evolcore 0.0.11 → 0.0.12

package/dist/agents/codex-runner.js

@@ -13,13 +13,14 @@ import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtecte
 import { CodexAppServerClient } from './codex-app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
+import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, parseLiteralShellArgv } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
@@ -118,10 +119,9 @@ const CODEX_CATALOG_FALLBACK = [
 ];
 const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
 let codexCatalogCache = null;
-// The permission bridge is version-locked to the v2 schema audited below:
-// named profiles, approvalsReviewer, additional/network approval context, and
-// item/permissions/requestApproval must all be present together.
-export const MIN_CODEX_CLI_VERSION = '0.144.1';
+// The permission bridge is version-locked to the audited approval schema and
+// managed PreToolUse hook behavior used by proactive first-tool enforcement.
+export const MIN_CODEX_CLI_VERSION = '0.147.0';
 export function parseCodexCliVersion(output) {
     const match = output.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/);
     return match?.[1] ?? null;
@@ -223,6 +223,8 @@ export class CodexRunner {
     trackedApprovalItems = new Map();
     threadDelegationCarriers = new Map();
     pendingInterrupts = new Map();
+    threadOperationLocks = new Map();
+    activeOperationReleases = new Map();
     appServerClient = null;
     onSessionIdUpdate;
     onCompactStart;
@@ -289,15 +291,6 @@ export class CodexRunner {
         const argv = parseLiteralShellArgv(command);
         return argv?.[0] === 'ec' ? argv : undefined;
     }
-    unwrapCodexShellCommandArgv(argv) {
-        if (argv.length !== 3 || argv[1] !== '-lc')
-            return undefined;
-        const shell = argv[0];
-        if (!['bash', '/bin/bash', '/usr/bin/bash', 'sh', '/bin/sh', '/usr/bin/sh'].includes(shell)) {
-            return undefined;
-        }
-        return argv[2];
-    }
     approvedEvolcoreCommandArgv(toolInput) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
@@ -306,7 +299,7 @@ export class CodexRunner {
         if (explicitArgv?.[0] === 'ec')
             return explicitArgv;
         const explicitWrappedCommand = explicitArgv
-            ? this.unwrapCodexShellCommandArgv(explicitArgv)
+            ? unwrapCodexShellCommandArgv(explicitArgv)
             : undefined;
         if (explicitWrappedCommand !== undefined) {
             return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand);
@@ -317,7 +310,7 @@ export class CodexRunner {
             return directArgv;
         const wrappedArgv = parseLiteralShellArgv(command);
         const wrappedCommand = wrappedArgv
-            ? this.unwrapCodexShellCommandArgv(wrappedArgv)
+            ? unwrapCodexShellCommandArgv(wrappedArgv)
             : undefined;
         return wrappedCommand === undefined
             ? undefined
@@ -796,6 +789,35 @@ export class CodexRunner {
     }
     setSendPrompt(fn) { this.sendPromptFn = fn; }
     setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    async evaluatePreToolUse(threadId, toolName, toolInput) {
+        const sessionKey = this.findSessionKeyByThread(threadId);
+        const activeThread = this.activeSessions.get(sessionKey);
+        const context = this.permissionContexts.get(sessionKey);
+        if (!activeThread || activeThread !== threadId) {
+            return { ok: true, applicable: false };
+        }
+        const proactiveSession = context?.chatmode === 'proactive';
+        if (!context || (proactiveSession && !context.preToolUsePolicyHook)) {
+            return { ok: false, applicable: true, decision: 'deny', reason: 'EvolCore proactive session policy context is unavailable' };
+        }
+        // A tracked interactive thread still needs an authenticated, explicit
+        // allow so the managed hook can fail closed when no runner matches.
