evolcore 0.0.12 → 0.0.14

package/dist/core/message/response-engine.js

@@ -3,7 +3,7 @@ import fs from 'fs';
 import os from 'os';
 import crypto from 'crypto';
 import { BaseagentRunnerUnavailableError, hasCompact, autoCompactWindowForContextWindow, autoCompactWindowForModel, isClaudeContextUsageModel, numericToken } from '../../agents/runner-types.js';
-import { buildTaskRuntimeEnv } from '../../cli/task-context.js';
+import { buildTaskRuntimeEnv, ensureRuntimeLockDir, ensureSessionRuntimeDir } from '../../cli/task-context.js';
 import { IMRenderer } from './im-renderer.js';
 import { createSendFileMarkerPattern } from './file-markers.js';
 import { createTextInferenceProvider } from '../inference/text-inference.js';
@@ -22,7 +22,7 @@ import { createRootCausation, deriveCausation, normalizeCausation } from '../cau
 import { recordCausationLink, recordCausationSpan } from '../causation/audit.js';
 import { normalizeBaseagent } from '../../agents/baseagent.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
-import { buildEnvelope } from './message-utils.js';
+import { buildEnvelope, replyContextFromSession, withEnvelopeReplyContext } from './message-utils.js';
 import { isSystemOrServicePeer, resolveChatMode } from './peer-mode.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../auth/agent-delegation.js';
 import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
@@ -136,6 +136,7 @@ const RETRY_EXHAUSTED_MARK = Symbol('evolcore.retryExhausted');
 const RETRY_MADE_PROGRESS_MARK = Symbol('evolcore.retryMadeProgress');
 const RETRY_HEALTH_RECORDED_MARK = Symbol('evolcore.retryHealthRecorded');
 const MODEL_FALLBACK_EXHAUSTED_MARK = Symbol('evolcore.modelFallbackExhausted');
+const RETRY_INPUT_ALREADY_SUBMITTED_MARK = Symbol('evolcore.retryInputAlreadySubmitted');
 function markRetryExhausted(error, retries) {
     if (error && typeof error === 'object') {
         error[RETRY_EXHAUSTED_MARK] = retries;
@@ -176,6 +177,21 @@ function getModelFallbackExhaustedMessage(error) {
         : undefined;
     return typeof message === 'string' ? message : undefined;
 }
+function markRetryInputAlreadySubmitted(error) {
+    if (error && typeof error === 'object') {
+        error[RETRY_INPUT_ALREADY_SUBMITTED_MARK] = true;
+        // A terminal delivery guard, rather than any buffered activity, owns the
+        // final user-visible explanation.
+        delete error._errorAlreadySent;
+    }
+}
+function wasRetryInputAlreadySubmitted(error) {
+    return !!(error && typeof error === 'object' && error[RETRY_INPUT_ALREADY_SUBMITTED_MARK] === true);
+}
+function formatRetryInputAlreadySubmittedMessage(error) {
+    const reason = getErrorMessage(error, undefined, false) || 'Codex 暂时不可用';
+    return `⚠️ Codex 已接收本次消息，但本轮未能确认完成。为避免在会话中重复写入同一消息，系统未自动重试。请检查会话状态后重新发送。\n原因：${reason}`;
+}
 function isNonErrorInterruptReason(reason) {
     return reason === 'new_message'
         || reason === 'stop'
@@ -492,7 +508,7 @@ export class ResponseEngine {
             return;
         const available = error.availableBaseagents.length ? error.availableBaseagents.join(', ') : '(none)';
         const text = `❌ 当前会话绑定的 baseagent 不可用: ${error.baseagent}\nAgent: ${error.evolagentName}\n可用: ${available}\n请使用 /baseagent 切换到可用后端。`;
-        const sessionReplyContext = { ...(replyContext ?? {}), sessionId: session.id };
+        const sessionReplyContext = { ...replyContextFromSession(session, replyContext), sessionId: session.id };
         await channelInfo.adapter.send(buildEnvelope({
             taskId: `system-${crypto.randomUUID().replace(/-/g, '').slice(0, 10)}`,
             sessionId: session.id,
@@ -655,7 +671,7 @@ export class ResponseEngine {
                 agentName: agent.name,
                 chatmode: this.resolveEffectiveChatmodeForSession(session, channelKey, session.channelId),
                 replyContext: {
-                    ...(session.metadata?.replyContext ?? {}),
+                    ...replyContextFromSession(session),
                     sessionId: session.id,
                     threadId: session.threadId || session.metadata?.replyContext?.threadId,
