evolcore 0.0.10 → 0.0.12

package/dist/agents/codex-runner.js

@@ -13,18 +13,21 @@ import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtecte
 import { CodexAppServerClient } from './codex-app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
+import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
-import { classifyEvolcoreShellCommand, parseLiteralShellArgv } from '../core/permission/ec-command-parser.js';
+import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
+import { classifyEvolcoreShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
 import { execFileSync } from 'child_process';
 import { execCodexCliSync, resolveCodexCliPath } from '../utils/codex-cli.js';
 import { createHash, randomBytes } from 'crypto';
+import { buildModelRequestHeaders } from './request-identity.js';
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
@@ -116,10 +119,9 @@ const CODEX_CATALOG_FALLBACK = [
 ];
 const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
 let codexCatalogCache = null;
-// The permission bridge is version-locked to the v2 schema audited below:
-// named profiles, approvalsReviewer, additional/network approval context, and
-// item/permissions/requestApproval must all be present together.
-export const MIN_CODEX_CLI_VERSION = '0.144.1';
+// The permission bridge is version-locked to the audited approval schema and
+// managed PreToolUse hook behavior used by proactive first-tool enforcement.
+export const MIN_CODEX_CLI_VERSION = '0.147.0';
 export function parseCodexCliVersion(output) {
     const match = output.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/);
     return match?.[1] ?? null;
@@ -221,6 +223,8 @@ export class CodexRunner {
     trackedApprovalItems = new Map();
     threadDelegationCarriers = new Map();
     pendingInterrupts = new Map();
+    threadOperationLocks = new Map();
+    activeOperationReleases = new Map();
     appServerClient = null;
     onSessionIdUpdate;
     onCompactStart;
@@ -231,6 +235,12 @@ export class CodexRunner {
     pendingInterruptTtlMs = 30_000;
     constructor(config, callbacks) {
         this.resolvedConfig = resolveOpenaiConfig(config);
+        this.resolvedConfig.headers = buildModelRequestHeaders({
+            baseagent: 'codex',
+            baseUrl: this.resolvedConfig.baseUrl,
+            agentAid: config.agents?.codex?.evolcoreAgentAid,
+            configuredHeaders: this.resolvedConfig.headers,
+        });
         this.resolvedConfig.evolcoreAgentAid = config.agents?.codex?.evolcoreAgentAid;
         this.resolvedConfig.evolcoreAgentConfig = config.agents?.codex?.evolcoreAgentConfig;
         this.capabilities = {
@@ -281,15 +291,6 @@ export class CodexRunner {
         const argv = parseLiteralShellArgv(command);
         return argv?.[0] === 'ec' ? argv : undefined;
     }
-    unwrapCodexShellCommandArgv(argv) {
-        if (argv.length !== 3 || argv[1] !== '-lc')
-            return undefined;
-        const shell = argv[0];
-        if (!['bash', '/bin/bash', '/usr/bin/bash', 'sh', '/bin/sh', '/usr/bin/sh'].includes(shell)) {
-            return undefined;
-        }
-        return argv[2];
-    }
     approvedEvolcoreCommandArgv(toolInput) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
@@ -298,7 +299,7 @@ export class CodexRunner {
         if (explicitArgv?.[0] === 'ec')
             return explicitArgv;
         const explicitWrappedCommand = explicitArgv
-            ? this.unwrapCodexShellCommandArgv(explicitArgv)
+            ? unwrapCodexShellCommandArgv(explicitArgv)
             : undefined;
         if (explicitWrappedCommand !== undefined) {
             return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand);
@@ -309,7 +310,7 @@ export class CodexRunner {
             return directArgv;
         const wrappedArgv = parseLiteralShellArgv(command);
         const wrappedCommand = wrappedArgv
-            ? this.unwrapCodexShellCommandArgv(wrappedArgv)
+            ? unwrapCodexShellCommandArgv(wrappedArgv)
             : undefined;
         return wrappedCommand === undefined
             ? undefined
@@ -416,14 +417,35 @@ export class CodexRunner {
     }
     async resolveCapabilityThreadConfig(projectPath) {
         const agentConfig = this.resolvedConfig.evolcoreAgentConfig;
-        if (!agentConfig)
-            return {};
+        if (!agentConfig) {
+            return {
+                skills: { config: [{ name: 'eclink', enabled: false }] },
+            };
+        }
         try {
