evolcore 0.0.15 → 0.0.17

package/CHANGELOG.md

@@ -3,6 +3,37 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.17 (2026-08-25)
+
+### Claude 与任务边界
+
+- 统一识别 Claude 启动参数过长错误，记录结构化能力不可用审计并以明确终态结束任务，避免无效重试和敏感启动参数泄露。
+
+### Codex 与 AUN 消息兼容
+
+- 将运行时 BaseAgent 信息传入任务上下文，仅对 Codex AUN 私聊/群聊文本载荷解码一层 `\\n`/`\\r`/`\\t` 转义，保持其它 Runner 和原始换行不变。
+
+### 临时目录与跨平台稳定性
+
+- 改进受管临时目录创建根路径解析，在拒绝不可信 TMPDIR 时使用固定系统回退并兼容 macOS `/var` 实路径，强化跨平台私有目录校验。
+
+## 0.0.16 (2026-08-25)
+
+### 任务与消息可靠性
+
+- 统一任务总执行时限与 AUN 附件投递重试边界，补充可恢复失败的退避与错误上下文，避免无配置时误设总超时。
+- 优化会话响应、事件总线和守护进程生命周期，完善任务结束、重试和清理时的状态收敛。
+
+### Windows 与运行兼容性
+
+- 强化 Windows 进程识别、登录自启状态探测和命令输出解码，避免误识别其它 Node 服务并改善失败诊断。
+- 修正 Windows Claude 沙箱 settings 的受管临时文件生命周期，收紧运行目录校验，并为过长的 Unix socket 路径提供隔离的短路径回退。
+
+### 审计与权限边界
+
+- 增强结构化日志完整性检查、生命周期关联和重复记录识别，统一工具错误分类与审计上下文。
+- 收紧只读诊断、受保护路径和运行时锁访问策略，仅允许显式授权的有界源码诊断。
+
 ## 0.0.15 (2026-08-25)
 
 ### Codex 文件授权

package/README.md

@@ -162,6 +162,7 @@ ec init aun
   "idleMonitor": {
     "enabled": true,                            // 任务超时监控开关
     "timeout": 120,                             // 超时阈值（秒），默认 120 秒
+    "maxExecutionTime": 7200,                   // 可选：任务总执行时限（秒）；未配置、非数字或 <=0 时不限制
     "safeModeThreshold": 3                      // 连续超时 N 次后进入安全模式（设为 0 禁用安全模式）
   },
   "flushDelay": 4                               // 工具活动消息聚合发送间隔（秒），默认 4 秒

