evolcore 0.0.10 → 0.0.12

package/CHANGELOG.md

@@ -3,6 +3,50 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.12 (2026-08-19)
+
+### AUN 通信
+
+- 规范结构化提及在消息收发、队列和响应链路中的传递，完善 @all、目标校验和非法载荷处理。
+- 增强入站去重、断线重投和错误回传，避免消息重复处理与错误循环。
+
+### 会话与 Agent
+
+- 串行化 Codex 会话的继续、压缩、分叉和回滚操作，完善 app-server 进程管理和安全清理。
+- 优化 proactive 会话、Handoff 和 Bootstrap 的生命周期处理，隔离并发会话上下文。
+
+### 权限与菜单
+
+- 收敛菜单执行上下文和托管命令授权，强化 EC shell 与 Codex 命令解析边界。
+- 完善菜单批量查询、关系上下文、联系人状态和工具拦截审计。
+
+### 运行兼容性
+
+- 统一跨平台子进程启动和 Windows 窗口处理，改进升级监控与内置 AUN SDK 管理。
+- 统一 Claude、Codex 的技能发现和运行时上下文注入。
+
+## 0.0.11 (2026-08-11)
+
+### Agent 初始化与引导
+
+- `ec init` 支持在任意交互步骤连续按两次 Esc 或使用 Ctrl+C 安全退出，并完善二维码超时后的重新生成、手动绑定与取消清理流程。
+- 重新设计 Agent bootstrap 引导消息，在 Agent 完成初始化后可靠投递，并通过持久化和去重避免断线重试造成消息丢失或重复。
+
+### 权限与消息可靠性
+
+- 扩展安全只读 Shell 查询和环境变量解析能力，统一工具授权、危险命令识别与审批边界。
+- 完善 AUN 关键消息的持久化、去重和日志落盘，提升断线恢复与异常重试时的一致性。
+
+### 请求身份与模型目录
+
+- 模型请求统一携带 EvolCore 版本、Agent AID 和 BaseAgent 类型，便于网关进行来源识别、审计和问题定位。
+- Claude 元数据请求复用 Agent 自定义请求头，同时隔离公共模型目录请求中的 API Key、租户头和 Agent 身份信息。
+
+### 热重载
+
+- 同一 Agent 的重载操作改为串行执行；任务繁忙时默认拒绝重载，也可通过 `--force` 清理队列并等待运行中任务中断。
+- 为 runner 与渠道重载建立明确的提交边界和失败回滚，完善 resync 下线清理，避免重载失败后残留旧实例或半更新状态。
+
 ## 0.0.10 (2026-08-06)
 
 ### 数据迁移

package/README.md

@@ -86,13 +86,13 @@ ResponseEngine.processMessage()
 **一行安装（macOS / Linux）**：
 
 ```bash
-curl -fsSL https://download.evolai.cn/releases/evolcore/2026-08-05.2/install.sh | bash
+curl -fsSL https://download.evolai.cn/install.sh | bash
 ```
 
 **Windows PowerShell**：
 
 ```powershell
-& ([scriptblock]::Create((irm https://download.evolai.cn/releases/evolcore/2026-08-05.2/install.ps1))) -AutoStart
+& ([scriptblock]::Create((irm https://download.evolai.cn/install.ps1))) -AutoStart
 ```
 
 安装器会自动进入 `ec init` 交互向导；只有已有配置同时包含控制 AID 和 Owner 时才跳过。上面的 Windows 命令会在绑定完成后自动运行 `ec start`；macOS/Linux 需手动运行 `ec start`。安装器不会停止或重启已有服务，详细流程见 [一键安装脚本说明](docs/evolcore-install-script.md)。
@@ -145,7 +145,7 @@ ec init aun
 - 渠道选择（飞书 / 微信 / 钉钉 / QQ 频道 / 企业微信 / AUN）并扫码登录
 - 默认项目路径
 - 模型选择（sonnet/opus/haiku）
-- owner 配置：默认走 **Evol App 扫码绑定**，若无 Evol App 可手工录入 AID 兜底
+- owner 配置：默认走 **Evol App 扫码绑定**，若无 Evol App 可手工录入 AID 兜底。扫码流程只追加 owner；移除 owner 请直接编辑对应 JSON 配置。
 - 自动写入 `EVOLCORE_HOME` 到 shell profile（Unix）或用户环境变量（Windows）
 
