evolcore 0.0.10 → 0.0.11

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.11 (2026-08-11)
+
+### Agent 初始化与引导
+
+- `ec init` 支持在任意交互步骤连续按两次 Esc 或使用 Ctrl+C 安全退出，并完善二维码超时后的重新生成、手动绑定与取消清理流程。
+- 重新设计 Agent bootstrap 引导消息，在 Agent 完成初始化后可靠投递，并通过持久化和去重避免断线重试造成消息丢失或重复。
+
+### 权限与消息可靠性
+
+- 扩展安全只读 Shell 查询和环境变量解析能力，统一工具授权、危险命令识别与审批边界。
+- 完善 AUN 关键消息的持久化、去重和日志落盘，提升断线恢复与异常重试时的一致性。
+
+### 请求身份与模型目录
+
+- 模型请求统一携带 EvolCore 版本、Agent AID 和 BaseAgent 类型，便于网关进行来源识别、审计和问题定位。
+- Claude 元数据请求复用 Agent 自定义请求头，同时隔离公共模型目录请求中的 API Key、租户头和 Agent 身份信息。
+
+### 热重载
+
+- 同一 Agent 的重载操作改为串行执行；任务繁忙时默认拒绝重载，也可通过 `--force` 清理队列并等待运行中任务中断。
+- 为 runner 与渠道重载建立明确的提交边界和失败回滚，完善 resync 下线清理，避免重载失败后残留旧实例或半更新状态。
+
 ## 0.0.10 (2026-08-06)
 
 ### 数据迁移

package/README.md

@@ -86,13 +86,13 @@ ResponseEngine.processMessage()
 **一行安装（macOS / Linux）**：
 
 ```bash
-curl -fsSL https://download.evolai.cn/releases/evolcore/2026-08-05.2/install.sh | bash
+curl -fsSL https://download.evolai.cn/install.sh | bash
 ```
 
 **Windows PowerShell**：
 
 ```powershell
-& ([scriptblock]::Create((irm https://download.evolai.cn/releases/evolcore/2026-08-05.2/install.ps1))) -AutoStart
+& ([scriptblock]::Create((irm https://download.evolai.cn/install.ps1))) -AutoStart
 ```
 
 安装器会自动进入 `ec init` 交互向导；只有已有配置同时包含控制 AID 和 Owner 时才跳过。上面的 Windows 命令会在绑定完成后自动运行 `ec start`；macOS/Linux 需手动运行 `ec start`。安装器不会停止或重启已有服务，详细流程见 [一键安装脚本说明](docs/evolcore-install-script.md)。
@@ -145,7 +145,7 @@ ec init aun
 - 渠道选择（飞书 / 微信 / 钉钉 / QQ 频道 / 企业微信 / AUN）并扫码登录
 - 默认项目路径
 - 模型选择（sonnet/opus/haiku）
-- owner 配置：默认走 **Evol App 扫码绑定**，若无 Evol App 可手工录入 AID 兜底
+- owner 配置：默认走 **Evol App 扫码绑定**，若无 Evol App 可手工录入 AID 兜底。扫码流程只追加 owner；移除 owner 请直接编辑对应 JSON 配置。
 - 自动写入 `EVOLCORE_HOME` 到 shell profile（Unix）或用户环境变量（Windows）
 
 配置文件生成在 `{EVOLCORE_HOME}/data/daemon.json`（默认 `~/.evolcore/data/daemon.json`）。

package/dist/agents/baseagent.js

@@ -279,6 +279,8 @@ export function resolveOpenaiConfig(config, override) {
         effort,
         enableRequestUserInput,
         approvalsReviewer,
+        evolcoreAgentAid: override?.evolcoreAgentAid ?? config.agents?.codex?.evolcoreAgentAid,
+        evolcoreAgentConfig: override?.evolcoreAgentConfig ?? config.agents?.codex?.evolcoreAgentConfig,
     };
 }
 export function resolveGoogleConfig(config, override) {
@@ -325,11 +327,13 @@ export function resolveEcagentConfig(config, override) {
         || process.env.ECAGENT_BASE_URL
         || DEFAULT_ECAGENT_BASE_URL;
     const model = override?.model || configured?.model || DEFAULT_ECAGENT_MODEL;
+    const headers = normalizeStringMap(override?.headers ?? configured?.headers, 'headers');
     const effort = override?.effort ?? configured?.effort;
     const numberOr = (value, fallback) => (typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : fallback);
     return {
         apiKey,
         baseUrl,
+        headers,
         model,
         effort,
         timeoutMs: numberOr(override?.timeoutMs ?? configured?.timeoutMs, DEFAULT_ECAGENT_TIMEOUT_MS),