                 },
@@ -937,7 +953,7 @@ export class ResponseEngine {
             }
             agent.registerStream(streamKey, retryStream);
             return await this.processEventStream(retryStream, session, agent, renderer, resetTimer, shouldSuppress, proactive, undefined, // 重试分支不调插件钩子
-            undefined, turnLease);
+            undefined, turnLease, opts.permissionMode, opts.proactiveSelfAid);
         }
         // Dropping the whole session hides the root cause and can replay side
         // effects in unattended trigger tasks. Surface an actionable failure
@@ -1199,7 +1215,7 @@ export class ResponseEngine {
             logger.warn(`[ResponseEngine] Trigger execution identity missing: trigger=${message.triggerMeta?.triggerId ?? '<none>'}`);
             const channelInfo = this.resolveChannelInfo(accessChannelKey);
             if (channelInfo) {
-                await channelInfo.adapter.send({
+                await channelInfo.adapter.send(buildEnvelope({
                     taskId: `trigger-identity-missing-${Date.now()}`,
                     sessionId: session.id,
                     channel: accessChannelKey,
@@ -1208,7 +1224,7 @@ export class ResponseEngine {
                     chatmode: 'interactive',
                     replyContext: message.replyContext,
                     timestamp: Date.now(),
-                }, {
+                }), {
                     kind: 'system.error',
                     text: 'Trigger 创建者身份缺失，已拒绝执行',
                     subtype: 'trigger_identity_missing',
@@ -1230,7 +1246,7 @@ export class ResponseEngine {
             const channelInfo = this.resolveChannelInfo(channelKey);
             if (channelInfo) {
                 try {
-                    await channelInfo.adapter.send({
+                    await channelInfo.adapter.send(buildEnvelope({
                         taskId: `access-denied-${Date.now()}`,
                         sessionId: session.id,
                         channel: channelKey,
@@ -1239,7 +1255,7 @@ export class ResponseEngine {
                         chatmode: 'interactive',
                         replyContext: message.replyContext,
                         timestamp: Date.now(),
-                    }, {
+                    }), {
                         kind: 'system.error',
                         text: '暂无权限访问本 agent，请联系 agent 管理员授权访问',
                         subtype: 'access_denied',
@@ -1497,7 +1513,12 @@ export class ResponseEngine {
     }
     /** 自动安全模式已禁用：仅保留错误计数，不再自动切换状态 */
     async _processMessageInternal(message, session, absoluteProjectPath, resetTimer, shouldSuppress, getLastIdleSec, outputState = { middleOutputMode: 'all' }, timeoutControl) {
-        const messageId = `${message.channel}_${message.channelId}_${message.timestamp || Date.now()}`;
+        // The model must see the time at which the adapter accepted the input.
+        // Runner start is recorded separately so queue delay never rewrites input
+        // chronology after a historical replay or a long backlog.
+        const inboundTimestamp = message.receivedAt ?? message.enqueuedAt ?? message.timestamp ?? Date.now();
+        const runnerStartedAt = Date.now();
+        const messageId = `${message.channel}_${message.channelId}_${inboundTimestamp}`;
         const channelKey = this.messageChannelKey(message, session);
         const channelInfo = this.resolveChannelInfo(channelKey);
         const taskAgentAid = message.selfAID || session.selfAID;
@@ -1724,7 +1745,7 @@ export class ResponseEngine {
         const taskReplyContext = () => {
             const base = this.getReplyContext(message);
             return {
-                ...(base ?? {}),
+                ...replyContextFromSession(session, base),
                 sessionId: session.id,
                 threadId: session.threadId || base?.threadId,
                 metadata: withTaskMetadata(base?.metadata),
@@ -1844,7 +1865,7 @@ export class ResponseEngine {
         // Kept outside the task body so a thrown terminal error can preserve the
         // work already performed in its trigger audit metadata.
