evolcore 0.0.12 → 0.0.14

package/CHANGELOG.md

@@ -3,6 +3,43 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.14 (2026-08-24)
+
+### Codex 受管运行与安全
+
+- 强化 Codex proactive 模式的受管 PreToolUse 校验，Linux 使用隔离运行时，Windows 支持受管 Hook 安装、加载检查和 fail-closed 启动。
+- 隔离会话临时目录并统一运行时锁管理，收紧 Shell、文件访问和受控 EC 命令解析，扩展群文件 ACL 操作及权限校验。
+- 完善工具审批、委派票据和工具结果关联审计，避免未成功发送或未完成授权的操作推进主动模式状态。
+- 为 Claude、Codex、ecagent 的工具预检拒绝补充统一结构化授权审计，记录策略码、请求/任务及会话上下文，便于跨 Runner 追踪拦截原因。
+- 规范 Codex EC 审批命令与委派校验，拒绝无法规范化的命令、复合命令和空字节输入；允许触发器正文安全使用受管临时目录标记。
+
+### AUN 消息与授权
+
+- 贯通 AUN 消息路由、会话上下文和授权审计关联信息，补齐请求、工具调用和结果之间的 correlation ID。
+- 统一结构化日志字段，改进异常、策略拦截和拒绝结果的可追踪性。
+
+## 0.0.13 (2026-08-20)
+
+### AUN 消息与文件
+
+- 显式区分 AUN 私聊与群聊投递路由，强化入站去重、顺序处理、消息队列持久化和失败恢复。
+- 统一 AUN RPC 与存储客户端，扩展群文件写入与下载能力，收敛文件操作和载荷处理边界。
+- 增加群文件下载票据校验和内容哈希验证，补齐短连接 RPC、存储上传及启动期角色配置迁移能力。
+
+### 权限与关系
+
+- 收敛角色迁移、权限作用域和最小能力模式，强化 Owner、关系范围与工具执行审计边界。
+- 贯通会话投递元数据和跨会话授权校验，避免托管操作越过当前 Agent、会话或关系范围。
+- 强化受管 `$TMPDIR`、群规则读取和群文件上传的路径隔离，拒绝符号链接、越界目录及不符合权限/所有者要求的路径。
+- 完善菜单授权审计的请求与会话关联信息，扩展只读 Shell 查询、配置批量读取和委派有效期校验。
+
+### 会话与运行时
+
+- 完善消息撤回隔离、错误回传、菜单交互、重启命令和 Trigger 反馈的上下文校验。
+- 简化 Agent 运行器与启动流程，修正系统重启路径并清理托管会话凭据。
+- 为 Codex app-server 请求增加 request ID 与载荷指纹重放防护，使重复请求复用结果、冲突请求拒绝；会话重试按至多执行一次处理。
+- 统一 EC Web 守护进程的发现、接管、健康检查和退出清理，修正 Linux 进程启动时间计算，并改进 Codex 初始化/升级探测与 Web 消息路由展示。
+
 ## 0.0.12 (2026-08-19)
 
 ### AUN 通信

package/bin/codex-managed-hook.mjs

@@ -45,7 +45,10 @@ function queryDaemon(socketPath, payload) {
 }
 
 async function main() {
-  const socketPath = process.argv[2];
+  // Windows managed requirements use one machine-wide command. Resolve the
+  // per-daemon named pipe from the inherited environment so multiple EvolCore
+  // homes can share the installed hook without rewriting requirements.toml.
+  const socketPath = process.argv[2] || process.env.EVOLCORE_INSTANCE_SOCKET;
   let input;
   try {
     input = JSON.parse(fs.readFileSync(0, 'utf8'));

package/bin/ec-safe-output.js

@@ -82,12 +82,27 @@ function resolveExecutionPaths(payload) {
   return { workspace, cwd };
 }
 
