+        }
+        catch { }
+        for (const gitDirectory of [...paths].filter(candidate => !candidate.endsWith(`${path.sep}**`))) {
+            try {
+                const commonDirectory = fs.readFileSync(path.join(gitDirectory, 'commondir'), 'utf8').trim();
+                if (commonDirectory)
+                    addDirectory(path.resolve(gitDirectory, commonDirectory));
+            }
+            catch { }
+        }
+        return Object.fromEntries([...paths].map(candidate => [candidate, 'write']));
+    }
+    buildPermissionProfileConfig(sessionId, mode, projectPath) {
+        const profileName = this.permissionProfileName(sessionId);
+        const managedTempDir = this.ensureSessionTempDir(sessionId);
+        const network = {
+            enabled: true,
+            unix_sockets: { [resolvePaths().instanceSocket]: 'allow' },
+        };
+        return {
+            default_permissions: profileName,
+            permissions: {
+                [profileName]: {
+                    extends: mode === 'readonly' ? ':read-only' : ':workspace',
+                    filesystem: {
+                        ...buildCodexProtectedFilesystemRules(resolveRoot()),
+                        ...this.resolveGitMetadataWriteRules(projectPath, mode),
+                        ...(mode !== 'readonly' && managedTempDir ? {
+                            [managedTempDir]: 'write',
+                            [path.join(managedTempDir, '**')]: 'write',
+                        } : {}),
+                    },
+                    network,
+                },
+            },
+        };
+    }
+    buildExecutionSandboxOptions(sessionId, mode, projectPath) {
+        const decision = resolvePhaseOneExecutionSandbox(mode, this.permissionContexts.get(sessionId)?.role);
+        return {
+            decision,
+            permissionProfileConfig: decision.state === 'active'
+                ? this.buildPermissionProfileConfig(sessionId, decision.permissionMode, projectPath)
+                : undefined,
+            sandbox: decision.state === 'off' ? 'danger-full-access' : undefined,
+        };
+    }
+    buildLifecycleLockdownConfig() {
+        return {
+            features: {
+                hooks: false,
+            },
+        };
+    }
+    setMode(mode) {
+        const normalized = normalizePermissionMode(mode);
+        this.currentMode = normalized.mode;
+    }
+    getMode() { return this.currentMode; }
+    listModes() {
+        return [
+            { key: 'readonly', nameZh: '只读', description: '只读操作自动执行，写入直接拒绝', available: true },
+            { key: 'auto', nameZh: '自动', description: '常规操作自动执行，危险操作自动拒绝', available: true },
+            { key: 'request', nameZh: '审批', description: '默认能力自动执行，缺失能力进入人工审批', available: true },
+            { key: 'bypass', nameZh: '放行', description: 'owner 关闭任务沙盒，危险操作和硬边界仍受控', available: true },
+        ];
+    }
+    setSendPrompt(fn) { this.sendPromptFn = fn; }
+    setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    setPermissionGateway(gw) { this.permissionGateway = gw; }
+    // ── Stream management (needed by MessageProcessor) ──
+    registerStream(key, stream) {
+        this.activeStreams.set(key, stream);
+    }
+    cleanupStream(key) {
+        this.activeStreams.delete(key);
+        this.activeAbortControllers.delete(key);
+        this.pendingInterrupts.delete(key);
+    }
+    hasActiveStream(key) {
+        return this.activeStreams.has(key) || this.activeAbortControllers.has(key) || this.activeTurns.has(key);
+    }
+    // ── Core: runQuery ──
+    async runQuery(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
+        let agentSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        const callModel = modelOverride?.model || this.model;
+        const callEffort = modelOverride?.effort ?? this.effort;
+        // per-call 权限模式：优先 override（message-processor 解析后传入），缺省回落实例级 currentMode。
+        // 写入 chatModes 供异步审批回调按 sessionKey 读取，并据此派生本次 thread 的 approvalPolicy/sandbox，
+        // 不依赖共享的 this.approvalPolicy/this.sandboxMode（多会话并发互不污染）。
+        const requestedPermissionMode = modelOverride?.permissionMode || this.currentMode;
+        const normalizedPermission = normalizePermissionMode(requestedPermissionMode);
+        const callMode = normalizedPermission.mode;
+        this.chatModes.set(sessionId, callMode);
+        const callApprovalPolicy = this.toApprovalPolicy(callMode);
+        const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath);
+        const appServer = this.getAppServerClient();
+        this.dropExpiredPendingInterrupt(sessionId);
+        const effectiveApprovalPolicy = callApprovalPolicy;
+        const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
+        const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, callMode);
+        const managedTempInstruction = this.managedTempInstruction(sessionId);
+        const developerInstructions = [systemPromptAppend, managedTempInstruction].filter(Boolean).join('\n\n') || undefined;
+        const threadOptions = {
+            model: callModel,
+            effort: callEffort,
+            approvalPolicy: effectiveApprovalPolicy,
+            approvalsReviewer: 'user',
+            ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
+            config: this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId), this.buildLifecycleLockdownConfig()),
+            ...(developerInstructions ? { developerInstructions } : {}),
+        };
+        logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
+            `role=${executionSandbox.decision.role ?? 'none'} sandbox=${executionSandbox.decision.state}`);
+        const threadResponse = agentSessionId
+            ? await appServer.threadResume(agentSessionId, projectPath, threadOptions)
+            : await appServer.threadStart(projectPath, threadOptions);
+        const threadId = threadResponse.thread?.id || agentSessionId;
+        if (!threadId)
+            throw new Error('Codex app-server did not return a thread id');
+        agentSessionId = threadId;
+        this.activeSessions.set(sessionId, threadId);
+        this.threadProjectPaths.set(threadId, path.resolve(projectPath));
+        this.bindExternalToolBoundary(threadId, externalToolConfig);
+        this.onSessionIdUpdate?.(sessionId, threadId);
+        const controller = new AbortController();
+        this.activeAbortControllers.set(sessionId, controller);
+        const tempFiles = [];
+        const input = this.buildAppServerInput(prompt, images, tempFiles);
+        const queue = new AsyncEventQueue();
+        controller.signal.addEventListener('abort', () => queue.end(), { once: true });
+        const state = {
+            threadId,
+            model: callModel,
+            streamedAgentMessageIds: new Set(),
+            agentMessageDeltaText: new Map(),
+            completedItemIds: new Set(),
+            emittedEditCallIds: new Set(),
+            completedTurnIds: new Set(),
+            openToolCalls: new Map(),
+        };
+        const unsubscribe = appServer.onNotification(notification => {
+            // 仅从 turn/started 锁定权威 turnId — resume 时会有上一轮 turn 的残留通知
+            // （如 thread/tokenUsage/updated）先于新 turn 到达，不能用它们 latch turnId
+            const params = notification.params || {};
+            const notifThreadId = params.threadId ?? params.thread_id;
+            if (notifThreadId !== undefined && notifThreadId !== threadId)
+                return;
+            if (notification.method === 'turn/started') {
+                const startedTurnId = this.extractTurnId(notification);
+                if (startedTurnId && !state.turnId) {
+                    state.turnId = startedTurnId;
+                    this.activeTurns.set(sessionId, { threadId, turnId: startedTurnId });
+                    if (this.consumePendingInterrupt(sessionId)) {
+                        this.interruptAppServerTurn(threadId, startedTurnId).catch(() => { });
+                        this.activeTurns.delete(sessionId);
+                    }
+                }
+            }
+            if (!this.isAppServerTurnNotification(notification, state))
+                return;
+            queue.push(notification);
+            // 仅在已锁定 turnId 后才允许 turn/completed 结束队列，避免残留的旧 turn/completed 误关
+            if (notification.method === 'turn/completed' && state.turnId)
+                queue.end();
+        });
+        if (this.consumePendingInterrupt(sessionId)) {
+            controller.abort('User interrupt');
+            this.activeAbortControllers.delete(sessionId);
+            this.activeStreams.delete(sessionId);
+            logger.info(`[CodexRunner] Applied pending interrupt before turn start: ${sessionId}`);
+            return this.transformAppServerStream(queue, sessionId, state, unsubscribe, tempFiles);
+        }
+        try {
+            const turnResponse = await appServer.turnStart(threadId, input, {
+                cwd: projectPath,
+                model: callModel,
+                effort: callEffort,
+                approvalPolicy: effectiveApprovalPolicy,
+                ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
+            });
+            const turnId = turnResponse.turn?.id;
+            if (turnId && !state.turnId) {
+                state.turnId = turnId;
+                this.activeTurns.set(sessionId, { threadId, turnId });
+            }
+            if (turnId && this.consumePendingInterrupt(sessionId)) {
+                await this.interruptAppServerTurn(threadId, turnId);
+                controller.abort('User interrupt');
+                this.activeAbortControllers.delete(sessionId);
+                this.activeStreams.delete(sessionId);
+                this.activeTurns.delete(sessionId);
+            }
+            const status = turnResponse.turn?.status;
+            if (status === 'completed' || status === 'failed') {
+                queue.push({ method: 'turn/completed', params: { threadId, turn: turnResponse.turn } });
+                queue.end();
+            }
+        }
+        catch (error) {
+            unsubscribe();
+            this.activeAbortControllers.delete(sessionId);
+            this.activeTurns.delete(sessionId);
+            this.pendingInterrupts.delete(sessionId);
+            this.cleanupTempFiles(tempFiles);
+            throw error;
+        }
+        return this.transformAppServerStream(queue, sessionId, state, unsubscribe, tempFiles);
+    }
+    // ── Interrupt ──
+    async interrupt(sessionKey) {
+        const controller = this.activeAbortControllers.get(sessionKey);
+        const activeTurn = this.activeTurns.get(sessionKey);
+        const hadActiveState = !!controller || !!activeTurn || this.activeStreams.has(sessionKey);
+        const interruptTurn = activeTurn
+            ? this.interruptAppServerTurn(activeTurn.threadId, activeTurn.turnId)
+            : Promise.resolve();
+        if (!activeTurn)
+            this.rememberPendingInterrupt(sessionKey);
+        if (controller)
+            controller.abort('User interrupt');
+        if (hadActiveState) {
+            this.activeAbortControllers.delete(sessionKey);
+            this.activeStreams.delete(sessionKey);
+            this.activeTurns.delete(sessionKey);
+            logger.info(`[CodexRunner] Interrupted session: ${sessionKey}`);
+        }
+        await interruptTurn;
+    }
+    rememberPendingInterrupt(sessionId) {
+        this.pendingInterrupts.set(sessionId, Date.now());
+    }
+    consumePendingInterrupt(sessionId) {
+        if (!this.pendingInterrupts.has(sessionId))
+            return false;
+        const requestedAt = this.pendingInterrupts.get(sessionId);
+        this.pendingInterrupts.delete(sessionId);
+        return Date.now() - requestedAt <= this.pendingInterruptTtlMs;
+    }
+    dropExpiredPendingInterrupt(sessionId) {
+        const requestedAt = this.pendingInterrupts.get(sessionId);
+        if (requestedAt !== undefined && Date.now() - requestedAt > this.pendingInterruptTtlMs) {
+            this.pendingInterrupts.delete(sessionId);
+        }
+    }
+    async interruptAppServerTurn(threadId, turnId) {
+        try {
+            await this.getAppServerClient().turnInterrupt(threadId, turnId);
+        }
+        catch (error) {
+            logger.debug(`[CodexRunner] app-server turn interrupt failed: ${error}`);
+        }
+    }
+    // ── Session commands ──
+    updateSessionId(sessionId, agentSessionId) {
+        const previousThreadId = this.activeSessions.get(sessionId);
+        if (previousThreadId && previousThreadId !== agentSessionId) {
+            this.threadProjectPaths.delete(previousThreadId);
+            this.unbindExternalToolBoundary(previousThreadId);
+            this.clearTrackedApprovalItemsForThread(previousThreadId);
+        }
+        if (agentSessionId) {
+            this.activeSessions.set(sessionId, agentSessionId);
+        }
+        else {
+            this.activeSessions.delete(sessionId);
+        }
+        this.onSessionIdUpdate?.(sessionId, agentSessionId);
+    }
+    async closeSession(sessionId) {
+        const threadId = this.activeSessions.get(sessionId);
