evolcore 0.0.11 → 0.0.13

package/dist/agents/codex-runner.js

@@ -7,19 +7,19 @@
  */
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
-import { normalizePermissionMode } from '../core/permission/mode.js';
-import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
+import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/protected-paths.js';
 import { CodexAppServerClient } from './codex-app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
+import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, parseLiteralShellArgv } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
@@ -75,6 +75,39 @@ class AsyncEventQueue {
 }
 const managedTempDirsForExitCleanup = new Map();
 let managedTempExitCleanupRegistered = false;
+function isTrustedManagedTempDirectory(directory, parent) {
+    try {
+        const parentPath = path.resolve(parent);
+        const directoryPath = path.resolve(directory);
+        // The session directory must be a direct child of the private parent.
+        // This lexical check is required before canonicalization so a replaced
+        // parent symlink cannot turn an old session path into another tree.
+        if (path.dirname(directoryPath) !== parentPath)
+            return false;
+        const trustedDirectory = (candidate) => {
+            const stat = fs.lstatSync(candidate);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                return false;
+            if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                return false;
+            return (stat.mode & 0o077) === 0;
+        };
+        if (!trustedDirectory(parentPath) || !trustedDirectory(directoryPath))
+            return false;
+        const canonicalParent = resolveProtectedCandidate(parentPath);
+        const canonicalDirectory = resolveProtectedCandidate(directoryPath);
+        // Keep the canonical and lexical paths identical after the lstat checks;
+        // this rejects symlink replacement in either node or an existing ancestor.
+        return canonicalParent === parentPath
+            && canonicalDirectory === directoryPath
+            && canonicalDirectory !== canonicalParent
+            && path.dirname(canonicalDirectory) === canonicalParent
+            && isSameOrDescendant(canonicalDirectory, canonicalParent);
+    }
+    catch {
+        return false;
+    }
+}
 function registerManagedTempDirForExitCleanup(directory, parent) {
     managedTempDirsForExitCleanup.set(directory, parent);
     if (managedTempExitCleanupRegistered)
@@ -83,10 +116,8 @@ function registerManagedTempDirForExitCleanup(directory, parent) {
     process.once('exit', () => {
         for (const [candidatePath, parentPath] of managedTempDirsForExitCleanup) {
             try {
-                const parentCandidate = resolveProtectedCandidate(parentPath);
-                const candidate = resolveProtectedCandidate(candidatePath);
-                if (candidate !== parentCandidate && isSameOrDescendant(candidate, parentCandidate)) {
-                    fs.rmSync(candidate, { recursive: true, force: true });
+                if (isTrustedManagedTempDirectory(candidatePath, parentPath)) {
+                    fs.rmSync(path.resolve(candidatePath), { recursive: true, force: true });
                 }
             }
             catch {
@@ -118,10 +149,9 @@ const CODEX_CATALOG_FALLBACK = [
 ];
 const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
 let codexCatalogCache = null;
-// The permission bridge is version-locked to the v2 schema audited below:
-// named profiles, approvalsReviewer, additional/network approval context, and
-// item/permissions/requestApproval must all be present together.
-export const MIN_CODEX_CLI_VERSION = '0.144.1';
+// The permission bridge is version-locked to the audited approval schema and
+// managed PreToolUse hook behavior used by proactive first-tool enforcement.