+function resolveManagedTempRoot() {
+  const raw = typeof process.env.TMPDIR === 'string' ? process.env.TMPDIR.trim() : '';
+  if (!raw || !path.isAbsolute(raw)) fail('managed TMPDIR is unavailable');
+  try {
+    const root = fs.realpathSync(raw);
+    if (!fs.statSync(root).isDirectory()) fail('managed TMPDIR is not a directory');
+    return root;
+  } catch {
+    fail('managed TMPDIR is unavailable');
+  }
+}
+
 function openOutputFile(payload, paths) {
   if (payload.outputPath === undefined) return undefined;
-  if (typeof payload.outputPath !== 'string' || !payload.outputPath || path.isAbsolute(payload.outputPath)) {
-    fail('output path must be relative');
-  }
-  const target = path.resolve(paths.cwd, payload.outputPath);
+  if (typeof payload.outputPath !== 'string' || !payload.outputPath) fail('output path is invalid');
+
+  const isManagedTempOutput = path.isAbsolute(payload.outputPath);
+  const outputRoot = isManagedTempOutput ? resolveManagedTempRoot() : paths.workspace;
+  const target = isManagedTempOutput
+    ? path.resolve(payload.outputPath)
+    : path.resolve(paths.cwd, payload.outputPath);
   const parent = path.dirname(target);
   let realParent;
   try {
@@ -97,9 +112,13 @@ function openOutputFile(payload, paths) {
     fail('output parent does not exist');
   }
   const canonicalTarget = path.join(realParent, path.basename(target));
-  if (!sameOrDescendant(canonicalTarget, paths.workspace)) fail('output path escapes workspace');
-  const relative = path.relative(paths.workspace, canonicalTarget);
-  if (relative === '.git' || relative.startsWith(`.git${path.sep}`)) fail('output path may not target Git metadata');
+  if (!sameOrDescendant(canonicalTarget, outputRoot)) {
+    fail(isManagedTempOutput ? 'output path escapes managed TMPDIR' : 'output path escapes workspace');
+  }
+  if (!isManagedTempOutput) {
+    const relative = path.relative(paths.workspace, canonicalTarget);
+    if (relative === '.git' || relative.startsWith(`.git${path.sep}`)) fail('output path may not target Git metadata');
+  }
 