package/dist/agents/claude-runner.js

@@ -11,6 +11,7 @@ import fs from 'fs';
 import os from 'os';
 import crypto from 'crypto';
 import { logger } from '../utils/logger.js';
+import { createClaudeStartupArgumentsTooLongError, isClaudeStartupArgumentsTooLong, } from '../utils/error-utils.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
@@ -25,6 +26,7 @@ import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClass
 import { buildHClassGuardCommand, createSandboxInitializationError, isSandboxInitializationFailure, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
+import { isManagedSessionRuntimeDir } from '../cli/task-context.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
 // Built-in tools execute inside the Claude runtime and are covered by the
@@ -243,6 +245,17 @@ function trustedRuntimeWritePaths(runtimeEnv) {
     }
     return [...new Set(paths)];
 }
+function resolveClaudeSettingsDirectory(runtimeEnv) {
+    const configured = runtimeEnv?.TMPDIR?.trim();
+    if (!configured || !path.isAbsolute(configured)) {
+        throw new Error('[ClaudeSandbox] managed TMPDIR is unavailable');
+    }
+    const directory = path.resolve(configured);
+    if (!isManagedSessionRuntimeDir(directory, configured)) {
+        throw new Error('[ClaudeSandbox] settings file directory is outside the managed TMPDIR');
+    }
+    return directory;
+}
 async function assertClaudeSettingSourcesHaveLiteralSandboxPaths(cwd, settingSources, managedSettings) {
     if (process.platform !== 'linux' || settingSources.length === 0)
         return;
@@ -601,6 +614,7 @@ export class AgentRunner {
     activeMessageStreams = new Map();
     interruptFns = new Map();
     activeQueries = new Map();
+    sandboxSettingsFiles = new Map();
     streamDone = new Map();
     streamDoneResolvers = new Map();
     onSessionIdUpdate;
@@ -612,6 +626,33 @@ export class AgentRunner {
     /** 每个 session 最近的子进程 stderr 行（环形缓冲），用于子进程崩溃时还原真正原因 */
     recentStderr = new Map();
     static STDERR_BUFFER_MAX = 80;
+    trackSandboxSettingsFile(sessionId, filePath) {
+        const files = this.sandboxSettingsFiles.get(sessionId) ?? new Set();
+        files.add(filePath);
+        this.sandboxSettingsFiles.set(sessionId, files);
+    }
+    cleanupSandboxSettingsFile(sessionId, filePath) {
+        if (!filePath)
+            return;
+        try {
+            fs.rmSync(filePath, { force: true });
+        }
+        catch (error) {
+            const code = error && typeof error === 'object' && 'code' in error
+                ? String(error.code)
+                : 'unknown';
+            logger.warn(`[ClaudeSandbox] failed to remove transient settings file code=${code}`);
+        }
+        const files = this.sandboxSettingsFiles.get(sessionId);
+        files?.delete(filePath);
+        if (files?.size === 0)
+            this.sandboxSettingsFiles.delete(sessionId);
+    }
+    cleanupSandboxSettingsFiles(sessionId) {
+        for (const filePath of [...(this.sandboxSettingsFiles.get(sessionId) ?? [])]) {
+            this.cleanupSandboxSettingsFile(sessionId, filePath);
+        }
+    }
     constructor(apiKey, model, onSessionIdUpdate, baseUrl, config) {
         this.apiKey = apiKey;
         this.model = model || 'sonnet';
@@ -1366,7 +1407,7 @@ export class AgentRunner {
      * SDK 原始事件 → 标准 AgentEvent 转换
      * 所有 SDK 特有的事件类型引用封装在此方法内
      */
-    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false) {
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile) {
         let lastSessionId;
         let hasTurnActivity = false;
         let ignoredPreTurnResult = false;
@@ -1785,6 +1826,30 @@ export class AgentRunner {
             else {
                 logger.error(`[AgentRunner] Subprocess stream failed (session=${sessionId}) with no captured stderr.`);
             }
+            if (isClaudeStartupArgumentsTooLong(err)) {
+                const detail = createClaudeStartupArgumentsTooLongError(err);
+                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                    code: 'capability_unavailable',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName: 'Bash',
+                    policyCode: 'claude_startup_arguments_too_long',
+                    decisionSource: 'infrastructure',
+                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
+                    summary: detail.message.slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+                yield {
+                    type: 'complete',
+                    isError: true,
+                    subtype: 'infrastructure',
+                    terminalReason: 'claude_startup_arguments_too_long',
+                    errors: [detail.message],
+                    queryFinal: true,
+                };
+                return;
+            }
             if (isSandboxInitializationFailure(err, buf ?? [])) {
                 const detail = createSandboxInitializationError(err, buf ?? []);
                 await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
@@ -1813,6 +1878,7 @@ export class AgentRunner {
         }
         finally {
             this.recentStderr.delete(sessionId);
+            this.cleanupSandboxSettingsFile(sessionId, sandboxSettingsFile);
         }
     }
     async runQuery(sessionId, prompt, projectPath, initialClaudeSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