         let streamResult = { isError: false, lastReplyText: '', fullText: '', hasReceivedText: false };
-        let startTime = Date.now();
+        let startTime = runnerStartedAt;
         let protocolReplayAttempts = 0;
         try {
             const isBackground = this.isBackgroundSession(session, message.channel, message.channelId);
@@ -1853,7 +1874,10 @@ export class ResponseEngine {
                 msgId: messageId,
                 sessionId: session.id,
                 dir: 'inbound',
-                status: 'received'
+                status: 'received',
+                receivedAt: message.receivedAt ?? inboundTimestamp,
+                enqueuedAt: message.enqueuedAt,
+                processingStartedAt: runnerStartedAt,
             });
             this.eventBus.publish({
                 type: 'message:received',
@@ -1862,7 +1886,10 @@ export class ResponseEngine {
                 channelId: message.channelId,
                 content: message.content,
                 agentName: agentNameForStats,
-                timestamp: Date.now()
+                timestamp: inboundTimestamp,
+                receivedAt: message.receivedAt ?? inboundTimestamp,
+                enqueuedAt: message.enqueuedAt,
+                processingStartedAt: runnerStartedAt,
             });
             // ── 硬上限检查：超限直接返回提示，不调模型 ──
             {
@@ -1965,6 +1992,7 @@ export class ResponseEngine {
             const renderer = new IMRenderer({
                 adapter,
                 envelope,
+                agentAid: session.selfAID,
                 flushDelay: (options?.flushDelay ?? this.agentRegistry?.resolveByChannel(channelKey)?.config?.flush_delay ?? 3) * 1000,
                 suppressActivityItems: isProactive ? false : middleOutputMode !== 'all',
                 suppressIntermediateText: isProactive ? false : middleOutputMode === 'none',
@@ -2007,7 +2035,7 @@ export class ResponseEngine {
                     opts.metadata = withTaskMetadata(opts.metadata);
                     if (payload.kind.startsWith('status.'))
                         this.touchAgentActivity(channelKey);
-                    const enrichedEnvelope = { ...envelope, replyContext: opts };
+                    const enrichedEnvelope = withEnvelopeReplyContext(envelope, opts);
                     snapshot.pushOutbound(session.id, taskId, { kind: payload.kind, decision: 'sent' });
                     await adapter.send(enrichedEnvelope, payload);
                 },
@@ -2032,7 +2060,7 @@ export class ResponseEngine {
             const capturedReplyContext = taskReplyContext();
             // 设置权限审批的消息发送回调（指向当前渠道）
             const permissionPrompt = async (text) => {
-                await adapter.send({ ...envelope, replyContext: capturedReplyContext }, { kind: 'result.text', text, isFinal: false });
+                await adapter.send(withEnvelopeReplyContext(envelope, capturedReplyContext), { kind: 'result.text', text, isFinal: false });
             };
             const authChatType = configChatType;
             const authConversationId = authChatType === 'group'
@@ -2046,15 +2074,16 @@ export class ResponseEngine {
                 : undefined;
             const permissionAdapter = triggerOriginChannelInfo?.adapter ?? adapter;
             const permissionChannelId = authorizationIdentity?.actorId ?? capturedChannelId;
-            const permissionReplyContext = authorizationIdentity ? undefined : capturedReplyContext;
+            const permissionReplyContext = authorizationIdentity
+                ? { delivery: { chatType: 'private' } }
+                : capturedReplyContext;
             let permissionTerminalFailure;
             const permissionPromptForOrigin = async (text) => {
-                await permissionAdapter.send({
+                await permissionAdapter.send(withEnvelopeReplyContext({
                     ...envelope,
                     channel: authorizationIdentity?.originChannelKey ?? envelope.channel,
                     channelId: permissionChannelId,
-                    replyContext: permissionReplyContext,
-                }, { kind: 'result.text', text, isFinal: false });
+                }, permissionReplyContext), { kind: 'result.text', text, isFinal: false });
             };
             agent.setSendPrompt(permissionPromptForOrigin);
             const owningAgentForAuth = owningAgentForTask;
@@ -2142,6 +2171,7 @@ export class ResponseEngine {
                 ? (anomaly) => {
                     recordTriggerExecutionAnomaly(triggerRunId, {
                         ...anomaly,
+                        correlationId: anomaly.correlationId ?? anomaly.requestId,
                         agentAid: anomaly.agentAid ?? session.selfAID ?? message.selfAID,
