evolcore 0.0.12 → 0.0.14

package/dist/agents/codex-runner.js

@@ -7,22 +7,23 @@
  */
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
-import { normalizePermissionMode } from '../core/permission/mode.js';
-import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
+import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/protected-paths.js';
 import { CodexAppServerClient } from './codex-app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
+import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
+import { ensureProcessManagedTempDir } from '../cli/task-context.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
 import { execFileSync } from 'child_process';
 import { execCodexCliSync, resolveCodexCliPath } from '../utils/codex-cli.js';
@@ -76,6 +77,39 @@ class AsyncEventQueue {
 }
 const managedTempDirsForExitCleanup = new Map();
 let managedTempExitCleanupRegistered = false;
+function isTrustedManagedTempDirectory(directory, parent) {
+    try {
+        const parentPath = path.resolve(parent);
+        const directoryPath = path.resolve(directory);
+        // The session directory must be a direct child of the private parent.
+        // This lexical check is required before canonicalization so a replaced
+        // parent symlink cannot turn an old session path into another tree.
+        if (path.dirname(directoryPath) !== parentPath)
+            return false;
+        const trustedDirectory = (candidate) => {
+            const stat = fs.lstatSync(candidate);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                return false;
+            if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                return false;
+            return (stat.mode & 0o077) === 0;
+        };
+        if (!trustedDirectory(parentPath) || !trustedDirectory(directoryPath))
+            return false;
+        const canonicalParent = resolveProtectedCandidate(parentPath);
+        const canonicalDirectory = resolveProtectedCandidate(directoryPath);
+        // Keep the canonical and lexical paths identical after the lstat checks;
+        // this rejects symlink replacement in either node or an existing ancestor.
+        return canonicalParent === parentPath
+            && canonicalDirectory === directoryPath
+            && canonicalDirectory !== canonicalParent
+            && path.dirname(canonicalDirectory) === canonicalParent
+            && isSameOrDescendant(canonicalDirectory, canonicalParent);
+    }
+    catch {
+        return false;
+    }
+}
 function registerManagedTempDirForExitCleanup(directory, parent) {
     managedTempDirsForExitCleanup.set(directory, parent);
     if (managedTempExitCleanupRegistered)
@@ -84,10 +118,8 @@ function registerManagedTempDirForExitCleanup(directory, parent) {
     process.once('exit', () => {
         for (const [candidatePath, parentPath] of managedTempDirsForExitCleanup) {
             try {
-                const parentCandidate = resolveProtectedCandidate(parentPath);
-                const candidate = resolveProtectedCandidate(candidatePath);
-                if (candidate !== parentCandidate && isSameOrDescendant(candidate, parentCandidate)) {
-                    fs.rmSync(candidate, { recursive: true, force: true });
+                if (isTrustedManagedTempDirectory(candidatePath, parentPath)) {
+                    fs.rmSync(path.resolve(candidatePath), { recursive: true, force: true });
                 }
             }
             catch {
@@ -121,7 +153,7 @@ const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
 let codexCatalogCache = null;
 // The permission bridge is version-locked to the audited approval schema and
 // managed PreToolUse hook behavior used by proactive first-tool enforcement.