@@ -2001,6 +2067,7 @@ export class AgentRunner {
                 userId: permCtx?.userId,
                 role: permCtx?.role,
                 permissionMode: callPermissionMode,
+                allowReadonlySourceDiagnostics: permCtx?.allowReadonlySourceDiagnostics === true,
                 allowHostProcessCommands: true,
                 allowProtectedMetadata: false,
                 safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
@@ -2035,6 +2102,7 @@ export class AgentRunner {
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
                     allowProtectedMetadata: false,
+                    allowReadonlySourceDiagnostics: permCtx?.allowReadonlySourceDiagnostics === true,
                 };
                 const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
@@ -2123,6 +2191,7 @@ export class AgentRunner {
                 userId: permCtx?.userId,
                 role: permCtx?.role,
                 permissionMode: callPermissionMode,
+                allowReadonlySourceDiagnostics: permCtx?.allowReadonlySourceDiagnostics === true,
                 allowHostProcessCommands: true,
                 allowProtectedMetadata: false,
                 safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
@@ -2193,6 +2262,7 @@ export class AgentRunner {
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
                     allowProtectedMetadata: false,
+                    allowReadonlySourceDiagnostics: permCtx?.allowReadonlySourceDiagnostics === true,
                 };
                 const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
@@ -2362,23 +2432,54 @@ export class AgentRunner {
             stderr: handleClaudeStderr,
             env: this.getAgentEnv(runtimeEnv, sessionId, callPermissionMode)
         };
+        // Native Windows has a small CreateProcess command-line limit. The SDK
+        // normally serializes `sandbox` into inline `--settings` JSON, so preserve
+        // the same flag-settings semantics while passing a short file path.
+        let sandboxSettingsFile;
+        const shouldUseSandboxSettingsFile = process.platform === 'win32' && sandboxOptions && sandboxOptions.enabled !== false;
+        if (shouldUseSandboxSettingsFile) {
+            try {
+                const managedTmpDir = resolveClaudeSettingsDirectory(runtimeEnv);
+                sandboxSettingsFile = path.join(managedTmpDir, `.claude-sandbox-${crypto.randomUUID()}.json`);
+                const capabilitySettings = capabilityOptions.settings;
+                const settingsContent = JSON.stringify({
+                    ...(capabilitySettings && typeof capabilitySettings === 'object' && !Array.isArray(capabilitySettings)
+                        ? capabilitySettings
+                        : {}),
+                    sandbox: sandboxOptions,
+                });
+                fs.writeFileSync(sandboxSettingsFile, settingsContent, { flag: 'wx', mode: 0o600 });
+                this.trackSandboxSettingsFile(sessionId, sandboxSettingsFile);
+                logger.info(`[ClaudeSandbox] Windows settings externalized settingsChars=${settingsContent.length} ` +
+                    `settingsPathChars=${sandboxSettingsFile.length}`);
+            }
+            catch (error) {
+                this.cleanupSandboxSettingsFile(sessionId, sandboxSettingsFile);
+                throw new Error(`[ClaudeSandbox] failed to externalize Windows settings: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
         const createQuery = (promptInput, resumeSessionId, resumeAt) => {
             if (useSettingSources) {
+                const queryOptions = {
+                    ...commonOptions,
+                    ...(!resumeSessionId && callSessionTitle ? { title: callSessionTitle } : {}),
+                    settingSources: [...settingSources],
+                    systemPrompt: {
+                        type: 'preset',
+                        preset: 'claude_code',
+                        ...(excludeDynamic ? { excludeDynamicSections: true } : {}),
+                        ...(systemPromptAppend ? { append: systemPromptAppend } : {})
+                    },
+                    ...(resumeSessionId ? { resume: resumeSessionId } : {}),
+                    ...(resumeAt ? { resumeSessionAt: resumeAt } : {}),
+                };
+                if (sandboxSettingsFile) {
+                    delete queryOptions.sandbox;
+                    queryOptions.settings = sandboxSettingsFile;
+                }
                 return query({
                     prompt: promptInput,
-                    options: {
-                        ...commonOptions,
-                        ...(!resumeSessionId && callSessionTitle ? { title: callSessionTitle } : {}),
-                        settingSources: [...settingSources],
-                        systemPrompt: {
-                            type: 'preset',
-                            preset: 'claude_code',
-                            ...(excludeDynamic ? { excludeDynamicSections: true } : {}),
-                            ...(systemPromptAppend ? { append: systemPromptAppend } : {})
-                        },
-                        ...(resumeSessionId ? { resume: resumeSessionId } : {}),
-                        ...(resumeAt ? { resumeSessionAt: resumeAt } : {}),
-                    }
+                    options: queryOptions