-            return await resolveCodexCapabilityThreadConfigForProject(agentConfig, projectPath, 'codex');
+            const resolved = await resolveCodexCapabilityThreadConfigForProject(agentConfig, projectPath, 'codex');
+            const skills = this.configRecord(resolved.skills);
+            const configured = Array.isArray(skills?.config)
+                ? skills.config.filter(entry => {
+                    if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+                        return true;
+                    return entry.name !== 'eclink';
+                })
+                : [];
+            return this.mergeThreadConfig(resolved, {
+                skills: {
+                    ...(skills ?? {}),
+                    config: [...configured, { name: 'eclink', enabled: false }],
+                },
+            }) ?? {
+                skills: { config: [{ name: 'eclink', enabled: false }] },
+            };
         }
         catch (error) {
             logger.warn(`[CodexRunner] Failed to resolve Codex capability thread config: ${error}`);
-            return {};
+            return {
+                skills: { config: [{ name: 'eclink', enabled: false }] },
+            };
         }
     }
     configRecord(value) {
@@ -721,7 +743,9 @@ export class CodexRunner {
                 [profileName]: {
                     extends: mode === 'readonly' ? ':read-only' : ':workspace',
                     filesystem: {
-                        ...buildCodexProtectedFilesystemRules(resolveRoot()),
+                        ...buildCodexProtectedFilesystemRules(resolveRoot(), {
+                            denyLClassRead: mode === 'readonly',
+                        }),
                         ...this.resolveGitMetadataWriteRules(projectPath, mode),
                         ...(mode !== 'readonly' && managedTempDir ? {
                             [managedTempDir]: 'write',
@@ -765,6 +789,35 @@ export class CodexRunner {
     }
     setSendPrompt(fn) { this.sendPromptFn = fn; }
     setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    async evaluatePreToolUse(threadId, toolName, toolInput) {
+        const sessionKey = this.findSessionKeyByThread(threadId);
+        const activeThread = this.activeSessions.get(sessionKey);
+        const context = this.permissionContexts.get(sessionKey);
+        if (!activeThread || activeThread !== threadId) {
+            return { ok: true, applicable: false };
+        }
+        const proactiveSession = context?.chatmode === 'proactive';
+        if (!context || (proactiveSession && !context.preToolUsePolicyHook)) {
+            return { ok: false, applicable: true, decision: 'deny', reason: 'EvolCore proactive session policy context is unavailable' };
+        }
+        // A tracked interactive thread still needs an authenticated, explicit
+        // allow so the managed hook can fail closed when no runner matches.
+        if (!context.preToolUsePolicyHook)
+            return { ok: true, applicable: true, decision: 'allow' };
+        const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
+            ? toolInput
+            : {};
+        try {
+            const result = context.preToolUsePolicyHook(toolName, normalizedInput);
+            if (result?.block) {
+                return { ok: true, applicable: true, decision: 'deny', reason: result.reason };
+            }
+            return { ok: true, applicable: true, decision: 'allow' };
+        }
+        catch (error) {
+            return { ok: false, applicable: true, decision: 'deny', reason: `policy hook failed: ${error instanceof Error ? error.message : String(error)}` };
+        }
+    }
     setPermissionGateway(gw) { this.permissionGateway = gw; }
     // ── Stream management (needed by MessageProcessor) ──
     registerStream(key, stream) {
@@ -774,13 +827,135 @@ export class CodexRunner {
         this.activeStreams.delete(key);
         this.activeAbortControllers.delete(key);
         this.pendingInterrupts.delete(key);
+        const release = this.activeOperationReleases.get(key);
+        if (release) {
+            this.activeOperationReleases.delete(key);
+            release();
+        }
     }
     hasActiveStream(key) {
         return this.activeStreams.has(key) || this.activeAbortControllers.has(key) || this.activeTurns.has(key);
     }
+    threadOperationKey(threadId, sessionId) {
+        // Once a thread id is known it is the shared identity, including when
+        // multiple EvolCore sessions happen to address the same Codex thread.