                         sessionId: anomaly.sessionId ?? session.id,
                         permissionMode: anomaly.permissionMode ?? effectivePermissionMode,
@@ -2200,7 +2230,7 @@ export class ResponseEngine {
                     },
                 },
                 permissionStateChanged: async (permissionEvent) => {
-                    const executionEnvelope = { ...envelope, replyContext: capturedReplyContext };
+                    const executionEnvelope = withEnvelopeReplyContext(envelope, capturedReplyContext);
                     if (permissionEvent.state === 'waiting') {
                         const payload = {
                             kind: 'status.requires_action',
@@ -2214,12 +2244,11 @@ export class ResponseEngine {
                         };
                         await adapter.send(executionEnvelope, payload);
                         if (permissionAdapter !== adapter || permissionChannelId !== capturedChannelId) {
-                            await permissionAdapter.send({
+                            await permissionAdapter.send(withEnvelopeReplyContext({
                                 ...envelope,
                                 channel: authorizationIdentity?.originChannelKey ?? envelope.channel,
                                 channelId: permissionChannelId,
-                                replyContext: permissionReplyContext,
-                            }, payload);
+                            }, permissionReplyContext), payload);
                         }
                         return;
                     }
@@ -2731,6 +2760,12 @@ export class ResponseEngine {
                             this.handoffRuntime.completeTargetContext(selfAid, handoffId);
                     }
                 }
+                // The runner may already own a stronger per-session directory (Codex
+                // registers one before constructing its thread). Other runners use a
+                // private child of the process-provided TMPDIR. Both paths are passed
+                // explicitly so sandboxed helper commands never fall back to a shared
+                // agent or project directory for transient state.
+                const sessionRuntimeDir = agent.getManagedTempDir?.(session.id) ?? ensureSessionRuntimeDir(session.id);
                 const taskRuntimeContext = {
                     taskId,
                     sessionId: session.id,
@@ -2744,6 +2779,8 @@ export class ResponseEngine {
                     peerType: message.peerType || session.metadata?.peerType || undefined,
                     peerRole,
                     threadId: session.threadId || undefined,
+                    sessionRuntimeDir,
+                    runtimeLockDir: ensureRuntimeLockDir(sessionRuntimeDir),
                     handoffIds: v2HandoffIds.length > 0 && v2HandoffDirection === 'target' ? v2HandoffIds : undefined,
                     causation: taskCausation,
                 };
@@ -2777,6 +2814,7 @@ export class ResponseEngine {
                     ? (agent.resolveModelId(model) ?? model)
                     : model));
                 const retryAttemptTimeoutMs = this.retryAttemptTimeoutMs();
+                const retryInputIsAtMostOnce = agent.retryInputSemantics === 'at_most_once';
                 let runAttempt = 1;
                 const recordRetryHealthError = async (retryError) => {
                     if (!policy.accumulateErrors(chatType, identityRole))
@@ -2813,14 +2851,17 @@ export class ResponseEngine {
                         const processAttempt = this.processEventStream(stream, session, agent, renderer, (eventType, toolName) => {
                             resetTimer(eventType, toolName);
                             attemptTimeout?.reset();
-                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease);
+                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode, session.selfAID || message.selfAID);
                         streamResult = attemptTimeout
                             ? await Promise.race([processAttempt, attemptTimeout.promise])
                             : await processAttempt;
                         if (!streamResult.isError) {
                             const protocolDecision = this.turnCoordinator.evaluateCommit(turnLease, this.buildTurnCommitEvidence(session, streamResult));
                             const protocolReason = protocolDecision.ok ? undefined : protocolDecision.reason;
-                            const safeProtocolReplay = isSafeProtocolReplayCandidate(streamResult, protocolReason);
+                            // Codex app-server turn/start appends its input before runQuery
+                            // resolves. Replaying here would create a second user turn.
