evolcore 0.0.17 → 0.0.19

package/CHANGELOG.md

@@ -3,6 +3,57 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.19 (2026-08-27)
+
+### PowerShell EC 命令安全
+
+- 支持 PowerShell `pwsh`/`powershell` 受管命令载体解析，拒绝拼接、展开和重定向。
+- 统一 Codex EC 命令委派与预检解析，补充 PowerShell 引号、展开和错误指引。
+
+### Bootstrap 与运行时控制
+
+- Bootstrap 阶段保留 Menu 与斜杠协议处理，普通模型任务继续按生命周期门禁。
+- 命令意外泄漏至响应引擎时统一丢弃并记录失败审计，避免进入 Agent 执行。
+
+### 跨平台安装与诊断
+
+- Windows 数据迁移固定调用系统 `bsdtar`，避免 Git Bash GNU tar 误解析 Windows 绝对路径。
+- Linux 安装器幂等创建真实 `/etc/codex` 目录，拒绝同名文件和符号链接。
+- 统一数据根解析，仅使用 `EVOLCORE_HOME` 或 `~/.evolcore`，避免因启动目录不同误用数据目录。
+- `ec start` 已运行提示新增 Daemon 持续运行时长，并支持 IPC uptime 回退探测。
+
+## 0.0.18 (2026-08-27)
+
+### DaemonOwner 与受管 Agent 操作
+
+- 新增 `daemon-owner` 进程角色，仅由 `daemon.json.owners` 的控制 AID 解析。
+- 进程操作、跨 Agent Trigger 与内部 Trigger 目录统一要求 DaemonOwner。
+- Agent channel 保持仅能操作自身；拒绝结果附带原因码与下一步指引。
+- 受管任务通过委派 IPC 执行授权的 `ec agent` 查询、非交互创建和生命周期操作。
+
+### 任务暂停与 Bootstrap 门禁
+
+- 新增 `/pause`、`/resume`，在下一次工具调用前暂停或恢复当前任务。
+- Codex、Claude 与 ecagent 的工具边界均接入暂停门禁；任务结束自动解除。
+- Agent 仅在 `active`、`bootstrapping` 生命周期运行，不再回退默认 Runner。
+- Bootstrap 隔离普通任务与上下文，仅允许受限的 `agent.md` 确认、发布和 ready。
+- 首次欢迎消息按实际私聊或群聊路由持久化投递。
+
+### AUN 投递与连接可靠性
+
+- 群消息恢复支持有界多页补拉，避免尾部同步后遗留大积压。
+- 适配新版 AUN 连接状态事件，隔离旧客户端事件并记录传输/入站时间。
+- 受管沙箱发送 AUN 消息改经配置存储读取超时和默认加密设置。
+
+### 审计、安全与跨平台运行
+
+- 菜单响应新增 `processing_ms` 与独立的协议业务流日志。
+- 工具与授权审计新增生命周期键、执行状态和敏感参数脱敏。
+- 统一 Codex 受管 `PreToolUse` Hook，强化 Bubblewrap 挂载与失败熔断诊断。
+- 原子写入保留正式文件并刷新热备，避免受保护状态挂载竞态。
+- `ec stop`、`ec restart` 优先经 IPC 请求守护进程优雅退出并校验 PID。
+- Windows 自启增加计划任务校验、用户级 Run 回退和非 EvolCore 配置保护。
+
 ## 0.0.17 (2026-08-25)
 
 ### Claude 与任务边界

package/bin/codex-managed-hook.mjs

@@ -1,7 +1,10 @@
 import fs from 'node:fs';
 import net from 'node:net';
 
-const timeoutMs = 1500;
+// Only bound socket establishment. Once connected, the official Codex hook
+// timeout owns the lifetime of this process; an application timeout here would
+// turn /pause into a denial/allow race.
+const connectTimeoutMs = 1500;
 
