evolcore 0.0.11 → 0.0.13

package/dist/core/message/response-engine.js

@@ -11,7 +11,7 @@ import { StreamIdleMonitor } from './stream-idle-monitor.js';
 import { logger } from '../../utils/logger.js';
 import { isHostChinese } from '../../utils/locale.js';
 import { getErrorMessage, classifyError, ErrorType, ERROR_PREFIX, isInfraError, isAbortTerminalReason, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
-import { isEvolcoreSendCommandForSession } from '../permission/ec-command-parser.js';
+import { isExactEvolcoreSendCommandForSession } from '../permission/ec-command-parser.js';
 import { summarizeToolInput } from '../../utils/tool-summary.js';
 import { getPackageRoot, resolveRoot, resolvePaths } from '../../paths.js';
 import { renderKitSections } from '../../eck/kit-renderer.js';
@@ -22,7 +22,7 @@ import { createRootCausation, deriveCausation, normalizeCausation } from '../cau
 import { recordCausationLink, recordCausationSpan } from '../causation/audit.js';
 import { normalizeBaseagent } from '../../agents/baseagent.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
-import { buildEnvelope } from './message-utils.js';
+import { buildEnvelope, replyContextFromSession, withEnvelopeReplyContext } from './message-utils.js';
 import { isSystemOrServicePeer, resolveChatMode } from './peer-mode.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../auth/agent-delegation.js';
 import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
@@ -33,7 +33,6 @@ import { eligibleFallbackModels } from '../model/model-fallback.js';
 import { RetryScheduler } from './retry-scheduler.js';
 import { constrainRuntimePermissionMode, resolveRuntimeStringField } from '../role/runtime-policy.js';
 import { resolveEffective, resolveEffectiveFieldWithSource } from '../../config/config-manager.js';
-import { dispatchToMentionMode } from '../../config/mention-mode.js';
 import { authorizationConfigRevision, checkRoleAccess, getFirstStaticAgentOwner, listStaticAgentAdmins, listStaticAgentOwners, resolvePeerRoleDetail, roleToSessionIdentity, } from '../../config/peer-role-resolver.js';
 import { insertUsageEvent, insertContextBreakdown, insertModelCalls } from '../../stats/writer.js';
 import { normalizeUsage } from '../../stats/normalizer.js';
@@ -137,6 +136,7 @@ const RETRY_EXHAUSTED_MARK = Symbol('evolcore.retryExhausted');
 const RETRY_MADE_PROGRESS_MARK = Symbol('evolcore.retryMadeProgress');
 const RETRY_HEALTH_RECORDED_MARK = Symbol('evolcore.retryHealthRecorded');
 const MODEL_FALLBACK_EXHAUSTED_MARK = Symbol('evolcore.modelFallbackExhausted');
+const RETRY_INPUT_ALREADY_SUBMITTED_MARK = Symbol('evolcore.retryInputAlreadySubmitted');
 function markRetryExhausted(error, retries) {
     if (error && typeof error === 'object') {
         error[RETRY_EXHAUSTED_MARK] = retries;
@@ -177,6 +177,21 @@ function getModelFallbackExhaustedMessage(error) {
         : undefined;
     return typeof message === 'string' ? message : undefined;
 }
+function markRetryInputAlreadySubmitted(error) {
+    if (error && typeof error === 'object') {
+        error[RETRY_INPUT_ALREADY_SUBMITTED_MARK] = true;
+        // A terminal delivery guard, rather than any buffered activity, owns the
+        // final user-visible explanation.