+                            const safeProtocolReplay = !retryInputIsAtMostOnce
+                                && isSafeProtocolReplayCandidate(streamResult, protocolReason);
                             const protocolRetry = retryScheduler.afterProtocolFailure(safeProtocolReplay ? protocolReason : undefined, safeProtocolReplay);
                             if (protocolRetry.kind === 'protocol_replay') {
                                 protocolReplayAttempts = protocolRetry.attempt;
@@ -2865,6 +2906,16 @@ export class ResponseEngine {
                             permissionError._errorAlreadySent = true;
                             throw permissionError;
                         }
+                        const retryWouldReplaySubmittedInput = retryAttemptTimedOut
+                            || isRetryableError(retryError)
+                            || classifyError(retryError) === ErrorType.MODEL_UNAVAILABLE;
+                        if (retryInputIsAtMostOnce && streamRegistered && retryWouldReplaySubmittedInput) {
+                            await recordRetryHealthError(retryError);
+                            markRetryInputAlreadySubmitted(retryError);
+                            logger.warn(`[ResponseEngine] Not replaying already-submitted input: agent=${agent.name} `
+                                + `session=${session.id} task=${taskId} attempt=${runAttempt}`);
+                            throw retryError;
+                        }
                         if (classifyError(retryError) === ErrorType.MODEL_UNAVAILABLE && !hasExplicitTriggerModel) {
                             if (probingPrimaryModel && previousFallbackState) {
                                 const resumedFallback = previousFallbackState.activeFallback;
@@ -2958,6 +3009,8 @@ export class ResponseEngine {
                         resetTimer,
                         shouldSuppress,
                         proactive,
+                        proactiveSelfAid: session.selfAID || message.selfAID,
+                        permissionMode: effectivePermissionMode,
                         turnLease,
                     });
                 }
@@ -2999,6 +3052,8 @@ export class ResponseEngine {
                     resetTimer,
                     shouldSuppress,
                     proactive,
+                    proactiveSelfAid: session.selfAID || message.selfAID,
+                    permissionMode: effectivePermissionMode,
                     turnLease,
                 });
                 // 重试后仍然 prompt_too_long：显示友好提示
@@ -3070,7 +3125,7 @@ export class ResponseEngine {
                             return;
                         const isCurrentlyBackground = this.isBackgroundSession(session, message.channel, message.channelId);
                         if (!isCurrentlyBackground) {
-                            await adapter.send({ ...envelope, replyContext: capturedReplyContext }, payload);
+                            await adapter.send(withEnvelopeReplyContext(envelope, capturedReplyContext), payload);
                             if (payload.kind === 'result.text') {
                                 logger.info(`[ResponseEngine] afterProcess sent: task=${taskId} text="${payload.text.slice(0, 60)}"`);
                             }
@@ -3158,7 +3213,10 @@ export class ResponseEngine {
                             // 发送文件
                             logger.info(`[${adapter.channelName}] Sending file via ${targetInfo.adapter.channelName}: ${resolvedPath}`);
                             try {
-                                await targetInfo.adapter.send(buildEnvelope({ taskId, channel: targetInfo.adapter.channelName, channelId: targetChannelId, agentName: agentNameForStats, replyContext: capturedReplyContext }), { kind: 'result.file', filePath: resolvedPath });
+                                const targetReplyContext = isCrossChannel
+                                    ? { delivery: { chatType: 'private' } }
+                                    : capturedReplyContext;
+                                await targetInfo.adapter.send(buildEnvelope({ taskId, channel: targetInfo.adapter.channelName, channelId: targetChannelId, agentName: agentNameForStats, replyContext: targetReplyContext }), { kind: 'result.file', filePath: resolvedPath });
                                 this.eventBus.publish({ type: 'runner:file-sent', sessionId: session.id, filePath: resolvedPath, channel: targetInfo.adapter.channelName });
                                 sent++;
                                 if (isCrossChannel) {
@@ -3681,6 +3739,7 @@ export class ResponseEngine {
             // processEventStream 已通过 renderer 发过错误时也跳过
             const retryExhaustedCount = getRetryExhaustedCount(error);
             const modelFallbackExhaustedMessage = getModelFallbackExhaustedMessage(error);
+            const retryInputAlreadySubmitted = wasRetryInputAlreadySubmitted(error);
             if (isUserInterrupt) {
                 logger.info(`[ResponseEngine] User interrupt by new_message, skip sending error message`);
             }
@@ -3692,13 +3751,15 @@ export class ResponseEngine {
                 const idleSec = getLastIdleSec?.() || 0;
                 const userMessage = retryExhaustedCount
                     ? formatRetryableErrorFinalMessage(error, retryExhaustedCount)
-                    : modelFallbackExhaustedMessage
-                        ? modelFallbackExhaustedMessage
-                        : isTotalExecutionTimeout
-                            ? `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`
-                            : isTimeout
-                                ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
-                                : getErrorMessage(error, undefined);
+                    : retryInputAlreadySubmitted
+                        ? formatRetryInputAlreadySubmittedMessage(error)
+                        : modelFallbackExhaustedMessage
+                            ? modelFallbackExhaustedMessage
+                            : isTotalExecutionTimeout
+                                ? `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`
+                                : isTimeout
+                                    ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
+                                    : getErrorMessage(error, undefined);
                 // 获取 session 用于话题回复（如果 resolveSession 已执行）
                 let sendOpts;
                 try {
@@ -3715,14 +3776,14 @@ export class ResponseEngine {
                 const errorPayload = {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: retryExhaustedCount ? 'retry_exhausted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
+                    reason: retryExhaustedCount ? 'retry_exhausted' : retryInputAlreadySubmitted ? 'input_already_submitted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
                 };
                 if (!isUserInterrupt && daemonTrigger && procStatus === 'error') {
                     // DaemonChannel settles a trigger on the first terminal payload. Put
                     // the complete failure metadata first so the audit retains tool
                     // counts and context-recovery diagnostics even for thrown errors
                     // (for example when compact itself fails).