                 });
             }
             else {
@@ -2408,22 +2509,27 @@ export class AgentRunner {
                     globalClaudeMd,
                     systemPromptAppend,
                 ].filter(Boolean).join('\n\n');
+                const queryOptions = {
+                    ...commonOptions,
+                    ...(!resumeSessionId && callSessionTitle ? { title: callSessionTitle } : {}),
+                    settingSources: [],
+                    ...(resumeSessionId ? { resume: resumeSessionId } : {}),
+                    ...(resumeAt ? { resumeSessionAt: resumeAt } : {}),
+                    ...(fullAppend ? {
+                        systemPrompt: {
+                            type: 'preset',
+                            preset: 'claude_code',
+                            append: fullAppend
+                        }
+                    } : {}),
+                };
+                if (sandboxSettingsFile) {
+                    delete queryOptions.sandbox;
+                    queryOptions.settings = sandboxSettingsFile;
+                }
                 return query({
                     prompt: promptInput,
-                    options: {
-                        ...commonOptions,
-                        ...(!resumeSessionId && callSessionTitle ? { title: callSessionTitle } : {}),
-                        settingSources: [],
-                        ...(resumeSessionId ? { resume: resumeSessionId } : {}),
-                        ...(resumeAt ? { resumeSessionAt: resumeAt } : {}),
-                        ...(fullAppend ? {
-                            systemPrompt: {
-                                type: 'preset',
-                                preset: 'claude_code',
-                                append: fullAppend
-                            }
-                        } : {}),
-                    }
+                    options: queryOptions
                 });
             }
         };
@@ -2455,7 +2561,10 @@ export class AgentRunner {
                 sdkStream = createQuery(msgStream);
             }
             catch (error) {
+                this.cleanupSandboxSettingsFile(sessionId, sandboxSettingsFile);
                 const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isClaudeStartupArgumentsTooLong(error))
+                    throw createClaudeStartupArgumentsTooLongError(error);
                 if (isSandboxInitializationFailure(error, stderr))
                     throw createSandboxInitializationError(error, stderr);
                 throw error;
@@ -2468,7 +2577,10 @@ export class AgentRunner {
                 sdkStream = createQuery(msgStream, agentSessionId, resumeAt);
             }
             catch (error) {
+                this.cleanupSandboxSettingsFile(sessionId, sandboxSettingsFile);
                 const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isClaudeStartupArgumentsTooLong(error))
+                    throw createClaudeStartupArgumentsTooLongError(error);
                 if (isSandboxInitializationFailure(error, stderr))
                     throw createSandboxInitializationError(error, stderr);
                 throw error;
@@ -2483,13 +2595,14 @@ export class AgentRunner {
             this.interruptFns.set(sessionId, () => sdkStream.interrupt());
         }
         // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
-        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId);
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile);
         const self = this;
         return (async function* () {
             try {
                 yield* transformed;
             }
             finally {
+                self.cleanupSandboxSettingsFile(sessionId, sandboxSettingsFile);
                 self.streamDoneResolvers.get(sessionId)?.();
                 self.streamDoneResolvers.delete(sessionId);
                 self.streamDone.delete(sessionId);
@@ -2536,6 +2649,7 @@ export class AgentRunner {
         }
         this.interruptFns.delete(sessionId);
         this.activeStreams.delete(sessionId);
+        this.cleanupSandboxSettingsFiles(sessionId);
         return { stillQueued, cancelledInputIds, closed: true };
     }
     hasActiveStream(sessionId) {
@@ -2553,6 +2667,7 @@ export class AgentRunner {
         this.activeStreams.delete(sessionId);
         this.interruptFns.delete(sessionId);
         this.activeQueries.delete(sessionId);
+        this.cleanupSandboxSettingsFiles(sessionId);
         this.recentStderr.delete(sessionId);
     }
     injectUserMessage(sessionId, text) {
@@ -2657,6 +2772,7 @@ export class AgentRunner {
         this.interruptFns.delete(sessionId);
         this.activeQueries.delete(sessionId);
         this.permissionContexts.delete(sessionId);
+        this.cleanupSandboxSettingsFiles(sessionId);
     }
     async dispose() {
         const interrupts = [...this.interruptFns.values()].map(async (interrupt) => {
@@ -2686,6 +2802,9 @@ export class AgentRunner {
         this.streamDoneResolvers.clear();
         this.permissionContexts.clear();
         this.recentStderr.clear();
+        for (const sessionId of [...this.sandboxSettingsFiles.keys()]) {
+            this.cleanupSandboxSettingsFiles(sessionId);
+        }
     }
     resolveSessionFile(agentSessionId, projectPath) {
         const encodedProjectPath = encodePath(projectPath);