 function deny(reason) {
   process.stdout.write(JSON.stringify({
@@ -11,9 +14,8 @@ function deny(reason) {
       permissionDecisionReason: reason || 'EvolCore policy denied this tool call.',
     },
   }));
-  // Codex 0.147 app-server runs this managed hook but does not reliably honor
-  // the JSON denial alone for thread/shellCommand. Exit 2 is the documented
-  // blocking transport; retain the JSON shape for compatible hook consumers.
+  // Exit 2 is the documented blocking transport. Keep the structured JSON as
+  // well so Codex can surface the policy reason through the PreToolUse result.
   process.stderr.write(`${reason || 'EvolCore policy denied this tool call.'}\n`);
   process.exitCode = 2;
 }
@@ -24,6 +26,7 @@ function queryDaemon(socketPath, payload) {
     let buffer = '';
     let settled = false;
     let timer;
+    let connected = false;
     const finish = value => {
       if (settled) return;
       settled = true;
@@ -31,10 +34,16 @@ function queryDaemon(socketPath, payload) {
       socket.destroy();
       resolve(value);
     };
-    timer = setTimeout(() => finish(null), timeoutMs);
+    timer = setTimeout(() => {
+      if (!connected) finish(null);
+    }, connectTimeoutMs);
     timer.unref?.();
     socket.once('error', () => finish(null));
-    socket.once('connect', () => socket.write(JSON.stringify(payload) + '\n'));
+    socket.once('connect', () => {
+      connected = true;
+      clearTimeout(timer);
+      socket.write(JSON.stringify(payload) + '\n');
+    });
     socket.on('data', chunk => {
       buffer += String(chunk);
       const index = buffer.indexOf('\n');
@@ -69,7 +78,7 @@ async function main() {
   const result = await queryDaemon(socketPath, {
     type: 'codex-pre-tool-use',
     threadId: input.session_id,
-    toolName: typeof input.tool_name === 'string' ? input.tool_name : '',
+    toolName: input.tool_name,
     toolInput: input.tool_input ?? null,
   });
   if (!result) {

package/bin/install-codex-managed-hooks.mjs

@@ -151,7 +151,7 @@ function main() {
   const targetDirectory = argument('--managed-dir')
     || path.join(path.dirname(requirements), 'EvolCore', 'hooks');
   const sourceHook = path.join(packageRoot, 'bin', 'codex-managed-hook.mjs');
-  if (!fs.statSync(sourceHook).isFile()) fail(`Managed hook source was not found: ${sourceHook}`);
+  if (!fs.existsSync(sourceHook) || !fs.statSync(sourceHook).isFile()) fail(`Codex PreToolUse hook source was not found: ${sourceHook}`);
 
   fs.mkdirSync(targetDirectory, { recursive: true, mode: 0o700 });
   const hookPath = path.join(targetDirectory, 'pre-tool-use.mjs');
@@ -180,7 +180,9 @@ function main() {
     'type = "command"',
     `command = ${tomlString(command)}`,
     `command_windows = ${tomlString(command)}`,
-    'timeout = 3',
+    // Intentionally omit timeout: Codex applies its documented 600-second
+    // default for synchronous PreToolUse hooks. The application pause gate
+    // itself has no timeout; Codex remains the outer infrastructure ceiling.
     'statusMessage = "Checking EvolCore session policy"',
     markerEnd,
     '',

