evolcore 0.0.12 → 0.0.13

package/dist/core/message/message-utils.js

@@ -9,6 +9,10 @@ import { renderCommandCardAsText, renderActionAsText } from '../interaction-rout
  */
 export function buildEnvelope(opts) {
     const taskId = opts.taskId ?? `interaction-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const delivery = opts.delivery ?? opts.replyContext?.delivery;
+    const replyContext = opts.replyContext
+        ? { ...opts.replyContext, ...(delivery ? { delivery } : {}) }
+        : undefined;
     return {
         taskId,
         operationId: opts.operationId ?? taskId,
@@ -17,11 +21,86 @@ export function buildEnvelope(opts) {
         channelId: opts.channelId,
         agentName: opts.agentName ?? '<unknown>',
         chatmode: opts.chatmode ?? 'interactive',
-        replyContext: opts.replyContext,
+        delivery,
+        replyContext,
         causation: opts.causation,
         timestamp: opts.timestamp ?? Date.now(),
     };
 }
+/**
+ * Replace an envelope's reply context while keeping its transport route
+ * authoritative at the top level. A per-send context may intentionally move
+ * a reply to another target (for example owner approval in a private chat).
+ */
+export function withEnvelopeReplyContext(envelope, replyContext) {
+    const delivery = replyContext?.delivery ?? envelope.delivery;
+    return {
+        ...envelope,
+        ...(delivery ? { delivery } : {}),
+        ...(replyContext
+            ? {
+                replyContext: {
+                    ...replyContext,
+                    ...(delivery ? { delivery } : {}),
+                },
+            }
+            : {}),
+    };
+}
+/** Runtime validation for routes persisted in envelopes, sessions, and outbox entries. */
+export function isDeliveryTarget(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const route = value;
+    if (route.chatType === 'private')
+        return true;
+    return route.chatType === 'group'
+        && typeof route.groupId === 'string'
+        && route.groupId.trim().length > 0;
+}
+/** Validate a route and ensure group routes address the enclosing channel. */
+export function isDeliveryTargetForChannel(value, channelId) {
+    return isDeliveryTarget(value)
+        && (value.chatType === 'private' || value.groupId === channelId);
+}
+/** Compare normalized private/group delivery routes. */
+export function sameDeliveryTarget(left, right) {
+    return left.chatType === right.chatType
+        && (left.chatType === 'private'
+            || (right.chatType === 'group' && left.groupId === right.groupId));
+}
+/** Resolve an outbound route from trusted, persisted session state. */
+export function deliveryTargetFromSession(session) {
+    const channelType = session.channelType || session.channel?.split('#', 1)[0];
+    const strictAun = channelType?.toLowerCase() === 'aun';
+    if (session.chatType === 'group') {
+        const groupId = session.metadata?.groupId;
+        if (strictAun && (!groupId || groupId !== session.channelId)) {
+            const code = groupId ? 'AUN_OUTBOUND_ROUTE_MISMATCH' : 'AUN_OUTBOUND_ROUTE_REQUIRED';
+            throw Object.assign(new Error(`AUN group session has no valid persisted groupId for channelId=${session.channelId}`), { code });
+        }
+        return { chatType: 'group', groupId: groupId || session.channelId };
+    }
+    if (session.chatType === 'private')
+        return { chatType: 'private' };
+    if (strictAun) {
+        throw Object.assign(new Error(`AUN session has no persisted chatType for channelId=${session.channelId}`), {
+            code: 'AUN_OUTBOUND_ROUTE_REQUIRED',
+        });
+    }
+    return { chatType: 'private' };
+}
+/** Preserve channel-specific reply fields while filling the session route. */
+export function replyContextFromSession(session, context) {
+    return {
+        ...(session.metadata?.replyContext ?? {}),
+        ...(context ?? {}),
+        // Session chatType/groupId is the persisted routing authority. The nested
+        // reply context can outlive a route correction, so only an explicit
+        // per-send context may override it.