+        delete error._errorAlreadySent;
+    }
+}
+function wasRetryInputAlreadySubmitted(error) {
+    return !!(error && typeof error === 'object' && error[RETRY_INPUT_ALREADY_SUBMITTED_MARK] === true);
+}
+function formatRetryInputAlreadySubmittedMessage(error) {
+    const reason = getErrorMessage(error, undefined, false) || 'Codex 暂时不可用';
+    return `⚠️ Codex 已接收本次消息，但本轮未能确认完成。为避免在会话中重复写入同一消息，系统未自动重试。请检查会话状态后重新发送。\n原因：${reason}`;
+}
 function isNonErrorInterruptReason(reason) {
     return reason === 'new_message'
         || reason === 'stop'
@@ -493,7 +508,7 @@ export class ResponseEngine {
             return;
         const available = error.availableBaseagents.length ? error.availableBaseagents.join(', ') : '(none)';
         const text = `❌ 当前会话绑定的 baseagent 不可用: ${error.baseagent}\nAgent: ${error.evolagentName}\n可用: ${available}\n请使用 /baseagent 切换到可用后端。`;
-        const sessionReplyContext = { ...(replyContext ?? {}), sessionId: session.id };
+        const sessionReplyContext = { ...replyContextFromSession(session, replyContext), sessionId: session.id };
         await channelInfo.adapter.send(buildEnvelope({
             taskId: `system-${crypto.randomUUID().replace(/-/g, '').slice(0, 10)}`,
             sessionId: session.id,
@@ -656,7 +671,7 @@ export class ResponseEngine {
                 agentName: agent.name,
                 chatmode: this.resolveEffectiveChatmodeForSession(session, channelKey, session.channelId),
                 replyContext: {
-                    ...(session.metadata?.replyContext ?? {}),
+                    ...replyContextFromSession(session),
                     sessionId: session.id,
                     threadId: session.threadId || session.metadata?.replyContext?.threadId,
                 },
@@ -727,7 +742,19 @@ export class ResponseEngine {
         const selfAid = runtime?.selfAid || session?.selfAID;
         if (!selfAid)
             return { ok: false, code: 'HANDOFF_NOT_FOUND', error: 'self agent not found' };
-        return this.handoffRuntime.returnHandoff({
+        return this.returnAuthorizedHandoffResult({
+            sessionId: params.sessionId,
+            handoffId: params.handoffId,
+            content: params.content,
+        }, selfAid);
+    }
+    /** Execute a handoff return after the daemon IPC boundary has authorized the task delegation. */
+    async returnAuthorizedHandoffResult(params, selfAid) {
+        if (!this.handoffRuntime) {
+            return { ok: false, code: 'HANDOFF_NOT_FOUND', error: 'handoff runtime not configured' };
+        }
+        const runtime = this.activeTaskRuntimeContexts.get(params.sessionId);
+        return await this.handoffRuntime.returnHandoff({
             selfAid,
             currentSessionId: params.sessionId,
             handoffId: params.handoffId,
@@ -926,7 +953,7 @@ export class ResponseEngine {
             }
             agent.registerStream(streamKey, retryStream);
             return await this.processEventStream(retryStream, session, agent, renderer, resetTimer, shouldSuppress, proactive, undefined, // 重试分支不调插件钩子
-            undefined, turnLease);
+            undefined, turnLease, opts.permissionMode);
         }
         // Dropping the whole session hides the root cause and can replay side
         // effects in unattended trigger tasks. Surface an actionable failure
@@ -1152,6 +1179,14 @@ export class ResponseEngine {
     async processMessage(message) {
         const idleMs = (this.globalSettings.idleMonitor?.timeout ?? 120) * 1000;
         const totalExecutionMs = this.totalExecutionLimitMs();
+        if (message.handoffDelivery
+            && this.handoffRuntime
+            && this.handoffRuntime.isDiscardedDelivery(message)) {
+            logger.info(`[ResponseEngine] Skip stale handoff delivery before session resolution:`
+                + ` direction=${message.handoffDelivery.direction}`
+                + ` handoff=${message.handoffDelivery.handoffId}`);
+            return;
+        }
         // 先解析会话，再优先用 session.metadata.channelKey 精确定位实例级 adapter
         // message.channel 现在存实例名（channelName），可直接用于精确路由
         const { session, absoluteProjectPath } = await this.resolveSession(message);
@@ -1180,7 +1215,7 @@ export class ResponseEngine {
             logger.warn(`[ResponseEngine] Trigger execution identity missing: trigger=${message.triggerMeta?.triggerId ?? '<none>'}`);
             const channelInfo = this.resolveChannelInfo(accessChannelKey);
             if (channelInfo) {
-                await channelInfo.adapter.send({
+                await channelInfo.adapter.send(buildEnvelope({
                     taskId: `trigger-identity-missing-${Date.now()}`,
                     sessionId: session.id,
                     channel: accessChannelKey,
@@ -1189,7 +1224,7 @@ export class ResponseEngine {
                     chatmode: 'interactive',
                     replyContext: message.replyContext,
                     timestamp: Date.now(),
-                }, {
+                }), {
                     kind: 'system.error',
                     text: 'Trigger 创建者身份缺失，已拒绝执行',
                     subtype: 'trigger_identity_missing',
@@ -1211,7 +1246,7 @@ export class ResponseEngine {
             const channelInfo = this.resolveChannelInfo(channelKey);
             if (channelInfo) {
                 try {
-                    await channelInfo.adapter.send({
+                    await channelInfo.adapter.send(buildEnvelope({
                         taskId: `access-denied-${Date.now()}`,
                         sessionId: session.id,
                         channel: channelKey,
@@ -1220,7 +1255,7 @@ export class ResponseEngine {
                         chatmode: 'interactive',
                         replyContext: message.replyContext,
                         timestamp: Date.now(),
-                    }, {
+                    }), {
                         kind: 'system.error',
                         text: '暂无权限访问本 agent，请联系 agent 管理员授权访问',
                         subtype: 'access_denied',
@@ -1478,7 +1513,12 @@ export class ResponseEngine {
     }
     /** 自动安全模式已禁用：仅保留错误计数，不再自动切换状态 */
     async _processMessageInternal(message, session, absoluteProjectPath, resetTimer, shouldSuppress, getLastIdleSec, outputState = { middleOutputMode: 'all' }, timeoutControl) {
-        const messageId = `${message.channel}_${message.channelId}_${message.timestamp || Date.now()}`;
+        // The model must see the time at which the adapter accepted the input.