package/dist/agents/claude-runner.js

@@ -1,6 +1,8 @@
-import { query, forkSession as sdkForkSession, getSessionMessages as sdkGetSessionMessages, resolveSettings as sdkResolveSettings } from '@anthropic-ai/claude-agent-sdk';
+import { query, forkSession as sdkForkSession, getSessionMessages as sdkGetSessionMessages, resolveSettings as sdkResolveSettings, } from '@anthropic-ai/claude-agent-sdk';
+import { spawn } from 'child_process';
 import { atomicReadJson, atomicWriteJson, ensureDir } from '../utils/atomic-write.js';
 import { resolveAnthropicConfig } from './baseagent.js';
+import { buildModelRequestHeaders } from './request-identity.js';
 import { DEFAULT_PERMISSION_MODE } from '../types.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
@@ -11,6 +13,7 @@ import crypto from 'crypto';
 import { logger } from '../utils/logger.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
+import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
 import { summarizeToolInput } from '../utils/tool-summary.js';
 import { encodePath } from '../utils/cross-platform.js';
 import { getPackageRoot, resolvePaths } from '../paths.js';
@@ -20,7 +23,7 @@ import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/
 import { normalizePermissionMode } from '../core/permission/mode.js';
 import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, resolveProtectedCandidate, } from '../core/protected-paths.js';
-import { ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
@@ -59,6 +62,22 @@ const CLAUDE_BUILTIN_TOOLS = new Set([
     'WebSearch',
     'Write',
 ]);
+function spawnClaudeWithHClassGuard(options, root, onStderr) {
+    const guarded = buildHClassGuardCommand(options.command, options.args, root);
+    if (!guarded) {
+        throw new Error('Claude owner bypass 缺少 EvolCore H 类路径隔离运行时，已拒绝启动');
+    }
+    const child = spawn(guarded.command, guarded.args, {
+        cwd: options.cwd,
+        env: options.env,
+        signal: options.signal,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        windowsHide: true,
+    });
+    child.stderr.on('data', chunk => onStderr(String(chunk)));
+    child.stderr.on('error', error => onStderr(`[ClaudeGuard] stderr read failed: ${error.message}`));
+    return child;
+}
 function isClaudeMcpTool(toolName) {
     return toolName.startsWith('mcp__');
 }
@@ -337,7 +356,7 @@ function apiPricingToQuad(p) {
 }
 /** 拉取网关 /v1/models 的官方价(pricing) + 网关价(effective_pricing)，写入 gatewayPricingCache。
  *  失败静默——保持回退到本地价表 / official。 */
-async function refreshGatewayPricing(baseUrl, apiKey) {
+async function refreshGatewayPricing(baseUrl, apiKey, requestHeaders) {
     if (gatewayPricingInFlight.has(baseUrl))
         return;
     gatewayPricingInFlight.add(baseUrl);
@@ -347,7 +366,10 @@ async function refreshGatewayPricing(baseUrl, apiKey) {
         const timer = setTimeout(() => controller.abort(), 5000);
         const resp = await fetch(url, {
             signal: controller.signal,
-            headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+            headers: {
+                ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+                ...requestHeaders,
+            },
         });
         clearTimeout(timer);
         if (!resp.ok)
@@ -408,7 +430,7 @@ function deriveAliasesFromModelIds(ids) {
     return aliases;
 }
 /** 异步刷新某 baseUrl 的别名缓存（失败静默，不抛出） */
-async function refreshModelAliases(baseUrl, apiKey) {
+async function refreshModelAliases(baseUrl, apiKey, requestHeaders) {
     const cacheKey = normalizeModelGatewayUrl(baseUrl);
     if (modelAliasInFlight.has(cacheKey))
         return;
@@ -420,7 +442,10 @@ async function refreshModelAliases(baseUrl, apiKey) {
         const timer = setTimeout(() => controller.abort(), 5000);
         const resp = await fetch(url, {
             signal: controller.signal,
-            headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+            headers: {