   const noFollow = fs.constants.O_NOFOLLOW ?? 0;
   try {

package/bin/install-codex-managed-hooks.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+const markerStart = '# BEGIN EVOLCORE MANAGED CODEX HOOK';
+const markerEnd = '# END EVOLCORE MANAGED CODEX HOOK';
+
+function argument(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function fail(message) {
+  process.stderr.write(`[evolcore] ${message}\n`);
+  process.exit(1);
+}
+
+function tomlString(value) {
+  return JSON.stringify(value);
+}
+
+function windowsCommandArg(value) {
+  // Keep filesystem separators intact; tomlString() performs the required
+  // TOML escaping after this Windows command-line quoting step.
+  return `"${value.replaceAll('"', '\\"')}"`;
+}
+
+function removeManagedBlock(source) {
+  const expression = new RegExp(`\\n?${markerStart}[\\s\\S]*?${markerEnd}\\n?`, 'g');
+  return source.replace(expression, '\n').replace(/\n{3,}/g, '\n\n');
+}
+
+function tableBounds(lines, table) {
+  const header = table ? `[${table}]` : null;
+  const start = header
+    ? lines.findIndex(line => line.trim() === header)
+    : -1;
+  if (table && start < 0) return null;
+  const from = table ? start + 1 : 0;
+  let to = lines.length;
+  for (let index = from; index < lines.length; index += 1) {
+    if (/^\s*\[\[?[^\]]+\]\]?\s*(?:#.*)?$/.test(lines[index])) {
+      to = index;
+      break;
+    }
+  }
+  return { start, from, to };
+}
+
+function setTomlKey(source, table, key, value) {
+  const lines = source.split('\n');
+  let bounds = tableBounds(lines, table);
+  if (!bounds) {
+    if (table) {
+      if (lines.length && lines.at(-1) !== '') lines.push('');
+      lines.push(`[${table}]`, `${key} = ${value}`);
+    } else {
+      let insertAt = lines.findIndex(line => /^\s*\[/.test(line));
+      if (insertAt < 0) insertAt = lines.length;
+      lines.splice(insertAt, 0, `${key} = ${value}`);
+    }
+    return lines.join('\n');
+  }
+  const keyExpression = new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}\\s*=`);
+  const existing = lines.slice(bounds.from, bounds.to).findIndex(line => keyExpression.test(line));
+  if (existing >= 0) {
+    lines[bounds.from + existing] = `${key} = ${value}`;
+  } else {
+    lines.splice(bounds.from, 0, `${key} = ${value}`);
+  }
+  return lines.join('\n');
+}
+
+function atomicReplace(file, temporary) {
+  try {
+    fs.renameSync(temporary, file);
+    return;
+  } catch (error) {
+    if (error?.code !== 'EEXIST' && error?.code !== 'EPERM') throw error;
+  }
+  const backup = `${file}.evolcore-backup-${process.pid}-${Date.now()}`;
+  fs.renameSync(file, backup);
+  try {
+    fs.renameSync(temporary, file);
+  } catch (error) {
+    try { fs.renameSync(backup, file); } catch {}
+    throw error;
+  }
+  try { fs.rmSync(backup, { force: true }); } catch {}
+}
+
+function atomicWrite(file, content) {
+  const temporary = `${file}.evolcore-${process.pid}-${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(temporary, content, { encoding: 'utf8', mode: 0o440, flag: 'wx' });
+    atomicReplace(file, temporary);
+  } finally {
+    try { fs.rmSync(temporary, { force: true }); } catch {}
+  }
+}
+
+function restrictWindowsAcl(target) {
+  if (process.platform !== 'win32') return;
+  // Keep the hook and requirements administrator-owned while allowing the
+  // daemon's normal user token to read and execute them.
+  execFileSync('icacls.exe', [
+    target,
+    '/inheritance:r',
+    '/grant:r',
+    '*S-1-5-18:(OI)(CI)F',
+    '*S-1-5-32-544:(OI)(CI)F',
+    '*S-1-5-32-545:(OI)(CI)RX',
+  ], { stdio: 'ignore' });