+        delivery: context?.delivery ?? deliveryTargetFromSession(session),
+    };
+}
 /**
  * 交互请求的默认回退文本
  * 当调用方未显式提供时使用，根据交互类型选择合适的渲染器。
@@ -60,9 +139,7 @@ export async function sendInteractionPayload(adapter, envelope, interaction, fal
         fallbackText: text || undefined,
     };
     try {
-        const enriched = replyCtx
-            ? { ...envelope, replyContext: replyCtx }
-            : envelope;
+        const enriched = replyCtx ? withEnvelopeReplyContext(envelope, replyCtx) : envelope;
         const receipt = await adapter.send(enriched, payload);
         if (receipt?.status === 'suppressed')
             return false;

package/dist/core/message/response-engine.js

@@ -22,7 +22,7 @@ import { createRootCausation, deriveCausation, normalizeCausation } from '../cau
 import { recordCausationLink, recordCausationSpan } from '../causation/audit.js';
 import { normalizeBaseagent } from '../../agents/baseagent.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
-import { buildEnvelope } from './message-utils.js';
+import { buildEnvelope, replyContextFromSession, withEnvelopeReplyContext } from './message-utils.js';
 import { isSystemOrServicePeer, resolveChatMode } from './peer-mode.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../auth/agent-delegation.js';
 import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
@@ -136,6 +136,7 @@ const RETRY_EXHAUSTED_MARK = Symbol('evolcore.retryExhausted');
 const RETRY_MADE_PROGRESS_MARK = Symbol('evolcore.retryMadeProgress');
 const RETRY_HEALTH_RECORDED_MARK = Symbol('evolcore.retryHealthRecorded');
 const MODEL_FALLBACK_EXHAUSTED_MARK = Symbol('evolcore.modelFallbackExhausted');
+const RETRY_INPUT_ALREADY_SUBMITTED_MARK = Symbol('evolcore.retryInputAlreadySubmitted');
 function markRetryExhausted(error, retries) {
     if (error && typeof error === 'object') {
         error[RETRY_EXHAUSTED_MARK] = retries;
@@ -176,6 +177,21 @@ function getModelFallbackExhaustedMessage(error) {
         : undefined;
     return typeof message === 'string' ? message : undefined;
 }
+function markRetryInputAlreadySubmitted(error) {
+    if (error && typeof error === 'object') {
+        error[RETRY_INPUT_ALREADY_SUBMITTED_MARK] = true;
+        // A terminal delivery guard, rather than any buffered activity, owns the
+        // final user-visible explanation.
+        delete error._errorAlreadySent;
+    }
+}
+function wasRetryInputAlreadySubmitted(error) {
+    return !!(error && typeof error === 'object' && error[RETRY_INPUT_ALREADY_SUBMITTED_MARK] === true);
+}
+function formatRetryInputAlreadySubmittedMessage(error) {
+    const reason = getErrorMessage(error, undefined, false) || 'Codex 暂时不可用';
+    return `⚠️ Codex 已接收本次消息，但本轮未能确认完成。为避免在会话中重复写入同一消息，系统未自动重试。请检查会话状态后重新发送。\n原因：${reason}`;
+}
 function isNonErrorInterruptReason(reason) {
     return reason === 'new_message'
         || reason === 'stop'
@@ -492,7 +508,7 @@ export class ResponseEngine {
             return;
         const available = error.availableBaseagents.length ? error.availableBaseagents.join(', ') : '(none)';
         const text = `❌ 当前会话绑定的 baseagent 不可用: ${error.baseagent}\nAgent: ${error.evolagentName}\n可用: ${available}\n请使用 /baseagent 切换到可用后端。`;
-        const sessionReplyContext = { ...(replyContext ?? {}), sessionId: session.id };
+        const sessionReplyContext = { ...replyContextFromSession(session, replyContext), sessionId: session.id };
         await channelInfo.adapter.send(buildEnvelope({
             taskId: `system-${crypto.randomUUID().replace(/-/g, '').slice(0, 10)}`,
             sessionId: session.id,
@@ -655,7 +671,7 @@ export class ResponseEngine {
                 agentName: agent.name,
                 chatmode: this.resolveEffectiveChatmodeForSession(session, channelKey, session.channelId),
                 replyContext: {
-                    ...(session.metadata?.replyContext ?? {}),
+                    ...replyContextFromSession(session),
                     sessionId: session.id,
                     threadId: session.threadId || session.metadata?.replyContext?.threadId,