+export const MIN_CODEX_CLI_VERSION = '0.145.0';
 export function parseCodexCliVersion(output) {
     const match = output.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/);
     return match?.[1] ?? null;
@@ -144,19 +174,18 @@ export function getCodexCliVersion() {
 }
 export function getCodexAppServerAvailability() {
     if (!resolveCodexCliPath()) {
-        const upgradeHint = '请升级 Codex CLI：npm install -g @openai/codex@latest';
-        return { available: false, reason: `未检测到可用 Codex CLI。${upgradeHint}` };
+        return { available: false, reason: '未检测到 Codex CLI。' };
     }
     const version = getCodexCliVersion();
-    const upgradeHint = '请升级 Codex CLI：npm install -g @openai/codex@latest';
     if (!version) {
-        return { available: false, reason: `未检测到可用 Codex CLI。${upgradeHint}` };
+        return { available: false, reason: '无法读取 Codex CLI 版本。' };
     }
     if (!isCodexCliVersionSupported(version)) {
         return {
             available: false,
             version,
-            reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。${upgradeHint}`,
+            reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。请升级 Codex CLI：npm install -g @openai/codex@latest`,
+            requiresUpgrade: true,
         };
     }
     try {
@@ -168,7 +197,7 @@ export function getCodexAppServerAvailability() {
         return { available: true, version };
     }
     catch {
-        return { available: false, version, reason: `Codex CLI ${version} 不支持 app-server。${upgradeHint}` };
+        return { available: false, version, reason: `Codex CLI ${version} 不支持 app-server。` };
     }
 }
 export function isCodexAppServerAvailable() {
@@ -208,6 +237,9 @@ export function getCodexEfforts(model) {
 // ── Codex Runner ──
 export class CodexRunner {
     name = 'codex';
+    // turn/start persists a new user turn before runQuery resolves. App-server
+    // has no retry-in-place API for a completed or failed turn.
+    retryInputSemantics = 'at_most_once';
     capabilities;
     model;
     effort;
@@ -223,6 +255,8 @@ export class CodexRunner {
     trackedApprovalItems = new Map();
     threadDelegationCarriers = new Map();
     pendingInterrupts = new Map();
+    threadOperationLocks = new Map();
+    activeOperationReleases = new Map();
     appServerClient = null;
     onSessionIdUpdate;
     onCompactStart;
@@ -280,25 +314,23 @@ export class CodexRunner {
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommandArgv(command) {
+    approvedLiteralEvolcoreCommandArgv(command, managedTempDir) {
         const classification = classifyEvolcoreShellCommand(command);
         if (classification.kind === 'bounded-output')
             return classification.command.argv;
         if (classification.kind !== 'literal')
             return undefined;
-        const argv = parseLiteralShellArgv(command);
-        return argv?.[0] === 'ec' ? argv : undefined;
-    }
-    unwrapCodexShellCommandArgv(argv) {
-        if (argv.length !== 3 || argv[1] !== '-lc')
-            return undefined;
-        const shell = argv[0];
-        if (!['bash', '/bin/bash', '/usr/bin/bash', 'sh', '/bin/sh', '/usr/bin/sh'].includes(shell)) {
+        // Keep the approval/delegation parser aligned with the preflight parser:
+        // the session-managed `$TMPDIR` token is a permitted EC path reference.