+}
+
+function managedHookLauncher(packageRoot) {
+  // Keep the machine-wide entrypoint stable across npm upgrades. The app
+  // npm upgrades replace the package contents at this stable global path, so
+  // this file never needs to be rewritten just because the hook changed.
+  const trustedPackageRoot = path.resolve(packageRoot);
+  return `#!/usr/bin/env node
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+// EVOLCORE_MANAGED_HOOK_LAUNCHER
+const packageRoot = ${JSON.stringify(trustedPackageRoot)};
+
+try {
+  await import(pathToFileURL(path.join(packageRoot, 'bin', 'codex-managed-hook.mjs')).href);
+} catch (error) {
+  process.stderr.write('[evolcore] failed to load the current managed hook: '
+    + (error instanceof Error ? error.message : String(error)) + '\\n');
+  process.exit(2);
+}
+`;
+}
+
+function main() {
+  if (process.platform !== 'win32' && !argument('--requirements')) {
+    fail('Codex managed hook provisioning is only supported on Windows.');
+  }
+  const packageRoot = argument('--package-root');
+  const nodePath = argument('--node-path') || process.execPath;
+  const requirements = argument('--requirements')
+    || path.join(process.env.ProgramData || path.join(os.homedir(), 'ProgramData'), 'OpenAI', 'Codex', 'requirements.toml');
+  if (!packageRoot) fail('--package-root is required.');
+  const existingRequirements = fs.existsSync(requirements) ? fs.readFileSync(requirements, 'utf8') : '';
+  const targetDirectory = argument('--managed-dir')
+    || path.join(path.dirname(requirements), 'EvolCore', 'hooks');
+  const sourceHook = path.join(packageRoot, 'bin', 'codex-managed-hook.mjs');
+  if (!fs.statSync(sourceHook).isFile()) fail(`Managed hook source was not found: ${sourceHook}`);
+
+  fs.mkdirSync(targetDirectory, { recursive: true, mode: 0o700 });
+  const hookPath = path.join(targetDirectory, 'pre-tool-use.mjs');
+  const temporaryHook = `${hookPath}.evolcore-${process.pid}-${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(temporaryHook, managedHookLauncher(packageRoot), { encoding: 'utf8', mode: 0o500, flag: 'wx' });
+    fs.chmodSync(temporaryHook, 0o500);
+    atomicReplace(hookPath, temporaryHook);
+  } finally {
+    try { fs.rmSync(temporaryHook, { force: true }); } catch {}
+  }
+
+  let content = existingRequirements;
+  content = removeManagedBlock(content);
+  content = setTomlKey(content, null, 'allow_managed_hooks_only', 'true');
+  content = setTomlKey(content, 'features', 'hooks', 'true');
+  content = setTomlKey(content, 'hooks', 'windows_managed_dir', tomlString(path.resolve(targetDirectory)));
+  if (!content.endsWith('\n')) content += '\n';
+  const command = `${windowsCommandArg(nodePath)} ${windowsCommandArg(hookPath)}`;
+  content += [
+    markerStart,
+    '[[hooks.PreToolUse]]',
+    'matcher = "*"',
+    '',
+    '[[hooks.PreToolUse.hooks]]',
+    'type = "command"',
+    `command = ${tomlString(command)}`,
+    `command_windows = ${tomlString(command)}`,
+    'timeout = 3',
+    'statusMessage = "Checking EvolCore session policy"',
+    markerEnd,
+    '',
+  ].join('\n');
+  fs.mkdirSync(path.dirname(requirements), { recursive: true });
+  atomicWrite(requirements, content);
+  try { fs.chmodSync(requirements, 0o440); } catch {}
+  restrictWindowsAcl(targetDirectory);
+  restrictWindowsAcl(hookPath);
+  restrictWindowsAcl(requirements);
+  process.stdout.write(`${JSON.stringify({ requirements, managedDir: path.resolve(targetDirectory), hookPath })}\n`);
+}
+
+try {
+  main();
+} catch (error) {
+  fail(error instanceof Error ? error.message : String(error));
+}