 配置文件生成在 `{EVOLCORE_HOME}/data/daemon.json`（默认 `~/.evolcore/data/daemon.json`）。

package/bin/codex-managed-hook.mjs

@@ -0,0 +1,80 @@
+import fs from 'node:fs';
+import net from 'node:net';
+
+const timeoutMs = 1500;
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason || 'EvolCore policy denied this tool call.',
+    },
+  }));
+  // Codex 0.147 app-server runs this managed hook but does not reliably honor
+  // the JSON denial alone for thread/shellCommand. Exit 2 is the documented
+  // blocking transport; retain the JSON shape for compatible hook consumers.
+  process.stderr.write(`${reason || 'EvolCore policy denied this tool call.'}\n`);
+  process.exitCode = 2;
+}
+
+function queryDaemon(socketPath, payload) {
+  return new Promise(resolve => {
+    const socket = net.createConnection(socketPath);
+    let buffer = '';
+    let settled = false;
+    let timer;
+    const finish = value => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(value);
+    };
+    timer = setTimeout(() => finish(null), timeoutMs);
+    timer.unref?.();
+    socket.once('error', () => finish(null));
+    socket.once('connect', () => socket.write(JSON.stringify(payload) + '\n'));
+    socket.on('data', chunk => {
+      buffer += String(chunk);
+      const index = buffer.indexOf('\n');
+      if (index < 0) return;
+      try { finish(JSON.parse(buffer.slice(0, index))); } catch { finish(null); }
+    });
+  });
+}
+
+async function main() {
+  const socketPath = process.argv[2];
+  let input;
+  try {
+    input = JSON.parse(fs.readFileSync(0, 'utf8'));
+  } catch {
+    deny('Invalid Codex PreToolUse payload.');
+    return;
+  }
+  if (!socketPath
+    || input?.hook_event_name !== 'PreToolUse'
+    || typeof input?.session_id !== 'string'
+    || !input.session_id
+    || typeof input?.tool_name !== 'string'
+    || !input.tool_name) {
+    deny('Incomplete Codex PreToolUse payload.');
+    return;
+  }
+
+  const result = await queryDaemon(socketPath, {
+    type: 'codex-pre-tool-use',
+    threadId: input.session_id,
+    toolName: typeof input.tool_name === 'string' ? input.tool_name : '',
+    toolInput: input.tool_input ?? null,
+  });
+  if (!result) {
+    deny('EvolCore policy service is unavailable.');
+    return;
+  }
+  if (result.ok === true && result.applicable === true && result.decision === 'allow') return;
+  deny(result.reason || 'EvolCore policy did not explicitly allow this tool call.');
+}
+
+void main();

package/dist/agents/baseagent.js

@@ -279,6 +279,8 @@ export function resolveOpenaiConfig(config, override) {
         effort,
         enableRequestUserInput,
         approvalsReviewer,
+        evolcoreAgentAid: override?.evolcoreAgentAid ?? config.agents?.codex?.evolcoreAgentAid,
+        evolcoreAgentConfig: override?.evolcoreAgentConfig ?? config.agents?.codex?.evolcoreAgentConfig,
     };
 }
 export function resolveGoogleConfig(config, override) {
@@ -325,11 +327,13 @@ export function resolveEcagentConfig(config, override) {
         || process.env.ECAGENT_BASE_URL
         || DEFAULT_ECAGENT_BASE_URL;
     const model = override?.model || configured?.model || DEFAULT_ECAGENT_MODEL;
+    const headers = normalizeStringMap(override?.headers ?? configured?.headers, 'headers');
     const effort = override?.effort ?? configured?.effort;
     const numberOr = (value, fallback) => (typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : fallback);
     return {
         apiKey,
         baseUrl,
+        headers,
         model,
         effort,
         timeoutMs: numberOr(override?.timeoutMs ?? configured?.timeoutMs, DEFAULT_ECAGENT_TIMEOUT_MS),