+        // Runner start is recorded separately so queue delay never rewrites input
+        // chronology after a historical replay or a long backlog.
+        const inboundTimestamp = message.receivedAt ?? message.enqueuedAt ?? message.timestamp ?? Date.now();
+        const runnerStartedAt = Date.now();
+        const messageId = `${message.channel}_${message.channelId}_${inboundTimestamp}`;
         const channelKey = this.messageChannelKey(message, session);
         const channelInfo = this.resolveChannelInfo(channelKey);
         const taskAgentAid = message.selfAID || session.selfAID;
@@ -1705,7 +1745,7 @@ export class ResponseEngine {
         const taskReplyContext = () => {
             const base = this.getReplyContext(message);
             return {
-                ...(base ?? {}),
+                ...replyContextFromSession(session, base),
                 sessionId: session.id,
                 threadId: session.threadId || base?.threadId,
                 metadata: withTaskMetadata(base?.metadata),
@@ -1720,11 +1760,11 @@ export class ResponseEngine {
                 messageId: message.messageId, peerId: message.peerId, content: message.content,
                 peerType: message.peerType || session.metadata?.peerType,
                 chatType: chatType, isMentioned: message.isMentioned,
-                mentionAids: message.mentionAids, source: message.source,
+                mentions: message.mentions, mentionAids: message.mentionAids, source: message.source,
             },
             modeConfig: resolvedMode.context.modeConfig,
             state: modeState,
-            isSendCommand: (toolName, toolInput) => isEvolcoreSendCommandForSession(toolName, toolInput, session.channelId),
+            isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, chatType, session.selfAID || message.selfAID),
             logger,
         } : null;
         if (resolvedMode?.mode.beforeProcess && modeProcessCtx) {
@@ -1825,7 +1865,7 @@ export class ResponseEngine {
         // Kept outside the task body so a thrown terminal error can preserve the
         // work already performed in its trigger audit metadata.
         let streamResult = { isError: false, lastReplyText: '', fullText: '', hasReceivedText: false };
-        let startTime = Date.now();
+        let startTime = runnerStartedAt;
         let protocolReplayAttempts = 0;
         try {
             const isBackground = this.isBackgroundSession(session, message.channel, message.channelId);
@@ -1834,7 +1874,10 @@ export class ResponseEngine {
                 msgId: messageId,
                 sessionId: session.id,
                 dir: 'inbound',
-                status: 'received'
+                status: 'received',
+                receivedAt: message.receivedAt ?? inboundTimestamp,
+                enqueuedAt: message.enqueuedAt,
+                processingStartedAt: runnerStartedAt,
             });
             this.eventBus.publish({
                 type: 'message:received',
@@ -1843,7 +1886,10 @@ export class ResponseEngine {
                 channelId: message.channelId,
                 content: message.content,
                 agentName: agentNameForStats,
-                timestamp: Date.now()
+                timestamp: inboundTimestamp,
+                receivedAt: message.receivedAt ?? inboundTimestamp,
+                enqueuedAt: message.enqueuedAt,
+                processingStartedAt: runnerStartedAt,
             });
             // ── 硬上限检查：超限直接返回提示，不调模型 ──
             {
@@ -1988,7 +2034,7 @@ export class ResponseEngine {
                     opts.metadata = withTaskMetadata(opts.metadata);
                     if (payload.kind.startsWith('status.'))