-export const MIN_CODEX_CLI_VERSION = '0.147.0';
+export const MIN_CODEX_CLI_VERSION = '0.144.1';
 export function parseCodexCliVersion(output) {
     const match = output.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/);
     return match?.[1] ?? null;
@@ -144,19 +176,18 @@ export function getCodexCliVersion() {
 }
 export function getCodexAppServerAvailability() {
     if (!resolveCodexCliPath()) {
-        const upgradeHint = '请升级 Codex CLI：npm install -g @openai/codex@latest';
-        return { available: false, reason: `未检测到可用 Codex CLI。${upgradeHint}` };
+        return { available: false, reason: '未检测到 Codex CLI。' };
     }
     const version = getCodexCliVersion();
-    const upgradeHint = '请升级 Codex CLI：npm install -g @openai/codex@latest';
     if (!version) {
-        return { available: false, reason: `未检测到可用 Codex CLI。${upgradeHint}` };
+        return { available: false, reason: '无法读取 Codex CLI 版本。' };
     }
     if (!isCodexCliVersionSupported(version)) {
         return {
             available: false,
             version,
-            reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。${upgradeHint}`,
+            reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。请升级 Codex CLI：npm install -g @openai/codex@latest`,
+            requiresUpgrade: true,
         };
     }
     try {
@@ -168,7 +199,7 @@ export function getCodexAppServerAvailability() {
         return { available: true, version };
     }
     catch {
-        return { available: false, version, reason: `Codex CLI ${version} 不支持 app-server。${upgradeHint}` };
+        return { available: false, version, reason: `Codex CLI ${version} 不支持 app-server。` };
     }
 }
 export function isCodexAppServerAvailable() {
@@ -208,6 +239,9 @@ export function getCodexEfforts(model) {
 // ── Codex Runner ──
 export class CodexRunner {
     name = 'codex';
+    // turn/start persists a new user turn before runQuery resolves. App-server
+    // has no retry-in-place API for a completed or failed turn.
+    retryInputSemantics = 'at_most_once';
     capabilities;
     model;
     effort;
@@ -282,51 +316,82 @@ export class CodexRunner {
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommandArgv(command) {
+    approvedLiteralEvolcoreCommandArgv(command, managedTempDir) {
         const classification = classifyEvolcoreShellCommand(command);
         if (classification.kind === 'bounded-output')
             return classification.command.argv;
         if (classification.kind !== 'literal')
             return undefined;
-        const argv = parseLiteralShellArgv(command);
+        // Keep the approval/delegation parser aligned with the preflight parser:
+        // the session-managed `$TMPDIR` token is a permitted EC path reference.
+        const argv = parseLiteralShellArgv(command, {
+            allowManagedTmpDir: true,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        });
+        if (argv && containsLiteralManagedTmpDirOutsideSendContent(argv))
+            return undefined;
         return argv?.[0] === 'ec' ? argv : undefined;
     }
-    approvedEvolcoreCommandArgv(toolInput) {
+    approvedEvolcoreCommandArgv(toolInput, managedTempDir) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
             : undefined;
-        if (explicitArgv?.[0] === 'ec')
-            return explicitArgv;
+        if (explicitArgv?.[0] === 'ec') {
+            return explicitArgv.some(value => value.includes('\0'))
+                || containsLiteralManagedTmpDirOutsideSendContent(explicitArgv)
+                ? undefined
+                : explicitArgv;
+        }
         const explicitWrappedCommand = explicitArgv
             ? unwrapCodexShellCommandArgv(explicitArgv)
             : undefined;
         if (explicitWrappedCommand !== undefined) {
-            return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand);
+            return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand, managedTempDir);
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
-        const directArgv = this.approvedLiteralEvolcoreCommandArgv(command);
+        const directArgv = this.approvedLiteralEvolcoreCommandArgv(command, managedTempDir);
         if (directArgv)
             return directArgv;
-        const wrappedArgv = parseLiteralShellArgv(command);
+        const wrappedArgv = parseLiteralShellArgv(command, {
+            allowManagedTmpDir: true,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        });
         const wrappedCommand = wrappedArgv
             ? unwrapCodexShellCommandArgv(wrappedArgv)
             : undefined;
         return wrappedCommand === undefined
             ? undefined
-            : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand);
+            : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand, managedTempDir);
     }
-    armApprovedDelegationCommand(sessionId, toolInput) {
+    isManagedEvolcoreCommandIntent(toolInput) {
+        if (Array.isArray(toolInput.commandArgv)) {