+        const argv = parseLiteralShellArgv(command, {
+            allowManagedTmpDir: true,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        });
+        if (argv?.some(value => value.includes('$TMPDIR')))
             return undefined;
-        }
-        return argv[2];
+        return argv?.[0] === 'ec' ? argv : undefined;
     }
-    approvedEvolcoreCommandArgv(toolInput) {
+    approvedEvolcoreCommandArgv(toolInput, managedTempDir) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
@@ -306,27 +338,30 @@ export class CodexRunner {
         if (explicitArgv?.[0] === 'ec')
             return explicitArgv;
         const explicitWrappedCommand = explicitArgv
-            ? this.unwrapCodexShellCommandArgv(explicitArgv)
+            ? unwrapCodexShellCommandArgv(explicitArgv)
             : undefined;
         if (explicitWrappedCommand !== undefined) {
-            return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand);
+            return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand, managedTempDir);
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
-        const directArgv = this.approvedLiteralEvolcoreCommandArgv(command);
+        const directArgv = this.approvedLiteralEvolcoreCommandArgv(command, managedTempDir);
         if (directArgv)
             return directArgv;
-        const wrappedArgv = parseLiteralShellArgv(command);
+        const wrappedArgv = parseLiteralShellArgv(command, {
+            allowManagedTmpDir: true,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        });
         const wrappedCommand = wrappedArgv
-            ? this.unwrapCodexShellCommandArgv(wrappedArgv)
+            ? unwrapCodexShellCommandArgv(wrappedArgv)
             : undefined;
         return wrappedCommand === undefined
             ? undefined
-            : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand);
+            : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand, managedTempDir);
     }
     armApprovedDelegationCommand(sessionId, toolInput) {
         const threadId = this.activeSessions.get(sessionId);
         const carrierToken = threadId ? this.threadDelegationCarriers.get(threadId) : undefined;
-        const argv = this.approvedEvolcoreCommandArgv(toolInput);
+        const argv = this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionId));
         if (!carrierToken || !argv)
             return false;
         const commandHash = hashDelegatedCommandArgv(argv);
@@ -796,6 +831,35 @@ export class CodexRunner {
     }
     setSendPrompt(fn) { this.sendPromptFn = fn; }
     setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    async evaluatePreToolUse(threadId, toolName, toolInput) {
+        const sessionKey = this.findSessionKeyByThread(threadId);
+        const activeThread = this.activeSessions.get(sessionKey);
+        const context = this.permissionContexts.get(sessionKey);
+        if (!activeThread || activeThread !== threadId) {
+            return { ok: true, applicable: false };
+        }
+        const proactiveSession = context?.chatmode === 'proactive';
+        if (!context || (proactiveSession && !context.preToolUsePolicyHook)) {
+            return { ok: false, applicable: true, decision: 'deny', reason: 'EvolCore proactive session policy context is unavailable' };
+        }
+        // A tracked interactive thread still needs an authenticated, explicit
+        // allow so the managed hook can fail closed when no runner matches.
+        if (!context.preToolUsePolicyHook)
+            return { ok: true, applicable: true, decision: 'allow' };
+        const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
+            ? toolInput
+            : {};
+        try {
+            const result = context.preToolUsePolicyHook(toolName, normalizedInput);
+            if (result?.block) {
+                return { ok: true, applicable: true, decision: 'deny', reason: result.reason };
+            }
+            return { ok: true, applicable: true, decision: 'allow' };
+        }
+        catch (error) {
+            return { ok: false, applicable: true, decision: 'deny', reason: `policy hook failed: ${error instanceof Error ? error.message : String(error)}` };
+        }
+    }
     setPermissionGateway(gw) { this.permissionGateway = gw; }
     // ── Stream management (needed by MessageProcessor) ──
     registerStream(key, stream) {
@@ -805,13 +869,135 @@ export class CodexRunner {
         this.activeStreams.delete(key);
         this.activeAbortControllers.delete(key);
         this.pendingInterrupts.delete(key);
+        const release = this.activeOperationReleases.get(key);
+        if (release) {
+            this.activeOperationReleases.delete(key);
+            release();
+        }
     }
     hasActiveStream(key) {
         return this.activeStreams.has(key) || this.activeAbortControllers.has(key) || this.activeTurns.has(key);
     }
+    threadOperationKey(threadId, sessionId) {
+        // Once a thread id is known it is the shared identity, including when
+        // multiple EvolCore sessions happen to address the same Codex thread.