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, {
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), {
                         kind: 'status.error',
                         metadata: {
                             errorType: errType,
@@ -3735,17 +3796,17 @@ export class ResponseEngine {
                             contextRecoveryAttempts: streamResult.contextRecoveryAttempts ?? 0,
                         },
                     }).catch(() => { });
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, errorPayload);
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), errorPayload);
                 }
                 else {
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, errorPayload);
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), errorPayload);
                 }
                 if (!isUserInterrupt && daemonTrigger && procStatus !== 'error') {
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, statusPayload).catch(() => { });
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), statusPayload).catch(() => { });
                 }
                 // Proactive 可观测：catch 块的基础设施错误也透传为 thought，保证按 task_id 聚合完整
                 if (isProactive && adapter.capabilities?.thought) {
-                    await adapter.send({ ...envelope, replyContext: sendOpts }, {
+                    await adapter.send(withEnvelopeReplyContext(envelope, sendOpts), {
                         kind: 'activity.batch',
                         items: [{
                                 kind: 'notice',
@@ -3973,7 +4034,7 @@ export class ResponseEngine {
      */
     async processEventStream(stream, session, agent, renderer, resetTimer, shouldSuppress, proactive, 
     /** [迁移点4/5] 响应模式插件 + 状态，用于调 onToolUse/onComplete 钩子 */
-    modeHooks, causation, turnLease) {
+    modeHooks, causation, turnLease, permissionMode, proactiveSelfAid) {
         // Per-session agent name for stats bucketing
         const statsChannelKey = session.channel === 'daemon' ? session.channel : (session.metadata?.channelKey || session.channel);
         const agentNameForStats = this.agentRegistry?.resolveByChannel(statsChannelKey)?.name ?? '<unknown>';
@@ -3989,6 +4050,7 @@ export class ResponseEngine {
         let toolUseCount = 0;
         const openToolUseIds = new Set();
         const anonymousToolUseIds = new Map();
+        const anonymousOpenIdByCorrelation = new Map();
         const finalizeResult = () => ({
             ...completeResult,
             hasReceivedText,
@@ -4004,7 +4066,28 @@ export class ResponseEngine {
         let lastReplyText = '';
         // callId → description 映射，用于 tool_result 回显描述
         const toolDescByCallId = new Map();
+        const toolInputByCallId = new Map();
+        const toolInputByCorrelationId = new Map();
+        const anonymousToolInputsByName = new Map();
         const ctlQueueReadCallIds = new Set();
+        const removePendingToolInput = (pending) => {
+            for (const [callId, value] of toolInputByCallId) {
+                if (value === pending)
+                    toolInputByCallId.delete(callId);
+            }
+            for (const [correlationId, value] of toolInputByCorrelationId) {
+                if (value === pending)
+                    toolInputByCorrelationId.delete(correlationId);
+            }
+            const anonymous = anonymousToolInputsByName.get(pending.name);
+            if (anonymous) {
+                const remaining = anonymous.filter(value => value !== pending);
+                if (remaining.length > 0)
+                    anonymousToolInputsByName.set(pending.name, remaining);
+                else
+                    anonymousToolInputsByName.delete(pending.name);
+            }
+        };
         try {
             for await (let event of stream) {
                 if (turnLease && !this.turnCoordinator.isCurrent(turnLease)) {
@@ -4036,16 +4119,44 @@ export class ResponseEngine {
                     else {
                         const syntheticId = `__anonymous_tool_${toolUseCount}`;
                         openToolUseIds.add(syntheticId);
+                        if (event.correlationId)
+                            anonymousOpenIdByCorrelation.set(event.correlationId, syntheticId);
                         const pending = anonymousToolUseIds.get(event.name) ?? [];
                         pending.push(syntheticId);
                         anonymousToolUseIds.set(event.name, pending);
                     }
                 }
                 else if (event.type === 'tool_result') {
-                    if (event.callId) {
+                    // A result carrying both identifiers may be stale or replayed. Do not
+                    // close the active call until both identifiers resolve to the same
+                    // pending tool invocation; otherwise a mismatched result can make the
+                    // protocol look complete even though the real call is still open.