+        if (!context.preToolUsePolicyHook)
+            return { ok: true, applicable: true, decision: 'allow' };
+        const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
+            ? toolInput
+            : {};
+        try {
+            const result = context.preToolUsePolicyHook(toolName, normalizedInput);
+            if (result?.block) {
+                return { ok: true, applicable: true, decision: 'deny', reason: result.reason };
+            }
+            return { ok: true, applicable: true, decision: 'allow' };
+        }
+        catch (error) {
+            return { ok: false, applicable: true, decision: 'deny', reason: `policy hook failed: ${error instanceof Error ? error.message : String(error)}` };
+        }
+    }
     setPermissionGateway(gw) { this.permissionGateway = gw; }
     // ── Stream management (needed by MessageProcessor) ──
     registerStream(key, stream) {
@@ -805,13 +827,135 @@ export class CodexRunner {
         this.activeStreams.delete(key);
         this.activeAbortControllers.delete(key);
         this.pendingInterrupts.delete(key);
+        const release = this.activeOperationReleases.get(key);
+        if (release) {
+            this.activeOperationReleases.delete(key);
+            release();
+        }
     }
     hasActiveStream(key) {
         return this.activeStreams.has(key) || this.activeAbortControllers.has(key) || this.activeTurns.has(key);
     }
+    threadOperationKey(threadId, sessionId) {
+        // Once a thread id is known it is the shared identity, including when
+        // multiple EvolCore sessions happen to address the same Codex thread.
+        if (threadId)
+            return `thread:${threadId}`;
+        if (sessionId)
+            return `session:${sessionId}`;
+        return 'session:unknown';
+    }
+    getThreadOperationLock(key) {
+        const existing = this.threadOperationLocks.get(key);
+        if (existing)
+            return existing;
+        const lock = { aliases: new Set([key]) };
+        this.threadOperationLocks.set(key, lock);
+        return lock;
+    }
+    bindThreadOperationKeys(...keys) {
+        const uniqueKeys = [...new Set(keys.filter(Boolean))];
+        if (uniqueKeys.length < 2)
+            return;
+        const locks = uniqueKeys.map(key => this.getThreadOperationLock(key));
+        const primary = locks[0];
+        for (const other of locks.slice(1)) {
+            if (other === primary)
+                continue;
+            const tails = [primary.tail, other.tail].filter((tail) => !!tail);
+            if (tails.length === 1) {
+                primary.tail = tails[0];
+            }
+            else if (tails.length > 1) {
+                const merged = Promise.all(tails).then(() => undefined);
+                primary.tail = merged;
+                merged.then(() => {
+                    if (primary.tail === merged)
+                        primary.tail = undefined;
+                });
+            }
+            for (const alias of other.aliases) {
+                primary.aliases.add(alias);
+                this.threadOperationLocks.set(alias, primary);
+            }
+        }
+    }
+    isActiveThreadOperationAlias(key) {
+        if (key.startsWith('session:'))
+            return this.activeSessions.has(key.slice('session:'.length));
+        if (key.startsWith('thread:')) {
+            const threadId = key.slice('thread:'.length);
+            for (const activeThreadId of this.activeSessions.values()) {
+                if (activeThreadId === threadId)
+                    return true;
+            }
+            return false;
+        }
+        return true;
+    }
+    pruneThreadOperationLocks() {
+        for (const [key, lock] of this.threadOperationLocks) {
+            if (lock.tail || this.isActiveThreadOperationAlias(key))
+                continue;
+            this.threadOperationLocks.delete(key);
+            lock.aliases.delete(key);
+        }
+    }
+    async acquireThreadOperation(key, operation) {
+        const lock = this.getThreadOperationLock(key);
+        const previous = lock.tail;
+        let releaseCurrent;
+        const current = new Promise(resolve => {
+            releaseCurrent = resolve;
+        });
+        lock.tail = current;
+        if (previous) {
+            logger.info(`[CodexRunner] queued ${operation} behind an active operation: ${key}`);
+            await previous;
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            if (lock.tail === current)
+                lock.tail = undefined;
+            releaseCurrent();
+            this.pruneThreadOperationLocks();
+        };
+    }
+    async *holdThreadOperation(stream, sessionId, release) {
+        try {
+            for await (const item of stream)
+                yield item;
+        }
+        finally {
+            if (this.activeOperationReleases.get(sessionId) === release) {