+        if (threadId)
+            return `thread:${threadId}`;
+        if (sessionId)
+            return `session:${sessionId}`;
+        return 'session:unknown';
+    }
+    getThreadOperationLock(key) {
+        const existing = this.threadOperationLocks.get(key);
+        if (existing)
+            return existing;
+        const lock = { aliases: new Set([key]) };
+        this.threadOperationLocks.set(key, lock);
+        return lock;
+    }
+    bindThreadOperationKeys(...keys) {
+        const uniqueKeys = [...new Set(keys.filter(Boolean))];
+        if (uniqueKeys.length < 2)
+            return;
+        const locks = uniqueKeys.map(key => this.getThreadOperationLock(key));
+        const primary = locks[0];
+        for (const other of locks.slice(1)) {
+            if (other === primary)
+                continue;
+            const tails = [primary.tail, other.tail].filter((tail) => !!tail);
+            if (tails.length === 1) {
+                primary.tail = tails[0];
+            }
+            else if (tails.length > 1) {
+                const merged = Promise.all(tails).then(() => undefined);
+                primary.tail = merged;
+                merged.then(() => {
+                    if (primary.tail === merged)
+                        primary.tail = undefined;
+                });
+            }
+            for (const alias of other.aliases) {
+                primary.aliases.add(alias);
+                this.threadOperationLocks.set(alias, primary);
+            }
+        }
+    }
+    isActiveThreadOperationAlias(key) {
+        if (key.startsWith('session:'))
+            return this.activeSessions.has(key.slice('session:'.length));
+        if (key.startsWith('thread:')) {
+            const threadId = key.slice('thread:'.length);
+            for (const activeThreadId of this.activeSessions.values()) {
+                if (activeThreadId === threadId)
+                    return true;
+            }
+            return false;
+        }
+        return true;
+    }
+    pruneThreadOperationLocks() {
+        for (const [key, lock] of this.threadOperationLocks) {
+            if (lock.tail || this.isActiveThreadOperationAlias(key))
+                continue;
+            this.threadOperationLocks.delete(key);
+            lock.aliases.delete(key);
+        }
+    }
+    async acquireThreadOperation(key, operation) {
+        const lock = this.getThreadOperationLock(key);
+        const previous = lock.tail;
+        let releaseCurrent;
+        const current = new Promise(resolve => {
+            releaseCurrent = resolve;
+        });
+        lock.tail = current;
+        if (previous) {
+            logger.info(`[CodexRunner] queued ${operation} behind an active operation: ${key}`);
+            await previous;
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            if (lock.tail === current)
+                lock.tail = undefined;
+            releaseCurrent();
+            this.pruneThreadOperationLocks();
+        };
+    }
+    async *holdThreadOperation(stream, sessionId, release) {
+        try {
+            for await (const item of stream)
+                yield item;
+        }
+        finally {
+            if (this.activeOperationReleases.get(sessionId) === release) {
+                this.activeOperationReleases.delete(sessionId);
+            }
+            release();
+        }
+    }
     // ── Core: runQuery ──
     async runQuery(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
+        const knownThreadId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        const operationKey = this.threadOperationKey(knownThreadId, sessionId);
+        const release = await this.acquireThreadOperation(operationKey, 'thread/resume+turn/start');
+        try {
+            const stream = await this.runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv);
+            this.activeOperationReleases.set(sessionId, release);
+            return this.holdThreadOperation(stream, sessionId, release);
+        }
+        catch (error) {
+            release();
+            throw error;
+        }
+    }
+    async runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
         let agentSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        if (this.permissionContexts.get(sessionId)?.chatmode === 'proactive' && process.platform !== 'linux') {
+            throw new Error('Codex proactive managed PreToolUse enforcement currently requires Linux');
+        }
         const resumingThread = !!agentSessionId;
         const callModel = modelOverride?.model || this.model;
         const callEffort = modelOverride?.effortMode === 'model_default'