+        if (threadId)
+            return `thread:${threadId}`;
+        if (sessionId)
+            return `session:${sessionId}`;
+        return 'session:unknown';
+    }
+    getThreadOperationLock(key) {
+        const existing = this.threadOperationLocks.get(key);
+        if (existing)
+            return existing;
+        const lock = { aliases: new Set([key]) };
+        this.threadOperationLocks.set(key, lock);
+        return lock;
+    }
+    bindThreadOperationKeys(...keys) {
+        const uniqueKeys = [...new Set(keys.filter(Boolean))];
+        if (uniqueKeys.length < 2)
+            return;
+        const locks = uniqueKeys.map(key => this.getThreadOperationLock(key));
+        const primary = locks[0];
+        for (const other of locks.slice(1)) {
+            if (other === primary)
+                continue;
+            const tails = [primary.tail, other.tail].filter((tail) => !!tail);
+            if (tails.length === 1) {
+                primary.tail = tails[0];
+            }
+            else if (tails.length > 1) {
+                const merged = Promise.all(tails).then(() => undefined);
+                primary.tail = merged;
+                merged.then(() => {
+                    if (primary.tail === merged)
+                        primary.tail = undefined;
+                });
+            }
+            for (const alias of other.aliases) {
+                primary.aliases.add(alias);
+                this.threadOperationLocks.set(alias, primary);
+            }
+        }
+    }
+    isActiveThreadOperationAlias(key) {
+        if (key.startsWith('session:'))
+            return this.activeSessions.has(key.slice('session:'.length));
+        if (key.startsWith('thread:')) {
+            const threadId = key.slice('thread:'.length);
+            for (const activeThreadId of this.activeSessions.values()) {
+                if (activeThreadId === threadId)
+                    return true;
+            }
+            return false;
+        }
+        return true;
+    }
+    pruneThreadOperationLocks() {
+        for (const [key, lock] of this.threadOperationLocks) {
+            if (lock.tail || this.isActiveThreadOperationAlias(key))
+                continue;
+            this.threadOperationLocks.delete(key);
+            lock.aliases.delete(key);
+        }
+    }
+    async acquireThreadOperation(key, operation) {
+        const lock = this.getThreadOperationLock(key);
+        const previous = lock.tail;
+        let releaseCurrent;
+        const current = new Promise(resolve => {
+            releaseCurrent = resolve;
+        });
+        lock.tail = current;
+        if (previous) {
+            logger.info(`[CodexRunner] queued ${operation} behind an active operation: ${key}`);
+            await previous;
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            if (lock.tail === current)
+                lock.tail = undefined;
+            releaseCurrent();
+            this.pruneThreadOperationLocks();
+        };
+    }
+    async *holdThreadOperation(stream, sessionId, release) {
+        try {
+            for await (const item of stream)
+                yield item;
+        }
+        finally {
+            if (this.activeOperationReleases.get(sessionId) === release) {
+                this.activeOperationReleases.delete(sessionId);
+            }
+            release();
+        }
+    }
     // ── Core: runQuery ──
     async runQuery(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
+        const knownThreadId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        const operationKey = this.threadOperationKey(knownThreadId, sessionId);
+        const release = await this.acquireThreadOperation(operationKey, 'thread/resume+turn/start');
+        try {
+            const stream = await this.runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv);
+            this.activeOperationReleases.set(sessionId, release);
+            return this.holdThreadOperation(stream, sessionId, release);
+        }
+        catch (error) {
+            release();
+            throw error;
+        }
+    }
+    async runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
         let agentSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        if (this.permissionContexts.get(sessionId)?.chatmode === 'proactive' && process.platform !== 'linux') {
+            throw new Error('Codex proactive managed PreToolUse enforcement currently requires Linux');
+        }
         const resumingThread = !!agentSessionId;
         const callModel = modelOverride?.model || this.model;
         const callEffort = modelOverride?.effortMode === 'model_default'