+        this.activeSessions.delete(sessionId);
+        this.activeStreams.delete(sessionId);
+        this.activeAbortControllers.delete(sessionId);
+        this.activeTurns.delete(sessionId);
+        this.pendingInterrupts.delete(sessionId);
+        this.permissionContexts.delete(sessionId);
+        this.chatModes.delete(sessionId);
+        this.cleanupSessionTempDir(sessionId);
+        if (threadId) {
+            this.threadProjectPaths.delete(threadId);
+            this.unbindExternalToolBoundary(threadId);
+        }
+        this.clearTrackedApprovalItemsForThread(threadId);
+    }
+    resolveSessionFile(agentSessionId, _projectPath) {
+        // Codex session 文件: ~/.codex/sessions/YYYY/MM/DD/rollout-*-{threadId}.jsonl
+        const sessionsDir = path.join(os.homedir(), '.codex', 'sessions');
+        if (!fs.existsSync(sessionsDir))
+            return null;
+        // 递归搜索文件名包含 threadId 的 JSONL 文件
+        const search = (dir) => {
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+                if (entry.isDirectory()) {
+                    const found = search(path.join(dir, entry.name));
+                    if (found)
+                        return found;
+                }
+                else if (entry.name.endsWith('.jsonl') && entry.name.includes(agentSessionId)) {
+                    return path.join(dir, entry.name);
+                }
+            }
+            return null;
+        };
+        return search(sessionsDir);
+    }
+    async clearSession(sessionId, _agentSessionId, _projectPath) {
+        // Codex: 清空会话 = 下次 runQuery 不传 resumeId，自动创建新 thread
+        const threadId = this.activeSessions.get(sessionId) ?? _agentSessionId;
+        this.activeSessions.delete(sessionId);
+        this.chatModes.delete(sessionId);
+        this.cleanupSessionTempDir(sessionId);
+        this.threadProjectPaths.delete(threadId);
+        this.unbindExternalToolBoundary(threadId);
+        this.clearTrackedApprovalItemsForThread(threadId);
+        this.onSessionIdUpdate?.(sessionId, '');
+        return true;
+    }
+    async compactSession(_sessionId, agentSessionId, _projectPath) {
+        try {
+            const appServer = this.getAppServerClient();
+            this.onCompactStart?.(_sessionId);
+            try {
+                return await this.startAndWaitForCompact(appServer, agentSessionId);
+            }
+            catch (error) {
+                if (!this.isThreadNotFoundError(error))
+                    throw error;
+                logger.info(`[CodexRunner] Compact thread not loaded, resuming before compact: ${agentSessionId}`);
+                // 优先用 per-session 模式派生（与 runQuery 一致），缺省回落实例级
+                const compactMode = this.chatModes.get(_sessionId) ?? this.currentMode;
+                const compactPolicy = this.toApprovalPolicy(compactMode);
+                const executionSandbox = this.buildExecutionSandboxOptions(_sessionId, compactMode, _projectPath);
+                const capabilityConfig = await this.resolveCapabilityThreadConfig(_projectPath);
+                const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, _projectPath, capabilityConfig, compactMode);
+                await appServer.threadResume(agentSessionId, _projectPath, {
+                    model: this.model,
+                    effort: this.effort,
+                    approvalPolicy: compactPolicy,
+                    approvalsReviewer: 'user',
+                    ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
+                    config: this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId), this.buildLifecycleLockdownConfig()),
+                });
+                this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
+                this.bindExternalToolBoundary(agentSessionId, externalToolConfig);
+                return await this.startAndWaitForCompact(appServer, agentSessionId);
+            }
+        }
+        catch (error) {
+            logger.error('[CodexRunner] Compact failed:', error);
+            return false;
+        }
+    }
+    async compact(sessionId, agentSessionId, projectPath) {
+        return this.compactSession(sessionId, agentSessionId, projectPath);
+    }
+    async startAndWaitForCompact(appServer, threadId) {
+        const completion = this.waitForThreadCompacted(appServer, threadId, Date.now());
+        try {
+            await appServer.threadCompactStart(threadId);
+            await completion.promise;
+            return true;
+        }
+        finally {
+            completion.dispose();
+        }
+    }
+    waitForThreadCompacted(appServer, threadId, startedAtMs) {
+        let unsubscribe;
+        let pollTimer;
+        let settled = false;
+        const settle = (resolve, source) => {
+            if (settled)
+                return;
+            settled = true;
+            if (pollTimer)
+                clearInterval(pollTimer);
+            logger.info(`[CodexRunner] Compact completed for thread: ${threadId} (${source})`);
+            unsubscribe?.();
+            resolve();
+        };
+        const promise = new Promise(resolve => {
+            unsubscribe = appServer.onNotification(notification => {
+                if (notification.method !== 'thread/compacted')
+                    return;
+                const params = notification.params || {};
+                const notifThreadId = params.threadId ?? params.thread_id;
+                if (notifThreadId !== threadId)
+                    return;
+                settle(resolve, 'notification');
+            });
+            pollTimer = setInterval(() => {
+                if (this.hasPersistedCompactCompletion(threadId, startedAtMs)) {
+                    settle(resolve, 'session-log');
+                }
+            }, 1000);
+            pollTimer.unref?.();
+        });
+        return {
+            promise,
+            dispose: () => {
+                if (pollTimer)
+                    clearInterval(pollTimer);
+                if (!settled)
+                    unsubscribe?.();
+            },
+        };
+    }
+    hasPersistedCompactCompletion(threadId, startedAtMs) {
+        const sessionFile = this.findCodexSessionFile(threadId);
+        if (!sessionFile)
+            return false;
+        let text = '';
+        try {
+            text = fs.readFileSync(sessionFile, 'utf8');
+        }
+        catch {
+            return false;
+        }
+        const threshold = startedAtMs - 1000;
+        for (const line of text.trimEnd().split('\n').reverse()) {
+            if (!line.trim())
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            const ts = typeof entry.timestamp === 'string' ? Date.parse(entry.timestamp) : NaN;
+            if (!Number.isFinite(ts))
+                continue;
+            if (ts < threshold)
+                break;
+            const payloadType = entry.payload?.type;
+            if (entry.type === 'compacted' || payloadType === 'context_compacted')
+                return true;
+        }
+        return false;
+    }
+    findCodexSessionFile(threadId) {
+        const root = process.env.CODEX_HOME
+            ? path.join(process.env.CODEX_HOME, 'sessions')
+            : path.join(process.env.HOME || os.homedir(), '.codex', 'sessions');
+        const stack = [root];
+        let newest;
+        while (stack.length > 0) {
+            const dir = stack.pop();
+            let entries;
+            try {
+                entries = fs.readdirSync(dir, { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                if (entry.isDirectory()) {
+                    stack.push(fullPath);
+                }
+                else if (entry.isFile() && entry.name.includes(threadId) && entry.name.endsWith('.jsonl')) {
+                    let mtimeMs = 0;
+                    try {
+                        mtimeMs = fs.statSync(fullPath).mtimeMs;
+                    }
+                    catch {
+                        continue;
+                    }
+                    if (!newest || mtimeMs > newest.mtimeMs)
+                        newest = { path: fullPath, mtimeMs };
+                }
+            }
+        }
+        return newest?.path;
+    }
+    async forkSession(agentSessionId, projectPath, title) {
+        const sessionKey = this.findSessionKeyByThread(agentSessionId);
+        const mode = this.chatModes.get(sessionKey) ?? this.currentMode;
+        const executionSandbox = this.buildExecutionSandboxOptions(sessionKey, mode, projectPath);
+        const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
+        const appServer = this.getAppServerClient();
+        const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, mode);
+        const response = await appServer.threadFork(agentSessionId, projectPath, title, {
+            model: this.model,
+            effort: this.effort,
+            approvalPolicy: this.toApprovalPolicy(mode),
+            approvalsReviewer: 'user',
+            ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
+            config: this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey), this.buildLifecycleLockdownConfig()),
+        });
+        const forkedThreadId = response.thread?.id;
+        if (!forkedThreadId)
+            throw new Error('Codex fork did not return a thread id');
+        this.threadProjectPaths.set(forkedThreadId, path.resolve(projectPath));
+        this.bindExternalToolBoundary(forkedThreadId, externalToolConfig);
+        return forkedThreadId;
+    }
+    async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title) {
+        const turns = buildSessionTurnList(await this.getSessionMessages(agentSessionId, projectPath));
+        const targetIndex = turns.findIndex(turn => turn.assistantUuid === assistantMessageId);
+        if (targetIndex < 0)
+            throw new Error('fork point not found');
+        const forkedThreadId = await this.forkSession(agentSessionId, projectPath, title);
+        const turnsToDiscard = turns.length - targetIndex - 1;
+        if (turnsToDiscard > 0) {
+            const rolledBack = await this.rollbackSessionTurns(forkedThreadId, projectPath, turnsToDiscard);
+            if (!rolledBack)
+                throw new Error('forked thread rollback failed');
+        }
+        return forkedThreadId;
+    }
+    async setSessionName(agentSessionId, name) {
+        return this.getAppServerClient().threadSetName(agentSessionId, name);
+    }
+    async updateSessionMetadata(agentSessionId, metadata) {
+        const gitInfo = metadata?.gitInfo && typeof metadata.gitInfo === 'object' ? metadata.gitInfo : undefined;
+        return this.getAppServerClient().threadMetadataUpdate(agentSessionId, gitInfo);
+    }
+    async getSessionMessages(agentSessionId, projectPath) {
+        const response = await this.getAppServerClient().threadRead(agentSessionId, true);
+        return this.mapThreadToSessionMessages(response, agentSessionId);
+    }
+    approvalItemKey(threadId, turnId, itemId) {
+        if (typeof threadId !== 'string' || typeof turnId !== 'string' || typeof itemId !== 'string')
+            return undefined;
+        return JSON.stringify([threadId, turnId, itemId]);
+    }
+    trackApprovalItemNotification(notification) {
+        const params = (notification.params || {});
+        const item = params.item && typeof params.item === 'object' ? params.item : undefined;
+        const itemId = item?.id ?? params.itemId;
+        const threadId = this.requestThreadId(params);
+        const key = this.approvalItemKey(threadId, params.turnId, itemId);
+        if (notification.method === 'item/started' && key && item && threadId) {
+            this.trackedApprovalItems.set(key, {
+                threadId,
+                turnId: params.turnId,
+                itemId,
+                item: { ...item },
+            });
+            return;
+        }
+        if (notification.method === 'item/fileChange/patchUpdated' && key && threadId) {
+            const tracked = this.trackedApprovalItems.get(key);
+            this.trackedApprovalItems.set(key, {
+                threadId,
+                turnId: params.turnId,
+                itemId,
+                item: {
+                    ...(tracked?.item ?? { id: itemId, type: 'fileChange' }),
+                    changes: params.changes,
+                },
+            });
+            return;
+        }
+        if (notification.method === 'item/completed' && key) {
+            this.trackedApprovalItems.delete(key);
+            return;
+        }
+        if (notification.method === 'turn/completed' && threadId) {
+            const completedTurnId = typeof params.turnId === 'string'
+                ? params.turnId
+                : typeof params.turn?.id === 'string'
+                    ? params.turn.id
+                    : undefined;
+            for (const [trackedKey, tracked] of this.trackedApprovalItems) {
+                if (tracked.threadId === threadId && (!completedTurnId || tracked.turnId === completedTurnId)) {
+                    this.trackedApprovalItems.delete(trackedKey);