                         this.touchAgentActivity(channelKey);
-                    const enrichedEnvelope = { ...envelope, replyContext: opts };
+                    const enrichedEnvelope = withEnvelopeReplyContext(envelope, opts);
                     snapshot.pushOutbound(session.id, taskId, { kind: payload.kind, decision: 'sent' });
                     await adapter.send(enrichedEnvelope, payload);
                 },
@@ -2013,7 +2059,7 @@ export class ResponseEngine {
             const capturedReplyContext = taskReplyContext();
             // 设置权限审批的消息发送回调（指向当前渠道）
             const permissionPrompt = async (text) => {
-                await adapter.send({ ...envelope, replyContext: capturedReplyContext }, { kind: 'result.text', text, isFinal: false });
+                await adapter.send(withEnvelopeReplyContext(envelope, capturedReplyContext), { kind: 'result.text', text, isFinal: false });
             };
             const authChatType = configChatType;
             const authConversationId = authChatType === 'group'
@@ -2027,15 +2073,16 @@ export class ResponseEngine {
                 : undefined;
             const permissionAdapter = triggerOriginChannelInfo?.adapter ?? adapter;
             const permissionChannelId = authorizationIdentity?.actorId ?? capturedChannelId;
-            const permissionReplyContext = authorizationIdentity ? undefined : capturedReplyContext;
+            const permissionReplyContext = authorizationIdentity
+                ? { delivery: { chatType: 'private' } }
+                : capturedReplyContext;
             let permissionTerminalFailure;
             const permissionPromptForOrigin = async (text) => {
-                await permissionAdapter.send({
+                await permissionAdapter.send(withEnvelopeReplyContext({
                     ...envelope,
                     channel: authorizationIdentity?.originChannelKey ?? envelope.channel,
                     channelId: permissionChannelId,
-                    replyContext: permissionReplyContext,
-                }, { kind: 'result.text', text, isFinal: false });
+                }, permissionReplyContext), { kind: 'result.text', text, isFinal: false });
             };
             agent.setSendPrompt(permissionPromptForOrigin);
             const owningAgentForAuth = owningAgentForTask;
@@ -2118,11 +2165,21 @@ export class ResponseEngine {
                     },
                 };
             })();
+            let effectivePermissionMode = 'readonly';
             const recordExecutionAnomaly = triggerRunId
                 ? (anomaly) => {
-                    recordTriggerExecutionAnomaly(triggerRunId, anomaly);
+                    recordTriggerExecutionAnomaly(triggerRunId, {
+                        ...anomaly,
+                        agentAid: anomaly.agentAid ?? session.selfAID ?? message.selfAID,
+                        sessionId: anomaly.sessionId ?? session.id,
+                        permissionMode: anomaly.permissionMode ?? effectivePermissionMode,
+                    });
                 }
                 : undefined;
+            const runModeConfig = resolvedMode?.mode.configureRun && modeProcessCtx
+                ? resolvedMode.mode.configureRun(modeProcessCtx)
+                : undefined;
+            const pureSessionPolicyHook = runModeConfig?.policyHook;
             // 设置权限审批的交互上下文（支持交互卡片）
             agent.setPermissionContext?.(session.id, {
                 sendPrompt: permissionPromptForOrigin,
@@ -2144,6 +2201,7 @@ export class ResponseEngine {
                 approvalRouting,
                 approvalInteractionPolicy: authorizationIdentity ? 'deny' : 'interactive',
                 recordExecutionAnomaly,
+                preToolUsePolicyHook: pureSessionPolicyHook,
                 armApprovedDelegationCommand: this.agentDelegationRegistry