@@ -893,6 +1079,7 @@ export class CodexRunner {
         }
         agentSessionId = threadId;
         this.activeSessions.set(sessionId, threadId);
+        this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         this.threadProjectPaths.set(threadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(threadId, externalToolConfig);
         this.onSessionIdUpdate?.(sessionId, threadId);
@@ -1035,10 +1222,12 @@ export class CodexRunner {
         }
         if (agentSessionId) {
             this.activeSessions.set(sessionId, agentSessionId);
+            this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${agentSessionId}`);
         }
         else {
             this.activeSessions.delete(sessionId);
         }
+        this.pruneThreadOperationLocks();
         this.onSessionIdUpdate?.(sessionId, agentSessionId);
     }
     async closeSession(sessionId) {
@@ -1057,6 +1246,7 @@ export class CodexRunner {
             this.unbindExternalToolBoundary(threadId);
         }
         this.clearTrackedApprovalItemsForThread(threadId);
+        this.pruneThreadOperationLocks();
     }
     resolveSessionFile(agentSessionId, _projectPath) {
         // Codex session 文件: ~/.codex/sessions/YYYY/MM/DD/rollout-*-{threadId}.jsonl
@@ -1089,10 +1279,12 @@ export class CodexRunner {
         this.threadDelegationCarriers.delete(threadId);
         this.unbindExternalToolBoundary(threadId);
         this.clearTrackedApprovalItemsForThread(threadId);
+        this.pruneThreadOperationLocks();
         this.onSessionIdUpdate?.(sessionId, '');
         return true;
     }
     async compactSession(_sessionId, agentSessionId, _projectPath) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId, _sessionId), 'compact');
         try {
             const appServer = this.getAppServerClient();
             this.onCompactStart?.(_sessionId);
@@ -1129,6 +1321,9 @@ export class CodexRunner {
             logger.error('[CodexRunner] Compact failed:', error);
             return false;
         }
+        finally {
+            release();
+        }
     }
     async compact(sessionId, agentSessionId, projectPath) {
         return this.compactSession(sessionId, agentSessionId, projectPath);
@@ -1254,6 +1449,15 @@ export class CodexRunner {
         return newest?.path;
     }
     async forkSession(agentSessionId, projectPath, title) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'fork');
+        try {
+            return await this.forkSessionLocked(agentSessionId, projectPath, title);
+        }
+        finally {
+            release();
+        }
+    }
+    async forkSessionLocked(agentSessionId, projectPath, title) {
         const sessionKey = this.findSessionKeyByThread(agentSessionId);
         const mode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const executionSandbox = this.buildExecutionSandboxOptions(sessionKey, mode, projectPath);
@@ -1278,18 +1482,30 @@ export class CodexRunner {
         return forkedThreadId;
     }
     async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title) {
-        const turns = buildSessionTurnList(await this.getSessionMessages(agentSessionId, projectPath));
-        const targetIndex = turns.findIndex(turn => turn.assistantUuid === assistantMessageId);
-        if (targetIndex < 0)
-            throw new Error('fork point not found');
-        const forkedThreadId = await this.forkSession(agentSessionId, projectPath, title);
-        const turnsToDiscard = turns.length - targetIndex - 1;
-        if (turnsToDiscard > 0) {
-            const rolledBack = await this.rollbackSessionTurns(forkedThreadId, projectPath, turnsToDiscard);
-            if (!rolledBack)
-                throw new Error('forked thread rollback failed');
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'forkAt');
+        try {
+            const turns = buildSessionTurnList(await this.getSessionMessages(agentSessionId, projectPath));
+            const targetIndex = turns.findIndex(turn => turn.assistantUuid === assistantMessageId);
+            if (targetIndex < 0)
+                throw new Error('fork point not found');
+            const forkedThreadId = await this.forkSessionLocked(agentSessionId, projectPath, title);
+            const turnsToDiscard = turns.length - targetIndex - 1;
+            if (turnsToDiscard > 0) {
+                const rollbackRelease = await this.acquireThreadOperation(this.threadOperationKey(forkedThreadId), 'rollback');
+                try {
+                    const rolledBack = await this.rollbackSessionTurnsLocked(forkedThreadId, turnsToDiscard);
+                    if (!rolledBack)
+                        throw new Error('forked thread rollback failed');