package/dist/agents/claude-runner.js

@@ -20,11 +20,11 @@ import { getPackageRoot, resolvePaths } from '../paths.js';
 import { resolveEffective } from '../config/config-manager.js';
 import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
-import { normalizePermissionMode } from '../core/permission/mode.js';
-import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
-import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, resolveProtectedCandidate, } from '../core/protected-paths.js';
-import { buildHClassGuardCommand, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
+import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
+import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/protected-paths.js';
+import { buildHClassGuardCommand, createSandboxInitializationError, isSandboxInitializationFailure, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
+import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
 // Built-in tools execute inside the Claude runtime and are covered by the
@@ -217,6 +217,32 @@ function buildClaudeManagedLockdownSettings(capabilityOptions) {
     };
 }
 const CLAUDE_SANDBOX_GLOB_MAGIC = /[*?[\]]/;
+function trustedRuntimeWritePaths(runtimeEnv) {
+    const tmp = process.env.TMPDIR?.trim();
+    if (!tmp || !path.isAbsolute(tmp))
+        return [];
+    const root = resolveProtectedCandidate(tmp);
+    const candidates = [runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR, runtimeEnv?.EVOLCORE_RUNTIME_LOCK_DIR]
+        .filter((value) => typeof value === 'string' && path.isAbsolute(value));
+    const paths = [];
+    for (const candidate of candidates) {
+        const resolved = resolveProtectedCandidate(candidate);
+        if (!isSameOrDescendant(resolved, root))
+            continue;
+        try {
+            const stat = fs.lstatSync(resolved);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                continue;
+            if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        paths.push(resolved, path.join(resolved, '**'));
+    }
+    return [...new Set(paths)];
+}
 async function assertClaudeSettingSourcesHaveLiteralSandboxPaths(cwd, settingSources, managedSettings) {
     if (process.platform !== 'linux' || settingSources.length === 0)
         return;
@@ -1759,6 +1785,30 @@ export class AgentRunner {
             else {
                 logger.error(`[AgentRunner] Subprocess stream failed (session=${sessionId}) with no captured stderr.`);
             }
+            if (isSandboxInitializationFailure(err, buf ?? [])) {
+                const detail = createSandboxInitializationError(err, buf ?? []);
+                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                    code: 'capability_unavailable',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName: 'Bash',
+                    policyCode: SANDBOX_INITIALIZATION_FAILED,
+                    decisionSource: 'infrastructure',
+                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
+                    summary: detail.message.slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+                yield {
+                    type: 'complete',
+                    isError: true,
+                    subtype: 'infrastructure',
+                    terminalReason: SANDBOX_INITIALIZATION_FAILED,
+                    errors: [detail.message],
+                    queryFinal: true,
+                };
+                return;
+            }
             throw err;
         }
         finally {
@@ -1856,8 +1906,25 @@ export class AgentRunner {
             const code = policyCode ?? (preflight?.behavior === 'deny' ? preflight.policyCode : undefined);
             if (!code)
                 return;
+            const ctx = this.permissionContexts.get(sessionId);
+            const summary = summarizeToolInputForAudit(toolName, toolInput).slice(0, 512);
+            auditToolPreflightDenial({
+                toolName,
+                policyCode: code,
+                reason: preflight?.behavior === 'deny' ? (preflight.message ?? 'policy denied') : 'policy denied',
+                summary,
+                sessionId,
+                agentAid: ctx?.selfAid,
+                permissionMode: callPermissionMode,
+                channel: ctx?.channel,
+                actorId: ctx?.userId,
+                role: ctx?.role,
+                selfAid: ctx?.selfAid,
+                requestId: typeof requestId === 'string' ? requestId : undefined,
+                taskId: ctx?.taskId,
+            });
             try {
-                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                await ctx?.recordExecutionAnomaly?.({
                     code: 'operation_blocked',
                     severity: 'warning',
                     phase: 'execution',
@@ -1865,7 +1932,10 @@ export class AgentRunner {
                     toolName,
                     ...(typeof requestId === 'string' && requestId ? { requestId } : {}),
                     policyCode: code,
-                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    decisionSource: 'policy',
+                    agentAid: ctx?.selfAid,
+                    permissionMode: callPermissionMode,
+                    summary,
                     effect: 'operation_skipped',
                 });
             }
@@ -1932,6 +2002,7 @@ export class AgentRunner {
                 role: permCtx?.role,
                 permissionMode: callPermissionMode,
                 allowHostProcessCommands: true,
+                allowProtectedMetadata: false,
                 safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
                 projectPath,
             });
@@ -1963,10 +2034,11 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
+                    allowProtectedMetadata: false,
                 };
                 const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
-                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'readonly_mode');
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, roResult.policyCode ?? 'readonly_mode');
                     return hookDecision('deny', roResult.message, updatedInput);
                 }
                 return hookDecision('allow', undefined, updatedInput);
@@ -2052,6 +2124,7 @@ export class AgentRunner {
                 role: permCtx?.role,
                 permissionMode: callPermissionMode,
                 allowHostProcessCommands: true,
+                allowProtectedMetadata: false,
                 safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
                 projectPath,
             });
@@ -2119,10 +2192,11 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
+                    allowProtectedMetadata: false,
                 };
                 const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
-                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'readonly_mode');
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, roResult.policyCode ?? 'readonly_mode');
                     return { behavior: 'deny', message: roResult.message, decisionClassification: 'user_reject' };
                 }
                 return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
@@ -2213,6 +2287,7 @@ export class AgentRunner {
                 const sandboxUnixSockets = buildClaudeUnixSocketAllowlist(projectPath, {
                     role: runPermissionContext?.role,
                 });
+                const runtimeWritePaths = trustedRuntimeWritePaths(runtimeEnv);
                 await assertClaudeSettingSourcesHaveLiteralSandboxPaths(projectPath, [...settingSources], managedSettings);
                 const sandboxProjectionDurationMs = Date.now() - sandboxProjectionStartedAt;
                 if (sandboxProjectionDurationMs > 2_000) {
@@ -2229,7 +2304,10 @@ export class AgentRunner {
                         allowAllUnixSockets: false,
                         allowLocalBinding: false,
                     },
-                    filesystem: sandboxFilesystem,
+                    filesystem: {
+                        ...sandboxFilesystem,
+                        ...(runtimeWritePaths.length > 0 ? { allowWrite: runtimeWritePaths } : {}),
+                    },
                 };
             })();
         if (executionSandbox.state === 'off') {
@@ -2373,12 +2451,28 @@ export class AgentRunner {
             logger.info('[AgentRunner] Creating query with images:', images.length, 'first image size:', images[0]?.data?.length ?? 0);
             logger.debug('[AgentRunner] Skipping resume for image message to avoid history conflict');
             msgStream.push(prompt, images, inputId);
-            sdkStream = createQuery(msgStream);
+            try {
+                sdkStream = createQuery(msgStream);
+            }
+            catch (error) {
+                const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isSandboxInitializationFailure(error, stderr))
+                    throw createSandboxInitializationError(error, stderr);
+                throw error;
+            }
         }
         else {
             logger.debug('[AgentRunner] Creating query with text only, agentSessionId:', initialClaudeSessionId);
             msgStream.push(prompt, undefined, inputId);
-            sdkStream = createQuery(msgStream, agentSessionId, resumeAt);
+            try {
+                sdkStream = createQuery(msgStream, agentSessionId, resumeAt);
+            }
+            catch (error) {
+                const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isSandboxInitializationFailure(error, stderr))
+                    throw createSandboxInitializationError(error, stderr);
+                throw error;
+            }
         }
         this.activeMessageStreams.set(sessionId, msgStream);
         this.activeQueries.set(sessionId, sdkStream);