+                ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+                ...requestHeaders,
+            },
         });
         clearTimeout(timer);
         if (!resp.ok)
@@ -571,13 +596,18 @@ export class AgentRunner {
         if (config) {
             const anthropic = resolveAnthropicConfig(config);
             this.claudeExecutablePath = anthropic.pathToClaudeCodeExecutable;
-            this.customHeaders = anthropic.headers;
+            this.customHeaders = buildModelRequestHeaders({
+                baseagent: 'claude',
+                baseUrl: anthropic.baseUrl,
+                agentAid: config.agents?.claude?.evolcoreAgentAid,
+                configuredHeaders: anthropic.headers,
+            });
             this.customQueryParams = anthropic.queryParams;
         }
     }
-    getAgentEnv(runtimeEnv, evolcoreSessionId) {
+    getAgentEnv(runtimeEnv, evolcoreSessionId, permissionMode) {
         const anthropicBaseUrl = appendQueryParams(this.baseUrl, this.customQueryParams);
-        const env = {
+        const env = sanitizeShellExecutionEnvironment({
             ...process.env,
             ANTHROPIC_AUTH_TOKEN: this.apiKey,
             ANTHROPIC_API_KEY: this.apiKey,
@@ -589,7 +619,7 @@ export class AgentRunner {
                 : {}),
             ...(evolcoreSessionId ? { EVOLCORE_SESSION_ID: evolcoreSessionId } : {}),
             ...(runtimeEnv ?? {}),
-        };
+        }, { lockExecutableResolution: permissionMode === 'readonly' });
         const bubblewrapPath = resolveBubblewrapPath();
         return bubblewrapPath
             ? prependExecutableDirectory(env, bubblewrapPath)
@@ -608,7 +638,7 @@ export class AgentRunner {
             return undefined;
         const entry = gatewayPricingCache.get(this.baseUrl);
         if (!entry || Date.now() - entry.fetchedAt > GATEWAY_PRICING_TTL_MS) {
-            refreshGatewayPricing(this.baseUrl, this.apiKey); // 不 await，stale-while-revalidate
+            refreshGatewayPricing(this.baseUrl, this.apiKey, this.customHeaders); // 不 await，stale-while-revalidate
         }
         return entry?.cache;
     }
@@ -617,11 +647,26 @@ export class AgentRunner {
         let agentConfig = claudeConfig?.evolcoreAgentConfig;
         if (claudeConfig?.evolcoreAgentAid) {
             try {
-                agentConfig = resolveEffective({ self: claudeConfig.evolcoreAgentAid }, { cache: true });
+                agentConfig = resolveEffective({ self: claudeConfig.evolcoreAgentAid }, { cache: true, expand: true });
             }
             catch { }
         }
-        return await resolveClaudeCapabilityRunOptionsForProject(agentConfig, projectPath, 'claude');
+        const resolved = await resolveClaudeCapabilityRunOptionsForProject(agentConfig, projectPath, 'claude');
+        const settings = resolved.settings && typeof resolved.settings === 'object' && !Array.isArray(resolved.settings)
+            ? resolved.settings
+            : {};
+        const skillOverrides = settings.skillOverrides
+            && typeof settings.skillOverrides === 'object'
+            && !Array.isArray(settings.skillOverrides)
+            ? settings.skillOverrides
+            : {};
+        return {
+            ...resolved,
+            settings: {
+                ...settings,
+                skillOverrides: { ...skillOverrides, eclink: 'off' },
+            },
+        };
     }
     async listModels() {
         if (this.baseUrl) {
@@ -631,11 +676,11 @@ export class AgentRunner {
             const stale = !cached || (Date.now() - cached.fetchedAt > MODEL_ALIAS_TTL_MS);
             // 缓存为空（首次打开）→ 等待刷新；缓存仅过期 → 后台刷新不阻塞
             if (!cached) {
-                await refreshModelAliases(this.baseUrl, this.apiKey);
+                await refreshModelAliases(this.baseUrl, this.apiKey, this.customHeaders);