+                }
+            }
+        }
+    }
+    findTrackedApprovalItem(params) {
+        const key = this.approvalItemKey(this.requestThreadId(params), params.turnId, params.itemId);
+        return key ? this.trackedApprovalItems.get(key)?.item : undefined;
+    }
+    requestThreadId(params) {
+        const threadId = typeof params.threadId === 'string' && params.threadId.length > 0
+            ? params.threadId
+            : undefined;
+        if (threadId)
+            return threadId;
+        return typeof params.conversationId === 'string' && params.conversationId.length > 0
+            ? params.conversationId
+            : undefined;
+    }
+    clearTrackedApprovalItemsForThread(threadId) {
+        if (!threadId)
+            return;
+        for (const [key, tracked] of this.trackedApprovalItems) {
+            if (tracked.threadId === threadId)
+                this.trackedApprovalItems.delete(key);
+        }
+    }
+    async handleAppServerRequest(request) {
+        const params = (request.params || {});
+        if (request.method === 'mcpServer/elicitation/request') {
+            logger.warn(`[CodexRunner] MCP elicitation cancelled because EvolCore has no audited elicitation bridge: thread=${params.threadId ?? '<missing>'} server=${params.serverName ?? '<missing>'}`);
+            return { action: 'cancel', content: null, _meta: null };
+        }
+        if (request.method === 'item/tool/requestUserInput') {
+            const trackedItem = this.findTrackedApprovalItem(params);
+            if (trackedItem?.type === 'mcpToolCall') {
+                const unattendedDenial = await this.denyUnattendedExternalToolApproval(params, `MCP:${String(trackedItem.server || 'unknown')}/${String(trackedItem.tool || 'unknown')}`, request.id);
+                if (unattendedDenial)
+                    return unattendedDenial;
+                return this.handleMcpToolApproval(params, trackedItem);
+            }
+            if (trackedItem) {
+                return this.handleToolRequestUserInput(params);
+            }
+            if (this.looksLikeExternalToolApproval(params.questions)) {
+                const unattendedDenial = await this.denyUnattendedExternalToolApproval(params, 'MCP:untracked', request.id);
+                if (unattendedDenial)
+                    return unattendedDenial;
+                return this.denyUntrackedExternalToolApproval(params);
+            }
+            return this.handleToolRequestUserInput(params);
+        }
+        const approvalMethods = new Set([
+            'item/commandExecution/requestApproval',
+            'item/fileChange/requestApproval',
+            'item/permissions/requestApproval',
+            'applyPatchApproval',
+            'execCommandApproval',
+        ]);
+        if (!approvalMethods.has(request.method)) {
+            throw new Error(`Unsupported Codex app-server request: ${request.method}`);
+        }
+        const sessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
+        const permissionContext = this.permissionContexts.get(sessionKey);
+        const unattended = permissionContext?.approvalInteractionPolicy === 'deny';
+        const toolName = request.method === 'item/permissions/requestApproval'
+            ? 'PermissionGrant'
+            : request.method.includes('fileChange') || request.method === 'applyPatchApproval'
+                ? 'FileChange'
+                : 'Bash';
+        const toolInput = this.buildPermissionInput(request.method, params);
+        // proactive 模式行为策略（首次工具调用必须是 ec msg send）
+        const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
+        if (policyResult?.block) {
+            return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+        }
+        const summary = this.summarizeAppServerRequest(request.method, params);
+        const reason = params.reason || params.decisionReason || undefined;
+        const workspacePath = this.resolvePermissionWorkspacePath(params);
+        if (!workspacePath) {
+            logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
+            return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+        }
+        const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
+        const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
+        logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${summary}`);
+        try {
+            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd);
+            const response = this.toAppServerApprovalResponse(request.method, decision, toolInput, unattended);
+            logger.info(`[CodexRunner] app-server approval response id=${request.id} method=${request.method} decision=${decision} response=${JSON.stringify(response)}`);
+            return response;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            logger.warn(`[CodexRunner] app-server approval failed id=${request.id} method=${request.method}: ${message}`);
+            throw error;
+        }
+    }
+    classifyMcpApprovalLabel(label) {
+        const normalized = label.trim().toLowerCase().replace(/[\s_-]+/g, ' ');
+        const negative = /\b(decline|deny|reject|cancel|no|block|stop)\b|do not|don't|not\s+(?:accept|approve|allow)|拒绝|不同意|不允许|取消|否|停止/i.test(normalized);
+        if (negative)
+            return 'deny';
+        const positive = /\b(accept|approve|allow|yes|ok|okay|proceed|continue)\b|同意|允许|批准|确认|继续/i.test(normalized);
+        if (!positive)
+            return 'other';
+        const persistent = /\b(always|session|chat|conversation|remember|across)\b|don't ask|do not ask|永久|始终|会话|不再询问|记住/i.test(normalized);
+        return persistent ? 'allow_persistent' : 'allow_once';
+    }
+    selectMcpApprovalAnswer(question, allow) {
+        const options = Array.isArray(question.options) ? question.options : [];
+        const labels = options
+            .map((option) => typeof option?.label === 'string' ? option.label.trim() : '')
+            .filter(Boolean);
+        if (allow) {
+            const oneShot = labels.find(label => this.classifyMcpApprovalLabel(label) === 'allow_once'
+                && /\b(once|this time)\b|本次|仅此次/i.test(label));
+            if (oneShot)
+                return oneShot;
+            const explicit = labels.find(label => this.classifyMcpApprovalLabel(label) === 'allow_once');
+            if (explicit)
+                return explicit;
+            const persistent = labels.find(label => this.classifyMcpApprovalLabel(label) === 'allow_persistent');
+            if (persistent)
+                return persistent;
+        }
+        else {
+            const decline = labels.find(label => this.classifyMcpApprovalLabel(label) === 'deny'
+                && !/\bcancel\b|取消/i.test(label));
+            if (decline)
+                return decline;
+            const cancel = labels.find(label => this.classifyMcpApprovalLabel(label) === 'deny');
+            if (cancel)
+                return cancel;
+        }
+        throw new Error(`Codex MCP 审批缺少可验证的${allow ? '允许' : '拒绝'}选项`);
+    }
+    looksLikeExternalToolApproval(rawQuestions) {
+        if (!Array.isArray(rawQuestions) || rawQuestions.length === 0)
+            return false;
+        return rawQuestions.every(question => {
+            if (!question || typeof question !== 'object' || Array.isArray(question))
+                return false;
+            const options = Array.isArray(question.options)
+                ? question.options
+                : [];
+            const labels = options
+                .map((option) => typeof option?.label === 'string' ? option.label : '')
+                .filter(Boolean);
+            const hasAllow = labels.some((label) => {
+                const kind = this.classifyMcpApprovalLabel(label);
+                return kind === 'allow_once' || kind === 'allow_persistent';
+            });
+            const hasDeny = labels.some((label) => this.classifyMcpApprovalLabel(label) === 'deny');
+            return hasAllow && hasDeny;
+        });
+    }
+    denyUntrackedExternalToolApproval(params) {
+        const questions = Array.isArray(params.questions) ? params.questions : [];
+        const answers = {};
+        for (const question of questions) {
+            const questionId = typeof question.id === 'string' ? question.id : `q-${Object.keys(answers).length + 1}`;
+            answers[questionId] = { answers: [this.selectMcpApprovalAnswer(question, false)] };
+        }
+        logger.warn(`[CodexRunner] external tool approval denied because mcpToolCall metadata is missing: thread=${params.threadId ?? '<missing>'} item=${params.itemId ?? '<missing>'}`);
+        return { answers };
+    }
+    async denyUnattendedExternalToolApproval(params, toolName, requestId) {
+        const sessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
+        const context = this.permissionContexts.get(sessionKey);
+        if (context?.approvalInteractionPolicy !== 'deny')
+            return undefined;
+        try {
+            await context.recordExecutionAnomaly?.({
+                code: 'runtime_permission_denied',
+                severity: 'warning',
+                phase: 'execution',
+                occurredAt: Date.now(),
+                toolName,
+                ...(typeof requestId === 'string' || typeof requestId === 'number'
+                    ? { requestId: String(requestId) }
+                    : {}),
+                policy: context.approvalRouting?.approverPolicy ?? 'requester',
+                summary: `${toolName} runtime authorization denied by unattended Trigger policy`,
+                effect: 'operation_skipped',
+            });
+        }
+        catch (error) {
+            logger.warn(`[CodexRunner] failed to record unattended MCP denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+        }
+        logger.info(`[CodexRunner] unattended MCP approval denied: session=${sessionKey} tool=${toolName}`);
+        return this.denyUntrackedExternalToolApproval(params);
+    }
+    async handleMcpToolApproval(params, trackedItem) {
+        const questions = Array.isArray(params.questions) ? params.questions : [];
+        if (questions.length === 0)
+            throw new Error('Codex MCP 审批未包含问题，已拒绝');
+        const hasExactIdentity = typeof trackedItem.server === 'string'
+            && trackedItem.server.length > 0
+            && typeof trackedItem.tool === 'string'
+            && trackedItem.tool.length > 0
+            && Object.prototype.hasOwnProperty.call(trackedItem, 'arguments');
+        if (!hasExactIdentity) {
+            logger.warn(`[CodexRunner] MCP approval denied because exact tool metadata is missing: thread=${params.threadId ?? '<missing>'} item=${params.itemId ?? '<missing>'}`);
+            return this.denyUntrackedExternalToolApproval(params);
+        }
+        const threadId = this.requestThreadId(params);
+        const configFingerprint = threadId ? this.threadExternalToolFingerprints.get(threadId) : undefined;
+        const boundary = threadId ? this.threadExternalToolBoundaries.get(threadId) : undefined;
+        if (!configFingerprint || !boundary) {
+            logger.warn(`[CodexRunner] MCP approval denied because the hardened external-tool config is unbound: thread=${threadId ?? '<missing>'}`);
+            return this.denyUntrackedExternalToolApproval(params);
+        }
+        const sessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
+        const server = trackedItem.server;
+        const tool = trackedItem.tool;
+        const isAppCall = typeof trackedItem.mcpAppResourceUri === 'string'
+            || (trackedItem.appContext && typeof trackedItem.appContext === 'object');
+        const isExplicitlyDenied = isAppCall
+            ? boundary.deniedApps.has(server)
+            : boundary.deniedMcpServers.has(server);
+        const isAllowedApp = !isAppCall || boundary.allowedApps.has(server) || boundary.allowAnyApp;
+        if (isExplicitlyDenied || !isAllowedApp) {
+            logger.warn(`[CodexRunner] MCP approval denied by the explicit capability boundary: thread=${threadId} server=${server}`);
+            return this.denyUntrackedExternalToolApproval(params);
+        }
+        const toolName = `MCP:${server}/${tool}`;
+        const toolInput = {
+            server,
+            tool,
+            arguments: trackedItem.arguments,
+            ...(typeof trackedItem.pluginId === 'string' ? { pluginId: trackedItem.pluginId } : {}),
+            ...(typeof trackedItem.mcpAppResourceUri === 'string' ? { mcpAppResourceUri: trackedItem.mcpAppResourceUri } : {}),
+            ...(trackedItem.appContext && typeof trackedItem.appContext === 'object' ? { appContext: trackedItem.appContext } : {}),
+        };
+        const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
+        const workspacePath = this.resolvePermissionWorkspacePath(params);
+        const mode = normalizePermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode).mode;
+        // MCP servers are inherited unless capability config explicitly disables
+        // them. Apps retain their separate request/bypass lifecycle policy.