package/dist/agents/claude-runner.js

@@ -23,9 +23,9 @@ import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
 import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/protected-paths.js';
-import { buildHClassGuardCommand, createSandboxInitializationError, isSandboxInitializationFailure, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, recordSandboxInitializationFailure, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
-import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
+import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { isManagedSessionRuntimeDir } from '../cli/task-context.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
@@ -626,6 +626,40 @@ export class AgentRunner {
     /** 每个 session 最近的子进程 stderr 行（环形缓冲），用于子进程崩溃时还原真正原因 */
     recentStderr = new Map();
     static STDERR_BUFFER_MAX = 80;
+    async recordSandboxInfrastructureFailure(sessionId, inputId, permissionMode, error, stderr = []) {
+        const detail = createSandboxInitializationError(error, stderr);
+        const circuit = recordSandboxInitializationFailure(detail, stderr);
+        const context = this.permissionContexts.get(sessionId);
+        auditToolInfrastructureFailure({
+            toolName: 'Bash',
+            policyCode: SANDBOX_INITIALIZATION_FAILED,
+            reason: detail.message.slice(0, 512),
+            sessionId,
+            agentAid: context?.selfAid,
+            permissionMode,
+            role: context?.role,
+            callId: inputId,
+            taskId: context?.taskId,
+            occurrences: circuit.occurrences,
+        });
+        await context?.recordExecutionAnomaly?.({
+            code: 'capability_unavailable',
+            severity: 'warning',
+            phase: 'execution',
+            occurredAt: Date.now(),
+            correlationId: inputId,
+            requestId: inputId,
+            sessionId,
+            toolName: 'Bash',
+            policyCode: SANDBOX_INITIALIZATION_FAILED,
+            decisionSource: 'infrastructure',
+            agentAid: context?.selfAid,
+            permissionMode: permissionMode,
+            summary: detail.message.slice(0, 512),
+            effect: 'operation_skipped',
+        });
+        return { detail, occurrences: circuit.occurrences };
+    }
     trackSandboxSettingsFile(sessionId, filePath) {
         const files = this.sandboxSettingsFiles.get(sessionId) ?? new Set();
         files.add(filePath);
@@ -1407,7 +1441,7 @@ export class AgentRunner {
      * SDK 原始事件 → 标准 AgentEvent 转换
      * 所有 SDK 特有的事件类型引用封装在此方法内
      */
-    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile) {
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode) {
         let lastSessionId;
         let hasTurnActivity = false;
         let ignoredPreTurnResult = false;
@@ -1851,19 +1885,7 @@ export class AgentRunner {
                 return;
             }
             if (isSandboxInitializationFailure(err, buf ?? [])) {
-                const detail = createSandboxInitializationError(err, buf ?? []);
-                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
-                    code: 'capability_unavailable',
-                    severity: 'warning',
-                    phase: 'execution',
-                    occurredAt: Date.now(),
-                    toolName: 'Bash',
-                    policyCode: SANDBOX_INITIALIZATION_FAILED,
-                    decisionSource: 'infrastructure',
-                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
-                    summary: detail.message.slice(0, 512),
-                    effect: 'operation_skipped',
-                });
+                const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, inputId, permissionMode, err, buf ?? []);
                 yield {
                     type: 'complete',
                     isError: true,
@@ -1955,6 +1977,57 @@ export class AgentRunner {
         const callPermissionMode = normalizedPermission.mode;
         const runPermissionContext = this.permissionContexts.get(sessionId);
         const executionSandbox = resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
+        const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
+        if (executionSandbox.state !== 'off') {
+            const activeSandboxFailure = getActiveSandboxInitializationFailure();
+            if (activeSandboxFailure) {
+                const detail = createSandboxInitializationError(new Error(`sandbox bootstrap circuit open; firstObservedAt=${activeSandboxFailure.openedAt} ` +
+                    `occurrences=${activeSandboxFailure.occurrences}; ${activeSandboxFailure.detail}`));
+                const context = this.permissionContexts.get(sessionId);
+                auditToolInfrastructureFailure({
+                    toolName: 'Bash',
+                    policyCode: SANDBOX_INITIALIZATION_FAILED,
+                    reason: detail.message.slice(0, 512),
+                    sessionId,
+                    agentAid: context?.selfAid,
+                    permissionMode: callPermissionMode,
+                    role: context?.role,
+                    callId: inputId,
+                    taskId: context?.taskId,
+                    occurrences: activeSandboxFailure.occurrences,
+                });
+                await context?.recordExecutionAnomaly?.({
+                    code: 'capability_unavailable',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    correlationId: inputId,
+                    requestId: inputId,
+                    sessionId,
+                    toolName: 'Bash',
+                    policyCode: SANDBOX_INITIALIZATION_FAILED,
+                    decisionSource: 'infrastructure',
+                    agentAid: context?.selfAid,
+                    permissionMode: callPermissionMode,
+                    summary: detail.message.slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+                if (shouldLogSandboxCircuitNotice()) {