                 cached = modelAliasCache.get(cacheKey);
             }
             else if (stale) {
-                refreshModelAliases(this.baseUrl, this.apiKey);
+                refreshModelAliases(this.baseUrl, this.apiKey, this.customHeaders);
             }
             // 有缓存时返回网关 /models 的全量原始 ID
             if (cached && cached.ids.length > 0)
@@ -1729,12 +1774,12 @@ export class AgentRunner {
             const cacheKey = normalizeModelGatewayUrl(this.baseUrl);
             const cached = modelAliasCache.get(cacheKey);
             if (!cached || (Date.now() - cached.fetchedAt > MODEL_ALIAS_TTL_MS)) {
-                refreshModelAliases(this.baseUrl, this.apiKey);
+                refreshModelAliases(this.baseUrl, this.apiKey, this.customHeaders);
             }
             // 顺带预热网关价格缓存（1h TTL），让本轮结束写库时已就绪
             const pricing = gatewayPricingCache.get(this.baseUrl);
             if (!pricing || (Date.now() - pricing.fetchedAt > GATEWAY_PRICING_TTL_MS)) {
-                refreshGatewayPricing(this.baseUrl, this.apiKey);
+                refreshGatewayPricing(this.baseUrl, this.apiKey, this.customHeaders);
             }
         }
         ensureDir(projectPath);
@@ -1859,6 +1904,7 @@ export class AgentRunner {
                 : undefined;
             const preflight = evaluateToolPreflight(toolName, toolInput, {
                 sessionId,
+                selfAid: permCtx?.selfAid,
                 channel: permCtx?.channel,
                 userId: permCtx?.userId,
                 role: permCtx?.role,
@@ -1893,7 +1939,6 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
-                    allowLiteralReadShell: true,
                 };
                 const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
@@ -1974,6 +2019,7 @@ export class AgentRunner {
             const permCtx = this.permissionContexts.get(sessionId);
             const preflight = evaluateToolPreflight(toolName, input, {
                 sessionId,
+                selfAid: permCtx?.selfAid,
                 channel: permCtx?.channel,
                 userId: permCtx?.userId,
                 role: permCtx?.role,
@@ -2043,7 +2089,6 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
-                    allowLiteralReadShell: true,
                 };
                 const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
@@ -2129,7 +2174,9 @@ export class AgentRunner {
             : await (async () => {
                 const sandboxProjectionStartedAt = Date.now();
                 ensureClaudeGitWorktreeConfig(projectPath);
-                const sandboxFilesystem = buildClaudeProtectedFilesystem(resolvePaths().root);
+                const sandboxFilesystem = buildClaudeProtectedFilesystem(resolvePaths().root, {
+                    denyLClassRead: callPermissionMode === 'readonly',
+                });
                 const sandboxUnixSockets = buildClaudeUnixSocketAllowlist(projectPath, {
                     role: runPermissionContext?.role,
                 });
@@ -2153,8 +2200,29 @@ export class AgentRunner {
                 };
             })();
         if (executionSandbox.state === 'off') {
-            logger.info('[ClaudeSandbox] disabled for authenticated owner bypass task');
+            logger.info(process.platform === 'linux'
+                ? '[ClaudeSandbox] task sandbox disabled for authenticated owner bypass; outer H-class guard remains active'
+                : '[ClaudeSandbox] disabled for authenticated owner bypass task');
         }
+        const handleClaudeStderr = (msg) => {
+            const trimmed = msg.trim();
+            if (trimmed) {
+                let buf = this.recentStderr.get(sessionId);
+                if (!buf) {
+                    buf = [];
+                    this.recentStderr.set(sessionId, buf);
+                }
+                buf.push(trimmed);
+                if (buf.length > AgentRunner.STDERR_BUFFER_MAX)