+                    const hasBothResultIdentifiers = !!event.callId && !!event.correlationId;
+                    const byCallId = event.callId ? toolInputByCallId.get(event.callId) : undefined;
+                    const byCorrelationId = event.correlationId
+                        ? toolInputByCorrelationId.get(event.correlationId)
+                        : undefined;
+                    const identifiersMatch = !hasBothResultIdentifiers
+                        || (!!byCallId && !!byCorrelationId && byCallId === byCorrelationId);
+                    if (event.callId && identifiersMatch) {
                         openToolUseIds.delete(event.callId);
                     }
-                    else {
+                    else if (!event.callId && event.correlationId && byCorrelationId) {
+                        const syntheticId = anonymousOpenIdByCorrelation.get(event.correlationId);
+                        if (syntheticId) {
+                            openToolUseIds.delete(syntheticId);
+                            anonymousOpenIdByCorrelation.delete(event.correlationId);
+                        }
+                        else {
+                            for (const [callId, pending] of toolInputByCallId) {
+                                if (pending === byCorrelationId) {
+                                    openToolUseIds.delete(callId);
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                    else if (!event.callId) {
                         const names = event.name ? [event.name] : [...anonymousToolUseIds.keys()];
                         for (const name of names) {
                             const pending = anonymousToolUseIds.get(name);
@@ -4059,6 +4170,11 @@ export class ResponseEngine {
                         }
                     }
                 }
+                else if (event.type === 'notice') {
+                    for (const callId of event.closedToolCallIds ?? []) {
+                        openToolUseIds.delete(callId);
+                    }
+                }
                 else if (event.type === 'complete') {
                     assistantUuid = event.assistantUuid ?? assistantUuid;
                     protocolIncompleteReason = event.protocolIncompleteReason ?? protocolIncompleteReason;
@@ -4295,14 +4411,33 @@ export class ResponseEngine {
                             sessionId: session.id,
                             toolName: event.name,
                             input: event.input,
+                            ...(event.callId ? { callId: event.callId } : {}),
+                            ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
+                            ...(session.selfAID ? { agentAid: session.selfAID } : {}),
+                            ...(permissionMode ? { permissionMode } : {}),
                             timestamp: Date.now(),
                             causation,
                         });
+                        const desc = summarizeToolInput(event.name, event.input || {});
+                        const pendingInput = { name: event.name, input: event.input || {} };
+                        if (event.callId)
+                            toolInputByCallId.set(event.callId, pendingInput);
+                        if (event.correlationId)
+                            toolInputByCorrelationId.set(event.correlationId, pendingInput);
+                        else if (event.callId) {
+                            // Renderer/event-log normalization uses callId as the fallback
+                            // correlation. Keep the same alias here so a result carrying both
+                            // fields with that fallback still matches the original call.