+            const rawArgv = toolInput.commandArgv;
+            if (rawArgv[0] === 'ec')
+                return true;
+            if (!rawArgv.every(value => typeof value === 'string'))
+                return false;
+            const wrappedCommand = unwrapCodexShellCommandArgv(rawArgv);
+            return wrappedCommand !== undefined
+                && classifyEvolcoreShellCommand(wrappedCommand).kind !== 'none';
+        }
+        const command = typeof toolInput.command === 'string' ? toolInput.command : '';
+        return classifyEvolcoreShellCommand(command).kind !== 'none';
+    }
+    armApprovedDelegationCommand(sessionId, argv) {
         const threadId = this.activeSessions.get(sessionId);
         const carrierToken = threadId ? this.threadDelegationCarriers.get(threadId) : undefined;
-        const argv = this.approvedEvolcoreCommandArgv(toolInput);
-        if (!carrierToken || !argv)
-            return false;
         const commandHash = hashDelegatedCommandArgv(argv);
         const arm = this.permissionContexts.get(sessionId)?.armApprovedDelegationCommand;
-        if (!commandHash || !arm)
+        if (!carrierToken || !commandHash || !arm)
             return false;
-        return arm(carrierToken, commandHash);
+        try {
+            return arm(carrierToken, commandHash);
+        }
+        catch (error) {
+            logger.warn(`[CodexRunner] delegation arm callback failed: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
     }
     async readThreadDelegationCarrier(appServer, threadId) {
         try {
@@ -750,6 +815,8 @@ export class CodexRunner {
                         ...(mode !== 'readonly' && managedTempDir ? {
                             [managedTempDir]: 'write',
                             [path.join(managedTempDir, '**')]: 'write',
+                            [path.join(path.dirname(managedTempDir), 'evolcore-locks')]: 'write',
+                            [path.join(path.dirname(managedTempDir), 'evolcore-locks', '**')]: 'write',
                         } : {}),
                     },
                     network,
@@ -789,6 +856,17 @@ export class CodexRunner {
     }
     setSendPrompt(fn) { this.sendPromptFn = fn; }
     setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    async assertProactiveHookAvailability(sessionId, appServer) {
+        if (this.permissionContexts.get(sessionId)?.chatmode !== 'proactive')
+            return;
+        if (process.platform === 'win32') {
+            await appServer.assertManagedHooksAvailable();
+            return;
+        }
+        if (process.platform !== 'linux') {
+            throw new Error('Codex proactive managed PreToolUse enforcement requires Linux or an installed Windows managed hook');
+        }
+    }
     async evaluatePreToolUse(threadId, toolName, toolInput) {
         const sessionKey = this.findSessionKeyByThread(threadId);
         const activeThread = this.activeSessions.get(sessionKey);
@@ -953,9 +1031,6 @@ export class CodexRunner {
     }
     async runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
         let agentSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
-        if (this.permissionContexts.get(sessionId)?.chatmode === 'proactive' && process.platform !== 'linux') {
-            throw new Error('Codex proactive managed PreToolUse enforcement currently requires Linux');
-        }
         const resumingThread = !!agentSessionId;
         const callModel = modelOverride?.model || this.model;
         const callEffort = modelOverride?.effortMode === 'model_default'
@@ -975,6 +1050,7 @@ export class CodexRunner {
         const effectiveApprovalPolicy = callApprovalPolicy;
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
         const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, callMode);
+        await this.assertProactiveHookAvailability(sessionId, appServer);
         const managedTempInstruction = this.managedTempInstruction(sessionId);
         const developerInstructions = [systemPromptAppend, managedTempInstruction].filter(Boolean).join('\n\n') || undefined;
         let knownDelegationCarrier = agentSessionId
@@ -1044,7 +1120,7 @@ export class CodexRunner {
         const controller = new AbortController();
         this.activeAbortControllers.set(sessionId, controller);
         const tempFiles = [];
-        const input = this.buildAppServerInput(prompt, images, tempFiles);
+        const input = this.buildAppServerInput(prompt, images, tempFiles, sessionId, runtimeEnv);
         const queue = new AsyncEventQueue();
         controller.signal.addEventListener('abort', () => queue.end(), { once: true });
         const state = {
@@ -1259,6 +1335,7 @@ export class CodexRunner {
                 const executionSandbox = this.buildExecutionSandboxOptions(_sessionId, compactMode, _projectPath);
                 const capabilityConfig = await this.resolveCapabilityThreadConfig(_projectPath);