+        let allow = !policyResult?.block
+            && !!workspacePath
+            && (isAppCall
+                ? mode === 'request' || mode === 'bypass'
+                : mode !== 'readonly');
+        if (allow) {
+            try {
+                for (const question of questions)
+                    this.selectMcpApprovalAnswer(question, true);
+            }
+            catch {
+                allow = false;
+                logger.warn(`[CodexRunner] MCP approval denied because Codex offered no one-shot accept option: thread=${params.threadId ?? '<missing>'} item=${params.itemId ?? '<missing>'}`);
+            }
+        }
+        const answers = {};
+        for (const question of questions) {
+            const questionId = typeof question.id === 'string' ? question.id : `q-${Object.keys(answers).length + 1}`;
+            answers[questionId] = { answers: [this.selectMcpApprovalAnswer(question, allow)] };
+        }
+        return { answers };
+    }
+    async handleToolRequestUserInput(params) {
+        const sessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
+        const questions = Array.isArray(params.questions) ? params.questions : [];
+        const answers = {};
+        for (const question of questions) {
+            const questionId = typeof question.id === 'string' ? question.id : `q-${Object.keys(answers).length + 1}`;
+            answers[questionId] = {
+                answers: await this.collectUserInputAnswer(sessionKey, question),
+            };
+        }
+        return { answers };
+    }
+    async collectUserInputAnswer(sessionKey, question) {
+        const options = Array.isArray(question.options) ? question.options : [];
+        const fallback = options[0]?.label ? [String(options[0].label)] : [''];
+        const context = this.permissionContexts.get(sessionKey);
+        if (context?.approvalInteractionPolicy === 'deny') {
+            logger.info(`[CodexRunner] interaction.auto_resolved kind=ask_user session=${sessionKey}`);
+            const labels = options
+                .map((option) => typeof option?.label === 'string' ? option.label.trim() : '')
+                .filter(Boolean);
+            if (labels.length > 0) {
+                const prompt = `${String(question.header ?? '')} ${String(question.question ?? '')}`;
+                const isPlanApproval = /\bplan\b|计划|方案/i.test(prompt);
+                const affirmative = isPlanApproval
+                    ? labels.find(label => {
+                        const kind = this.classifyMcpApprovalLabel(label);
+                        return kind === 'allow_once' || kind === 'allow_persistent';
+                    })
+                    : undefined;
+                return [affirmative ?? labels[0]];
+            }
+            return ['当前为无人值守 Trigger，请基于已有上下文选择最安全合理的方案并继续执行。'];
+        }
+        const canFreeText = question.isOther !== false || options.length === 0;
+        const sendPrompt = context?.adapter && context.channelId
+            ? async (text) => context.adapter.send(buildEnvelope({
+                channel: context.adapter.channelName,
+                channelId: context.channelId,
+                replyContext: context.replyContext,
+            }), { kind: 'result.text', text, isFinal: true })
+            : this.sendPromptFn;
+        if (!context?.interactionRouter || !sendPrompt) {
+            if (sendPrompt)
+                await sendPrompt(this.formatUserInputFallback(question, fallback));
+            return fallback;
+        }
+        const requestId = `codex-ask-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const buttonArgMap = {};
+        const buttons = options.length > 0
+            ? options.map((option, index) => {
+                const key = `opt-${index}`;
+                buttonArgMap[key] = String(index + 1);
+                return { key, label: String(option.label || `选项 ${index + 1}`), style: 'default' };
+            })
+            : [{ key: 'custom', label: '提交', style: 'primary' }];
+        const bodyLines = [String(question.question || '')];
+        if (options.some((option) => option.description)) {
+            bodyLines.push('', ...options.map((option, index) => `${index + 1}. ${String(option.label || `选项 ${index + 1}`)}${option.description ? ` — ${option.description}` : ''}`));
+        }
+        const interaction = {
+            type: 'interaction',
+            id: requestId,
+            channelId: context.channelId || '',
+            sessionId: sessionKey,
+            initiatorId: context.userId,
+            kind: {
+                kind: 'action',
+                title: String(question.header || '问题'),
+                body: bodyLines.join('\n'),
+                buttons,
+                allowCustomInput: canFreeText,
+            },
+            fallback: {
+                command: 'ask',
+                buttonArgMap,
+                acceptFreeText: canFreeText,
+                freeTextHint: canFreeText ? '或回复 /ask <自定义内容>' : undefined,
+            },
+        };
+        const router = context.interactionRouter;
+        router.markWaiting(sessionKey);
+        let waitMarked = true;
+        let sent = false;
+        try {
+            await context.flushPending?.();
+            if (context.adapter && context.channelId) {
+                const envelope = buildEnvelope({
+                    taskId: context.taskId,
+                    channel: context.channel ?? context.adapter.channelName,
+                    channelId: context.channelId,
+                    agentName: context.agentName,
+                    chatmode: context.chatmode,
+                    replyContext: context.replyContext,
+                });
+                sent = !!await sendInteractionPayload(context.adapter, envelope, interaction, undefined, context.replyContext);
+            }
+            if (!sent) {
+                await sendPrompt(renderActionAsText(interaction));
+                sent = true;
+            }
+        }
+        catch (error) {
+            logger.warn('[CodexRunner] requestUserInput prompt send failed:', error);
+        }
+        if (!sent) {
+            router.unmarkWaiting(sessionKey);
+            return fallback;
+        }
+        return new Promise((resolve) => {
+            router.register(requestId, sessionKey, (action, values) => {
+                resolve(this.parseUserInputAction(action, values, options, fallback));
+            }, {
+                initiatorId: context.userId,
+                fallbackCommand: 'ask',
+            });
+            if (waitMarked) {
+                router.unmarkWaiting(sessionKey);
+                waitMarked = false;
+            }
+        });
+    }
+    parseUserInputAction(action, values, options, fallback) {
+        if (action === '_custom_input') {
+            const customText = typeof values?.custom_text === 'string' ? values.custom_text.trim() : '';
+            return customText ? [customText] : fallback;
+        }
+        if (action.startsWith('opt-')) {
+            const index = Number.parseInt(action.slice(4), 10);
+            const label = options[index]?.label;
+            return label ? [String(label)] : fallback;
+        }
+        const selected = action.split(',').map(part => part.trim()).filter(Boolean);
+        if (selected.length > 0 && selected.every(part => /^\d+$/.test(part))) {
+            const labels = selected
+                .map(part => options[Number.parseInt(part, 10) - 1]?.label)
+                .filter((label) => typeof label === 'string' && label.length > 0);
+            if (labels.length > 0)
+                return labels;
+        }
+        return action.trim() ? [action.trim()] : fallback;
+    }
+    formatUserInputFallback(question, fallback) {
+        const options = Array.isArray(question.options) ? question.options : [];
+        const lines = [String(question.header || '问题'), String(question.question || '')].filter(Boolean);
+        if (options.length > 0) {
+            lines.push('', ...options.map((option, index) => `${index + 1}. ${String(option.label || `选项 ${index + 1}`)}${option.description ? ` — ${option.description}` : ''}`));
+        }
+        lines.push('', `自动选择：${fallback.join(', ')}`);
+        return lines.join('\n');
+    }
+    findSessionKeyByThread(threadId, conversationId) {
+        const candidates = [threadId, conversationId].filter((value) => typeof value === 'string' && value.length > 0);
+        for (const candidate of candidates) {
+            for (const [sessionKey, activeThreadId] of this.activeSessions.entries()) {
+                if (activeThreadId === candidate)
+                    return sessionKey;
+            }
+        }
+        return candidates[0] || 'codex-app-server';
+    }
+    buildPermissionInput(method, params) {
+        if (method === 'item/permissions/requestApproval') {
+            return { permissions: params.permissions, cwd: params.cwd, reason: params.reason };
+        }
+        const trackedItem = this.findTrackedApprovalItem(params);
+        if (method.includes('fileChange') || method === 'applyPatchApproval') {
+            return {
+                fileChanges: params.fileChanges ?? trackedItem?.changes,
+                grantRoot: params.grantRoot,
+                reason: params.reason,
+            };
+        }
+        const rawCommand = params.command ?? trackedItem?.command;
+        const command = Array.isArray(rawCommand) ? rawCommand.join(' ') : (rawCommand || '');
+        return {
+            command,
+            ...(Array.isArray(rawCommand) ? { commandArgv: rawCommand } : {}),
+            cwd: params.cwd ?? trackedItem?.cwd,
+            reason: params.reason,
+            commandActions: params.commandActions || params.parsedCmd || trackedItem?.commandActions,
+            additionalPermissions: params.additionalPermissions,
+            networkApprovalContext: params.networkApprovalContext,
+            proposedNetworkPolicyAmendments: params.proposedNetworkPolicyAmendments,
+            proposedExecpolicyAmendment: params.proposedExecpolicyAmendment,
+            environmentId: params.environmentId,
+        };
+    }
+    summarizeAppServerRequest(method, params) {
+        if (method === 'item/permissions/requestApproval') {
+            return params.reason || '运行时权限升级';
+        }
+        if (method.includes('fileChange') || method === 'applyPatchApproval') {
+            if (params.grantRoot)
+                return '允许写入：' + params.grantRoot;
+            const trackedItem = this.findTrackedApprovalItem(params);
+            const changes = this.normalizeFileChanges(params.fileChanges ?? trackedItem?.changes);
+            const descriptions = changes.map(change => this.describeFileChange(change)).filter(Boolean);
+            return descriptions.length ? descriptions.join(', ') : '文件变更审批';
+        }
+        const networkContext = params.networkApprovalContext;
+        if (networkContext && typeof networkContext === 'object' && !Array.isArray(networkContext)) {
+            const host = typeof networkContext.host === 'string' ? networkContext.host : '';