+                this.activeOperationReleases.delete(sessionId);
+            }
+            release();
+        }
+    }
     // ── Core: runQuery ──
     async runQuery(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
+        const knownThreadId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        const operationKey = this.threadOperationKey(knownThreadId, sessionId);
+        const release = await this.acquireThreadOperation(operationKey, 'thread/resume+turn/start');
+        try {
+            const stream = await this.runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv);
+            this.activeOperationReleases.set(sessionId, release);
+            return this.holdThreadOperation(stream, sessionId, release);
+        }
+        catch (error) {
+            release();
+            throw error;
+        }
+    }
+    async runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
         let agentSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        if (this.permissionContexts.get(sessionId)?.chatmode === 'proactive' && process.platform !== 'linux') {
+            throw new Error('Codex proactive managed PreToolUse enforcement currently requires Linux');
+        }
         const resumingThread = !!agentSessionId;
         const callModel = modelOverride?.model || this.model;
         const callEffort = modelOverride?.effortMode === 'model_default'
@@ -893,6 +1037,7 @@ export class CodexRunner {
         }
         agentSessionId = threadId;
         this.activeSessions.set(sessionId, threadId);
+        this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         this.threadProjectPaths.set(threadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(threadId, externalToolConfig);
         this.onSessionIdUpdate?.(sessionId, threadId);
@@ -1035,10 +1180,12 @@ export class CodexRunner {
         }
         if (agentSessionId) {
             this.activeSessions.set(sessionId, agentSessionId);
+            this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${agentSessionId}`);
         }
         else {
             this.activeSessions.delete(sessionId);
         }
+        this.pruneThreadOperationLocks();
         this.onSessionIdUpdate?.(sessionId, agentSessionId);
     }
     async closeSession(sessionId) {
@@ -1057,6 +1204,7 @@ export class CodexRunner {
             this.unbindExternalToolBoundary(threadId);
         }
         this.clearTrackedApprovalItemsForThread(threadId);
+        this.pruneThreadOperationLocks();
     }
     resolveSessionFile(agentSessionId, _projectPath) {
         // Codex session 文件: ~/.codex/sessions/YYYY/MM/DD/rollout-*-{threadId}.jsonl
@@ -1089,10 +1237,12 @@ export class CodexRunner {
         this.threadDelegationCarriers.delete(threadId);
         this.unbindExternalToolBoundary(threadId);
         this.clearTrackedApprovalItemsForThread(threadId);
+        this.pruneThreadOperationLocks();
         this.onSessionIdUpdate?.(sessionId, '');
         return true;
     }
     async compactSession(_sessionId, agentSessionId, _projectPath) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId, _sessionId), 'compact');
         try {
             const appServer = this.getAppServerClient();
             this.onCompactStart?.(_sessionId);
@@ -1129,6 +1279,9 @@ export class CodexRunner {
             logger.error('[CodexRunner] Compact failed:', error);
             return false;
         }
+        finally {
+            release();
+        }
     }
     async compact(sessionId, agentSessionId, projectPath) {
         return this.compactSession(sessionId, agentSessionId, projectPath);
@@ -1254,6 +1407,15 @@ export class CodexRunner {
         return newest?.path;
     }
     async forkSession(agentSessionId, projectPath, title) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'fork');
+        try {
+            return await this.forkSessionLocked(agentSessionId, projectPath, title);
+        }
+        finally {
+            release();
+        }
+    }
+    async forkSessionLocked(agentSessionId, projectPath, title) {
         const sessionKey = this.findSessionKeyByThread(agentSessionId);
         const mode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const executionSandbox = this.buildExecutionSandboxOptions(sessionKey, mode, projectPath);
@@ -1278,18 +1440,30 @@ export class CodexRunner {
         return forkedThreadId;
     }
     async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title) {
-        const turns = buildSessionTurnList(await this.getSessionMessages(agentSessionId, projectPath));
-        const targetIndex = turns.findIndex(turn => turn.assistantUuid === assistantMessageId);
-        if (targetIndex < 0)
-            throw new Error('fork point not found');
-        const forkedThreadId = await this.forkSession(agentSessionId, projectPath, title);
-        const turnsToDiscard = turns.length - targetIndex - 1;
-        if (turnsToDiscard > 0) {