+                    logger.warn(`[ClaudeSandbox] bootstrap circuit open; skipping subprocess spawn ` +
+                        `cooldownMs=${SANDBOX_INITIALIZATION_COOLDOWN_MS} occurrences=${activeSandboxFailure.occurrences}`);
+                }
+                return (async function* () {
+                    yield {
+                        type: 'complete',
+                        isError: true,
+                        subtype: 'infrastructure',
+                        terminalReason: SANDBOX_INITIALIZATION_FAILED,
+                        errors: [detail.message],
+                        queryFinal: true,
+                    };
+                })();
+            }
+        }
         const permissionPrompt = runPermissionContext?.sendPrompt ?? this.sendPromptFn;
         const permissionContext = (signal) => {
             const context = this.permissionContexts.get(sessionId);
@@ -2013,7 +2086,14 @@ export class AgentRunner {
         // random one-shot payload from a validated output wrapper.
         const trustedSafeOutputCommands = new Set();
         // PreToolUse Hook - 黑名单检查 + input 修正（不可绕过，所有模式都走）
-        const preToolUseHook = async (input) => {
+        const preToolUseHook = async (input, _toolUseId, hookOptions) => {
+            const pauseController = this.permissionContexts.get(sessionId)?.pauseController;
+            if (pauseController) {
+                const pauseResult = await pauseController.waitAtToolBoundary(hookOptions?.signal);
+                if (pauseResult === 'cancelled') {
+                    return hookDecision('deny', '工具调用已取消');
+                }
+            }
             const toolName = input.tool_name;
             const originalInput = (input.tool_input || {});
             let toolInput = originalInput;
@@ -2358,6 +2438,10 @@ export class AgentRunner {
                     role: runPermissionContext?.role,
                 });
                 const runtimeWritePaths = trustedRuntimeWritePaths(runtimeEnv);
+                const bootstrapWritePaths = modelOverride?.bootstrapAgentMdPath
+                    ? [path.resolve(modelOverride.bootstrapAgentMdPath)]
+                    : [];
+                const allowedWritePaths = [...new Set([...runtimeWritePaths, ...bootstrapWritePaths])];
                 await assertClaudeSettingSourcesHaveLiteralSandboxPaths(projectPath, [...settingSources], managedSettings);
                 const sandboxProjectionDurationMs = Date.now() - sandboxProjectionStartedAt;
                 if (sandboxProjectionDurationMs > 2_000) {
@@ -2376,7 +2460,7 @@ export class AgentRunner {
                     },
                     filesystem: {
                         ...sandboxFilesystem,
-                        ...(runtimeWritePaths.length > 0 ? { allowWrite: runtimeWritePaths } : {}),
+                        ...(allowedWritePaths.length > 0 ? { allowWrite: allowedWritePaths } : {}),
                     },
                 };
             })();
@@ -2552,7 +2636,6 @@ export class AgentRunner {
         }
         let sdkStream;
         const msgStream = new MessageStream();
-        const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
         if (images && images.length > 0) {
             logger.info('[AgentRunner] Creating query with images:', images.length, 'first image size:', images[0]?.data?.length ?? 0);
             logger.debug('[AgentRunner] Skipping resume for image message to avoid history conflict');
@@ -2565,8 +2648,10 @@ export class AgentRunner {
                 const stderr = this.recentStderr.get(sessionId) ?? [];
                 if (isClaudeStartupArgumentsTooLong(error))
                     throw createClaudeStartupArgumentsTooLongError(error);
-                if (isSandboxInitializationFailure(error, stderr))
-                    throw createSandboxInitializationError(error, stderr);
+                if (isSandboxInitializationFailure(error, stderr)) {
+                    const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, inputId, callPermissionMode, error, stderr);
+                    throw detail;
+                }
                 throw error;
             }
         }
@@ -2581,8 +2666,10 @@ export class AgentRunner {
                 const stderr = this.recentStderr.get(sessionId) ?? [];
                 if (isClaudeStartupArgumentsTooLong(error))
                     throw createClaudeStartupArgumentsTooLongError(error);
-                if (isSandboxInitializationFailure(error, stderr))
-                    throw createSandboxInitializationError(error, stderr);
+                if (isSandboxInitializationFailure(error, stderr)) {
+                    const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, inputId, callPermissionMode, error, stderr);
+                    throw detail;
+                }
                 throw error;
             }
         }
@@ -2595,7 +2682,7 @@ export class AgentRunner {
             this.interruptFns.set(sessionId, () => sdkStream.interrupt());
         }
         // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
-        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile);
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode);
         const self = this;
         return (async function* () {
             try {
@@ -2611,6 +2698,7 @@ export class AgentRunner {
         })();
     }
     async interrupt(sessionId) {
+        this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const streamRegistered = this.activeStreams.has(sessionId);
         const fn = this.interruptFns.get(sessionId);
         const query = this.activeQueries.get(sessionId);
@@ -2764,6 +2852,7 @@ export class AgentRunner {
         }
     }
     async closeSession(sessionId) {
+        this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const query = this.activeQueries.get(sessionId);
         if (query && typeof query.close === 'function')
             query.close();