                     ? (carrierToken, commandHash) => this.agentDelegationRegistry.armApprovedCommand({
                         carrierToken,
@@ -2170,7 +2228,7 @@ export class ResponseEngine {
                     },
                 },
                 permissionStateChanged: async (permissionEvent) => {
-                    const executionEnvelope = { ...envelope, replyContext: capturedReplyContext };
+                    const executionEnvelope = withEnvelopeReplyContext(envelope, capturedReplyContext);
                     if (permissionEvent.state === 'waiting') {
                         const payload = {
                             kind: 'status.requires_action',
@@ -2184,12 +2242,11 @@ export class ResponseEngine {
                         };
                         await adapter.send(executionEnvelope, payload);
                         if (permissionAdapter !== adapter || permissionChannelId !== capturedChannelId) {
-                            await permissionAdapter.send({
+                            await permissionAdapter.send(withEnvelopeReplyContext({
                                 ...envelope,
                                 channel: authorizationIdentity?.originChannelKey ?? envelope.channel,
                                 channelId: permissionChannelId,
-                                replyContext: permissionReplyContext,
-                            }, payload);
+                            }, permissionReplyContext), payload);
                         }
                         return;
                     }
@@ -2233,10 +2290,7 @@ export class ResponseEngine {
                 // [迁移点2] policyHook 由 ProactiveMode.configureRun 提供（插件决策）；
                 // 引擎补充副作用：违规时注入提醒到模型上下文 + 行为探针。
                 policyHook: (() => {
-                    const runConfig = resolvedMode?.mode.configureRun && modeProcessCtx
-                        ? resolvedMode.mode.configureRun(modeProcessCtx)
-                        : undefined;
-                    const pluginHook = runConfig?.policyHook;
+                    const pluginHook = pureSessionPolicyHook;
                     if (!pluginHook)
                         return undefined;
                     return (toolName, toolInput) => {
@@ -2250,9 +2304,9 @@ export class ResponseEngine {
                             agent.injectUserMessage?.(session.id, errorMsg);
                             return result;
                         }
-                        // 首工具检查通过（firstToolDone 从 false 翻成 true 且未拦截）
-                        const stAfter = modeState.get('proactive');
-                        if (wasFirstPending && stAfter?.firstToolDone) {
+                        // 这里只记录审批结果。firstToolDone 必须等真实 tool_use 事件再推进，
+                        // 避免伪造 managed hook IPC 提前解除门禁。
+                        if (wasFirstPending) {
                             snapshot.set(session.id, taskId, { policyHook: { triggered: true, blocked: false, toolName } });
                         }
                         return undefined;
@@ -2290,8 +2344,6 @@ export class ResponseEngine {
             let handoffPromptRendered = false;
             let runtimeEnv;
             try {
-                // 动态构建运行时上下文提示
-                const contextParts = [];
                 // 通道能力
                 const supportsFileMarker = currentChannelType !== 'aun' && !isProactive && !!channelInfo.adapter.capabilities?.file;
                 const capParts = [];
@@ -2301,14 +2353,11 @@ export class ResponseEngine {
                     capParts.push('图片输出');
                 if (!isProactive && channelInfo.adapter.capabilities?.file)
                     capParts.push('文件发送');
-                // Personal layer
+                // Personal state is exposed to the manifest as vars. The manifest owns
+                // loading persona.md and working.md into the system prompt.