@@ -819,7 +994,7 @@ export class CodexRunner {
             approvalPolicy: effectiveApprovalPolicy,
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig()),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig()), callMode),
             ...(developerInstructions ? { developerInstructions } : {}),
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
@@ -862,6 +1037,7 @@ export class CodexRunner {
         }
         agentSessionId = threadId;
         this.activeSessions.set(sessionId, threadId);
+        this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         this.threadProjectPaths.set(threadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(threadId, externalToolConfig);
         this.onSessionIdUpdate?.(sessionId, threadId);
@@ -1004,10 +1180,12 @@ export class CodexRunner {
         }
         if (agentSessionId) {
             this.activeSessions.set(sessionId, agentSessionId);
+            this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${agentSessionId}`);
         }
         else {
             this.activeSessions.delete(sessionId);
         }
+        this.pruneThreadOperationLocks();
         this.onSessionIdUpdate?.(sessionId, agentSessionId);
     }
     async closeSession(sessionId) {
@@ -1026,6 +1204,7 @@ export class CodexRunner {
             this.unbindExternalToolBoundary(threadId);
         }
         this.clearTrackedApprovalItemsForThread(threadId);
+        this.pruneThreadOperationLocks();
     }
     resolveSessionFile(agentSessionId, _projectPath) {
         // Codex session 文件: ~/.codex/sessions/YYYY/MM/DD/rollout-*-{threadId}.jsonl
@@ -1058,10 +1237,12 @@ export class CodexRunner {
         this.threadDelegationCarriers.delete(threadId);
         this.unbindExternalToolBoundary(threadId);
         this.clearTrackedApprovalItemsForThread(threadId);
+        this.pruneThreadOperationLocks();
         this.onSessionIdUpdate?.(sessionId, '');
         return true;
     }
     async compactSession(_sessionId, agentSessionId, _projectPath) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId, _sessionId), 'compact');
         try {
             const appServer = this.getAppServerClient();
             this.onCompactStart?.(_sessionId);
@@ -1086,7 +1267,7 @@ export class CodexRunner {
                     approvalPolicy: compactPolicy,
                     approvalsReviewer: 'user',
                     ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-                    config: this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig()),
+                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig()), compactMode),
                 });
                 this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
                 this.threadDelegationCarriers.set(agentSessionId, compactDelegationCarrier);
@@ -1098,6 +1279,9 @@ export class CodexRunner {
             logger.error('[CodexRunner] Compact failed:', error);
             return false;
         }
+        finally {
+            release();
+        }
     }
     async compact(sessionId, agentSessionId, projectPath) {
         return this.compactSession(sessionId, agentSessionId, projectPath);
@@ -1223,6 +1407,15 @@ export class CodexRunner {
         return newest?.path;
     }
     async forkSession(agentSessionId, projectPath, title) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'fork');
+        try {
+            return await this.forkSessionLocked(agentSessionId, projectPath, title);
+        }
+        finally {
+            release();
+        }
+    }
+    async forkSessionLocked(agentSessionId, projectPath, title) {
         const sessionKey = this.findSessionKeyByThread(agentSessionId);
         const mode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const executionSandbox = this.buildExecutionSandboxOptions(sessionKey, mode, projectPath);
@@ -1236,7 +1429,7 @@ export class CodexRunner {
             approvalPolicy: this.toApprovalPolicy(mode),
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, delegationCarrier), this.buildLifecycleLockdownConfig()),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, delegationCarrier), this.buildLifecycleLockdownConfig()), mode),
         });
         const forkedThreadId = response.thread?.id;
         if (!forkedThreadId)
@@ -1247,18 +1440,30 @@ export class CodexRunner {
         return forkedThreadId;
     }
     async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title) {
-        const turns = buildSessionTurnList(await this.getSessionMessages(agentSessionId, projectPath));
-        const targetIndex = turns.findIndex(turn => turn.assistantUuid === assistantMessageId);
-        if (targetIndex < 0)