                 },
@@ -937,7 +953,7 @@ export class ResponseEngine {
             }
             agent.registerStream(streamKey, retryStream);
             return await this.processEventStream(retryStream, session, agent, renderer, resetTimer, shouldSuppress, proactive, undefined, // 重试分支不调插件钩子
-            undefined, turnLease);
+            undefined, turnLease, opts.permissionMode);
         }
         // Dropping the whole session hides the root cause and can replay side
         // effects in unattended trigger tasks. Surface an actionable failure
@@ -1199,7 +1215,7 @@ export class ResponseEngine {
             logger.warn(`[ResponseEngine] Trigger execution identity missing: trigger=${message.triggerMeta?.triggerId ?? '<none>'}`);
             const channelInfo = this.resolveChannelInfo(accessChannelKey);
             if (channelInfo) {
-                await channelInfo.adapter.send({
+                await channelInfo.adapter.send(buildEnvelope({
                     taskId: `trigger-identity-missing-${Date.now()}`,
                     sessionId: session.id,
                     channel: accessChannelKey,
@@ -1208,7 +1224,7 @@ export class ResponseEngine {
                     chatmode: 'interactive',
                     replyContext: message.replyContext,
                     timestamp: Date.now(),
-                }, {
+                }), {
                     kind: 'system.error',
                     text: 'Trigger 创建者身份缺失，已拒绝执行',
                     subtype: 'trigger_identity_missing',
@@ -1230,7 +1246,7 @@ export class ResponseEngine {
             const channelInfo = this.resolveChannelInfo(channelKey);
             if (channelInfo) {
                 try {
-                    await channelInfo.adapter.send({
+                    await channelInfo.adapter.send(buildEnvelope({
                         taskId: `access-denied-${Date.now()}`,
                         sessionId: session.id,
                         channel: channelKey,
@@ -1239,7 +1255,7 @@ export class ResponseEngine {
                         chatmode: 'interactive',
                         replyContext: message.replyContext,
                         timestamp: Date.now(),
-                    }, {
+                    }), {
                         kind: 'system.error',
                         text: '暂无权限访问本 agent，请联系 agent 管理员授权访问',
                         subtype: 'access_denied',
@@ -1497,7 +1513,12 @@ export class ResponseEngine {
     }
     /** 自动安全模式已禁用：仅保留错误计数，不再自动切换状态 */
     async _processMessageInternal(message, session, absoluteProjectPath, resetTimer, shouldSuppress, getLastIdleSec, outputState = { middleOutputMode: 'all' }, timeoutControl) {
-        const messageId = `${message.channel}_${message.channelId}_${message.timestamp || Date.now()}`;
+        // The model must see the time at which the adapter accepted the input.
+        // Runner start is recorded separately so queue delay never rewrites input
+        // chronology after a historical replay or a long backlog.
+        const inboundTimestamp = message.receivedAt ?? message.enqueuedAt ?? message.timestamp ?? Date.now();
+        const runnerStartedAt = Date.now();
+        const messageId = `${message.channel}_${message.channelId}_${inboundTimestamp}`;
         const channelKey = this.messageChannelKey(message, session);
         const channelInfo = this.resolveChannelInfo(channelKey);
         const taskAgentAid = message.selfAID || session.selfAID;
@@ -1724,7 +1745,7 @@ export class ResponseEngine {
         const taskReplyContext = () => {
             const base = this.getReplyContext(message);
             return {
-                ...(base ?? {}),
+                ...replyContextFromSession(session, base),
                 sessionId: session.id,
                 threadId: session.threadId || base?.threadId,
                 metadata: withTaskMetadata(base?.metadata),
@@ -1844,7 +1865,7 @@ export class ResponseEngine {
         // Kept outside the task body so a thrown terminal error can preserve the
         // work already performed in its trigger audit metadata.