                 const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, _projectPath, capabilityConfig, compactMode);
+                await this.assertProactiveHookAvailability(_sessionId, appServer);
                 const compactDelegationCarrier = this.threadDelegationCarriers.get(agentSessionId)
                     ?? this.createDelegationCarrier();
                 await appServer.threadResume(agentSessionId, _projectPath, {
@@ -1422,6 +1499,8 @@ export class CodexRunner {
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
         const appServer = this.getAppServerClient();
         const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, mode);
+        if (sessionKey)
+            await this.assertProactiveHookAvailability(sessionKey, appServer);
         const delegationCarrier = this.createDelegationCarrier();
         const response = await appServer.threadFork(agentSessionId, projectPath, title, {
             model: this.model,
@@ -1614,31 +1693,77 @@ export class CodexRunner {
             catch (error) {
                 logger.warn(`[CodexRunner] failed to record policy-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
             }
-            return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyResult.policyCode ?? 'session_policy_hook');
+            return response;
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
         const reason = params.reason || params.decisionReason || undefined;
         const workspacePath = this.resolvePermissionWorkspacePath(params);
         if (!workspacePath) {
             logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
-            return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', 'approval_workspace_unknown');
+            return response;
         }
         const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
         const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${summary}`);
+        const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
+            || request.method === 'execCommandApproval';
+        const managedEcIntent = isCommandApproval && this.isManagedEvolcoreCommandIntent(toolInput);
+        const approvedCommand = isCommandApproval
+            ? this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionKey))
+            : undefined;
+        const denyInfrastructure = async (policyCode, message) => {
+            logger.warn(`[CodexRunner] ${message}: session=${sessionKey} requestId=${request.id ?? '<missing>'}`);
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+                    policyCode,
+                    decisionSource: 'infrastructure',
+                    agentAid: permissionContext?.selfAid,
+                    sessionId: sessionKey,
+                    permissionMode: normalizePermissionMode(sessionMode).mode,
+                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record infrastructure approval denial: session=${sessionKey} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+            const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode);
+            return response;
+        };
+        if (managedEcIntent && !approvedCommand) {
+            return await denyInfrastructure('ec_command_not_canonical', 'EC command approval denied because no canonical argv could be derived');
+        }
         try {
             const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
-            if (decision !== 'deny'
-                && (request.method === 'item/commandExecution/requestApproval' || request.method === 'execCommandApproval')
-                && this.approvedEvolcoreCommandArgv(toolInput)) {
-                if (!this.armApprovedDelegationCommand(sessionKey, toolInput)) {
-                    // Approval policy and delegation authority are separate boundaries.
-                    // If no ticket can be armed, the CLI still fails closed at IPC token
-                    // validation instead of changing an otherwise valid tool decision.
-                    logger.warn(`[CodexRunner] EC command approved without a task-bound delegation ticket: session=${sessionKey}`);
+            if (decision !== 'deny' && managedEcIntent && approvedCommand) {
+                const carrierThreadIds = [
+                    this.activeSessions.get(sessionKey),
+                    typeof params.threadId === 'string' ? params.threadId : undefined,
+                    typeof params.conversationId === 'string' ? params.conversationId : undefined,
+                ];
+                const hasDelegationCarrier = carrierThreadIds.some(threadId => !!threadId && this.threadDelegationCarriers.has(threadId));
+                const canArmDelegation = typeof permissionContext?.armApprovedDelegationCommand === 'function';
+                // A carrier-bearing thread is managed even if its permission context
+                // was not wired with an arm callback; it must fail closed here rather
+                // than reaching daemon IPC with an unarmed carrier.