                 const owningAgent = owningAgentForTask;
                 const persona = owningAgent?.getPersona?.() || undefined;
                 const working = owningAgent?.getWorkingMemory?.() || undefined;
-                if (persona)
-                    contextParts.push(persona);
-                if (working)
-                    contextParts.push(`[当前关注]\n${working}`);
                 // 计算 peerKey：群聊固定按 groupId/channelId，私聊按发送者 peerId。
                 // 这样单条和积压合并批次不会因队列状态不同而切换关系级配置。
                 const normalizedBaseagent = normalizeBaseagent(agent.name);
@@ -2316,7 +2365,6 @@ export class ResponseEngine {
                 // Trigger 只能降低本次调用权限，不能突破当前角色的权限上限。
                 // 作为 per-call 入参随 modelOverride 传入 runQuery —— 与 model/effort 同构，
                 // 不写 AgentRunner 实例字段，多对端/多会话并发共享同一 runner 实例时互不污染。
-                let effectivePermissionMode;
                 const triggerPermissionModeOverride = message.triggerMeta?.permissionModeOverride;
                 try {
                     effectivePermissionMode = constrainRuntimePermissionMode({
@@ -2532,9 +2580,10 @@ export class ResponseEngine {
                         channel: currentChannelType || null,
                         venueUid: undefined,
                         // 群 @ 处理模式 / 客户端类型 / 权限模式
-                        // 优先 agent/relation mentionMode 配置，fallback 到服务器 dispatch_mode 缓存（协议词汇需翻译）。
+                        // 优先 agent/relation mentionMode 配置，fallback 到服务器 mention_mode 缓存。
                         mentionMode: effectiveAgentConfig?.mentionMode
-                            ?? dispatchToMentionMode(session.metadata?.dispatchMode ?? message.dispatchMode)
+                            ?? session.metadata?.mentionMode
+                            ?? message.mentionMode
                             ?? undefined,
                         clientType: message.clientType || undefined,
                         permissionMode: effectivePermissionMode,
@@ -2583,17 +2632,13 @@ export class ResponseEngine {
                 const sessionManifests = this.agentRegistry?.resolveByChannel(channelKey)?.config?.sessionManifests;
                 const manifestFile = sessionManifests?.[sessionType] ?? 'eck_manifest.json';
                 const kitContext = renderKitSections(kitCtx, manifestFile);
-                if (kitContext)
-                    contextParts.push(kitContext);
-                effectiveSystemPrompt = [options?.systemPromptAppend, ...contextParts].filter(Boolean).join('\n') || undefined;
+                effectiveSystemPrompt = [options?.systemPromptAppend, kitContext].filter(Boolean).join('\n') || undefined;
                 // ── Stats: context_breakdown 旁路采集（各段估算 token 数，字符数/4 近似） ──
                 try {
                     const estTokens = (s) => s ? Math.ceil(s.length / 4) : 0;
                     const cbModel = effectiveModel || agentModel || 'unknown';
                     const cbMaxTokens = 200000; // 保守默认，后续可从 model-catalog 取
                     const systemPromptTokens = estTokens(options?.systemPromptAppend);
-                    const personaTokens = estTokens(persona);
-                    const workingTokens = estTokens(working);
                     const kitTokens = estTokens(kitContext);
                     const totalEst = estTokens(effectiveSystemPrompt);
                     insertContextBreakdown(resolveRoot(), {
@@ -2603,7 +2648,7 @@ export class ResponseEngine {
                         turn_count: 0, // 按 ts 排序得轮次
                         model: cbModel,
                         max_tokens: cbMaxTokens,
-                        system_prompt: systemPromptTokens + personaTokens + workingTokens,
+                        system_prompt: systemPromptTokens,
                         system_tools: 0, // 工具 schema 不在此层，留 0（后续 runner 层补）
                         mcp_tools: 0,
                         custom_agents: 0,
@@ -2629,6 +2674,7 @@ export class ResponseEngine {
                                 encrypted: message.encrypted,
                                 content: message.content, timestamp: message.timestamp,
                                 images: message.images,
+                                mentions: message.mentions,
                                 mentionAids: message.mentionAids,
                             }];
                     const peerItems = (() => {
@@ -2758,6 +2804,7 @@ export class ResponseEngine {
                     ? (agent.resolveModelId(model) ?? model)
                     : model));
                 const retryAttemptTimeoutMs = this.retryAttemptTimeoutMs();
+                const retryInputIsAtMostOnce = agent.retryInputSemantics === 'at_most_once';
                 let runAttempt = 1;
                 const recordRetryHealthError = async (retryError) => {
                     if (!policy.accumulateErrors(chatType, identityRole))
@@ -2794,14 +2841,17 @@ export class ResponseEngine {
                         const processAttempt = this.processEventStream(stream, session, agent, renderer, (eventType, toolName) => {
                             resetTimer(eventType, toolName);
                             attemptTimeout?.reset();
-                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease);
+                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode);
                         streamResult = attemptTimeout
                             ? await Promise.race([processAttempt, attemptTimeout.promise])
                             : await processAttempt;
                         if (!streamResult.isError) {
                             const protocolDecision = this.turnCoordinator.evaluateCommit(turnLease, this.buildTurnCommitEvidence(session, streamResult));
                             const protocolReason = protocolDecision.ok ? undefined : protocolDecision.reason;
-                            const safeProtocolReplay = isSafeProtocolReplayCandidate(streamResult, protocolReason);
+                            // Codex app-server turn/start appends its input before runQuery
+                            // resolves. Replaying here would create a second user turn.
+                            const safeProtocolReplay = !retryInputIsAtMostOnce
+                                && isSafeProtocolReplayCandidate(streamResult, protocolReason);
                             const protocolRetry = retryScheduler.afterProtocolFailure(safeProtocolReplay ? protocolReason : undefined, safeProtocolReplay);
                             if (protocolRetry.kind === 'protocol_replay') {
                                 protocolReplayAttempts = protocolRetry.attempt;
@@ -2846,6 +2896,16 @@ export class ResponseEngine {