package/dist/agents/claude-runner.js

@@ -1,6 +1,8 @@
-import { query, forkSession as sdkForkSession, getSessionMessages as sdkGetSessionMessages, resolveSettings as sdkResolveSettings } from '@anthropic-ai/claude-agent-sdk';
+import { query, forkSession as sdkForkSession, getSessionMessages as sdkGetSessionMessages, resolveSettings as sdkResolveSettings, } from '@anthropic-ai/claude-agent-sdk';
+import { spawn } from 'child_process';
 import { atomicReadJson, atomicWriteJson, ensureDir } from '../utils/atomic-write.js';
 import { resolveAnthropicConfig } from './baseagent.js';
+import { buildModelRequestHeaders } from './request-identity.js';
 import { DEFAULT_PERMISSION_MODE } from '../types.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
@@ -11,7 +13,8 @@ import crypto from 'crypto';
 import { logger } from '../utils/logger.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
-import { summarizeToolInput } from '../utils/tool-summary.js';
+import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
+import { summarizeToolInput, summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { encodePath } from '../utils/cross-platform.js';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { resolveEffective } from '../config/config-manager.js';
@@ -20,7 +23,7 @@ import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/
 import { normalizePermissionMode } from '../core/permission/mode.js';
 import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, resolveProtectedCandidate, } from '../core/protected-paths.js';
-import { ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
@@ -59,6 +62,22 @@ const CLAUDE_BUILTIN_TOOLS = new Set([
     'WebSearch',
     'Write',
 ]);
+function spawnClaudeWithHClassGuard(options, root, onStderr) {
+    const guarded = buildHClassGuardCommand(options.command, options.args, root);
+    if (!guarded) {
+        throw new Error('Claude owner bypass 缺少 EvolCore H 类路径隔离运行时，已拒绝启动');
+    }
+    const child = spawn(guarded.command, guarded.args, {
+        cwd: options.cwd,
+        env: options.env,
+        signal: options.signal,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        windowsHide: true,
+    });
+    child.stderr.on('data', chunk => onStderr(String(chunk)));
+    child.stderr.on('error', error => onStderr(`[ClaudeGuard] stderr read failed: ${error.message}`));
+    return child;
+}
 function isClaudeMcpTool(toolName) {
     return toolName.startsWith('mcp__');
 }
@@ -337,7 +356,7 @@ function apiPricingToQuad(p) {
 }
 /** 拉取网关 /v1/models 的官方价(pricing) + 网关价(effective_pricing)，写入 gatewayPricingCache。
  *  失败静默——保持回退到本地价表 / official。 */
-async function refreshGatewayPricing(baseUrl, apiKey) {
+async function refreshGatewayPricing(baseUrl, apiKey, requestHeaders) {
     if (gatewayPricingInFlight.has(baseUrl))
         return;
     gatewayPricingInFlight.add(baseUrl);
@@ -347,7 +366,10 @@ async function refreshGatewayPricing(baseUrl, apiKey) {
         const timer = setTimeout(() => controller.abort(), 5000);
         const resp = await fetch(url, {
             signal: controller.signal,
-            headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+            headers: {
+                ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+                ...requestHeaders,
+            },
         });
         clearTimeout(timer);
         if (!resp.ok)
@@ -408,7 +430,7 @@ function deriveAliasesFromModelIds(ids) {
     return aliases;
 }
 /** 异步刷新某 baseUrl 的别名缓存（失败静默，不抛出） */
-async function refreshModelAliases(baseUrl, apiKey) {
+async function refreshModelAliases(baseUrl, apiKey, requestHeaders) {
     const cacheKey = normalizeModelGatewayUrl(baseUrl);
     if (modelAliasInFlight.has(cacheKey))
         return;
@@ -420,7 +442,10 @@ async function refreshModelAliases(baseUrl, apiKey) {
         const timer = setTimeout(() => controller.abort(), 5000);
         const resp = await fetch(url, {
             signal: controller.signal,
-            headers: apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+            headers: {
+                ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+                ...requestHeaders,
+            },
         });
         clearTimeout(timer);
         if (!resp.ok)
@@ -571,13 +596,18 @@ export class AgentRunner {
         if (config) {