+                            toolInputByCorrelationId.set(event.callId, pendingInput);
+                        }
+                        if (!event.callId && !event.correlationId) {
+                            const pending = anonymousToolInputsByName.get(event.name) ?? [];
+                            pending.push(pendingInput);
+                            anonymousToolInputsByName.set(event.name, pending);
+                        }
                         if (!shouldSuppress()) {
-                            const desc = summarizeToolInput(event.name, event.input || {});
-                            if (event.callId) {
+                            if (event.callId)
                                 toolDescByCallId.set(event.callId, desc);
-                            }
                             renderer.addToolCall(event.name, event.input, event.callId, desc, event.turn, event.outputTokens);
                         }
                         if (event.callId && isCtlQueueReadCommand(event.name, event.input || {})) {
@@ -4318,7 +4453,7 @@ export class ResponseEngine {
                                 toolInput: event.input || {},
                                 injectToModel: (text) => { agent.injectUserMessage?.(session.id, text); },
                                 getQueueLength: () => this.messageQueue?.getQueueLength(session.id) ?? 0,
-                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', session.selfAID),
+                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID),
                                 logger,
                             });
                         }
@@ -4344,9 +4479,62 @@ export class ResponseEngine {
                             toolName: event.name,
                             isError: event.isError,
                             agentName: agentNameForStats,
+                            ...(event.callId ? { callId: event.callId } : {}),
+                            ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
+                            ...(session.selfAID ? { agentAid: session.selfAID } : {}),
+                            ...(permissionMode ? { permissionMode } : {}),
                             timestamp: Date.now(),
                             causation,
                         });
+                        // A proactive send gate advances only after the matching command
+                        // completed successfully and returned an explicit send receipt.
+                        let original;
+                        const byCallId = event.callId ? toolInputByCallId.get(event.callId) : undefined;
+                        const byCorrelationId = event.correlationId
+                            ? toolInputByCorrelationId.get(event.correlationId)
+                            : undefined;
+                        // Both identifiers must describe the same call. This avoids
+                        // accepting a stale/replayed correlation as the result of a new
+                        // call, or vice versa.
+                        const hasBothResultIdentifiers = !!event.callId && !!event.correlationId;
+                        if (hasBothResultIdentifiers
+                            && (!byCallId || !byCorrelationId || byCallId !== byCorrelationId)) {
+                            logger.warn(`[ResponseEngine] Ignoring mismatched tool result identifiers: session=${session.id}`);
+                        }
+                        else if (!hasBothResultIdentifiers) {
+                            original = byCallId ?? byCorrelationId;
+                        }
+                        else {
+                            original = byCallId;
+                        }
+                        if (!original && !event.callId && !event.correlationId) {
+                            const pending = anonymousToolInputsByName.get(event.name);
+                            // Without either identifier, FIFO is unsafe when same-named calls
+                            // overlap or complete out of order. Leave the gate unchanged until
+                            // a unique pending call can be matched.
+                            if (pending?.length === 1) {
+                                original = pending[0];
+                                anonymousToolInputsByName.delete(event.name);
+                            }
+                        }
+                        if (original)
+                            removePendingToolInput(original);
+                        if (original && modeHooks?.mode?.onToolResult) {
+                            const proactiveState = modeHooks.state.get('proactive');
+                            await modeHooks.mode.onToolResult({
+                                session,
+                                state: modeHooks.state,
+                                toolName: original.name,
+                                toolInput: original.input,
+                                result: event.result,
+                                isError: event.isError,
+                                error: event.error,
+                                injectToModel: (text) => { agent.injectUserMessage?.(session.id, text); },
+                                getQueueLength: () => this.messageQueue?.getQueueLength(session.id) ?? 0,
+                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID),
+                                logger,
+                            });
+                        }
                         // 从 tool_use 阶段缓存的描述中回溯
                         const cachedDesc = event.callId ? toolDescByCallId.get(event.callId) : undefined;
                         if (event.isError && !shouldSuppress()) {
@@ -4360,6 +4548,12 @@ export class ResponseEngine {
                             renderer.addToolResult(event.name || '\u5de5\u5177', true, event.result, undefined, event.callId, event.durationMs, cachedDesc);
                         }
                     }
+                    // 非终态运行时告警走 status notify，不进入 activity/thought 历史。
+                    if (event.type === 'notice' && event.severity === 'warn') {
+                        await renderer.sendWarningStatus(event.message, event.subtype, {
+                            ...(event.missingItems !== undefined && { missingItems: event.missingItems }),
+                        });
+                    }
                     // 运行时错误（Codex: turn.failed / item error）
                     if (event.type === 'error') {
                         logger.warn(`[ResponseEngine] error event: ${event.errorType}: ${event.error}`);