+                if ((hasDelegationCarrier || canArmDelegation)
+                    && !this.armApprovedDelegationCommand(sessionKey, approvedCommand)) {
+                    return await denyInfrastructure('delegation_not_armed', 'EC command approval failed to arm delegation');
                 }
             }
             const response = this.toAppServerApprovalResponse(request.method, decision, toolInput, unattended);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval') : 'approval');
             logger.info(`[CodexRunner] app-server approval response id=${request.id} method=${request.method} decision=${decision} response=${JSON.stringify(response)}`);
             return response;
         }
@@ -1648,6 +1773,18 @@ export class CodexRunner {
             throw error;
         }
     }
+    logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode) {
+        logger.info(`[CodexRunner] app-server approval audit ${JSON.stringify({
+            requestId: request.id !== undefined ? String(request.id) : undefined,
+            method: request.method,
+            sessionId: sessionKey,
+            toolName,
+            decision,
+            decisionSource,
+            ...(policyCode ? { policyCode } : {}),
+            executed: false,
+        })}`);
+    }
     classifyMcpApprovalLabel(label) {
         const normalized = label.trim().toLowerCase().replace(/[\s_-]+/g, ' ');
         const negative = /\b(decline|deny|reject|cancel|no|block|stop)\b|do not|don't|not\s+(?:accept|approve|allow)|拒绝|不同意|不允许|取消|否|停止/i.test(normalized);
@@ -2058,10 +2195,15 @@ export class CodexRunner {
             channel: permCtx?.channel,
             peerId: permCtx?.userId,
             role: permCtx?.role,
+            allowProtectedMetadata: false,
+            // Revalidate ownership, mode, and parent containment at the final
+            // readonly decision. The map entry alone is stale if the directory was
+            // replaced between preflight and the approval callback.
+            managedTempDir: this.getManagedTempDir(sessionKey),
         } : undefined;
         if (toolName === 'Bash')
             return checkReadonly(toolName, input, projectPath, readonlyContext);
-        return { behavior: 'deny', message: '🔒 只读模式：权限升级和文件写入请求已拒绝' };
+        return { behavior: 'deny', message: '🔒 只读模式：权限升级和文件写入请求已拒绝', policyCode: 'readonly_permission_or_write' };
     }
     permissionProfiles(input) {
         return [input.permissions, input.additionalPermissions]
@@ -2174,6 +2316,22 @@ export class CodexRunner {
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const mode = normalizePermissionMode(rawMode).mode;
         const recordBlockedOperation = async (policyCode, operationInput = toolInput) => {
+            const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
+            auditToolPreflightDenial({
+                toolName,
+                policyCode,
+                reason: 'policy denied',
+                summary,
+                sessionId: sessionKey,
+                agentAid: permissionContext?.selfAid,
+                permissionMode: mode,
+                channel: permissionContext?.channel,
+                actorId: permissionContext?.userId,
+                role: permissionContext?.role,
+                selfAid: permissionContext?.selfAid,
+                requestId: typeof requestId === 'string' || typeof requestId === 'number' ? String(requestId) : undefined,
+                taskId: permissionContext?.taskId,
+            });
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
                     code: 'operation_blocked',
@@ -2183,7 +2341,10 @@ export class CodexRunner {
                     toolName,
                     ...(typeof requestId === 'string' || typeof requestId === 'number' ? { requestId: String(requestId) } : {}),
                     policyCode,
-                    summary: summarizeToolInputForAudit(toolName, operationInput).slice(0, 512),
+                    decisionSource: 'policy',
+                    agentAid: permissionContext?.selfAid,
+                    permissionMode: mode,
+                    summary,
                     effect: 'operation_skipped',
                 });
             }
@@ -2193,6 +2354,11 @@ export class CodexRunner {
         };
         const preflight = evaluateToolPreflight(toolName, toolInput, {
             sessionId: sessionKey,
+            // An unavailable registered root must fail closed; the policy helper
+            // distinguishes this explicit empty value from runners without a
+            // session-temp capability.