             const anthropic = resolveAnthropicConfig(config);
             this.claudeExecutablePath = anthropic.pathToClaudeCodeExecutable;
-            this.customHeaders = anthropic.headers;
+            this.customHeaders = buildModelRequestHeaders({
+                baseagent: 'claude',
+                baseUrl: anthropic.baseUrl,
+                agentAid: config.agents?.claude?.evolcoreAgentAid,
+                configuredHeaders: anthropic.headers,
+            });
             this.customQueryParams = anthropic.queryParams;
         }
     }
-    getAgentEnv(runtimeEnv, evolcoreSessionId) {
+    getAgentEnv(runtimeEnv, evolcoreSessionId, permissionMode) {
         const anthropicBaseUrl = appendQueryParams(this.baseUrl, this.customQueryParams);
-        const env = {
+        const env = sanitizeShellExecutionEnvironment({
             ...process.env,
             ANTHROPIC_AUTH_TOKEN: this.apiKey,
             ANTHROPIC_API_KEY: this.apiKey,
@@ -589,7 +619,7 @@ export class AgentRunner {
                 : {}),
             ...(evolcoreSessionId ? { EVOLCORE_SESSION_ID: evolcoreSessionId } : {}),
             ...(runtimeEnv ?? {}),
-        };
+        }, { lockExecutableResolution: permissionMode === 'readonly' });
         const bubblewrapPath = resolveBubblewrapPath();
         return bubblewrapPath
             ? prependExecutableDirectory(env, bubblewrapPath)
@@ -608,7 +638,7 @@ export class AgentRunner {
             return undefined;
         const entry = gatewayPricingCache.get(this.baseUrl);
         if (!entry || Date.now() - entry.fetchedAt > GATEWAY_PRICING_TTL_MS) {
-            refreshGatewayPricing(this.baseUrl, this.apiKey); // 不 await，stale-while-revalidate
+            refreshGatewayPricing(this.baseUrl, this.apiKey, this.customHeaders); // 不 await，stale-while-revalidate
         }
         return entry?.cache;
     }
@@ -617,11 +647,26 @@ export class AgentRunner {
         let agentConfig = claudeConfig?.evolcoreAgentConfig;
         if (claudeConfig?.evolcoreAgentAid) {
             try {
-                agentConfig = resolveEffective({ self: claudeConfig.evolcoreAgentAid }, { cache: true });
+                agentConfig = resolveEffective({ self: claudeConfig.evolcoreAgentAid }, { cache: true, expand: true });
             }
             catch { }
         }
-        return await resolveClaudeCapabilityRunOptionsForProject(agentConfig, projectPath, 'claude');
+        const resolved = await resolveClaudeCapabilityRunOptionsForProject(agentConfig, projectPath, 'claude');
+        const settings = resolved.settings && typeof resolved.settings === 'object' && !Array.isArray(resolved.settings)
+            ? resolved.settings
+            : {};
+        const skillOverrides = settings.skillOverrides
+            && typeof settings.skillOverrides === 'object'
+            && !Array.isArray(settings.skillOverrides)
+            ? settings.skillOverrides
+            : {};
+        return {
+            ...resolved,
+            settings: {
+                ...settings,
+                skillOverrides: { ...skillOverrides, eclink: 'off' },
+            },
+        };
     }
     async listModels() {
         if (this.baseUrl) {
@@ -631,11 +676,11 @@ export class AgentRunner {
             const stale = !cached || (Date.now() - cached.fetchedAt > MODEL_ALIAS_TTL_MS);
             // 缓存为空（首次打开）→ 等待刷新；缓存仅过期 → 后台刷新不阻塞
             if (!cached) {
-                await refreshModelAliases(this.baseUrl, this.apiKey);
+                await refreshModelAliases(this.baseUrl, this.apiKey, this.customHeaders);
                 cached = modelAliasCache.get(cacheKey);
             }
             else if (stale) {
-                refreshModelAliases(this.baseUrl, this.apiKey);
+                refreshModelAliases(this.baseUrl, this.apiKey, this.customHeaders);
             }
             // 有缓存时返回网关 /models 的全量原始 ID
             if (cached && cached.ids.length > 0)
@@ -1729,12 +1774,12 @@ export class AgentRunner {
             const cacheKey = normalizeModelGatewayUrl(this.baseUrl);
             const cached = modelAliasCache.get(cacheKey);
             if (!cached || (Date.now() - cached.fetchedAt > MODEL_ALIAS_TTL_MS)) {
-                refreshModelAliases(this.baseUrl, this.apiKey);
+                refreshModelAliases(this.baseUrl, this.apiKey, this.customHeaders);