+            const protocol = typeof networkContext.protocol === 'string' ? networkContext.protocol : '';
+            if (host)
+                return `允许网络访问：${protocol ? `${protocol}://` : ''}${host}`;
+        }
+        const trackedItem = this.findTrackedApprovalItem(params);
+        const rawCommand = params.command ?? trackedItem?.command;
+        const command = Array.isArray(rawCommand) ? rawCommand.join(' ') : rawCommand;
+        return command || '命令执行审批';
+    }
+    resolvePermissionWorkspacePath(params) {
+        const threadId = typeof params.threadId === 'string'
+            ? params.threadId
+            : typeof params.conversationId === 'string'
+                ? params.conversationId
+                : undefined;
+        if (threadId) {
+            const threadProjectPath = this.threadProjectPaths.get(threadId);
+            if (threadProjectPath)
+                return threadProjectPath;
+        }
+        return undefined;
+    }
+    resolvePermissionOperationCwd(params, workspacePath, toolName) {
+        if (toolName === 'FileChange')
+            return resolveProtectedCandidate(workspacePath);
+        const trackedItem = this.findTrackedApprovalItem(params);
+        const rawCwd = typeof params.cwd === 'string' && params.cwd
+            ? params.cwd
+            : typeof trackedItem?.cwd === 'string' && trackedItem.cwd
+                ? trackedItem.cwd
+                : undefined;
+        if (!rawCwd)
+            return resolveProtectedCandidate(workspacePath);
+        const absolute = path.isAbsolute(rawCwd) ? rawCwd : path.resolve(workspacePath, rawCwd);
+        return resolveProtectedCandidate(absolute);
+    }
+    checkCodexReadonly(toolName, input, projectPath, sessionKey) {
+        const permCtx = sessionKey ? this.permissionContexts.get(sessionKey) : undefined;
+        const readonlyContext = sessionKey ? {
+            sessionId: sessionKey,
+            channel: permCtx?.channel,
+            peerId: permCtx?.userId,
+            role: permCtx?.role,
+        } : undefined;
+        if (toolName === 'Bash')
+            return checkReadonly(toolName, input, projectPath, readonlyContext);
+        return { behavior: 'deny', message: '🔒 只读模式：权限升级和文件写入请求已拒绝' };
+    }
+    permissionProfiles(input) {
+        return [input.permissions, input.additionalPermissions]
+            .filter((value) => !!value && typeof value === 'object' && !Array.isArray(value));
+    }
+    filesystemProfileRequestsAccess(fileSystem) {
+        if (!fileSystem || typeof fileSystem !== 'object' || Array.isArray(fileSystem))
+            return false;
+        const fsProfile = fileSystem;
+        if (Array.isArray(fsProfile.read) && fsProfile.read.length > 0)
+            return true;
+        if (Array.isArray(fsProfile.write) && fsProfile.write.length > 0)
+            return true;
+        return Array.isArray(fsProfile.entries) && fsProfile.entries.some(entry => {
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+                return false;
+            return entry.access !== 'deny';
+        });
+    }
+    hasFilesystemPermissionRequest(input) {
+        return this.permissionProfiles(input)
+            .some(profile => this.filesystemProfileRequestsAccess(profile.fileSystem));
+    }
+    hasNetworkPermissionRequest(input) {
+        if (this.permissionProfiles(input).some(profile => {
+            const network = profile.network;
+            return !!network
+                && typeof network === 'object'
+                && !Array.isArray(network)
+                && network.enabled === true;
+        }))
+            return true;
+        const context = input.networkApprovalContext;
+        if (context && typeof context === 'object' && !Array.isArray(context)) {
+            const record = context;
+            if (typeof record.host === 'string' && record.host.length > 0)
+                return true;
+        }
+        return Array.isArray(input.proposedNetworkPolicyAmendments)
+            && input.proposedNetworkPolicyAmendments.length > 0;
+    }
+    hasUnknownPermissionRequest(input) {
+        return this.permissionProfiles(input).some(profile => Object.keys(profile).some(key => key !== 'network' && key !== 'fileSystem'));
+    }
+    fileChangeRequiresExpansion(input, projectPath, sessionKey) {
+        if (typeof input.grantRoot === 'string' && input.grantRoot.length > 0)
+            return true;
+        const paths = [];
+        for (const change of this.normalizeFileChanges(input.fileChanges)) {
+            for (const candidate of [
+                change?.path,
+                change?.move_path,
+                change?.movePath,
+                change?.kind?.move_path,
+                change?.kind?.movePath,
+            ]) {
+                if (typeof candidate === 'string' && candidate.length > 0)
+                    paths.push(candidate);
+            }
+        }
+        if (paths.length === 0)
+            return true;
+        const workspace = resolveProtectedCandidate(projectPath);
+        const managedTempDir = this.sessionTempDirs.get(sessionKey);
+        const trustedTempDir = managedTempDir ? this.isTrustedSessionTempDir(managedTempDir) : false;
+        if (managedTempDir && !trustedTempDir) {
+            logger.warn(`[CodexRunner] managed TMPDIR lost its trusted ownership or mode: session=${sessionKey} path=${managedTempDir}`);
+        }
+        const canonicalTempDir = managedTempDir && trustedTempDir
+            ? resolveProtectedCandidate(managedTempDir)
+            : undefined;
+        return paths.some(candidate => {
+            const absolute = path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(workspace, candidate);
+            const canonical = resolveProtectedCandidate(absolute);
+            if (isSameOrDescendant(canonical, workspace))
+                return false;
+            if (canonicalTempDir
+                && canonical !== canonicalTempDir
+                && isSameOrDescendant(canonical, canonicalTempDir)) {
+                try {
+                    const stat = fs.statSync(canonical);
+                    if (stat.isFile() && stat.nlink > 1) {
+                        logger.warn(`[CodexRunner] managed TMPDIR FileChange rejected hard link: session=${sessionKey} path=${canonical}`);
+                        return true;
+                    }
+                }
+                catch {
+                    // A new file is safe as long as its canonical existing ancestor stays
+                    // inside the managed session temp directory.
+                }
+                logger.info(`[CodexRunner] managed TMPDIR FileChange accepted: session=${sessionKey} path=${canonical}`);
+                return false;
+            }
+            return true;
+        });
+    }
+    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath) {
+        const permissionContext = this.permissionContexts.get(sessionKey);
+        const permissionPrompt = permissionContext?.sendPrompt ?? this.sendPromptFn;
+        const hasFilesystemPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
+            && this.hasFilesystemPermissionRequest(toolInput);
+        const hasNetworkPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
+            && this.hasNetworkPermissionRequest(toolInput);
+        const hasUnknownPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
+            && this.hasUnknownPermissionRequest(toolInput);
+        const hasPermissionExpansion = hasFilesystemPermissions || hasNetworkPermissions || hasUnknownPermissions;
+        const hasFileChangeExpansion = toolName === 'FileChange'
+            && this.fileChangeRequiresExpansion(toolInput, workspacePath, sessionKey);
+        // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
+        const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
+        const mode = normalizePermissionMode(rawMode).mode;
+        const preflight = evaluateToolPreflight(toolName, toolInput, {
+            sessionId: sessionKey,
+            channel: permissionContext?.channel,
+            userId: permissionContext?.userId,
+            role: permissionContext?.role,
+            permissionMode: mode,
+            projectPath: operationCwd,
+            workspacePath,
+        });
+        if (preflight.behavior === 'deny')
+            return 'deny';
+        if (preflight.behavior === 'allow')
+            return 'allow';
+        const checkedInput = preflight.input;
+        if (toolName === 'FileChange') {
+            const hasGrantRoot = typeof checkedInput.grantRoot === 'string'
+                && checkedInput.grantRoot.length > 0;
+            const hasConcreteChanges = this.normalizeFileChanges(checkedInput.fileChanges)
+                .some(change => typeof change?.path === 'string' && change.path.length > 0);
+            if (!hasGrantRoot && !hasConcreteChanges)
+                return 'deny';
+        }
+        if (toolName === 'Bash' && !hasPermissionExpansion) {
+            const command = typeof checkedInput.command === 'string'
+                ? checkedInput.command.trim()
+                : '';
+            if (!command)
+                return 'deny';
+        }
+        if (toolName === 'PermissionGrant' && !hasPermissionExpansion)
+            return 'deny';
+        const grantScope = `codex:${this.permissionProfileName(sessionKey)}:${mode}`;
+        if (mode === 'readonly') {
+            const readonly = this.checkCodexReadonly(toolName, checkedInput, operationCwd, sessionKey);
+            if (readonly.behavior === 'deny')
+                return 'deny';
+            return 'allow';
+        }
+        if (toolName.startsWith('MCP:')) {
+            return 'allow';
+        }
+        // auto 模式下检查危险命令，危险命令自动拒绝
+        if (mode === 'auto') {
+            if (hasFileChangeExpansion || hasFilesystemPermissions || hasUnknownPermissions)
+                return 'deny';
+            if (toolName === 'PermissionGrant' && !hasNetworkPermissions)
+                return 'deny';
+            const dangerous = checkDangerousCommand(toolName, checkedInput);
+            if (dangerous.isDangerous)
+                return 'deny';
+            return 'allow';
+        }
+        const requiresSandboxExpansionApproval = hasFileChangeExpansion
+            || hasFilesystemPermissions
+            || hasUnknownPermissions;
+        if (requiresSandboxExpansionApproval) {
+            if (!this.permissionGateway || !permissionPrompt)
+                return 'deny';
+            return this.permissionGateway.requestPermission(sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope);
+        }
+        if (mode === 'request' || mode === 'bypass') {
+            const dangerous = await requestDangerousCommandPermission(this.permissionGateway, sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), grantScope, mode);
+            if (dangerous.matched)
+                return dangerous.decision;
+            return 'allow';
+        }
+        // Network is already part of every profile, so a defensive
+        // network-only permission callback is accepted without a second approval.