+                }
+                finally {
+                    rollbackRelease();
+                }
+            }
+            return forkedThreadId;
+        }
+        finally {
+            release();
         }
-        return forkedThreadId;
     }
     async setSessionName(agentSessionId, name) {
         return this.getAppServerClient().threadSetName(agentSessionId, name);
@@ -1421,6 +1637,25 @@ export class CodexRunner {
         // proactive 模式行为策略（首次工具调用必须是 ec msg send）
         const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         if (policyResult?.block) {
+            logger.info(`[CodexRunner] app-server approval declined by session policy: session=${sessionKey} ` +
+                `requestId=${request.id ?? '<missing>'} code=${policyResult.policyCode ?? 'session_policy_hook'} ` +
+                `reason=${policyResult.reason ?? 'policy denied'} executed=false`);
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+                    policyCode: policyResult.policyCode ?? 'session_policy_hook',
+                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record policy-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+            }
             return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
@@ -1434,10 +1669,10 @@ export class CodexRunner {
         const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${summary}`);
         try {
-            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd);
+            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
             if (decision !== 'deny'
                 && (request.method === 'item/commandExecution/requestApproval' || request.method === 'execCommandApproval')
-                && this.approvedEvolcoreCommandArgv(toolInput)) {
+                && this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionKey))) {
                 if (!this.armApprovedDelegationCommand(sessionKey, toolInput)) {
                     // Approval policy and delegation authority are separate boundaries.
                     // If no ticket can be armed, the CLI still fails closed at IPC token
@@ -1865,10 +2100,15 @@ export class CodexRunner {
             channel: permCtx?.channel,
             peerId: permCtx?.userId,
             role: permCtx?.role,
+            allowProtectedMetadata: false,
+            // Revalidate ownership, mode, and parent containment at the final
+            // readonly decision. The map entry alone is stale if the directory was
+            // replaced between preflight and the approval callback.
+            managedTempDir: this.getManagedTempDir(sessionKey),
         } : undefined;
         if (toolName === 'Bash')
             return checkReadonly(toolName, input, projectPath, readonlyContext);
-        return { behavior: 'deny', message: '🔒 只读模式：权限升级和文件写入请求已拒绝' };
+        return { behavior: 'deny', message: '🔒 只读模式：权限升级和文件写入请求已拒绝', policyCode: 'readonly_permission_or_write' };
     }
     permissionProfiles(input) {
         return [input.permissions, input.additionalPermissions]
@@ -1965,7 +2205,7 @@ export class CodexRunner {
             return true;
         });
     }
-    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath) {
+    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId) {
         const permissionContext = this.permissionContexts.get(sessionKey);
         const permissionPrompt = permissionContext?.sendPrompt ?? this.sendPromptFn;
         const hasFilesystemPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
@@ -1980,8 +2220,34 @@ export class CodexRunner {
         // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const mode = normalizePermissionMode(rawMode).mode;
+        const recordBlockedOperation = async (policyCode, operationInput = toolInput) => {
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(typeof requestId === 'string' || typeof requestId === 'number' ? { requestId: String(requestId) } : {}),
+                    policyCode,
+                    decisionSource: 'policy',
+                    agentAid: permissionContext?.selfAid,
+                    permissionMode: mode,
+                    summary: summarizeToolInputForAudit(toolName, operationInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record blocked operation: session=${sessionKey} tool=${toolName} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
         const preflight = evaluateToolPreflight(toolName, toolInput, {
             sessionId: sessionKey,
+            // An unavailable registered root must fail closed; the policy helper
+            // distinguishes this explicit empty value from runners without a
+            // session-temp capability.