             }
             // 顺带预热网关价格缓存（1h TTL），让本轮结束写库时已就绪
             const pricing = gatewayPricingCache.get(this.baseUrl);
             if (!pricing || (Date.now() - pricing.fetchedAt > GATEWAY_PRICING_TTL_MS)) {
-                refreshGatewayPricing(this.baseUrl, this.apiKey);
+                refreshGatewayPricing(this.baseUrl, this.apiKey, this.customHeaders);
             }
         }
         ensureDir(projectPath);
@@ -1807,6 +1852,27 @@ export class AgentRunner {
                 ...(updatedInput ? { updatedInput } : {}),
             },
         });
+        const recordPreflightDenial = async (toolName, toolInput, preflight, requestId, policyCode) => {
+            const code = policyCode ?? (preflight?.behavior === 'deny' ? preflight.policyCode : undefined);
+            if (!code)
+                return;
+            try {
+                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(typeof requestId === 'string' && requestId ? { requestId } : {}),
+                    policyCode: code,
+                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[AgentRunner] failed to record preflight denial: session=${sessionId} tool=${toolName} code=${code} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
         // A rewritten helper command is trusted only after this hook produced its
         // random one-shot payload from a validated output wrapper.
         const trustedSafeOutputCommands = new Set();
@@ -1851,6 +1917,7 @@ export class AgentRunner {
             // proactive 模式行为策略（首次工具调用必须是 ec msg send）
             const policyResult = this.permissionContexts.get(sessionId)?.policyHook?.(toolName, toolInput);
             if (policyResult?.block) {
+                await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, policyResult.policyCode ?? 'session_policy_hook');
                 return hookDecision('deny', policyResult.reason || '当前会话策略拒绝此工具调用', updatedInput);
             }
             const permCtx = this.permissionContexts.get(sessionId);
@@ -1859,6 +1926,7 @@ export class AgentRunner {
                 : undefined;
             const preflight = evaluateToolPreflight(toolName, toolInput, {
                 sessionId,
+                selfAid: permCtx?.selfAid,
                 channel: permCtx?.channel,
                 userId: permCtx?.userId,
                 role: permCtx?.role,
@@ -1870,8 +1938,10 @@ export class AgentRunner {
             toolInput = preflight.input;
             if (toolInput !== originalInput)
                 updatedInput = toolInput;
-            if (preflight.behavior === 'deny')
+            if (preflight.behavior === 'deny') {
+                await recordPreflightDenial(toolName, toolInput, preflight, input.tool_use_id ?? input.toolUseID);
                 return hookDecision('deny', preflight.message, updatedInput);
+            }
             if (preflight.behavior === 'allow') {
                 const commandAfterPreflight = typeof toolInput.command === 'string' ? toolInput.command : undefined;
                 if (commandAfterPreflight && commandAfterPreflight !== commandBeforePreflight) {
@@ -1893,10 +1963,10 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
-                    allowLiteralReadShell: true,
                 };
                 const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'readonly_mode');
                     return hookDecision('deny', roResult.message, updatedInput);
                 }
                 return hookDecision('allow', undefined, updatedInput);
@@ -1906,6 +1976,7 @@ export class AgentRunner {
             }
             if (isUnknownClaudeTool(toolName)) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'auto_unknown_tool');
                     return hookDecision('deny', `auto 模式拒绝未知工具 ${toolName}：该工具不受 Claude 本地 sandbox 的完整约束`, updatedInput);
                 }
                 // request/bypass only receive external tools admitted by the session's
@@ -1915,6 +1986,7 @@ export class AgentRunner {
             const danger = checkDangerousCommand(toolName, toolInput);
             if (danger.isDangerous) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'auto_dangerous_command');
                     return hookDecision('deny', `危险操作已由 auto 模式拒绝：${danger.reason}`, updatedInput);
                 }