package/dist/agents/codex-runner.js

@@ -13,7 +13,7 @@ import { CodexAppServerClient } from './codex-app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
-import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
+import { auditCodexApprovalDecision, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
@@ -1694,7 +1694,7 @@ export class CodexRunner {
                 logger.warn(`[CodexRunner] failed to record policy-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
             }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyResult.policyCode ?? 'session_policy_hook');
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyResult.policyCode ?? 'session_policy_hook', policyResult.reason ?? 'session policy denied approval');
             return response;
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
@@ -1703,7 +1703,7 @@ export class CodexRunner {
         if (!workspacePath) {
             logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', 'approval_workspace_unknown');
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', 'approval_workspace_unknown', 'thread workspace is unknown');
             return response;
         }
         const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
@@ -1738,7 +1738,7 @@ export class CodexRunner {
                 logger.warn(`[CodexRunner] failed to record infrastructure approval denial: session=${sessionKey} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
             }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode, message);
             return response;
         };
         if (managedEcIntent && !approvedCommand) {
@@ -1763,7 +1763,13 @@ export class CodexRunner {
                 }
             }
             const response = this.toAppServerApprovalResponse(request.method, decision, toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval') : 'approval');
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval') : 'approval', decision === 'deny' && (sessionMode === 'auto' || sessionMode === 'readonly')
+                ? 'permission_mode_denied'
+                : undefined, decision === 'deny'
+                ? (reason || (sessionMode === 'auto' || sessionMode === 'readonly'
+                    ? `permission mode ${sessionMode} denied approval`
+                    : 'user approval denied'))
+                : 'approval accepted');
             logger.info(`[CodexRunner] app-server approval response id=${request.id} method=${request.method} decision=${decision} response=${JSON.stringify(response)}`);
             return response;
         }
@@ -1773,7 +1779,21 @@ export class CodexRunner {
             throw error;
         }
     }
-    logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode) {
+    logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode, reason) {
+        const context = this.permissionContexts.get(sessionKey);
+        auditCodexApprovalDecision({
+            requestId: request.id !== undefined ? String(request.id) : undefined,
+            method: request.method,
+            sessionId: sessionKey,
+            agentAid: context?.selfAid,
+            toolName,
+            decision,
+            decisionSource,
+            policyCode,
+            permissionMode: normalizePermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode).mode,
+            role: context?.role,
+            reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
+        });
         logger.info(`[CodexRunner] app-server approval audit ${JSON.stringify({
             requestId: request.id !== undefined ? String(request.id) : undefined,
             method: request.method,
@@ -1782,6 +1802,7 @@ export class CodexRunner {
             decision,
             decisionSource,
             ...(policyCode ? { policyCode } : {}),
+            reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             executed: false,
         })}`);
     }
@@ -2200,6 +2221,7 @@ export class CodexRunner {
             // readonly decision. The map entry alone is stale if the directory was
             // replaced between preflight and the approval callback.
             managedTempDir: this.getManagedTempDir(sessionKey),
+            allowReadonlySourceDiagnostics: permCtx?.allowReadonlySourceDiagnostics === true,
         } : undefined;
         if (toolName === 'Bash')
             return checkReadonly(toolName, input, projectPath, readonlyContext);
@@ -2315,12 +2337,12 @@ export class CodexRunner {
         // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const mode = normalizePermissionMode(rawMode).mode;
-        const recordBlockedOperation = async (policyCode, operationInput = toolInput) => {
+        const recordBlockedOperation = async (policyCode, operationInput = toolInput, denialReason = 'policy denied') => {
             const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
             auditToolPreflightDenial({
                 toolName,
                 policyCode,
-                reason: 'policy denied',
+                reason: denialReason,
                 summary,
                 sessionId: sessionKey,
                 agentAid: permissionContext?.selfAid,
@@ -2364,6 +2386,7 @@ export class CodexRunner {
             userId: permissionContext?.userId,
             role: permissionContext?.role,
             permissionMode: mode,
+            allowReadonlySourceDiagnostics: permissionContext?.allowReadonlySourceDiagnostics === true,
             projectPath: operationCwd,
             workspacePath,
         });
@@ -2371,7 +2394,7 @@ export class CodexRunner {
             logger.warn(`[CodexRunner] tool preflight denied: session=${sessionKey} tool=${toolName} ` +
                 `policy=${preflight.policyCode ?? 'unknown'} reason=${preflight.message ?? 'policy denied'}`);
             if (preflight.policyCode) {
-                await recordBlockedOperation(preflight.policyCode);
+                await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied');
             }
             return 'deny';
         }
@@ -2399,7 +2422,7 @@ export class CodexRunner {
         if (mode === 'readonly') {
             const readonly = this.checkCodexReadonly(toolName, checkedInput, operationCwd, sessionKey);
             if (readonly.behavior === 'deny') {
-                await recordBlockedOperation(readonly.policyCode ?? 'readonly_mode', checkedInput);
+                await recordBlockedOperation(readonly.policyCode ?? 'readonly_mode', checkedInput, readonly.message);
                 return 'deny';
             }
             return 'allow';
@@ -2928,6 +2951,7 @@ export class CodexRunner {
                     name: 'Shell',
                     result: item.aggregatedOutput ?? '',
                     isError: item.exitCode !== null && item.exitCode !== undefined ? item.exitCode !== 0 : item.status === 'failed',
+                    ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
                 };
@@ -2939,6 +2963,7 @@ export class CodexRunner {
                     result: item.result,
                     isError: item.status === 'failed',
                     error: item.error?.message,
+                    ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
                 };
@@ -2949,6 +2974,7 @@ export class CodexRunner {
                     name: item.namespace ? `${item.namespace}:${item.tool}` : item.tool,
                     result: item.contentItems,
                     isError: item.success === false || item.status === 'failed',
+                    ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
                 };