                             permissionError._errorAlreadySent = true;
                             throw permissionError;
                         }
+                        const retryWouldReplaySubmittedInput = retryAttemptTimedOut
+                            || isRetryableError(retryError)
+                            || classifyError(retryError) === ErrorType.MODEL_UNAVAILABLE;
+                        if (retryInputIsAtMostOnce && streamRegistered && retryWouldReplaySubmittedInput) {
+                            await recordRetryHealthError(retryError);
+                            markRetryInputAlreadySubmitted(retryError);
+                            logger.warn(`[ResponseEngine] Not replaying already-submitted input: agent=${agent.name} `
+                                + `session=${session.id} task=${taskId} attempt=${runAttempt}`);
+                            throw retryError;
+                        }
                         if (classifyError(retryError) === ErrorType.MODEL_UNAVAILABLE && !hasExplicitTriggerModel) {
                             if (probingPrimaryModel && previousFallbackState) {
                                 const resumedFallback = previousFallbackState.activeFallback;
@@ -2939,6 +2999,7 @@ export class ResponseEngine {
                         resetTimer,
                         shouldSuppress,
                         proactive,
+                        permissionMode: effectivePermissionMode,
                         turnLease,
                     });
                 }
@@ -2980,6 +3041,7 @@ export class ResponseEngine {
                     resetTimer,
                     shouldSuppress,
                     proactive,
+                    permissionMode: effectivePermissionMode,
                     turnLease,
                 });
                 // 重试后仍然 prompt_too_long：显示友好提示
@@ -3051,7 +3113,7 @@ export class ResponseEngine {
                             return;
                         const isCurrentlyBackground = this.isBackgroundSession(session, message.channel, message.channelId);
                         if (!isCurrentlyBackground) {
-                            await adapter.send({ ...envelope, replyContext: capturedReplyContext }, payload);
+                            await adapter.send(withEnvelopeReplyContext(envelope, capturedReplyContext), payload);
                             if (payload.kind === 'result.text') {
                                 logger.info(`[ResponseEngine] afterProcess sent: task=${taskId} text="${payload.text.slice(0, 60)}"`);
                             }
@@ -3139,7 +3201,10 @@ export class ResponseEngine {
                             // 发送文件
                             logger.info(`[${adapter.channelName}] Sending file via ${targetInfo.adapter.channelName}: ${resolvedPath}`);
                             try {
-                                await targetInfo.adapter.send(buildEnvelope({ taskId, channel: targetInfo.adapter.channelName, channelId: targetChannelId, agentName: agentNameForStats, replyContext: capturedReplyContext }), { kind: 'result.file', filePath: resolvedPath });
+                                const targetReplyContext = isCrossChannel
+                                    ? { delivery: { chatType: 'private' } }
+                                    : capturedReplyContext;
+                                await targetInfo.adapter.send(buildEnvelope({ taskId, channel: targetInfo.adapter.channelName, channelId: targetChannelId, agentName: agentNameForStats, replyContext: targetReplyContext }), { kind: 'result.file', filePath: resolvedPath });
                                 this.eventBus.publish({ type: 'runner:file-sent', sessionId: session.id, filePath: resolvedPath, channel: targetInfo.adapter.channelName });
                                 sent++;
                                 if (isCrossChannel) {
@@ -3662,6 +3727,7 @@ export class ResponseEngine {
             // processEventStream 已通过 renderer 发过错误时也跳过
             const retryExhaustedCount = getRetryExhaustedCount(error);
             const modelFallbackExhaustedMessage = getModelFallbackExhaustedMessage(error);
+            const retryInputAlreadySubmitted = wasRetryInputAlreadySubmitted(error);
             if (isUserInterrupt) {
                 logger.info(`[ResponseEngine] User interrupt by new_message, skip sending error message`);
             }
@@ -3673,13 +3739,15 @@ export class ResponseEngine {
                 const idleSec = getLastIdleSec?.() || 0;
                 const userMessage = retryExhaustedCount
                     ? formatRetryableErrorFinalMessage(error, retryExhaustedCount)
-                    : modelFallbackExhaustedMessage
-                        ? modelFallbackExhaustedMessage
-                        : isTotalExecutionTimeout
-                            ? `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`
-                            : isTimeout
-                                ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
-                                : getErrorMessage(error, undefined);
+                    : retryInputAlreadySubmitted
+                        ? formatRetryInputAlreadySubmittedMessage(error)
+                        : modelFallbackExhaustedMessage
+                            ? modelFallbackExhaustedMessage
+                            : isTotalExecutionTimeout
+                                ? `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`
+                                : isTimeout
+                                    ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
+                                    : getErrorMessage(error, undefined);
                 // 获取 session 用于话题回复（如果 resolveSession 已执行）
                 let sendOpts;
                 try {
@@ -3696,14 +3764,14 @@ export class ResponseEngine {
                 const errorPayload = {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: retryExhaustedCount ? 'retry_exhausted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
+                    reason: retryExhaustedCount ? 'retry_exhausted' : retryInputAlreadySubmitted ? 'input_already_submitted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
                 };
                 if (!isUserInterrupt && daemonTrigger && procStatus === 'error') {
                     // DaemonChannel settles a trigger on the first terminal payload. Put
                     // the complete failure metadata first so the audit retains tool
                     // counts and context-recovery diagnostics even for thrown errors
                     // (for example when compact itself fails).