                 if (callPermissionMode === 'request' || callPermissionMode === 'bypass') {
@@ -1974,6 +2046,7 @@ export class AgentRunner {
             const permCtx = this.permissionContexts.get(sessionId);
             const preflight = evaluateToolPreflight(toolName, input, {
                 sessionId,
+                selfAid: permCtx?.selfAid,
                 channel: permCtx?.channel,
                 userId: permCtx?.userId,
                 role: permCtx?.role,
@@ -1984,6 +2057,7 @@ export class AgentRunner {
             });
             input = preflight.input;
             if (preflight.behavior === 'deny') {
+                await recordPreflightDenial(toolName, input, preflight, options.toolUseID);
                 return { behavior: 'deny', message: preflight.message, decisionClassification: 'user_reject' };
             }
             if (preflight.behavior === 'allow') {
@@ -1995,6 +2069,7 @@ export class AgentRunner {
             }
             const permissionExpansion = inspectClaudePermissionExpansion(input, options, projectPath);
             if (permissionExpansion.protectedReason) {
+                await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'protected_permission_expansion');
                 return {
                     behavior: 'deny',
                     message: permissionExpansion.protectedReason,
@@ -2003,6 +2078,7 @@ export class AgentRunner {
             }
             if (permissionExpansion.requiresApproval) {
                 if (callPermissionMode === 'readonly' || callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, callPermissionMode === 'readonly' ? 'readonly_permission_expansion' : 'auto_permission_expansion');
                     return {
                         behavior: 'deny',
                         message: `${callPermissionMode} 模式拒绝 Claude SDK 文件系统或未知权限扩权请求`,
@@ -2043,10 +2119,10 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
-                    allowLiteralReadShell: true,
                 };
                 const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'readonly_mode');
                     return { behavior: 'deny', message: roResult.message, decisionClassification: 'user_reject' };
                 }
                 return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
@@ -2056,6 +2132,7 @@ export class AgentRunner {
             }
             if (isUnknownClaudeTool(toolName)) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'auto_unknown_tool');
                     return {
                         behavior: 'deny',
                         message: `auto 模式拒绝未知工具 ${toolName}：该工具不受 Claude 本地 sandbox 的完整约束`,
@@ -2067,6 +2144,7 @@ export class AgentRunner {
             const danger = checkDangerousCommand(toolName, input);
             if (danger.isDangerous) {
                 if (callPermissionMode === 'auto') {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'auto_dangerous_command');
                     return { behavior: 'deny', message: `auto 模式拒绝危险操作：${danger.reason}`, decisionClassification: 'user_reject' };
                 }
                 if (callPermissionMode === 'request' || callPermissionMode === 'bypass') {
@@ -2129,7 +2207,9 @@ export class AgentRunner {
             : await (async () => {
                 const sandboxProjectionStartedAt = Date.now();
                 ensureClaudeGitWorktreeConfig(projectPath);
-                const sandboxFilesystem = buildClaudeProtectedFilesystem(resolvePaths().root);
+                const sandboxFilesystem = buildClaudeProtectedFilesystem(resolvePaths().root, {
+                    denyLClassRead: callPermissionMode === 'readonly',
+                });
                 const sandboxUnixSockets = buildClaudeUnixSocketAllowlist(projectPath, {
                     role: runPermissionContext?.role,
                 });
@@ -2153,8 +2233,29 @@ export class AgentRunner {
                 };
             })();
         if (executionSandbox.state === 'off') {
-            logger.info('[ClaudeSandbox] disabled for authenticated owner bypass task');
+            logger.info(process.platform === 'linux'
+                ? '[ClaudeSandbox] task sandbox disabled for authenticated owner bypass; outer H-class guard remains active'
+                : '[ClaudeSandbox] disabled for authenticated owner bypass task');