+            managedTempDir: this.getManagedTempDir(sessionKey) ?? '',
+            allowProtectedMetadata: false,
             selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
             userId: permissionContext?.userId,
@@ -2202,6 +2368,8 @@ export class CodexRunner {
             workspacePath,
         });
         if (preflight.behavior === 'deny') {
+            logger.warn(`[CodexRunner] tool preflight denied: session=${sessionKey} tool=${toolName} ` +
+                `policy=${preflight.policyCode ?? 'unknown'} reason=${preflight.message ?? 'policy denied'}`);
             if (preflight.policyCode) {
                 await recordBlockedOperation(preflight.policyCode);
             }
@@ -2231,7 +2399,7 @@ export class CodexRunner {
         if (mode === 'readonly') {
             const readonly = this.checkCodexReadonly(toolName, checkedInput, operationCwd, sessionKey);
             if (readonly.behavior === 'deny') {
-                await recordBlockedOperation('readonly_mode', checkedInput);
+                await recordBlockedOperation(readonly.policyCode ?? 'readonly_mode', checkedInput);
                 return 'deny';
             }
             return 'allow';
@@ -2468,11 +2636,15 @@ export class CodexRunner {
         this.onCompactStart = callback;
     }
     // ── Event stream transformation ──
-    buildAppServerInput(prompt, images, tempFiles) {
+    buildAppServerInput(prompt, images, tempFiles, sessionId, runtimeEnv) {
         const input = [{ type: 'text', text: prompt, text_elements: [] }];
         if (!images?.length)
             return input;
-        const tmpDir = os.tmpdir();
+        const tmpDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR
+            ?? (sessionId ? this.getManagedTempDir(sessionId) : undefined)
+            ?? process.env.TMPDIR;
+        if (!tmpDir || !path.isAbsolute(tmpDir))
+            throw new Error('managed TMPDIR is unset or not absolute');
         for (let i = 0; i < images.length; i++) {
             const img = images[i];
             const ext = MIME_EXT[img.mimeType || ''] || '.jpg';
@@ -2636,19 +2808,18 @@ export class CodexRunner {
     *reconcileOpenAppServerToolCalls(state, turnId) {
         if (state.openToolCalls.size === 0)
             return;
-        const callIds = [...state.openToolCalls.keys()];
+        const openCalls = [...state.openToolCalls.entries()];
+        const callIds = openCalls.map(([callId]) => callId);
         logger.warn(`[CodexRunner] Turn completed with ${callIds.length} open tool call(s): ` +
             `thread=${state.threadId} turn=${turnId || state.turnId || 'unknown'} calls=${callIds.join(',')}`);
-        for (const [callId, name] of state.openToolCalls) {
-            yield {
-                type: 'tool_result',
-                name,
-                result: '',
-                isError: true,
-                error: 'Codex app-server ended the turn without an item/completed notification',
-                callId,
-            };
-        }
+        yield {
+            type: 'notice',
+            severity: 'warn',
+            subtype: 'missing-item-completed',
+            message: 'Turn completed before tool completion was received',
+            closedToolCallIds: callIds,
+            missingItems: openCalls.map(([itemId, toolName]) => ({ itemId, toolName })),
+        };
         state.openToolCalls.clear();
     }
     *mapAppServerItemStarted(item, state) {
@@ -2962,7 +3133,8 @@ export class CodexRunner {
     }
     managedTempParent() {
         const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
-        return path.join(resolveProtectedCandidate(os.tmpdir()), `evolcore-codex-${uid}`);
+        const base = ensureProcessManagedTempDir();
+        return path.join(resolveProtectedCandidate(base), `evolcore-codex-${uid}`);
     }
     ensurePrivateDirectory(directory) {
         try {
@@ -2999,6 +3171,7 @@ export class CodexRunner {
         try {
             const parent = this.managedTempParent();
             this.ensurePrivateDirectory(parent);
+            this.ensurePrivateDirectory(path.join(parent, 'evolcore-locks'));
             // Include a per-runner nonce so a daemon restart never reuses contents
             // left behind by an unclean shutdown for the same EvolCore session id.