-            const rolledBack = await this.rollbackSessionTurns(forkedThreadId, projectPath, turnsToDiscard);
-            if (!rolledBack)
-                throw new Error('forked thread rollback failed');
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'forkAt');
+        try {
+            const turns = buildSessionTurnList(await this.getSessionMessages(agentSessionId, projectPath));
+            const targetIndex = turns.findIndex(turn => turn.assistantUuid === assistantMessageId);
+            if (targetIndex < 0)
+                throw new Error('fork point not found');
+            const forkedThreadId = await this.forkSessionLocked(agentSessionId, projectPath, title);
+            const turnsToDiscard = turns.length - targetIndex - 1;
+            if (turnsToDiscard > 0) {
+                const rollbackRelease = await this.acquireThreadOperation(this.threadOperationKey(forkedThreadId), 'rollback');
+                try {
+                    const rolledBack = await this.rollbackSessionTurnsLocked(forkedThreadId, turnsToDiscard);
+                    if (!rolledBack)
+                        throw new Error('forked thread rollback failed');
+                }
+                finally {
+                    rollbackRelease();
+                }
+            }
+            return forkedThreadId;
+        }
+        finally {
+            release();
         }
-        return forkedThreadId;
     }
     async setSessionName(agentSessionId, name) {
         return this.getAppServerClient().threadSetName(agentSessionId, name);
@@ -1421,6 +1595,25 @@ export class CodexRunner {
         // proactive 模式行为策略（首次工具调用必须是 ec msg send）
         const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         if (policyResult?.block) {
+            logger.info(`[CodexRunner] app-server approval declined by session policy: session=${sessionKey} ` +
+                `requestId=${request.id ?? '<missing>'} code=${policyResult.policyCode ?? 'session_policy_hook'} ` +
+                `reason=${policyResult.reason ?? 'policy denied'} executed=false`);
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+                    policyCode: policyResult.policyCode ?? 'session_policy_hook',
+                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record policy-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+            }
             return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
@@ -1434,7 +1627,7 @@ export class CodexRunner {
         const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${summary}`);
         try {
-            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd);
+            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
             if (decision !== 'deny'
                 && (request.method === 'item/commandExecution/requestApproval' || request.method === 'execCommandApproval')
                 && this.approvedEvolcoreCommandArgv(toolInput)) {
@@ -1965,7 +2158,7 @@ export class CodexRunner {
             return true;
         });
     }
-    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath) {
+    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId) {
         const permissionContext = this.permissionContexts.get(sessionKey);
         const permissionPrompt = permissionContext?.sendPrompt ?? this.sendPromptFn;
         const hasFilesystemPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
@@ -1980,6 +2173,24 @@ export class CodexRunner {
         // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const mode = normalizePermissionMode(rawMode).mode;
+        const recordBlockedOperation = async (policyCode, operationInput = toolInput) => {
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(typeof requestId === 'string' || typeof requestId === 'number' ? { requestId: String(requestId) } : {}),
+                    policyCode,
+                    summary: summarizeToolInputForAudit(toolName, operationInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record blocked operation: session=${sessionKey} tool=${toolName} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
         const preflight = evaluateToolPreflight(toolName, toolInput, {
             sessionId: sessionKey,
             selfAid: permissionContext?.selfAid,
@@ -1990,8 +2201,12 @@ export class CodexRunner {
             projectPath: operationCwd,
             workspacePath,
         });
-        if (preflight.behavior === 'deny')
+        if (preflight.behavior === 'deny') {
+            if (preflight.policyCode) {
+                await recordBlockedOperation(preflight.policyCode);
+            }
             return 'deny';
+        }
         if (preflight.behavior === 'allow')
             return 'allow';
         const checkedInput = preflight.input;
@@ -2015,8 +2230,10 @@ export class CodexRunner {
         const grantScope = `codex:${this.permissionProfileName(sessionKey)}:${mode}`;
         if (mode === 'readonly') {