         let streamResult = { isError: false, lastReplyText: '', fullText: '', hasReceivedText: false };
-        let startTime = Date.now();
+        let startTime = runnerStartedAt;
         let protocolReplayAttempts = 0;
         try {
             const isBackground = this.isBackgroundSession(session, message.channel, message.channelId);
@@ -1853,7 +1874,10 @@ export class ResponseEngine {
                 msgId: messageId,
                 sessionId: session.id,
                 dir: 'inbound',
-                status: 'received'
+                status: 'received',
+                receivedAt: message.receivedAt ?? inboundTimestamp,
+                enqueuedAt: message.enqueuedAt,
+                processingStartedAt: runnerStartedAt,
             });
             this.eventBus.publish({
                 type: 'message:received',
@@ -1862,7 +1886,10 @@ export class ResponseEngine {
                 channelId: message.channelId,
                 content: message.content,
                 agentName: agentNameForStats,
-                timestamp: Date.now()
+                timestamp: inboundTimestamp,
+                receivedAt: message.receivedAt ?? inboundTimestamp,
+                enqueuedAt: message.enqueuedAt,
+                processingStartedAt: runnerStartedAt,
             });
             // ── 硬上限检查：超限直接返回提示，不调模型 ──
             {
@@ -2007,7 +2034,7 @@ export class ResponseEngine {
                     opts.metadata = withTaskMetadata(opts.metadata);
                     if (payload.kind.startsWith('status.'))
                         this.touchAgentActivity(channelKey);
-                    const enrichedEnvelope = { ...envelope, replyContext: opts };
+                    const enrichedEnvelope = withEnvelopeReplyContext(envelope, opts);
                     snapshot.pushOutbound(session.id, taskId, { kind: payload.kind, decision: 'sent' });
                     await adapter.send(enrichedEnvelope, payload);
                 },
@@ -2032,7 +2059,7 @@ export class ResponseEngine {
             const capturedReplyContext = taskReplyContext();
             // 设置权限审批的消息发送回调（指向当前渠道）
             const permissionPrompt = async (text) => {
-                await adapter.send({ ...envelope, replyContext: capturedReplyContext }, { kind: 'result.text', text, isFinal: false });
+                await adapter.send(withEnvelopeReplyContext(envelope, capturedReplyContext), { kind: 'result.text', text, isFinal: false });
             };
             const authChatType = configChatType;
             const authConversationId = authChatType === 'group'
@@ -2046,15 +2073,16 @@ export class ResponseEngine {
                 : undefined;
             const permissionAdapter = triggerOriginChannelInfo?.adapter ?? adapter;
             const permissionChannelId = authorizationIdentity?.actorId ?? capturedChannelId;
-            const permissionReplyContext = authorizationIdentity ? undefined : capturedReplyContext;
+            const permissionReplyContext = authorizationIdentity
+                ? { delivery: { chatType: 'private' } }
+                : capturedReplyContext;
             let permissionTerminalFailure;
             const permissionPromptForOrigin = async (text) => {
-                await permissionAdapter.send({
+                await permissionAdapter.send(withEnvelopeReplyContext({
                     ...envelope,
                     channel: authorizationIdentity?.originChannelKey ?? envelope.channel,
                     channelId: permissionChannelId,
-                    replyContext: permissionReplyContext,
-                }, { kind: 'result.text', text, isFinal: false });
+                }, permissionReplyContext), { kind: 'result.text', text, isFinal: false });
             };
             agent.setSendPrompt(permissionPromptForOrigin);
             const owningAgentForAuth = owningAgentForTask;
@@ -2200,7 +2228,7 @@ export class ResponseEngine {
                     },
                 },
                 permissionStateChanged: async (permissionEvent) => {
-                    const executionEnvelope = { ...envelope, replyContext: capturedReplyContext };
+                    const executionEnvelope = withEnvelopeReplyContext(envelope, capturedReplyContext);
                     if (permissionEvent.state === 'waiting') {
                         const payload = {
                             kind: 'status.requires_action',
@@ -2214,12 +2242,11 @@ export class ResponseEngine {
                         };
                         await adapter.send(executionEnvelope, payload);
                         if (permissionAdapter !== adapter || permissionChannelId !== capturedChannelId) {
-                            await permissionAdapter.send({
+                            await permissionAdapter.send(withEnvelopeReplyContext({
                                 ...envelope,
                                 channel: authorizationIdentity?.originChannelKey ?? envelope.channel,
                                 channelId: permissionChannelId,
-                                replyContext: permissionReplyContext,
-                            }, payload);
+                            }, permissionReplyContext), payload);
                         }
                         return;
                     }
@@ -2777,6 +2804,7 @@ export class ResponseEngine {
                     ? (agent.resolveModelId(model) ?? model)
                     : model));
                 const retryAttemptTimeoutMs = this.retryAttemptTimeoutMs();
+                const retryInputIsAtMostOnce = agent.retryInputSemantics === 'at_most_once';
                 let runAttempt = 1;
                 const recordRetryHealthError = async (retryError) => {
                     if (!policy.accumulateErrors(chatType, identityRole))
@@ -2813,14 +2841,17 @@ export class ResponseEngine {
                         const processAttempt = this.processEventStream(stream, session, agent, renderer, (eventType, toolName) => {
                             resetTimer(eventType, toolName);
                             attemptTimeout?.reset();
-                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease);
+                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode);
                         streamResult = attemptTimeout
                             ? await Promise.race([processAttempt, attemptTimeout.promise])
                             : await processAttempt;
                         if (!streamResult.isError) {
                             const protocolDecision = this.turnCoordinator.evaluateCommit(turnLease, this.buildTurnCommitEvidence(session, streamResult));
                             const protocolReason = protocolDecision.ok ? undefined : protocolDecision.reason;
-                            const safeProtocolReplay = isSafeProtocolReplayCandidate(streamResult, protocolReason);
+                            // Codex app-server turn/start appends its input before runQuery
+                            // resolves. Replaying here would create a second user turn.