+                    buf.shift();
+            }
+            if (msg.includes('[ERROR]') || msg.includes('[WARN]') || msg.includes('Stream started')) {
+                logger.info(`[Claude-stderr] ${trimmed}`);
+            }
+            else {
+                logger.debug(`[Claude-stderr] ${trimmed}`);
+            }
+        };
         const commonOptions = {
             cwd: projectPath,
             model: sdkModel,
@@ -2163,6 +2231,9 @@ export class AgentRunner {
             managedSettings,
             ...(callEffort ? { effort: callEffort } : {}),
             ...(this.claudeExecutablePath ? { pathToClaudeCodeExecutable: this.claudeExecutablePath } : {}),
+            ...(executionSandbox.state === 'off' && process.platform === 'linux' ? {
+                spawnClaudeCodeProcess: (options) => spawnClaudeWithHClassGuard(options, resolvePaths().root, handleClaudeStderr),
+            } : {}),
             autoCompactWindow: autoCompactWindowForModel(sdkModel),
             advisorModel: 'haiku',
             canUseTool: canUseToolCallback,
@@ -2177,27 +2248,8 @@ export class AgentRunner {
                 PermissionDenied: [{ matcher: '.*', hooks: [permissionDeniedHook] }]
             },
             ...(enableSummaries ? { agentProgressSummaries: true } : {}),
-            stderr: (msg) => {
-                const trimmed = msg.trim();
-                if (trimmed) {
-                    // 环形缓冲：保留最近 N 行，供子进程崩溃时还原真实原因
-                    let buf = this.recentStderr.get(sessionId);
-                    if (!buf) {
-                        buf = [];
-                        this.recentStderr.set(sessionId, buf);
-                    }
-                    buf.push(trimmed);
-                    if (buf.length > AgentRunner.STDERR_BUFFER_MAX)
-                        buf.shift();
-                }
-                if (msg.includes('[ERROR]') || msg.includes('[WARN]') || msg.includes('Stream started')) {
-                    logger.info(`[Claude-stderr] ${trimmed}`);
-                }
-                else {
-                    logger.debug(`[Claude-stderr] ${trimmed}`);
-                }
-            },
-            env: this.getAgentEnv(runtimeEnv, sessionId)
+            stderr: handleClaudeStderr,
+            env: this.getAgentEnv(runtimeEnv, sessionId, callPermissionMode)
         };
         const createQuery = (promptInput, resumeSessionId, resumeAt) => {
             if (useSettingSources) {
@@ -2479,6 +2531,35 @@ export class AgentRunner {
         this.activeQueries.delete(sessionId);
         this.permissionContexts.delete(sessionId);
     }
+    async dispose() {
+        const interrupts = [...this.interruptFns.values()].map(async (interrupt) => {
+            try {
+                await interrupt();
+            }
+            catch { }
+        });
+        await Promise.allSettled(interrupts);
+        for (const stream of this.activeMessageStreams.values())
+            stream.end();
+        for (const query of this.activeQueries.values()) {
+            try {
+                if (typeof query?.close === 'function')
+                    await query.close();
+            }
+            catch { }
+        }
+        for (const resolve of this.streamDoneResolvers.values())
+            resolve();
+        this.activeSessions.clear();
+        this.activeStreams.clear();
+        this.activeMessageStreams.clear();
+        this.interruptFns.clear();
+        this.activeQueries.clear();
+        this.streamDone.clear();
+        this.streamDoneResolvers.clear();
+        this.permissionContexts.clear();
+        this.recentStderr.clear();
+    }
     resolveSessionFile(agentSessionId, projectPath) {
         const encodedProjectPath = encodePath(projectPath);
         const sessionFile = path.join(os.homedir(), '.claude', 'projects', encodedProjectPath, `${agentSessionId}.jsonl`);