+            managedTempDir: this.getManagedTempDir(sessionKey) ?? '',
+            allowProtectedMetadata: false,
             selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
             userId: permissionContext?.userId,
@@ -1990,8 +2256,14 @@ export class CodexRunner {
             projectPath: operationCwd,
             workspacePath,
         });
-        if (preflight.behavior === 'deny')
+        if (preflight.behavior === 'deny') {
+            logger.warn(`[CodexRunner] tool preflight denied: session=${sessionKey} tool=${toolName} ` +
+                `policy=${preflight.policyCode ?? 'unknown'} reason=${preflight.message ?? 'policy denied'}`);
+            if (preflight.policyCode) {
+                await recordBlockedOperation(preflight.policyCode);
+            }
             return 'deny';
+        }
         if (preflight.behavior === 'allow')
             return 'allow';
         const checkedInput = preflight.input;
@@ -2015,8 +2287,10 @@ export class CodexRunner {
         const grantScope = `codex:${this.permissionProfileName(sessionKey)}:${mode}`;
         if (mode === 'readonly') {
             const readonly = this.checkCodexReadonly(toolName, checkedInput, operationCwd, sessionKey);
-            if (readonly.behavior === 'deny')
+            if (readonly.behavior === 'deny') {
+                await recordBlockedOperation(readonly.policyCode ?? 'readonly_mode', checkedInput);
                 return 'deny';
+            }
             return 'allow';
         }
         if (toolName.startsWith('MCP:')) {
@@ -2024,13 +2298,19 @@ export class CodexRunner {
         }
         // auto 模式下检查危险命令，危险命令自动拒绝
         if (mode === 'auto') {
-            if (hasFileChangeExpansion || hasFilesystemPermissions || hasUnknownPermissions)
+            if (hasFileChangeExpansion || hasFilesystemPermissions || hasUnknownPermissions) {
+                await recordBlockedOperation('auto_permission_expansion', checkedInput);
                 return 'deny';
-            if (toolName === 'PermissionGrant' && !hasNetworkPermissions)
+            }
+            if (toolName === 'PermissionGrant' && !hasNetworkPermissions) {
+                await recordBlockedOperation('auto_permission_expansion', checkedInput);
                 return 'deny';
+            }
             const dangerous = checkDangerousCommand(toolName, checkedInput);
-            if (dangerous.isDangerous)
+            if (dangerous.isDangerous) {
+                await recordBlockedOperation('auto_dangerous_command', checkedInput);
                 return 'deny';
+            }
             return 'allow';
         }
         const requiresSandboxExpansionApproval = hasFileChangeExpansion
@@ -2083,6 +2363,15 @@ export class CodexRunner {
         throw new Error('Unsupported Codex app-server request: ' + method);
     }
     async rollbackSessionTurns(agentSessionId, _projectPath, numTurns) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'rollback');
+        try {
+            return await this.rollbackSessionTurnsLocked(agentSessionId, numTurns);
+        }
+        finally {
+            release();
+        }
+    }
+    async rollbackSessionTurnsLocked(agentSessionId, numTurns) {
         if (numTurns < 1)
             return true;
         const response = await this.getAppServerClient().threadRollback(agentSessionId, numTurns);
@@ -2121,7 +2410,11 @@ export class CodexRunner {
     }
     readGitHeadFile(projectPath, filePath) {
         try {
-            return execFileSync('git', ['show', `HEAD:${filePath.replace(/\\/g, '/')}`], { cwd: projectPath, stdio: ['pipe', 'pipe', 'ignore'] });
+            return execFileSync('git', ['show', `HEAD:${filePath.replace(/\\/g, '/')}`], {
+                cwd: projectPath,
+                stdio: ['pipe', 'pipe', 'ignore'],
+                windowsHide: process.platform === 'win32',
+            });
         }
         catch {
             return null;
@@ -2400,19 +2693,18 @@ export class CodexRunner {
     *reconcileOpenAppServerToolCalls(state, turnId) {
         if (state.openToolCalls.size === 0)
             return;
-        const callIds = [...state.openToolCalls.keys()];
+        const openCalls = [...state.openToolCalls.entries()];
+        const callIds = openCalls.map(([callId]) => callId);
         logger.warn(`[CodexRunner] Turn completed with ${callIds.length} open tool call(s): ` +