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, {
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), {
                         kind: 'status.error',
                         metadata: {
                             errorType: errType,
@@ -3716,17 +3784,17 @@ export class ResponseEngine {
                             contextRecoveryAttempts: streamResult.contextRecoveryAttempts ?? 0,
                         },
                     }).catch(() => { });
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, errorPayload);
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), errorPayload);
                 }
                 else {
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, errorPayload);
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), errorPayload);
                 }
                 if (!isUserInterrupt && daemonTrigger && procStatus !== 'error') {
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, statusPayload).catch(() => { });
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), statusPayload).catch(() => { });
                 }
                 // Proactive 可观测：catch 块的基础设施错误也透传为 thought，保证按 task_id 聚合完整
                 if (isProactive && adapter.capabilities?.thought) {
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, {
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), {
                         kind: 'activity.batch',
                         items: [{
                                 kind: 'notice',
@@ -3916,12 +3984,10 @@ export class ResponseEngine {
                 await this.sessionManager.updateSession(session.id, { metadata: session.metadata });
             }
         }
-        // 群聊分发模式同步：aun.ts 从服务器信封解析的 dispatchMode 注入到 message，
-        // 此处写入 session.metadata，确保 ECK 上下文的 venue fragment 正确渲染 dispatch 变量。
-        // 仅当 message.dispatchMode 有值且与 session 记录不一致时更新。
-        if (message.chatType === 'group' && message.dispatchMode && session.metadata?.dispatchMode !== message.dispatchMode) {
-            logger.info(`[ResponseEngine] dispatchMode sync: sessionId=${session.id} ${session.metadata?.dispatchMode ?? 'none'} -> ${message.dispatchMode}`);
-            session.metadata = { ...(session.metadata || {}), dispatchMode: message.dispatchMode };
+        // 同步服务端 mention_mode，供同一群会话的上下文和菜单展示使用。
+        if (message.chatType === 'group' && message.mentionMode && session.metadata?.mentionMode !== message.mentionMode) {
+            logger.info(`[ResponseEngine] mentionMode sync: sessionId=${session.id} ${session.metadata?.mentionMode ?? 'none'} -> ${message.mentionMode}`);
+            session.metadata = { ...(session.metadata || {}), mentionMode: message.mentionMode };
             await this.sessionManager.updateSession(session.id, { metadata: session.metadata });
         }
         // chatMode 策略由 agent/relation behavior 配置在处理阶段解析；此处不再写 session 级参数。
@@ -3956,7 +4022,7 @@ export class ResponseEngine {
      */
     async processEventStream(stream, session, agent, renderer, resetTimer, shouldSuppress, proactive, 
     /** [迁移点4/5] 响应模式插件 + 状态，用于调 onToolUse/onComplete 钩子 */
-    modeHooks, causation, turnLease) {
+    modeHooks, causation, turnLease, permissionMode) {
         // Per-session agent name for stats bucketing
         const statsChannelKey = session.channel === 'daemon' ? session.channel : (session.metadata?.channelKey || session.channel);
         const agentNameForStats = this.agentRegistry?.resolveByChannel(statsChannelKey)?.name ?? '<unknown>';
@@ -4042,6 +4108,11 @@ export class ResponseEngine {
                         }
                     }
                 }
+                else if (event.type === 'notice') {
+                    for (const callId of event.closedToolCallIds ?? []) {
+                        openToolUseIds.delete(callId);
+                    }
+                }
                 else if (event.type === 'complete') {
                     assistantUuid = event.assistantUuid ?? assistantUuid;
                     protocolIncompleteReason = event.protocolIncompleteReason ?? protocolIncompleteReason;
@@ -4278,6 +4349,9 @@ export class ResponseEngine {
                             sessionId: session.id,
                             toolName: event.name,
                             input: event.input,
+                            ...(event.callId ? { callId: event.callId } : {}),
+                            ...(session.selfAID ? { agentAid: session.selfAID } : {}),
+                            ...(permissionMode ? { permissionMode } : {}),
                             timestamp: Date.now(),
                             causation,
                         });
@@ -4293,6 +4367,7 @@ export class ResponseEngine {
                         }
                         // [迁移点4] 工具汇报提醒：由 ProactiveMode.onToolUse 实现
                         if (modeHooks?.mode?.onToolUse) {
+                            const proactiveState = modeHooks.state.get('proactive');
                             modeHooks.mode.onToolUse({
                                 session,
                                 state: modeHooks.state,
@@ -4300,7 +4375,7 @@ export class ResponseEngine {
                                 toolInput: event.input || {},
                                 injectToModel: (text) => { agent.injectUserMessage?.(session.id, text); },
                                 getQueueLength: () => this.messageQueue?.getQueueLength(session.id) ?? 0,
-                                isSendCommand: (toolName, toolInput) => isEvolcoreSendCommandForSession(toolName, toolInput, session.channelId),
+                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', session.selfAID),
                                 logger,
                             });
                         }
@@ -4326,6 +4401,9 @@ export class ResponseEngine {
                             toolName: event.name,
                             isError: event.isError,
                             agentName: agentNameForStats,
+                            ...(event.callId ? { callId: event.callId } : {}),
+                            ...(session.selfAID ? { agentAid: session.selfAID } : {}),
+                            ...(permissionMode ? { permissionMode } : {}),
                             timestamp: Date.now(),
                             causation,
                         });
@@ -4342,6 +4420,12 @@ export class ResponseEngine {
                             renderer.addToolResult(event.name || '\u5de5\u5177', true, event.result, undefined, event.callId, event.durationMs, cachedDesc);
                         }
                     }
+                    // 非终态运行时告警走 status notify，不进入 activity/thought 历史。
+                    if (event.type === 'notice' && event.severity === 'warn') {
+                        await renderer.sendWarningStatus(event.message, event.subtype, {
+                            ...(event.missingItems !== undefined && { missingItems: event.missingItems }),
+                        });
+                    }
                     // 运行时错误（Codex: turn.failed / item error）
                     if (event.type === 'error') {
                         logger.warn(`[ResponseEngine] error event: ${event.errorType}: ${event.error}`);