+        return 'allow';
+    }
+    toAppServerApprovalResponse(method, decision, toolInput, unattended = false) {
+        if (method === 'execCommandApproval' || method === 'applyPatchApproval') {
+            return { decision: decision === 'deny' ? 'denied' : 'approved' };
+        }
+        if (method === 'item/commandExecution/requestApproval') {
+            return { decision: decision === 'deny' ? 'decline' : 'accept' };
+        }
+        if (method === 'item/fileChange/requestApproval') {
+            return { decision: decision === 'deny' ? 'decline' : 'accept' };
+        }
+        if (method === 'item/permissions/requestApproval') {
+            // Codex expects a permissions object for this RPC. Throwing here turns a
+            // single denied capability into a terminal runner error, which is
+            // especially harmful for unattended Trigger runs: the operation should
+            // be skipped while the model remains free to continue with a fallback.
+            // Keep the historical RPC-error behavior for interactive callers, but
+            // return an empty turn-scoped grant in unattended mode.
+            if (decision === 'deny') {
+                if (unattended)
+                    return { permissions: {}, scope: 'turn', strictAutoReview: true };
+                throw new Error('Permission request denied');
+            }
+            const permissions = toolInput?.permissions;
+            return {
+                permissions: permissions && typeof permissions === 'object' ? permissions : {},
+                scope: 'turn',
+                strictAutoReview: true,
+            };
+        }
+        throw new Error('Unsupported Codex app-server request: ' + method);
+    }
+    async rollbackSessionTurns(agentSessionId, _projectPath, numTurns) {
+        if (numTurns < 1)
+            return true;
+        const response = await this.getAppServerClient().threadRollback(agentSessionId, numTurns);
+        return !!response.thread;
+    }
+    async rewindFiles(agentSessionId, projectPath, userMessageId) {
+        const messages = await this.getSessionMessages(agentSessionId, projectPath);
+        const targetIndex = messages.findIndex(message => message.uuid === userMessageId);
+        if (targetIndex < 0)
+            return { canRewind: false, error: 'target turn not found' };
+        const changedFiles = new Set();
+        for (let i = targetIndex; i < messages.length; i++) {
+            const message = messages[i];
+            const content = Array.isArray(message.message?.content) ? message.message.content : [];
+            for (const part of content) {
+                if (part?.type === 'file_change' && typeof part.path === 'string')
+                    changedFiles.add(part.path);
+            }
+        }
+        if (changedFiles.size === 0) {
+            return { canRewind: false, error: 'no file changes recorded for target turn' };
+        }
+        const snapshotFiles = [...changedFiles];
+        for (const filePath of snapshotFiles) {
+            const absolutePath = path.isAbsolute(filePath) ? filePath : path.join(projectPath, filePath);
+            const content = this.readGitHeadFile(projectPath, filePath);
+            if (content === null) {
+                fs.rmSync(absolutePath, { force: true });
+            }
+            else {
+                fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+                fs.writeFileSync(absolutePath, content);
+            }
+        }
+        return { canRewind: true, filesChanged: snapshotFiles };
+    }
+    readGitHeadFile(projectPath, filePath) {
+        try {
+            return execFileSync('git', ['show', `HEAD:${filePath.replace(/\\/g, '/')}`], { cwd: projectPath, stdio: ['pipe', 'pipe', 'ignore'] });
+        }
+        catch {
+            return null;
+        }
+    }
+    mapThreadToSessionMessages(response, fallbackThreadId) {
+        const thread = response.thread;
+        const threadId = thread?.id || fallbackThreadId;
+        const messages = [];
+        for (const turn of thread?.turns ?? []) {
+            for (const item of this.getTurnItems(turn)) {
+                if (item.type === 'userMessage') {
+                    messages.push({
+                        type: 'user',
+                        uuid: item.id || turn.id || (threadId + '-user-' + messages.length),
+                        session_id: threadId,
+                        message: { role: 'user', content: this.mapUserInputToContent(item.content) },
+                        parent_tool_use_id: null,
+                    });
+                }
+                else if (item.type === 'agentMessage') {
+                    messages.push({
+                        type: 'assistant',
+                        uuid: item.id || turn.id || (threadId + '-assistant-' + messages.length),
+                        session_id: threadId,
+                        message: { role: 'assistant', content: item.text || '' },
+                        parent_tool_use_id: null,
+                    });
+                }
+                else if (item.type === 'file_change') {
+                    messages.push({
+                        type: 'system',
+                        uuid: item.id || turn.id || (threadId + '-file-' + messages.length),
+                        session_id: threadId,
+                        message: { role: 'system', content: this.mapFileChangeToContent(item) },
+                        parent_tool_use_id: null,
+                    });
+                }
+            }
+        }
+        return messages;
+    }
+    getTurnItems(turn) {
+        const items = Array.isArray(turn?.items) ? turn.items : [];
+        const input = Array.isArray(turn?.input) ? turn.input : [];
+        const output = Array.isArray(turn?.output) ? turn.output : [];
+        return [...items, ...input, ...output];
+    }
+    mapUserInputToContent(content) {
+        if (!Array.isArray(content))
+            return [];
+        return content.map((part) => {
+            if (part?.type === 'text')
+                return { type: 'text', text: part.text || '' };
+            if (part?.type === 'localImage')
+                return { type: 'image', path: part.path };
+            if (part?.type === 'image')
+                return { type: 'image', url: part.url };
+            return { type: 'text', text: part?.text || part?.name || '' };
+        });
+    }
+    mapFileChangeToContent(item) {
+        const changes = this.normalizeFileChanges(item.changes);
+        return changes
+            .filter((change) => typeof change?.path === 'string')
+            .map((change) => {
+            const kind = this.normalizeFileChangeKind(change.kind ?? change.type);
+            return {
+                type: 'file_change',
+                path: change.path,
+                ...(kind ? { kind } : {}),
+            };
+        });
+    }
+    normalizeFileChanges(changes) {
+        if (Array.isArray(changes))
+            return changes;
+        if (!changes || typeof changes !== 'object')
+            return [];
+        return Object.entries(changes).map(([filePath, change]) => ({
+            ...(change && typeof change === 'object' ? change : {}),
+            path: filePath,
+        }));
+    }
+    describeFileChange(change) {
+        const kind = this.normalizeFileChangeKind(change?.kind ?? change?.type);
+        const filePath = typeof change?.path === 'string' ? change.path : '';
+        return [kind || 'change', filePath].filter(Boolean).join(' ');
+    }
+    normalizeFileChangeKind(kind) {
+        if (typeof kind === 'string')
+            return kind;
+        if (!kind || typeof kind !== 'object')
+            return undefined;
+        const data = kind;
+        for (const key of ['type', 'kind', 'action', 'operation', 'op']) {
+            if (typeof data[key] === 'string')
+                return data[key];
+        }
+        return undefined;
+    }
+    isThreadNotFoundError(error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return /thread\/compact\/start failed: thread not found:/i.test(message)
+            || /thread not found:/i.test(message);
+    }
+    setCompactStartCallback(callback) {
+        this.onCompactStart = callback;
+    }
+    // ── Event stream transformation ──
+    buildAppServerInput(prompt, images, tempFiles) {
+        const input = [{ type: 'text', text: prompt, text_elements: [] }];
+        if (!images?.length)
+            return input;
+        const tmpDir = os.tmpdir();
+        for (let i = 0; i < images.length; i++) {
+            const img = images[i];
+            const ext = MIME_EXT[img.mimeType || ''] || '.jpg';
+            const tmpPath = path.join(tmpDir, `evolcore-img-${Date.now()}-${i}${ext}`);
+            fs.writeFileSync(tmpPath, Buffer.from(img.data, 'base64'));
+            tempFiles.push(tmpPath);
+            input.push({ type: 'localImage', path: tmpPath });
+        }
+        logger.info(`[CodexRunner] Attached ${images.length} image(s) as localImage`);
+        return input;
+    }
+    cleanupTempFiles(tempFiles) {
+        if (!tempFiles?.length)
+            return;
+        for (const tempFile of tempFiles) {
+            try {
+                fs.unlinkSync(tempFile);
+            }
+            catch { /* ignore */ }
+        }
+    }
+    extractTurnId(notification) {
+        const params = notification.params || {};
+        return typeof params.turnId === 'string' ? params.turnId :
+            typeof params.turn_id === 'string' ? params.turn_id :
+                typeof params.turn?.id === 'string' ? params.turn.id : undefined;
+    }
+    isAppServerTurnNotification(notification, state) {
+        const params = notification.params || {};
+        const notifThreadId = params.threadId ?? params.thread_id;
+        if (notifThreadId !== undefined && notifThreadId !== state.threadId)
+            return false;
+        const turnId = this.extractTurnId(notification);
+        if (!state.turnId) {
+            return notification.method === 'turn/started' || !turnId;
+        }
+        return !state.turnId || !turnId || turnId === state.turnId;
+    }
+    async *transformAppServerStream(notifications, sessionId, state, unsubscribe, tempFiles) {
+        try {
+            yield { type: 'session_id', sessionId: state.threadId };
+            for await (const notification of notifications) {
+                if (!this.activeAbortControllers.has(sessionId))
+                    break;
+                yield* this.mapAppServerNotification(notification, sessionId, state);
+            }
+        }
+        finally {
+            unsubscribe();
+            this.activeAbortControllers.delete(sessionId);
+            this.activeTurns.delete(sessionId);
+            this.cleanupTempFiles(tempFiles);
+        }
+    }
+    *mapAppServerNotification(notification, sessionId, state) {
+        const params = notification.params || {};
+        switch (notification.method) {
+            case 'turn/started': {
+                const turnId = this.extractTurnId(notification);
+                if (turnId) {
+                    state.turnId = turnId;
+                    this.activeTurns.set(sessionId, { threadId: state.threadId, turnId });
+                }
+                yield { type: 'state_changed', state: 'running' };
+                break;
+            }
+            case 'item/started': {
+                for (const event of this.mapAppServerItemStarted(params.item, state)) {
+                    this.trackAppServerToolLifecycle(event, state);
+                    yield event;
+                }
+                break;
+            }
+            case 'item/agentMessage/delta': {
+                const itemId = typeof params.itemId === 'string' ? params.itemId : undefined;
+                if (itemId)
+                    state.streamedAgentMessageIds.add(itemId);
+                if (itemId && typeof params.delta === 'string' && params.delta) {
+                    state.agentMessageDeltaText.set(itemId, (state.agentMessageDeltaText.get(itemId) || '') + params.delta);
+                }
+                break;
+            }
+            case 'item/completed': {
+                const item = params.item;
+                if (item?.id)
+                    state.completedItemIds.add(item.id);
+                for (const event of this.mapAppServerItemCompleted(item, state)) {
+                    this.trackAppServerToolLifecycle(event, state);
+                    yield event;
+                }
+                break;
+            }
+            case 'item/fileChange/patchUpdated': {
+                for (const event of this.mapAppServerFileChangePatchUpdated(params, state)) {