package/dist/agents/codex-app-server-client.js

@@ -475,6 +475,8 @@ export class CodexAppServerClient {
             fs.chmodSync(directory, 0o700);
             const hookPath = path.join(directory, 'pre-tool-use.mjs');
             const sourcePath = path.join(getPackageRoot(), 'bin', 'codex-managed-hook.mjs');
+            if (!fs.existsSync(sourcePath))
+                throw new Error('Codex PreToolUse hook source is unavailable');
             fs.copyFileSync(sourcePath, hookPath, fs.constants.COPYFILE_EXCL);
             fs.chmodSync(hookPath, 0o500);
             const command = `${this.shellQuote(process.execPath)} ${this.shellQuote(hookPath)} ${this.shellQuote(resolvePaths().instanceSocket)}`;
@@ -494,7 +496,10 @@ export class CodexAppServerClient {
                 '[[hooks.PreToolUse.hooks]]',
                 'type = "command"',
                 `command = ${JSON.stringify(command)}`,
-                'timeout = 3',
+                // Intentionally omit timeout: Codex applies its documented 600-second
+                // default for synchronous PreToolUse hooks. The application pause
+                // gate itself has no timeout; Codex remains the outer infrastructure
+                // ceiling.
                 'statusMessage = "Checking EvolCore session policy"',
                 '',
             ].join('\n'), { mode: 0o400, flag: 'wx' });