             const digest = createHash('sha256')
@@ -3019,39 +3192,28 @@ export class CodexRunner {
         }
     }
     isTrustedSessionTempDir(directory) {
-        try {
-            const rawStat = fs.lstatSync(directory);
-            if (!rawStat.isDirectory() || rawStat.isSymbolicLink())
-                return false;
-            const parent = resolveProtectedCandidate(this.managedTempParent());
-            const canonical = resolveProtectedCandidate(directory);
-            for (const candidate of [parent, canonical]) {
-                const stat = fs.lstatSync(candidate);
-                if (!stat.isDirectory() || stat.isSymbolicLink())
-                    return false;
-                if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
-                    return false;
-                if ((stat.mode & 0o077) !== 0)
-                    return false;
-            }
-            return canonical !== parent && isSameOrDescendant(canonical, parent);
-        }
-        catch {
-            return false;
-        }
+        return isTrustedManagedTempDirectory(directory, this.managedTempParent());
+    }
+    getManagedTempDir(sessionId) {
+        const directory = this.ensureSessionTempDir(sessionId);
+        if (!directory || !this.isTrustedSessionTempDir(directory))
+            return undefined;
+        return resolveProtectedCandidate(directory);
     }
     cleanupSessionTempDir(sessionId) {
         const directory = this.sessionTempDirs.get(sessionId);
         this.sessionTempDirs.delete(sessionId);
         if (!directory)
             return;
-        const parent = resolveProtectedCandidate(this.managedTempParent());
-        const candidate = resolveProtectedCandidate(directory);
-        if (candidate === parent || !isSameOrDescendant(candidate, parent)) {
+        // Reuse the same ownership, mode, lexical-parent, and canonicalization
+        // checks used at execution time. If the path changed, leave it in place
+        // rather than recursively removing an attacker-selected target.
+        if (!this.isTrustedSessionTempDir(directory)) {
             managedTempDirsForExitCleanup.delete(directory);
             logger.warn(`[CodexRunner] refused to clean unmanaged TMPDIR: session=${sessionId} path=${directory}`);
             return;
         }
+        const candidate = path.resolve(directory);
         try {
             fs.rmSync(candidate, { recursive: true, force: true });
             managedTempDirsForExitCleanup.delete(directory);
@@ -3063,7 +3225,7 @@ export class CodexRunner {
     managedTempInstruction(sessionId) {
         if (!this.ensureSessionTempDir(sessionId))
             return undefined;
-        return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。';
+        return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 `/tmp/evolcore-codex-*` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 `$TMPDIR` 重新创建，再继续执行后续 `ec` 命令。';
     }
     buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier) {
         const managedTempDir = this.ensureSessionTempDir(sessionId);
@@ -3072,6 +3234,8 @@ export class CodexRunner {
                 set: {
                     EVOLCORE_SESSION_ID: sessionId,
                     EVOLCORE_HOME: resolveRoot(),
+                    ...(managedTempDir ? { EVOLCORE_SESSION_RUNTIME_DIR: managedTempDir } : {}),
+                    ...(managedTempDir ? { EVOLCORE_RUNTIME_LOCK_DIR: path.join(path.dirname(managedTempDir), 'evolcore-locks') } : {}),
                     ...(delegationCarrier ? { [AGENT_DELEGATION_TOKEN_ENV]: delegationCarrier } : {}),
                     ...(managedTempDir ? { TMPDIR: managedTempDir } : {}),
                 },