+                    this.trackAppServerToolLifecycle(event, state);
+                    yield event;
+                }
+                break;
+            }
+            case 'turn/plan/updated': {
+                const plan = Array.isArray(params.plan) ? params.plan : [];
+                const completed = plan.filter((step) => step?.status === 'completed').length;
+                const summary = plan.length ? `计划进度：${completed}/${plan.length}` : (params.explanation || '计划已更新');
+                yield { type: 'task_progress', summary };
+                break;
+            }
+            case 'thread/tokenUsage/updated': {
+                state.tokenUsage = params.tokenUsage;
+                break;
+            }
+            case 'thread/compacted': {
+                logger.info(`[CodexRunner] Compact completed for thread: ${params.threadId || state.threadId}`);
+                const preTokens = this.pickNumber(state.tokenUsage?.last?.inputTokens, state.tokenUsage?.last?.input_tokens, state.tokenUsage?.last?.totalTokens, state.tokenUsage?.last?.total_tokens) ?? 0;
+                yield { type: 'compact', preTokens };
+                break;
+            }
+            case 'turn/completed': {
+                const turn = params.turn || {};
+                const turnId = turn.id || params.turnId;
+                if (turnId && state.completedTurnIds.has(turnId))
+                    break;
+                if (turnId)
+                    state.completedTurnIds.add(turnId);
+                this.activeTurns.delete(sessionId);
+                yield* this.reconcileOpenAppServerToolCalls(state, turnId);
+                if (turn.status === 'failed' && turn.error?.message) {
+                    if (isRetryableError(new Error(turn.error.message))) {
+                        throw new Error(turn.error.message);
+                    }
+                    yield { type: 'error', error: turn.error.message, errorType: 'unknown' };
+                }
+                yield this.mapAppServerTurnComplete(turn, state);
+                break;
+            }
+            case 'error': {
+                if (!params.message) {
+                    // SSE idle timeout reconnect — not a real task error, suppress
+                    logger.debug(`[CodexRunner] app-server SSE reconnect (no message)`);
+                    break;
+                }
+                if (isRetryableError(new Error(params.message))) {
+                    throw new Error(params.message);
+                }
+                yield { type: 'error', error: params.message, errorType: 'unknown' };
+                break;
+            }
+        }
+    }
+    trackAppServerToolLifecycle(event, state) {
+        if (event.type !== 'tool_use' && event.type !== 'tool_result')
+            return;
+        if (!event.callId)
+            return;
+        if (event.type === 'tool_use') {
+            state.openToolCalls.set(event.callId, event.name);
+        }
+        else if (event.type === 'tool_result') {
+            state.openToolCalls.delete(event.callId);
+        }
+    }
+    *reconcileOpenAppServerToolCalls(state, turnId) {
+        if (state.openToolCalls.size === 0)
+            return;
+        const callIds = [...state.openToolCalls.keys()];
+        logger.warn(`[CodexRunner] Turn completed with ${callIds.length} open tool call(s): ` +
+            `thread=${state.threadId} turn=${turnId || state.turnId || 'unknown'} calls=${callIds.join(',')}`);
+        for (const [callId, name] of state.openToolCalls) {
+            yield {
+                type: 'tool_result',
+                name,
+                result: '',
+                isError: true,
+                error: 'Codex app-server ended the turn without an item/completed notification',
+                callId,
+            };
+        }
+        state.openToolCalls.clear();
+    }
+    *mapAppServerItemStarted(item, state) {
+        if (!item)
+            return;
+        switch (item.type) {
+            case 'commandExecution':
+                yield { type: 'tool_use', name: 'Shell', input: { command: item.command, cwd: item.cwd }, callId: item.id };
+                break;
+            case 'mcpToolCall':
+                yield { type: 'tool_use', name: `MCP:${item.server}/${item.tool}`, input: item.arguments, callId: item.id };
+                break;
+            case 'dynamicToolCall':
+                yield { type: 'tool_use', name: item.namespace ? `${item.namespace}:${item.tool}` : item.tool, input: item.arguments, callId: item.id };
+                break;
+            case 'fileChange': {
+                const editEvent = this.buildCodexEditEvent(item.id, item.changes);
+                if (editEvent) {
+                    if (item.id)
+                        state?.emittedEditCallIds.add(item.id);
+                    yield editEvent;
+                }
+                else {
+                    const desc = this.normalizeFileChanges(item.changes).map((change) => this.describeFileChange(change)).join(', ');
+                    if (desc) {
+                        yield { type: 'tool_use', name: 'FileChange', input: { description: desc }, callId: item.id };
+                    }
+                }
+                break;
+            }
+            case 'webSearch':
+                yield {
+                    type: 'tool_use',
+                    name: 'WebSearch',
+                    input: {
+                        query: item.query,
+                        ...(item.action != null ? { action: item.action } : {}),
+                    },
+                    callId: item.id,
+                };
+                break;
+            case 'collabAgentToolCall':
+                yield {
+                    type: 'tool_use',
+                    name: `Collab:${item.tool}`,
+                    input: {
+                        receiverThreadIds: item.receiverThreadIds,
+                        ...(item.prompt != null ? { prompt: item.prompt } : {}),
+                        ...(item.model != null ? { model: item.model } : {}),
+                        ...(item.reasoningEffort != null ? { reasoningEffort: item.reasoningEffort } : {}),
+                    },
+                    callId: item.id,
+                };
+                break;
+            case 'imageView':
+                yield { type: 'tool_use', name: 'ViewImage', input: { path: item.path }, callId: item.id };
+                break;
+            case 'sleep':
+                yield { type: 'tool_use', name: 'Sleep', input: { durationMs: item.durationMs }, callId: item.id };
+                break;
+            case 'imageGeneration':
+                yield {
+                    type: 'tool_use',
+                    name: 'ImageGeneration',
+                    input: item.revisedPrompt != null ? { prompt: item.revisedPrompt } : {},
+                    callId: item.id,
+                };
+                break;
+            case 'subAgentActivity':
+                yield {
+                    type: 'task_progress',
+                    summary: `Subagent ${item.kind}: ${item.agentPath || item.agentThreadId}`,
+                };
+                break;
+            case 'enteredReviewMode':
+                yield { type: 'task_progress', summary: item.review || 'Review mode entered' };
+                break;
+            case 'exitedReviewMode':
+                yield { type: 'task_progress', summary: item.review || 'Review mode exited' };
+                break;
+            case 'plan':
+                yield { type: 'task_progress', summary: item.text || '计划已更新' };
+                break;
+        }
+    }
+    *mapAppServerItemCompleted(item, state) {
+        if (!item)
+            return;
+        switch (item.type) {
+            case 'agentMessage':
+                {
+                    const buffered = item.id ? state.agentMessageDeltaText.get(item.id) : undefined;
+                    const text = typeof item.text === 'string' && item.text ? item.text : buffered;
+                    if (text)
+                        yield { type: 'text', text };
+                    if (item.id)
+                        state.agentMessageDeltaText.delete(item.id);
+                }
+                break;
+            case 'commandExecution':
+                yield {
+                    type: 'tool_result',
+                    name: 'Shell',
+                    result: item.aggregatedOutput ?? '',
+                    isError: item.exitCode !== null && item.exitCode !== undefined ? item.exitCode !== 0 : item.status === 'failed',
+                    callId: item.id,
+                    durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
+                };
+                break;
+            case 'mcpToolCall':
+                yield {
+                    type: 'tool_result',
+                    name: `MCP:${item.server}/${item.tool}`,
+                    result: item.result,
+                    isError: item.status === 'failed',
+                    error: item.error?.message,
+                    callId: item.id,
+                    durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
+                };
+                break;
+            case 'dynamicToolCall':
+                yield {
+                    type: 'tool_result',
+                    name: item.namespace ? `${item.namespace}:${item.tool}` : item.tool,
+                    result: item.contentItems,
+                    isError: item.success === false || item.status === 'failed',
+                    callId: item.id,
+                    durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
+                };
+                break;
+            case 'fileChange':
+                if (this.fileChangesHaveProtocolDiff(item.changes)) {
+                    if (item.id && !state.emittedEditCallIds.has(item.id)) {
+                        const editEvent = this.buildCodexEditEvent(item.id, item.changes);
+                        if (editEvent) {
+                            state.emittedEditCallIds.add(item.id);
+                            yield editEvent;
+                        }
+                    }
+                    yield { type: 'tool_result', name: 'Edit', result: item.changes, isError: item.status === 'failed', callId: item.id };
+                }
+                else {
+                    const desc = this.normalizeFileChanges(item.changes).map((change) => this.describeFileChange(change)).join(', ');
+                    yield { type: 'tool_use', name: 'FileChange', input: { description: desc }, callId: item.id };
+                    yield { type: 'tool_result', name: 'FileChange', result: item.changes, isError: item.status === 'failed', callId: item.id };
+                }
+                break;
+            case 'webSearch':
+                yield {
+                    type: 'tool_result',
+                    name: 'WebSearch',
+                    result: {
+                        query: item.query,
+                        ...(item.action != null ? { action: item.action } : {}),
+                    },
+                    isError: false,
+                    callId: item.id,
+                };
+                break;
+            case 'collabAgentToolCall':
+                yield {
+                    type: 'tool_result',
+                    name: `Collab:${item.tool}`,
+                    result: {
+                        receiverThreadIds: item.receiverThreadIds,
+                        agentsStates: item.agentsStates,
+                    },
+                    isError: item.status === 'failed',
+                    error: item.status === 'failed' ? 'Collaboration tool call failed' : undefined,
+                    callId: item.id,
+                };
+                break;
+            case 'imageView':
+                yield { type: 'tool_result', name: 'ViewImage', result: { path: item.path }, isError: false, callId: item.id };
+                break;
+            case 'sleep':
+                yield {
+                    type: 'tool_result',
+                    name: 'Sleep',
+                    result: { durationMs: item.durationMs },
+                    isError: false,
+                    callId: item.id,
+                    durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
+                };
+                break;
+            case 'imageGeneration':
+                yield {
+                    type: 'tool_result',
+                    name: 'ImageGeneration',
+                    result: {
+                        ...(item.savedPath != null ? { savedPath: item.savedPath } : {}),
+                        ...(item.revisedPrompt != null ? { revisedPrompt: item.revisedPrompt } : {}),
+                    },