package/dist/agents/codex-app-server-client.js

@@ -4,6 +4,8 @@ import { logger } from '../utils/logger.js';
 import { buildHClassGuardCommand } from '../core/permission/sandbox-runtime.js';
 import { resolveCodexLaunchCommand } from '../utils/codex-cli.js';
 import { createHash } from 'crypto';
+import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
+const BUILT_IN_CODEX_PROVIDER_IDS = new Set(['openai']);
 function tomlProviderKey(value) {
     if (!value || /[\0\r\n]/.test(value)) {
         throw new Error(`Invalid Codex provider name: ${value}`);
@@ -19,6 +21,10 @@ function codexHeaderEnvName(headerName) {
     const digest = createHash('sha256').update(headerName).digest('hex').slice(0, 16).toUpperCase();
     return `EVOLCORE_CODEX_HEADER_${digest}`;
 }
+function runtimeProviderId(baseUrl) {
+    const digest = createHash('sha256').update(baseUrl || 'default').digest('hex').slice(0, 12);
+    return `evolcore_runtime_${digest}`;
+}
 function hasPermissionProfile(config) {
     if (!config || typeof config.default_permissions !== 'string' || !config.default_permissions)
         return false;
@@ -341,14 +347,7 @@ export class CodexAppServerClient {
         }
     }
     startProcess() {
-        const env = { ...process.env, ...this.options.env };
-        env.CODEX_API_KEY = this.options.apiKey;
-        for (const [name, value] of Object.entries(this.options.headers ?? {})) {
-            env[codexHeaderEnvName(name)] = value;
-        }
-        if (this.options.baseUrl) {
-            env.OPENAI_BASE_URL = this.options.baseUrl;
-        }
+        const env = this.buildProcessEnvironment();
         const args = this.buildProcessArgs();
         const launchCommand = resolveCodexLaunchCommand(args);
         if (!launchCommand)
@@ -378,6 +377,20 @@ export class CodexAppServerClient {
             logger.debug(`[CodexAppServer] ${text}`);
         });
     }
+    buildProcessEnvironment() {
+        const env = sanitizeShellExecutionEnvironment({
+            ...process.env,
+            ...this.options.env,
+        });
+        env.CODEX_API_KEY = this.options.apiKey;
+        for (const [name, value] of Object.entries(this.options.headers ?? {})) {
+            env[codexHeaderEnvName(name)] = value;
+        }
+        if (this.options.baseUrl) {
+            env.OPENAI_BASE_URL = this.options.baseUrl;
+        }
+        return env;
+    }
     buildProcessArgs() {
         const args = ['app-server', '--listen', 'stdio://'];
         if (this.options.enableRequestUserInput !== false) {
@@ -390,7 +403,18 @@ export class CodexAppServerClient {
         const hasHeaders = Object.keys(headerEnvNames).length > 0;
         const hasQueryParams = Object.keys(this.options.queryParams ?? {}).length > 0;
         if (hasHeaders || hasQueryParams) {
-            const provider = tomlProviderKey(this.options.provider || 'openai');
+            const configuredProvider = this.options.provider?.trim();
+            const useRuntimeProvider = !configuredProvider || BUILT_IN_CODEX_PROVIDER_IDS.has(configuredProvider.toLowerCase());
+            const providerName = !useRuntimeProvider
+                ? configuredProvider
+                : runtimeProviderId(this.options.baseUrl);
+            const provider = tomlProviderKey(providerName);
+            args.push('--config', `model_provider=${JSON.stringify(providerName)}`);
+            args.push('--config', `model_providers.${provider}.name=${JSON.stringify('EvolCore runtime gateway')}`);
+            args.push('--config', `model_providers.${provider}.wire_api=${JSON.stringify('responses')}`);
+            if (useRuntimeProvider || this.options.baseUrl) {
+                args.push('--config', `model_providers.${provider}.base_url=${JSON.stringify(this.options.baseUrl || 'https://api.openai.com/v1')}`);
+            }
             if (hasHeaders) {
                 args.push('--config', `model_providers.${provider}.env_http_headers=${tomlInlineStringTable(headerEnvNames)}`);
             }