-            throw new Error('fork point not found');
-        const forkedThreadId = await this.forkSession(agentSessionId, projectPath, title);
-        const turnsToDiscard = turns.length - targetIndex - 1;
-        if (turnsToDiscard > 0) {
-            const rolledBack = await this.rollbackSessionTurns(forkedThreadId, projectPath, turnsToDiscard);
-            if (!rolledBack)
-                throw new Error('forked thread rollback failed');
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'forkAt');
+        try {
+            const turns = buildSessionTurnList(await this.getSessionMessages(agentSessionId, projectPath));
+            const targetIndex = turns.findIndex(turn => turn.assistantUuid === assistantMessageId);
+            if (targetIndex < 0)
+                throw new Error('fork point not found');
+            const forkedThreadId = await this.forkSessionLocked(agentSessionId, projectPath, title);
+            const turnsToDiscard = turns.length - targetIndex - 1;
+            if (turnsToDiscard > 0) {
+                const rollbackRelease = await this.acquireThreadOperation(this.threadOperationKey(forkedThreadId), 'rollback');
+                try {
+                    const rolledBack = await this.rollbackSessionTurnsLocked(forkedThreadId, turnsToDiscard);
+                    if (!rolledBack)
+                        throw new Error('forked thread rollback failed');
+                }
+                finally {
+                    rollbackRelease();
+                }
+            }
+            return forkedThreadId;
+        }
+        finally {
+            release();
         }
-        return forkedThreadId;
     }
     async setSessionName(agentSessionId, name) {
         return this.getAppServerClient().threadSetName(agentSessionId, name);
@@ -1390,6 +1595,25 @@ export class CodexRunner {
         // proactive 模式行为策略（首次工具调用必须是 ec msg send）
         const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         if (policyResult?.block) {
+            logger.info(`[CodexRunner] app-server approval declined by session policy: session=${sessionKey} ` +
+                `requestId=${request.id ?? '<missing>'} code=${policyResult.policyCode ?? 'session_policy_hook'} ` +
+                `reason=${policyResult.reason ?? 'policy denied'} executed=false`);
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+                    policyCode: policyResult.policyCode ?? 'session_policy_hook',
+                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record policy-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+            }
             return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
@@ -1403,7 +1627,7 @@ export class CodexRunner {
         const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${summary}`);
         try {
-            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd);
+            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
             if (decision !== 'deny'
                 && (request.method === 'item/commandExecution/requestApproval' || request.method === 'execCommandApproval')
                 && this.approvedEvolcoreCommandArgv(toolInput)) {
@@ -1934,7 +2158,7 @@ export class CodexRunner {
             return true;
         });
     }
-    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath) {
+    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId) {
         const permissionContext = this.permissionContexts.get(sessionKey);
         const permissionPrompt = permissionContext?.sendPrompt ?? this.sendPromptFn;
         const hasFilesystemPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
@@ -1949,8 +2173,27 @@ export class CodexRunner {
         // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const mode = normalizePermissionMode(rawMode).mode;
+        const recordBlockedOperation = async (policyCode, operationInput = toolInput) => {
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(typeof requestId === 'string' || typeof requestId === 'number' ? { requestId: String(requestId) } : {}),
+                    policyCode,
+                    summary: summarizeToolInputForAudit(toolName, operationInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record blocked operation: session=${sessionKey} tool=${toolName} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
         const preflight = evaluateToolPreflight(toolName, toolInput, {
             sessionId: sessionKey,
+            selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
             userId: permissionContext?.userId,
             role: permissionContext?.role,
@@ -1958,8 +2201,12 @@ export class CodexRunner {