package/dist/agents/codex-runner.js

@@ -20,7 +20,7 @@ import { buildEnvelope, sendInteractionPayload } from '../core/message/message-u
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
 import { ensureProcessManagedTempDir } from '../cli/task-context.js';
@@ -316,18 +316,20 @@ export class CodexRunner {
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommandArgv(command, managedTempDir) {
-        const classification = classifyEvolcoreShellCommand(command);
+    approvedLiteralEvolcoreCommandArgv(command, managedTempDir, dialect = 'posix') {
+        const parseOptions = {
+            allowManagedTmpDir: true,
+            dialect,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        };
+        const classification = classifyEvolcoreShellCommand(command, parseOptions);
         if (classification.kind === 'bounded-output')
             return classification.command.argv;
         if (classification.kind !== 'literal')
             return undefined;
         // Keep the approval/delegation parser aligned with the preflight parser:
         // the session-managed `$TMPDIR` token is a permitted EC path reference.
-        const argv = parseLiteralShellArgv(command, {
-            allowManagedTmpDir: true,
-            ...(managedTempDir ? { managedTempDir } : {}),
-        });
+        const argv = parseLiteralShellArgv(command, parseOptions);
         if (argv && containsLiteralManagedTmpDirOutsideSendContent(argv))
             return undefined;
         return argv?.[0] === 'ec' ? argv : undefined;
@@ -343,11 +345,11 @@ export class CodexRunner {
                 ? undefined
                 : explicitArgv;
         }
-        const explicitWrappedCommand = explicitArgv
-            ? unwrapCodexShellCommandArgv(explicitArgv)
+        const explicitCarrier = explicitArgv
+            ? resolveCodexShellCarrierArgv(explicitArgv)
             : undefined;
-        if (explicitWrappedCommand !== undefined) {
-            return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand, managedTempDir);
+        if (explicitCarrier !== undefined) {
+            return this.approvedLiteralEvolcoreCommandArgv(explicitCarrier.command, managedTempDir, explicitCarrier.dialect);
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         const directArgv = this.approvedLiteralEvolcoreCommandArgv(command, managedTempDir);
@@ -357,12 +359,12 @@ export class CodexRunner {
             allowManagedTmpDir: true,
             ...(managedTempDir ? { managedTempDir } : {}),
         });
-        const wrappedCommand = wrappedArgv
-            ? unwrapCodexShellCommandArgv(wrappedArgv)
+        const shellCarrier = wrappedArgv
+            ? resolveCodexShellCarrierArgv(wrappedArgv)
             : undefined;
-        return wrappedCommand === undefined
+        return shellCarrier === undefined
             ? undefined
-            : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand, managedTempDir);
+            : this.approvedLiteralEvolcoreCommandArgv(shellCarrier.command, managedTempDir, shellCarrier.dialect);
     }
     isManagedEvolcoreCommandIntent(toolInput) {
         if (Array.isArray(toolInput.commandArgv)) {
@@ -371,9 +373,11 @@ export class CodexRunner {
                 return true;
             if (!rawArgv.every(value => typeof value === 'string'))
                 return false;
-            const wrappedCommand = unwrapCodexShellCommandArgv(rawArgv);
-            return wrappedCommand !== undefined
-                && classifyEvolcoreShellCommand(wrappedCommand).kind !== 'none';
+            const shellCarrier = resolveCodexShellCarrierArgv(rawArgv);
+            return shellCarrier !== undefined
+                && classifyEvolcoreShellCommand(shellCarrier.command, {
+                    dialect: shellCarrier.dialect,
+                }).kind !== 'none';
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         return classifyEvolcoreShellCommand(command).kind !== 'none';
@@ -795,7 +799,7 @@ export class CodexRunner {
         }
         return Object.fromEntries([...paths].map(candidate => [candidate, 'write']));
     }
-    buildPermissionProfileConfig(sessionId, mode, projectPath) {
+    buildPermissionProfileConfig(sessionId, mode, projectPath, bootstrapAgentMdPath) {
         const profileName = this.permissionProfileName(sessionId);
         const managedTempDir = this.ensureSessionTempDir(sessionId);
         const network = {
@@ -812,6 +816,9 @@ export class CodexRunner {
                             denyLClassRead: mode === 'readonly',
                         }),
                         ...this.resolveGitMetadataWriteRules(projectPath, mode),
+                        ...(bootstrapAgentMdPath ? {
+                            [path.resolve(bootstrapAgentMdPath)]: mode === 'readonly' ? 'read' : 'write',
+                        } : {}),
                         ...(mode !== 'readonly' && managedTempDir ? {
                             [managedTempDir]: 'write',
                             [path.join(managedTempDir, '**')]: 'write',
@@ -824,12 +831,12 @@ export class CodexRunner {
             },
         };
     }
-    buildExecutionSandboxOptions(sessionId, mode, projectPath) {
+    buildExecutionSandboxOptions(sessionId, mode, projectPath, bootstrapAgentMdPath) {
         const decision = resolvePhaseOneExecutionSandbox(mode, this.permissionContexts.get(sessionId)?.role);
         return {
             decision,
             permissionProfileConfig: decision.state === 'active'
-                ? this.buildPermissionProfileConfig(sessionId, decision.permissionMode, projectPath)
+                ? this.buildPermissionProfileConfig(sessionId, decision.permissionMode, projectPath, bootstrapAgentMdPath)
                 : undefined,
             sandbox: decision.state === 'off' ? 'danger-full-access' : undefined,
         };
@@ -837,7 +844,11 @@ export class CodexRunner {
     buildLifecycleLockdownConfig() {
         return {
             features: {
-                hooks: false,
+                // The app-server is launched with allow_managed_hooks_only=true, so
+                // enabling the feature exposes only EvolCore's requirements-managed
+                // PreToolUse hook. Disabling it here suppresses that managed hook too
+                // and bypasses the pause/proactive policy boundary entirely.
+                hooks: true,
             },
         };
     }
@@ -867,7 +878,7 @@ export class CodexRunner {
             throw new Error('Codex proactive managed PreToolUse enforcement requires Linux or an installed Windows managed hook');
         }
     }
-    async evaluatePreToolUse(threadId, toolName, toolInput) {
+    async evaluatePreToolUse(threadId, toolName, toolInput, signal) {
         const sessionKey = this.findSessionKeyByThread(threadId);
         const activeThread = this.activeSessions.get(sessionKey);
         const context = this.permissionContexts.get(sessionKey);
@@ -878,6 +889,12 @@ export class CodexRunner {
         if (!context || (proactiveSession && !context.preToolUsePolicyHook)) {
             return { ok: false, applicable: true, decision: 'deny', reason: 'EvolCore proactive session policy context is unavailable' };
         }
+        if (context.pauseController) {
+            const pauseResult = await context.pauseController.waitAtToolBoundary(signal);
+            if (pauseResult === 'cancelled') {
+                return { ok: true, applicable: true, decision: 'deny', reason: '工具调用已取消' };
+            }
+        }
         // A tracked interactive thread still needs an authenticated, explicit
         // allow so the managed hook can fail closed when no runner matches.
         if (!context.preToolUsePolicyHook)
@@ -1044,7 +1061,7 @@ export class CodexRunner {
         const callMode = normalizedPermission.mode;
         this.chatModes.set(sessionId, callMode);
         const callApprovalPolicy = this.toApprovalPolicy(callMode);
-        const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath);
+        const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath);
         const appServer = this.getAppServerClient();
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
@@ -1203,6 +1220,7 @@ export class CodexRunner {
     }
     // ── Interrupt ──
     async interrupt(sessionKey) {
+        this.permissionContexts.get(sessionKey)?.pauseController?.cancel();
         const controller = this.activeAbortControllers.get(sessionKey);
         const activeTurn = this.activeTurns.get(sessionKey);
         const hadActiveState = !!controller || !!activeTurn || this.activeStreams.has(sessionKey);
@@ -1265,6 +1283,7 @@ export class CodexRunner {
         this.onSessionIdUpdate?.(sessionId, agentSessionId);
     }
     async closeSession(sessionId) {
+        this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const threadId = this.activeSessions.get(sessionId);
         this.activeSessions.delete(sessionId);
         this.activeStreams.delete(sessionId);