+                            const safeProtocolReplay = !retryInputIsAtMostOnce
+                                && isSafeProtocolReplayCandidate(streamResult, protocolReason);
                             const protocolRetry = retryScheduler.afterProtocolFailure(safeProtocolReplay ? protocolReason : undefined, safeProtocolReplay);
                             if (protocolRetry.kind === 'protocol_replay') {
                                 protocolReplayAttempts = protocolRetry.attempt;
@@ -2865,6 +2896,16 @@ export class ResponseEngine {
                             permissionError._errorAlreadySent = true;
                             throw permissionError;
                         }
+                        const retryWouldReplaySubmittedInput = retryAttemptTimedOut
+                            || isRetryableError(retryError)
+                            || classifyError(retryError) === ErrorType.MODEL_UNAVAILABLE;
+                        if (retryInputIsAtMostOnce && streamRegistered && retryWouldReplaySubmittedInput) {
+                            await recordRetryHealthError(retryError);
+                            markRetryInputAlreadySubmitted(retryError);
+                            logger.warn(`[ResponseEngine] Not replaying already-submitted input: agent=${agent.name} `
+                                + `session=${session.id} task=${taskId} attempt=${runAttempt}`);
+                            throw retryError;
+                        }
                         if (classifyError(retryError) === ErrorType.MODEL_UNAVAILABLE && !hasExplicitTriggerModel) {
                             if (probingPrimaryModel && previousFallbackState) {
                                 const resumedFallback = previousFallbackState.activeFallback;
@@ -2958,6 +2999,7 @@ export class ResponseEngine {
                         resetTimer,
                         shouldSuppress,
                         proactive,
+                        permissionMode: effectivePermissionMode,
                         turnLease,
                     });
                 }
@@ -2999,6 +3041,7 @@ export class ResponseEngine {
                     resetTimer,
                     shouldSuppress,
                     proactive,
+                    permissionMode: effectivePermissionMode,
                     turnLease,
                 });
                 // 重试后仍然 prompt_too_long：显示友好提示
@@ -3070,7 +3113,7 @@ export class ResponseEngine {
                             return;
                         const isCurrentlyBackground = this.isBackgroundSession(session, message.channel, message.channelId);
                         if (!isCurrentlyBackground) {
-                            await adapter.send({ ...envelope, replyContext: capturedReplyContext }, payload);
+                            await adapter.send(withEnvelopeReplyContext(envelope, capturedReplyContext), payload);
                             if (payload.kind === 'result.text') {
                                 logger.info(`[ResponseEngine] afterProcess sent: task=${taskId} text="${payload.text.slice(0, 60)}"`);
                             }
@@ -3158,7 +3201,10 @@ export class ResponseEngine {
                             // 发送文件
                             logger.info(`[${adapter.channelName}] Sending file via ${targetInfo.adapter.channelName}: ${resolvedPath}`);
                             try {
-                                await targetInfo.adapter.send(buildEnvelope({ taskId, channel: targetInfo.adapter.channelName, channelId: targetChannelId, agentName: agentNameForStats, replyContext: capturedReplyContext }), { kind: 'result.file', filePath: resolvedPath });
+                                const targetReplyContext = isCrossChannel
+                                    ? { delivery: { chatType: 'private' } }
+                                    : capturedReplyContext;
+                                await targetInfo.adapter.send(buildEnvelope({ taskId, channel: targetInfo.adapter.channelName, channelId: targetChannelId, agentName: agentNameForStats, replyContext: targetReplyContext }), { kind: 'result.file', filePath: resolvedPath });
                                 this.eventBus.publish({ type: 'runner:file-sent', sessionId: session.id, filePath: resolvedPath, channel: targetInfo.adapter.channelName });
                                 sent++;
                                 if (isCrossChannel) {
@@ -3681,6 +3727,7 @@ export class ResponseEngine {
             // processEventStream 已通过 renderer 发过错误时也跳过
             const retryExhaustedCount = getRetryExhaustedCount(error);