+                    isError: item.status === 'failed',
+                    error: item.status === 'failed' ? 'Image generation failed' : undefined,
+                    callId: item.id,
+                };
+                break;
+        }
+    }
+    *mapAppServerFileChangePatchUpdated(params, state) {
+        const itemId = typeof params.itemId === 'string' ? params.itemId : undefined;
+        if (!itemId || state.emittedEditCallIds.has(itemId))
+            return;
+        const editEvent = this.buildCodexEditEvent(itemId, params.changes);
+        if (!editEvent)
+            return;
+        state.emittedEditCallIds.add(itemId);
+        yield editEvent;
+    }
+    buildCodexEditEvent(callId, changes) {
+        const editInput = this.buildCodexEditInput(changes);
+        if (!editInput)
+            return null;
+        return { type: 'tool_use', name: 'Edit', input: editInput, callId };
+    }
+    buildCodexEditInput(changes) {
+        const normalized = this.normalizeFileChanges(changes)
+            .map((change) => this.normalizeCodexProtocolDiffChange(change))
+            .filter((change) => !!change);
+        if (normalized.length === 0)
+            return null;
+        const first = normalized[0];
+        return {
+            file_path: first.path,
+            unified_diff: normalized.map(change => this.formatCodexUnifiedDiff(change)).join('\n'),
+            codex_file_changes: normalized,
+        };
+    }
+    normalizeCodexProtocolDiffChange(change) {
+        const filePath = typeof change?.path === 'string' ? change.path : '';
+        const diff = typeof change?.diff === 'string' ? change.diff
+            : typeof change?.unified_diff === 'string' ? change.unified_diff
+                : typeof change?.unifiedDiff === 'string' ? change.unifiedDiff
+                    : '';
+        if (!filePath || !diff)
+            return null;
+        return {
+            path: filePath,
+            diff,
+            kind: this.normalizeFileChangeKind(change.kind ?? change.type),
+        };
+    }
+    fileChangesHaveProtocolDiff(changes) {
+        return this.buildCodexEditInput(changes) !== null;
+    }
+    formatCodexUnifiedDiff(change) {
+        const pathLabel = change.path.replace(/\\/g, '/');
+        const diffPath = pathLabel.replace(/^\/+/, '');
+        const header = change.diff.startsWith('diff ')
+            || change.diff.startsWith('--- ')
+            || change.diff.startsWith('+++ ')
+            ? ''
+            : `--- a/${diffPath}\n+++ b/${diffPath}\n`;
+        return `${header}${change.diff.trimEnd()}`;
+    }
+    pickNumber(...values) {
+        for (const value of values) {
+            if (typeof value === 'number' && Number.isFinite(value))
+                return value;
+        }
+        return undefined;
+    }
+    mapCodexTokenUsage(raw) {
+        if (!raw || typeof raw !== 'object')
+            return undefined;
+        const usage = {
+            input_tokens: this.pickNumber(raw.inputTokens, raw.input_tokens),
+            output_tokens: this.pickNumber(raw.outputTokens, raw.output_tokens),
+            cache_read_input_tokens: this.pickNumber(raw.cachedInputTokens, raw.cache_read_input_tokens, raw.cached_input_tokens),
+            cache_creation_input_tokens: this.pickNumber(raw.cacheCreationInputTokens, raw.cache_creation_input_tokens, raw.cache_creation_tokens),
+        };
+        return Object.values(usage).some(value => value !== undefined) ? usage : undefined;
+    }
+    mapCodexContextUsage(raw) {
+        if (!raw || typeof raw !== 'object')
+            return undefined;
+        const totalTokens = this.pickNumber(raw.totalTokens, raw.total_tokens, raw.total);
+        const maxTokens = this.pickNumber(raw.maxTokens, raw.max_tokens, raw.max);
+        const model = typeof raw.model === 'string' ? raw.model : undefined;
+        if (totalTokens === undefined || maxTokens === undefined || !model)
+            return undefined;
+        const percentage = this.pickNumber(raw.percentage) ?? Math.round((totalTokens / maxTokens) * 100);
+        const effort = typeof raw.effort === 'string' ? raw.effort : undefined;
+        return { totalTokens, maxTokens, percentage, model, effort };
+    }
+    mapAppServerTurnComplete(turn, state) {
+        const status = turn.status || 'completed';
+        const tokenUsage = this.mapCodexTokenUsage(state.tokenUsage?.last ?? turn.tokenUsage ?? turn.usage);
+        const contextUsage = this.mapCodexContextUsage(turn.contextUsage ?? state.tokenUsage?.contextUsage ?? state.tokenUsage?.context);
+        const terminalReason = status === 'completed'
+            ? undefined
+            : status === 'interrupted'
+                ? 'aborted_streaming'
+                : status;
+        return {
+            type: 'complete',
+            subtype: status === 'completed' ? 'success' : status,
+            isError: status === 'failed',
+            errors: turn.error?.message ? [turn.error.message] : undefined,
+            terminalReason,
+            durationMs: typeof turn.durationMs === 'number' ? turn.durationMs : undefined,
+            ttftMs: this.pickNumber(turn.ttftMs, turn.ttft_ms),
+            costUsd: this.pickNumber(turn.costUsd, turn.totalCostUsd, turn.total_cost_usd),
+            sessionTitle: typeof turn.sessionTitle === 'string' ? turn.sessionTitle : typeof turn.session_title === 'string' ? turn.session_title : undefined,
+            numTurns: this.pickNumber(turn.numTurns, turn.num_turns),
+            model: state.model,
+            tokenUsage,
+            contextUsage,
+        };
+    }
+    managedTempParent() {
+        const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
+        return path.join(resolveProtectedCandidate(os.tmpdir()), `evolcore-codex-${uid}`);
+    }
+    ensurePrivateDirectory(directory) {
+        try {
+            fs.mkdirSync(directory, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error?.code !== 'EEXIST')
+                throw error;
+        }
+        const stat = fs.lstatSync(directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink()) {
+            throw new Error(`managed temp path is not a real directory: ${directory}`);
+        }
+        if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+            throw new Error(`managed temp path is owned by another uid: ${directory}`);
+        }
+        if ((stat.mode & 0o077) !== 0)
+            fs.chmodSync(directory, 0o700);
+    }
+    ensureSessionTempDir(sessionId) {
+        const existing = this.sessionTempDirs.get(sessionId);
+        if (existing) {
+            try {
+                this.ensurePrivateDirectory(this.managedTempParent());
+                this.ensurePrivateDirectory(existing);
+                return existing;
+            }
+            catch (error) {
+                this.sessionTempDirs.delete(sessionId);
+                logger.warn(`[CodexRunner] existing managed TMPDIR is no longer usable: session=${sessionId} path=${existing} error=${error instanceof Error ? error.message : String(error)}`);
+                return undefined;
+            }
+        }
+        try {
+            const parent = this.managedTempParent();
+            this.ensurePrivateDirectory(parent);
+            // Include a per-runner nonce so a daemon restart never reuses contents
+            // left behind by an unclean shutdown for the same EvolCore session id.
+            const digest = createHash('sha256')
+                .update(this.managedTempNonce)
+                .update('\0')
+                .update(sessionId)
+                .digest('hex')
+                .slice(0, 24);
+            const directory = path.join(parent, digest);
+            this.ensurePrivateDirectory(directory);
+            this.sessionTempDirs.set(sessionId, directory);
+            registerManagedTempDirForExitCleanup(directory, parent);
+            return directory;
+        }
+        catch (error) {
+            logger.warn(`[CodexRunner] managed TMPDIR unavailable for session=${sessionId}: ${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }
+    }
+    isTrustedSessionTempDir(directory) {
+        try {
+            const rawStat = fs.lstatSync(directory);
+            if (!rawStat.isDirectory() || rawStat.isSymbolicLink())
+                return false;
+            const parent = resolveProtectedCandidate(this.managedTempParent());
+            const canonical = resolveProtectedCandidate(directory);
+            for (const candidate of [parent, canonical]) {
+                const stat = fs.lstatSync(candidate);
+                if (!stat.isDirectory() || stat.isSymbolicLink())
+                    return false;
+                if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                    return false;
+                if ((stat.mode & 0o077) !== 0)
+                    return false;
+            }
+            return canonical !== parent && isSameOrDescendant(canonical, parent);
+        }
+        catch {
+            return false;
+        }
+    }
+    cleanupSessionTempDir(sessionId) {
+        const directory = this.sessionTempDirs.get(sessionId);
+        this.sessionTempDirs.delete(sessionId);
+        if (!directory)
+            return;
+        const parent = resolveProtectedCandidate(this.managedTempParent());
+        const candidate = resolveProtectedCandidate(directory);
+        if (candidate === parent || !isSameOrDescendant(candidate, parent)) {
+            managedTempDirsForExitCleanup.delete(directory);
+            logger.warn(`[CodexRunner] refused to clean unmanaged TMPDIR: session=${sessionId} path=${directory}`);
+            return;
+        }
+        try {
+            fs.rmSync(candidate, { recursive: true, force: true });
+            managedTempDirsForExitCleanup.delete(directory);
+        }
+        catch (error) {
+            logger.warn(`[CodexRunner] failed to clean managed TMPDIR: session=${sessionId} path=${candidate} error=${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    managedTempInstruction(sessionId) {
+        if (!this.ensureSessionTempDir(sessionId))
+            return undefined;
+        return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。';
+    }
+    buildEvolcoreShellEnvironmentConfig(sessionId) {
+        const managedTempDir = this.ensureSessionTempDir(sessionId);
+        return {
+            shell_environment_policy: {
+                set: {
+                    EVOLCORE_SESSION_ID: sessionId,
+                    EVOLCORE_HOME: resolveRoot(),
+                    ...(managedTempDir ? { TMPDIR: managedTempDir } : {}),
+                },
+            },
+        };
+    }
+    async dispose() {
+        // Abort all active streams
+        for (const [key, controller] of this.activeAbortControllers) {
+            controller.abort('dispose');
+        }
+        this.activeAbortControllers.clear();
+        this.activeStreams.clear();
+        this.activeSessions.clear();
+        this.activeTurns.clear();
+        this.threadProjectPaths.clear();
+        this.threadExternalToolFingerprints.clear();
+        this.threadExternalToolBoundaries.clear();
+        this.trackedApprovalItems.clear();
+        this.pendingInterrupts.clear();
+        this.permissionContexts.clear();
+        this.chatModes.clear();
+        for (const sessionId of [...this.sessionTempDirs.keys()])
+            this.cleanupSessionTempDir(sessionId);
+        await this.appServerClient?.close();
+        this.appServerClient = null;
+    }
+}
+// ── Plugin ──
+export class CodexAgentPlugin {
+    name = 'codex';
+    isEnabled(agent) {
+        if (!agent.config.baseagents?.codex)
+            return false;
+        if (!isCodexAppServerAvailable())
+            return false;
+        try {
+            const override = agent.config.baseagents.codex;
+            const syntheticConfig = { agents: { codex: override } };
+            const resolved = resolveOpenaiConfig(syntheticConfig, override);
+            return !!resolved.apiKey;
+        }
+        catch {
+            return false;
+        }
+    }
+    createAgent(agent, callbacks) {
+        const availability = getCodexAppServerAvailability();
+        if (!availability.available) {
+            throw new Error(availability.reason || 'Missing codex CLI with app-server');
+        }
+        const override = agent.config.baseagents?.codex;
+        const merged = {
+            agents: {
+                codex: {
+                    ...(override || {}),
+                    evolcoreAgentAid: agent.config.aid,
+                    evolcoreAgentConfig: agent.config,
+                },
+            },
+        };
+        return { evolagentName: agent.name, baseagent: 'codex', agent: new CodexRunner(merged, callbacks) };
+    }
+}