package/dist/agents/ecagent-runner.js

@@ -924,7 +924,8 @@ export class EcagentRunner {
         if (event.type === 'tool_execution_end') {
             queue.push({
                 type: 'tool_result', name: event.toolName, result: extractToolResult(event.result),
-                isError: event.isError, error: event.isError ? extractToolResult(event.result) : undefined, callId: event.toolCallId,
+                isError: event.isError, error: event.isError ? extractToolResult(event.result) : undefined,
+                callId: event.toolCallId,
             });
             return;
         }
@@ -1006,6 +1007,7 @@ export class EcagentRunner {
             userId: permissionContext?.userId,
             role: permissionContext?.role,
             permissionMode: mode,
+            allowReadonlySourceDiagnostics: permissionContext?.allowReadonlySourceDiagnostics === true,
             projectPath,
         });
         if (preflight.behavior === 'deny') {
@@ -1020,6 +1022,7 @@ export class EcagentRunner {
         if (mode === 'readonly') {
             const decision = checkReadonly(toolName, checkedInput, projectPath, {
                 sessionId, channel: permissionContext?.channel, peerId: permissionContext?.userId, role: permissionContext?.role,
+                allowReadonlySourceDiagnostics: permissionContext?.allowReadonlySourceDiagnostics === true,
             });
             if (decision.behavior === 'deny') {
                 await recordBlockedOperation(decision.policyCode ?? 'readonly_mode', checkedInput);