             const modelFallbackExhaustedMessage = getModelFallbackExhaustedMessage(error);
+            const retryInputAlreadySubmitted = wasRetryInputAlreadySubmitted(error);
             if (isUserInterrupt) {
                 logger.info(`[ResponseEngine] User interrupt by new_message, skip sending error message`);
             }
@@ -3692,13 +3739,15 @@ export class ResponseEngine {
                 const idleSec = getLastIdleSec?.() || 0;
                 const userMessage = retryExhaustedCount
                     ? formatRetryableErrorFinalMessage(error, retryExhaustedCount)
-                    : modelFallbackExhaustedMessage
-                        ? modelFallbackExhaustedMessage
-                        : isTotalExecutionTimeout
-                            ? `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`
-                            : isTimeout
-                                ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
-                                : getErrorMessage(error, undefined);
+                    : retryInputAlreadySubmitted
+                        ? formatRetryInputAlreadySubmittedMessage(error)
+                        : modelFallbackExhaustedMessage
+                            ? modelFallbackExhaustedMessage
+                            : isTotalExecutionTimeout
+                                ? `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`
+                                : isTimeout
+                                    ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
+                                    : getErrorMessage(error, undefined);
                 // 获取 session 用于话题回复（如果 resolveSession 已执行）
                 let sendOpts;
                 try {
@@ -3715,14 +3764,14 @@ export class ResponseEngine {
                 const errorPayload = {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: retryExhaustedCount ? 'retry_exhausted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
+                    reason: retryExhaustedCount ? 'retry_exhausted' : retryInputAlreadySubmitted ? 'input_already_submitted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
                 };
                 if (!isUserInterrupt && daemonTrigger && procStatus === 'error') {
                     // DaemonChannel settles a trigger on the first terminal payload. Put
                     // the complete failure metadata first so the audit retains tool
                     // counts and context-recovery diagnostics even for thrown errors
                     // (for example when compact itself fails).
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, {
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), {
                         kind: 'status.error',
                         metadata: {
                             errorType: errType,
@@ -3735,17 +3784,17 @@ export class ResponseEngine {
                             contextRecoveryAttempts: streamResult.contextRecoveryAttempts ?? 0,
                         },
                     }).catch(() => { });
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, errorPayload);
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), errorPayload);
                 }
                 else {
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, errorPayload);
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), errorPayload);
                 }
                 if (!isUserInterrupt && daemonTrigger && procStatus !== 'error') {
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, statusPayload).catch(() => { });
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), statusPayload).catch(() => { });
                 }
                 // Proactive 可观测：catch 块的基础设施错误也透传为 thought，保证按 task_id 聚合完整
                 if (isProactive && adapter.capabilities?.thought) {
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, {
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), {
                         kind: 'activity.batch',
                         items: [{
                                 kind: 'notice',
@@ -3973,7 +4022,7 @@ export class ResponseEngine {
      */
     async processEventStream(stream, session, agent, renderer, resetTimer, shouldSuppress, proactive, 
     /** [迁移点4/5] 响应模式插件 + 状态，用于调 onToolUse/onComplete 钩子 */
-    modeHooks, causation, turnLease) {
+    modeHooks, causation, turnLease, permissionMode) {
         // Per-session agent name for stats bucketing
         const statsChannelKey = session.channel === 'daemon' ? session.channel : (session.metadata?.channelKey || session.channel);
         const agentNameForStats = this.agentRegistry?.resolveByChannel(statsChannelKey)?.name ?? '<unknown>';