         }
+        const handleClaudeStderr = (msg) => {
+            const trimmed = msg.trim();
+            if (trimmed) {
+                let buf = this.recentStderr.get(sessionId);
+                if (!buf) {
+                    buf = [];
+                    this.recentStderr.set(sessionId, buf);
+                }
+                buf.push(trimmed);
+                if (buf.length > AgentRunner.STDERR_BUFFER_MAX)
+                    buf.shift();
+            }
+            if (msg.includes('[ERROR]') || msg.includes('[WARN]') || msg.includes('Stream started')) {
+                logger.info(`[Claude-stderr] ${trimmed}`);
+            }
+            else {
+                logger.debug(`[Claude-stderr] ${trimmed}`);
+            }
+        };
         const commonOptions = {
             cwd: projectPath,
             model: sdkModel,
@@ -2163,6 +2264,9 @@ export class AgentRunner {
             managedSettings,
             ...(callEffort ? { effort: callEffort } : {}),
             ...(this.claudeExecutablePath ? { pathToClaudeCodeExecutable: this.claudeExecutablePath } : {}),
+            ...(executionSandbox.state === 'off' && process.platform === 'linux' ? {
+                spawnClaudeCodeProcess: (options) => spawnClaudeWithHClassGuard(options, resolvePaths().root, handleClaudeStderr),
+            } : {}),
             autoCompactWindow: autoCompactWindowForModel(sdkModel),
             advisorModel: 'haiku',
             canUseTool: canUseToolCallback,
@@ -2177,27 +2281,8 @@ export class AgentRunner {
                 PermissionDenied: [{ matcher: '.*', hooks: [permissionDeniedHook] }]
             },
             ...(enableSummaries ? { agentProgressSummaries: true } : {}),
-            stderr: (msg) => {
-                const trimmed = msg.trim();
-                if (trimmed) {
-                    // 环形缓冲：保留最近 N 行，供子进程崩溃时还原真实原因
-                    let buf = this.recentStderr.get(sessionId);
-                    if (!buf) {
-                        buf = [];
-                        this.recentStderr.set(sessionId, buf);
-                    }
-                    buf.push(trimmed);
-                    if (buf.length > AgentRunner.STDERR_BUFFER_MAX)
-                        buf.shift();
-                }
-                if (msg.includes('[ERROR]') || msg.includes('[WARN]') || msg.includes('Stream started')) {
-                    logger.info(`[Claude-stderr] ${trimmed}`);
-                }
-                else {
-                    logger.debug(`[Claude-stderr] ${trimmed}`);
-                }
-            },
-            env: this.getAgentEnv(runtimeEnv, sessionId)
+            stderr: handleClaudeStderr,
+            env: this.getAgentEnv(runtimeEnv, sessionId, callPermissionMode)
         };
         const createQuery = (promptInput, resumeSessionId, resumeAt) => {
             if (useSettingSources) {
@@ -2479,6 +2564,35 @@ export class AgentRunner {
         this.activeQueries.delete(sessionId);
         this.permissionContexts.delete(sessionId);
     }
+    async dispose() {
+        const interrupts = [...this.interruptFns.values()].map(async (interrupt) => {
+            try {
+                await interrupt();
+            }
+            catch { }
+        });
+        await Promise.allSettled(interrupts);
+        for (const stream of this.activeMessageStreams.values())
+            stream.end();
+        for (const query of this.activeQueries.values()) {
+            try {
+                if (typeof query?.close === 'function')
+                    await query.close();
+            }
+            catch { }
+        }
+        for (const resolve of this.streamDoneResolvers.values())
+            resolve();
+        this.activeSessions.clear();
+        this.activeStreams.clear();
+        this.activeMessageStreams.clear();
+        this.interruptFns.clear();
+        this.activeQueries.clear();
+        this.streamDone.clear();
+        this.streamDoneResolvers.clear();
+        this.permissionContexts.clear();
+        this.recentStderr.clear();
+    }
     resolveSessionFile(agentSessionId, projectPath) {
         const encodedProjectPath = encodePath(projectPath);
         const sessionFile = path.join(os.homedir(), '.claude', 'projects', encodedProjectPath, `${agentSessionId}.jsonl`);