             const readonly = this.checkCodexReadonly(toolName, checkedInput, operationCwd, sessionKey);
-            if (readonly.behavior === 'deny')
+            if (readonly.behavior === 'deny') {
+                await recordBlockedOperation('readonly_mode', checkedInput);
                 return 'deny';
+            }
             return 'allow';
         }
         if (toolName.startsWith('MCP:')) {
@@ -2024,13 +2241,19 @@ export class CodexRunner {
         }
         // auto 模式下检查危险命令，危险命令自动拒绝
         if (mode === 'auto') {
-            if (hasFileChangeExpansion || hasFilesystemPermissions || hasUnknownPermissions)
+            if (hasFileChangeExpansion || hasFilesystemPermissions || hasUnknownPermissions) {
+                await recordBlockedOperation('auto_permission_expansion', checkedInput);
                 return 'deny';
-            if (toolName === 'PermissionGrant' && !hasNetworkPermissions)
+            }
+            if (toolName === 'PermissionGrant' && !hasNetworkPermissions) {
+                await recordBlockedOperation('auto_permission_expansion', checkedInput);
                 return 'deny';
+            }
             const dangerous = checkDangerousCommand(toolName, checkedInput);
-            if (dangerous.isDangerous)
+            if (dangerous.isDangerous) {
+                await recordBlockedOperation('auto_dangerous_command', checkedInput);
                 return 'deny';
+            }
             return 'allow';
         }
         const requiresSandboxExpansionApproval = hasFileChangeExpansion
@@ -2083,6 +2306,15 @@ export class CodexRunner {
         throw new Error('Unsupported Codex app-server request: ' + method);
     }
     async rollbackSessionTurns(agentSessionId, _projectPath, numTurns) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'rollback');
+        try {
+            return await this.rollbackSessionTurnsLocked(agentSessionId, numTurns);
+        }
+        finally {
+            release();
+        }
+    }
+    async rollbackSessionTurnsLocked(agentSessionId, numTurns) {
         if (numTurns < 1)
             return true;
         const response = await this.getAppServerClient().threadRollback(agentSessionId, numTurns);
@@ -2121,7 +2353,11 @@ export class CodexRunner {
     }
     readGitHeadFile(projectPath, filePath) {
         try {
-            return execFileSync('git', ['show', `HEAD:${filePath.replace(/\\/g, '/')}`], { cwd: projectPath, stdio: ['pipe', 'pipe', 'ignore'] });
+            return execFileSync('git', ['show', `HEAD:${filePath.replace(/\\/g, '/')}`], {
+                cwd: projectPath,
+                stdio: ['pipe', 'pipe', 'ignore'],
+                windowsHide: process.platform === 'win32',
+            });
         }
         catch {
             return null;
@@ -2877,6 +3113,8 @@ export class CodexRunner {
         this.pendingInterrupts.clear();
         this.permissionContexts.clear();
         this.chatModes.clear();
+        this.pruneThreadOperationLocks();
+        this.threadOperationLocks.clear();
         for (const sessionId of [...this.sessionTempDirs.keys()])
             this.cleanupSessionTempDir(sessionId);
         await this.appServerClient?.close();

package/dist/agents/ecagent-runner.js

@@ -9,6 +9,7 @@ import { requestDangerousCommandPermission } from '../core/permission/approval-g
 import { normalizePermissionMode } from '../core/permission/mode.js';
 import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { logger } from '../utils/logger.js';
+import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { resolveEcagentConfig } from './baseagent.js';
 import { buildModelRequestHeaders } from './request-identity.js';
 const PROVIDER_ID = 'evolcore-gateway';
@@ -957,9 +958,28 @@ export class EcagentRunner {
     }
     async authorizeTool(sessionId, projectPath, mode, toolName, input) {
         const permissionContext = this.permissionContexts.get(sessionId);
+        const recordBlockedOperation = async (policyCode, operationInput = input) => {
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    policyCode,
+                    summary: summarizeToolInputForAudit(toolName, operationInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[EcagentRunner] failed to record blocked operation: session=${sessionId} tool=${toolName} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
         const policy = permissionContext?.policyHook?.(toolName, input);
-        if (policy?.block)
+        if (policy?.block) {
+            await recordBlockedOperation(policy.policyCode ?? 'session_policy_hook');
             return { block: true, reason: policy.reason || '当前会话策略拒绝此工具调用' };
+        }
         const preflight = evaluateToolPreflight(toolName, input, {
             sessionId,
             selfAid: permissionContext?.selfAid,
@@ -969,8 +989,12 @@ export class EcagentRunner {
             permissionMode: mode,
             projectPath,
         });
-        if (preflight.behavior === 'deny')