@@ -4059,6 +4108,11 @@ export class ResponseEngine {
                         }
                     }
                 }
+                else if (event.type === 'notice') {
+                    for (const callId of event.closedToolCallIds ?? []) {
+                        openToolUseIds.delete(callId);
+                    }
+                }
                 else if (event.type === 'complete') {
                     assistantUuid = event.assistantUuid ?? assistantUuid;
                     protocolIncompleteReason = event.protocolIncompleteReason ?? protocolIncompleteReason;
@@ -4295,6 +4349,9 @@ export class ResponseEngine {
                             sessionId: session.id,
                             toolName: event.name,
                             input: event.input,
+                            ...(event.callId ? { callId: event.callId } : {}),
+                            ...(session.selfAID ? { agentAid: session.selfAID } : {}),
+                            ...(permissionMode ? { permissionMode } : {}),
                             timestamp: Date.now(),
                             causation,
                         });
@@ -4344,6 +4401,9 @@ export class ResponseEngine {
                             toolName: event.name,
                             isError: event.isError,
                             agentName: agentNameForStats,
+                            ...(event.callId ? { callId: event.callId } : {}),
+                            ...(session.selfAID ? { agentAid: session.selfAID } : {}),
+                            ...(permissionMode ? { permissionMode } : {}),
                             timestamp: Date.now(),
                             causation,
                         });
@@ -4360,6 +4420,12 @@ export class ResponseEngine {
                             renderer.addToolResult(event.name || '\u5de5\u5177', true, event.result, undefined, event.callId, event.durationMs, cachedDesc);
                         }
                     }
+                    // 非终态运行时告警走 status notify，不进入 activity/thought 历史。
+                    if (event.type === 'notice' && event.severity === 'warn') {
+                        await renderer.sendWarningStatus(event.message, event.subtype, {
+                            ...(event.missingItems !== undefined && { missingItems: event.missingItems }),
+                        });
+                    }
                     // 运行时错误（Codex: turn.failed / item error）
                     if (event.type === 'error') {
                         logger.warn(`[ResponseEngine] error event: ${event.errorType}: ${event.error}`);

package/dist/core/message/stream-debouncer.js

@@ -56,9 +56,10 @@ export class StreamDebouncer {
      * 如果窗口只剩这一条，整个窗口取消。
      * @returns true 如果找到并移除
      */
-    cancel(messageId) {
+    cancel(messageId, selfAID) {
         for (const [key, win] of this.pending) {
-            const idx = win.entries.findIndex(e => e.messageId === messageId);
+            const idx = win.entries.findIndex(e => e.messageId === messageId
+                && (selfAID === undefined || e.rest.selfAID === selfAID));
             if (idx === -1)
                 continue;
             // resolve 被撤回的那条（静默完成，不报错）
@@ -89,8 +90,13 @@ export class StreamDebouncer {
         const contents = [];
         const sourceMessageIds = [];
         const seenSourceMessageIds = new Set();
+        let receivedAt;
         for (const e of entries) {
             contents.push(e.content);
+            const entryReceivedAt = e.rest.receivedAt ?? e.rest.timestamp;
+            if (entryReceivedAt !== undefined) {
+                receivedAt = receivedAt === undefined ? entryReceivedAt : Math.min(receivedAt, entryReceivedAt);
+            }
             if (e.images)
                 allImages.push(...e.images);
             if (e.mentions)
@@ -119,6 +125,8 @@ export class StreamDebouncer {
             replyContext: last.replyContext,
             messageId: latestMessageId,
             sourceMessageIds: sourceMessageIds.length > 0 ? sourceMessageIds : undefined,
+            receivedAt,
+            timestamp: receivedAt ?? last.rest.timestamp,
         };
         const resolves = entries.map(e => e.resolve);
         const rejects = entries.map(e => e.reject);

package/dist/core/permission/approval-gateway.js

@@ -566,6 +566,7 @@ export class PermissionGateway {
             return decisionPromise;
         }
         const ownerReplyContext = {
+            delivery: { chatType: 'private' },
             metadata: {
                 source: 'handoff',
                 chatmode: 'interactive',