package/dist/agents/codex-runner.js

@@ -18,6 +18,7 @@ import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
+import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
 import { classifyEvolcoreShellCommand, parseLiteralShellArgv } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
@@ -25,6 +26,7 @@ import { buildSessionTurnList } from '../core/session/session-turns.js';
 import { execFileSync } from 'child_process';
 import { execCodexCliSync, resolveCodexCliPath } from '../utils/codex-cli.js';
 import { createHash, randomBytes } from 'crypto';
+import { buildModelRequestHeaders } from './request-identity.js';
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
@@ -231,6 +233,12 @@ export class CodexRunner {
     pendingInterruptTtlMs = 30_000;
     constructor(config, callbacks) {
         this.resolvedConfig = resolveOpenaiConfig(config);
+        this.resolvedConfig.headers = buildModelRequestHeaders({
+            baseagent: 'codex',
+            baseUrl: this.resolvedConfig.baseUrl,
+            agentAid: config.agents?.codex?.evolcoreAgentAid,
+            configuredHeaders: this.resolvedConfig.headers,
+        });
         this.resolvedConfig.evolcoreAgentAid = config.agents?.codex?.evolcoreAgentAid;
         this.resolvedConfig.evolcoreAgentConfig = config.agents?.codex?.evolcoreAgentConfig;
         this.capabilities = {
@@ -416,14 +424,35 @@ export class CodexRunner {
     }
     async resolveCapabilityThreadConfig(projectPath) {
         const agentConfig = this.resolvedConfig.evolcoreAgentConfig;
-        if (!agentConfig)
-            return {};
+        if (!agentConfig) {
+            return {
+                skills: { config: [{ name: 'eclink', enabled: false }] },
+            };
+        }
         try {
-            return await resolveCodexCapabilityThreadConfigForProject(agentConfig, projectPath, 'codex');
+            const resolved = await resolveCodexCapabilityThreadConfigForProject(agentConfig, projectPath, 'codex');
+            const skills = this.configRecord(resolved.skills);
+            const configured = Array.isArray(skills?.config)
+                ? skills.config.filter(entry => {
+                    if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+                        return true;
+                    return entry.name !== 'eclink';
+                })
+                : [];
+            return this.mergeThreadConfig(resolved, {
+                skills: {
+                    ...(skills ?? {}),
+                    config: [...configured, { name: 'eclink', enabled: false }],
+                },
+            }) ?? {
+                skills: { config: [{ name: 'eclink', enabled: false }] },
+            };
         }
         catch (error) {
             logger.warn(`[CodexRunner] Failed to resolve Codex capability thread config: ${error}`);
-            return {};
+            return {
+                skills: { config: [{ name: 'eclink', enabled: false }] },
+            };
         }
     }
     configRecord(value) {
@@ -721,7 +750,9 @@ export class CodexRunner {
                 [profileName]: {
                     extends: mode === 'readonly' ? ':read-only' : ':workspace',
                     filesystem: {
-                        ...buildCodexProtectedFilesystemRules(resolveRoot()),
+                        ...buildCodexProtectedFilesystemRules(resolveRoot(), {
+                            denyLClassRead: mode === 'readonly',
+                        }),
                         ...this.resolveGitMetadataWriteRules(projectPath, mode),
                         ...(mode !== 'readonly' && managedTempDir ? {
                             [managedTempDir]: 'write',
@@ -819,7 +850,7 @@ export class CodexRunner {
             approvalPolicy: effectiveApprovalPolicy,
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig()),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig()), callMode),
             ...(developerInstructions ? { developerInstructions } : {}),
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
@@ -1086,7 +1117,7 @@ export class CodexRunner {
                     approvalPolicy: compactPolicy,
                     approvalsReviewer: 'user',
                     ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-                    config: this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig()),
+                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig()), compactMode),
                 });
                 this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
                 this.threadDelegationCarriers.set(agentSessionId, compactDelegationCarrier);
@@ -1236,7 +1267,7 @@ export class CodexRunner {
             approvalPolicy: this.toApprovalPolicy(mode),
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, delegationCarrier), this.buildLifecycleLockdownConfig()),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, delegationCarrier), this.buildLifecycleLockdownConfig()), mode),
         });
         const forkedThreadId = response.thread?.id;
         if (!forkedThreadId)
@@ -1951,6 +1982,7 @@ export class CodexRunner {
         const mode = normalizePermissionMode(rawMode).mode;
         const preflight = evaluateToolPreflight(toolName, toolInput, {
             sessionId: sessionKey,
+            selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
             userId: permissionContext?.userId,
             role: permissionContext?.role,
@@ -2810,6 +2842,24 @@ export class CodexRunner {
             },
         };
     }
+    sanitizeThreadEnvironmentConfig(config, permissionMode) {
+        if (!config)
+            return null;
+        const policy = this.configRecord(config.shell_environment_policy);
+        const set = this.configRecord(policy?.set);
+        if (!policy || !set)
+            return config;
+        const safeSet = sanitizeShellExecutionEnvironment(set, {
+            lockExecutableResolution: permissionMode === 'readonly',
+        });
+        return {
+            ...config,
+            shell_environment_policy: {
+                ...policy,
+                set: safeSet,
+            },
+        };
+    }
     async dispose() {
         // Abort all active streams
         for (const [key, controller] of this.activeAbortControllers) {