package/dist/aun/msg/group.js

@@ -9,7 +9,7 @@ import { daemonTaskSendIpcTimeoutMs, resolveAunMessageEncrypt } from './p2p.js';
 import { checkGroupIndex, getGroupIndex } from './group-index.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from '../../core/message/message-log.js';
 import { chatDirPath } from '../../core/session/session-fs-store.js';
-import { readBestTaskRuntimeContext } from '../../cli/task-context.js';
+import { normalizeCodexTextPayload, readBestTaskRuntimeContext } from '../../cli/task-context.js';
 import { ipcQuery } from '../../ipc.js';
 import { resolvePaths } from '../../paths.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../../core/auth/agent-delegation.js';
@@ -151,6 +151,7 @@ export async function groupSend(args) {
     const runtimeContext = await readBestTaskRuntimeContext();
     if (args.body.mode !== 'file') {
         const payload = buildGroupPayload(args.body);
+        normalizeCodexTextPayload(payload, runtimeContext);
         applyGroupRoutingPayloadFields(payload, args, runtimeContext);
         const daemonResult = await tryDaemonGroupSend(args, payload, runtimeContext);
         if (daemonResult)
@@ -192,6 +193,7 @@ export async function groupSend(args) {
                 break;
             }
         }
+        normalizeCodexTextPayload(payload, runtimeContext);
         const payloadMentions = Object.prototype.hasOwnProperty.call(payload, 'mentions')
             ? normalizeAunMentionEntries(payload.mentions)
             : undefined;

package/dist/aun/msg/p2p.js

@@ -4,27 +4,27 @@ import { createShortConnection } from '../rpc/index.js';
 import { getAidStore, SLOT } from '../aid/store.js';
 import { uploadFileAndBuildPayload } from './upload.js';
 import { appendMessageLog, buildOutboundEntry, classifyAunPayloadForLog } from '../../core/message/message-log.js';
-import { readBestTaskRuntimeContext, runtimeRefMessageIdForMsgSend } from '../../cli/task-context.js';
+import { normalizeCodexTextPayload, readBestTaskRuntimeContext, runtimeRefMessageIdForMsgSend } from '../../cli/task-context.js';
 import { chatDirPath } from '../../core/session/session-fs-store.js';
 import { resolvePaths } from '../../paths.js';
 import { ipcQuery } from '../../ipc.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../../core/auth/agent-delegation.js';
 import { loadDaemonConfig } from '../../config-store.js';
 import { normalizeAunMentionEntries } from './mention-schema.js';
-const DEFAULT_TASK_EXECUTION_MS = 60 * 60 * 1000;
 const DAEMON_SEND_TIMEOUT_GRACE_MS = 10_000;
+const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
 const MAX_TIMER_MS = 2_147_483_647;
 export function daemonTaskSendIpcTimeoutMs(file = false) {
-    let executionMs = DEFAULT_TASK_EXECUTION_MS;
+    let idleTimeoutMs = DEFAULT_IDLE_TIMEOUT_MS;
     try {
         const config = JSON.parse(fs.readFileSync(resolvePaths().daemonConfig, 'utf8'));
-        const seconds = config.idleMonitor?.maxExecutionTime;
+        const seconds = config.idleMonitor?.timeout;
         if (typeof seconds === 'number' && Number.isFinite(seconds) && seconds > 0) {
-            executionMs = seconds * 1000;
+            idleTimeoutMs = seconds * 1000;
         }
     }
     catch { }
-    return Math.min(MAX_TIMER_MS, Math.max(file ? 120_000 : 5_000, executionMs + DAEMON_SEND_TIMEOUT_GRACE_MS));
+    return Math.min(MAX_TIMER_MS, Math.max(file ? 120_000 : 5_000, idleTimeoutMs + DAEMON_SEND_TIMEOUT_GRACE_MS));
 }
 export function resolveAunMessageEncrypt(explicit) {
     if (typeof explicit === 'boolean')
@@ -207,6 +207,7 @@ export async function msgSend(args) {
         let payload;
         if (args.body.mode !== 'file') {
             payload = buildSimplePayload(args.body);
+            normalizeCodexTextPayload(payload, runtimeContext);
             if (Object.prototype.hasOwnProperty.call(payload, 'mentions')) {
                 payload.mentions = normalizeAunMentionEntries(payload.mentions);
             }
@@ -263,6 +264,7 @@ export async function msgSend(args) {
         // 3. 构建 payload
         if (!payload) {
             payload = buildSimplePayload(args.body);
+            normalizeCodexTextPayload(payload, runtimeContext);
         }
         // 4. 写入 payload.chatmode
         payload.chatmode = chatmode;