             projectPath: operationCwd,
             workspacePath,
         });
-        if (preflight.behavior === 'deny')
+        if (preflight.behavior === 'deny') {
+            if (preflight.policyCode) {
+                await recordBlockedOperation(preflight.policyCode);
+            }
             return 'deny';
+        }
         if (preflight.behavior === 'allow')
             return 'allow';
         const checkedInput = preflight.input;
@@ -1983,8 +2230,10 @@ export class CodexRunner {
         const grantScope = `codex:${this.permissionProfileName(sessionKey)}:${mode}`;
         if (mode === 'readonly') {
             const readonly = this.checkCodexReadonly(toolName, checkedInput, operationCwd, sessionKey);
-            if (readonly.behavior === 'deny')
+            if (readonly.behavior === 'deny') {
+                await recordBlockedOperation('readonly_mode', checkedInput);
                 return 'deny';
+            }
             return 'allow';
         }
         if (toolName.startsWith('MCP:')) {
@@ -1992,13 +2241,19 @@ export class CodexRunner {
         }
         // auto 模式下检查危险命令，危险命令自动拒绝
         if (mode === 'auto') {
-            if (hasFileChangeExpansion || hasFilesystemPermissions || hasUnknownPermissions)
+            if (hasFileChangeExpansion || hasFilesystemPermissions || hasUnknownPermissions) {
+                await recordBlockedOperation('auto_permission_expansion', checkedInput);
                 return 'deny';
-            if (toolName === 'PermissionGrant' && !hasNetworkPermissions)
+            }
+            if (toolName === 'PermissionGrant' && !hasNetworkPermissions) {
+                await recordBlockedOperation('auto_permission_expansion', checkedInput);
                 return 'deny';
+            }
             const dangerous = checkDangerousCommand(toolName, checkedInput);
-            if (dangerous.isDangerous)
+            if (dangerous.isDangerous) {
+                await recordBlockedOperation('auto_dangerous_command', checkedInput);
                 return 'deny';
+            }
             return 'allow';
         }
         const requiresSandboxExpansionApproval = hasFileChangeExpansion
@@ -2051,6 +2306,15 @@ export class CodexRunner {
         throw new Error('Unsupported Codex app-server request: ' + method);
     }
     async rollbackSessionTurns(agentSessionId, _projectPath, numTurns) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'rollback');
+        try {
+            return await this.rollbackSessionTurnsLocked(agentSessionId, numTurns);
+        }
+        finally {
+            release();
+        }
+    }
+    async rollbackSessionTurnsLocked(agentSessionId, numTurns) {
         if (numTurns < 1)
             return true;
         const response = await this.getAppServerClient().threadRollback(agentSessionId, numTurns);
@@ -2089,7 +2353,11 @@ export class CodexRunner {
     }
     readGitHeadFile(projectPath, filePath) {
         try {
-            return execFileSync('git', ['show', `HEAD:${filePath.replace(/\\/g, '/')}`], { cwd: projectPath, stdio: ['pipe', 'pipe', 'ignore'] });
+            return execFileSync('git', ['show', `HEAD:${filePath.replace(/\\/g, '/')}`], {
+                cwd: projectPath,
+                stdio: ['pipe', 'pipe', 'ignore'],
+                windowsHide: process.platform === 'win32',
+            });
         }
         catch {
             return null;
@@ -2810,6 +3078,24 @@ export class CodexRunner {
             },
         };
     }
+    sanitizeThreadEnvironmentConfig(config, permissionMode) {
+        if (!config)
+            return null;
+        const policy = this.configRecord(config.shell_environment_policy);
+        const set = this.configRecord(policy?.set);
+        if (!policy || !set)
+            return config;
+        const safeSet = sanitizeShellExecutionEnvironment(set, {
+            lockExecutableResolution: permissionMode === 'readonly',
+        });
+        return {
+            ...config,
+            shell_environment_policy: {
+                ...policy,
+                set: safeSet,
+            },
+        };
+    }
     async dispose() {
         // Abort all active streams
         for (const [key, controller] of this.activeAbortControllers) {
@@ -2827,6 +3113,8 @@ export class CodexRunner {
         this.pendingInterrupts.clear();
         this.permissionContexts.clear();
         this.chatModes.clear();
+        this.pruneThreadOperationLocks();
+        this.threadOperationLocks.clear();
         for (const sessionId of [...this.sessionTempDirs.keys()])
             this.cleanupSessionTempDir(sessionId);
         await this.appServerClient?.close();