+        if (preflight.behavior === 'deny') {
+            if (preflight.policyCode) {
+                await recordBlockedOperation(preflight.policyCode, input);
+            }
             return { block: true, reason: preflight.message };
+        }
         if (preflight.behavior === 'allow')
             return {};
         const checkedInput = preflight.input;
@@ -978,11 +1002,19 @@ export class EcagentRunner {
             const decision = checkReadonly(toolName, checkedInput, projectPath, {
                 sessionId, channel: permissionContext?.channel, peerId: permissionContext?.userId, role: permissionContext?.role,
             });
-            return decision.behavior === 'deny' ? { block: true, reason: decision.message } : {};
+            if (decision.behavior === 'deny') {
+                await recordBlockedOperation('readonly_mode', checkedInput);
+                return { block: true, reason: decision.message };
+            }
+            return {};
         }
         const dangerous = checkDangerousCommand(toolName, checkedInput);
         if (mode === 'auto') {
-            return dangerous.isDangerous ? { block: true, reason: `危险操作已由 auto 模式拒绝：${dangerous.reason}` } : {};
+            if (dangerous.isDangerous) {
+                await recordBlockedOperation('auto_dangerous_command', checkedInput);
+                return { block: true, reason: `危险操作已由 auto 模式拒绝：${dangerous.reason}` };
+            }
+            return {};
         }
         const prompt = permissionContext?.sendPrompt ?? this.sendPromptFn;
         const decision = await requestDangerousCommandPermission(this.permissionGateway, sessionId, toolName, checkedInput, prompt, permissionContext, `ecagent:${mode}`, mode);

package/dist/agents/gemini-runner.js

@@ -344,6 +344,7 @@ export class GeminiRunner {
             cwd: projectPath,
             stdio: ['pipe', 'pipe', 'pipe'],
             env,
+            windowsHide: process.platform === 'win32',
         });
         this.activeProcesses.set(sessionId, child);
         // Log stderr

package/dist/aun/aid/client.js

@@ -1,8 +1,6 @@
 import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import { execFileSync } from 'child_process';
-import { isWindows } from '../../utils/cross-platform.js';
 /**
  * Suppress SDK console logs (DEBUG/INFO/WARN) in CLI context.
  * Call once at CLI entry point — NOT at module load time, to avoid
@@ -40,10 +38,9 @@ export function suppressSdkLogs() {
         return _origStderrWrite(chunk, encoding, callback);
     };
 }
-// ==================== Constants ====================
-export const MIN_AUN_CORE_SDK = [0, 4, 3];
+// ==================== SDK package ====================
+export const MIN_AUN_CORE_SDK = [0, 5, 6];
 export const AUN_CORE_SDK_PKG = '@agentunion/fastaun';
-// ==================== SDK & Environment ====================
 function compareVersion(a, min) {
     const parts = a.split('.').map(n => parseInt(n, 10));
     if (parts.length < 3 || parts.some(isNaN))
@@ -57,6 +54,7 @@ function compareVersion(a, min) {
 export function isAunSdkVersionOk(version) {
     return compareVersion(version, MIN_AUN_CORE_SDK);
 }
+/** Resolve only the SDK bundled in EvolCore's own dependency tree. */
 export function resolveAunCoreSdkPkg() {
     try {
         let dir = path.dirname(fileURLToPath(import.meta.url));
@@ -73,28 +71,20 @@ export function resolveAunCoreSdkPkg() {
             dir = parent;
         }
     }
-    catch { /* fall through */ }
-    try {
-        const npmCmd = isWindows ? 'npm.cmd' : 'npm';
-        const globalRoot = execFileSync(npmCmd, ['root', '-g'], {
-            encoding: 'utf-8', timeout: 10000, shell: isWindows,
-        }).trim();
-        const pkgPath = path.join(globalRoot, AUN_CORE_SDK_PKG, 'package.json');
-        if (fs.existsSync(pkgPath)) {
-            const data = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
-            return { version: data.version, path: pkgPath };
-        }
-    }
-    catch { /* not found */ }
+    catch { /* invalid or missing package metadata */ }
     return null;
 }
+/**
+ * Compatibility guard retained for callers that explicitly check SDK readiness.
+ * The SDK is bundled with EvolCore and must never be installed independently.
+ */
 export async function ensureAunSdk() {
     const installed = resolveAunCoreSdkPkg();
     if (installed && isAunSdkVersionOk(installed.version))
         return;
-    const { npmInstallGlobal } = await import('../../utils/npm-ops.js');
-    console.log(`正在安装 ${AUN_CORE_SDK_PKG}@latest...`);
-    await npmInstallGlobal(`${AUN_CORE_SDK_PKG}@latest`);
+    const expected = MIN_AUN_CORE_SDK.join('.');
+    const detected = installed?.version ?? 'missing';
+    throw new Error(`${AUN_CORE_SDK_PKG} ${detected} is not the bundled SDK expected by EvolCore (>= ${expected}); reinstall or upgrade EvolCore`);
 }
 export function isAunSdkReady() {
     const installed = resolveAunCoreSdkPkg();