             `thread=${state.threadId} turn=${turnId || state.turnId || 'unknown'} calls=${callIds.join(',')}`);
-        for (const [callId, name] of state.openToolCalls) {
-            yield {
-                type: 'tool_result',
-                name,
-                result: '',
-                isError: true,
-                error: 'Codex app-server ended the turn without an item/completed notification',
-                callId,
-            };
-        }
+        yield {
+            type: 'notice',
+            severity: 'warn',
+            subtype: 'missing-item-completed',
+            message: 'Turn completed before tool completion was received',
+            closedToolCallIds: callIds,
+            missingItems: openCalls.map(([itemId, toolName]) => ({ itemId, toolName })),
+        };
         state.openToolCalls.clear();
     }
     *mapAppServerItemStarted(item, state) {
@@ -2783,39 +3075,28 @@ export class CodexRunner {
         }
     }
     isTrustedSessionTempDir(directory) {
-        try {
-            const rawStat = fs.lstatSync(directory);
-            if (!rawStat.isDirectory() || rawStat.isSymbolicLink())
-                return false;
-            const parent = resolveProtectedCandidate(this.managedTempParent());
-            const canonical = resolveProtectedCandidate(directory);
-            for (const candidate of [parent, canonical]) {
-                const stat = fs.lstatSync(candidate);
-                if (!stat.isDirectory() || stat.isSymbolicLink())
-                    return false;
-                if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
-                    return false;
-                if ((stat.mode & 0o077) !== 0)
-                    return false;
-            }
-            return canonical !== parent && isSameOrDescendant(canonical, parent);
-        }
-        catch {
-            return false;
-        }
+        return isTrustedManagedTempDirectory(directory, this.managedTempParent());
+    }
+    getManagedTempDir(sessionId) {
+        const directory = this.sessionTempDirs.get(sessionId);
+        if (!directory || !this.isTrustedSessionTempDir(directory))
+            return undefined;
+        return resolveProtectedCandidate(directory);
     }
     cleanupSessionTempDir(sessionId) {
         const directory = this.sessionTempDirs.get(sessionId);
         this.sessionTempDirs.delete(sessionId);
         if (!directory)
             return;
-        const parent = resolveProtectedCandidate(this.managedTempParent());
-        const candidate = resolveProtectedCandidate(directory);
-        if (candidate === parent || !isSameOrDescendant(candidate, parent)) {
+        // Reuse the same ownership, mode, lexical-parent, and canonicalization
+        // checks used at execution time. If the path changed, leave it in place
+        // rather than recursively removing an attacker-selected target.
+        if (!this.isTrustedSessionTempDir(directory)) {
             managedTempDirsForExitCleanup.delete(directory);
             logger.warn(`[CodexRunner] refused to clean unmanaged TMPDIR: session=${sessionId} path=${directory}`);
             return;
         }
+        const candidate = path.resolve(directory);
         try {
             fs.rmSync(candidate, { recursive: true, force: true });
             managedTempDirsForExitCleanup.delete(directory);
@@ -2827,7 +3108,7 @@ export class CodexRunner {
     managedTempInstruction(sessionId) {
         if (!this.ensureSessionTempDir(sessionId))
             return undefined;
-        return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。';
+        return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 `/tmp/evolcore-codex-*` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 `$TMPDIR` 重新创建，再继续执行后续 `ec` 命令。';
     }
     buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier) {
         const managedTempDir = this.ensureSessionTempDir(sessionId);
@@ -2877,6 +3158,8 @@ export class CodexRunner {
         this.pendingInterrupts.clear();
         this.permissionContexts.clear();
         this.chatModes.clear();
+        this.pruneThreadOperationLocks();
+        this.threadOperationLocks.clear();
         for (const sessionId of [...this.sessionTempDirs.keys()])
             this.cleanupSessionTempDir(sessionId);
         await this.appServerClient?.close();