evolcore 0.0.19 → 0.0.21

package/dist/core/message/response-engine.js

@@ -33,6 +33,7 @@ import { eligibleFallbackModels } from '../model/model-fallback.js';
 import { RetryScheduler } from './retry-scheduler.js';
 import { constrainRuntimePermissionMode, resolveRuntimeStringField } from '../role/runtime-policy.js';
 import { resolveEffective, resolveEffectiveFieldWithSource } from '../../config/config-manager.js';
+import { resolveAgentLifecycle } from '../../config/lifecycle.js';
 import { authorizationConfigRevision, checkRoleAccess, getFirstStaticAgentOwner, listStaticAgentAdmins, listStaticAgentOwners, resolvePeerRoleDetail, roleToSessionIdentity, } from '../../config/peer-role-resolver.js';
 import { insertUsageEvent, insertContextBreakdown, insertModelCalls } from '../../stats/writer.js';
 import { normalizeUsage } from '../../stats/normalizer.js';
@@ -47,7 +48,17 @@ import { deriveSessionTitle, shouldAutoFillSessionTitle } from '../session/sessi
 import { SessionTurnCoordinator } from '../session/session-turn-coordinator.js';
 import { recordTriggerExecutionAnomaly } from '../../trigger/anomaly-store.js';
 import { classifyToolErrorCode } from '../permission/tool-error-code.js';
+import { normalizeExecutionPermissionMode } from '../permission/mode.js';
 import { buildToolLifecycleEventKey } from '../audit/event-key.js';
+import { isFullAccessEnabled, loadDaemonConfig } from '../../config-store.js';
+import { auditFullAccessEvent } from '../auth/authorization-audit.js';
+const INBOUND_MESSAGE_LOG_TEXT_MAX_LENGTH = 240;
+export function formatInboundMessageLogText(text) {
+    const singleLine = text.replace(/\s+/gu, ' ').trim();
+    if (singleLine.length <= INBOUND_MESSAGE_LOG_TEXT_MAX_LENGTH)
+        return singleLine;
+    return singleLine.slice(0, INBOUND_MESSAGE_LOG_TEXT_MAX_LENGTH - 3).trimEnd() + '...';
+}
 export class PauseController {
     state = 'running';
     waiters = new Set();
@@ -504,6 +515,7 @@ export class ResponseEngine {
     /** sessionId → 尚未收到 runner:task-notification 的子任务。 */
     activeRunnerTasks = new Map();
     triggerTerminalMessages = new WeakSet();
+    fullAccessTerminalMessages = new WeakSet();
     agentDelegationRegistry;
     turnCoordinator;
     /** 响应模式协调器（插件化机制中枢）。内置模式在构造时注册。 */
@@ -987,7 +999,8 @@ export class ResponseEngine {
         const active = this.activeRenderers.get(sessionId);
         if (!active || active.suppressActivities)
             return;
-        void this.emitOperationalNotice(active.renderer, '\u23f3 会话压缩中...', 'info', 'compact-start');
+        void this.emitOperationalNotice(active.renderer, '\u23f3 会话压缩中...', 'info', 'compact-start')
+            .catch(error => logger.warn(`[ResponseEngine] compact-start notice send failed: ${error instanceof Error ? error.message : String(error)}`));
     }
     async emitOperationalNotice(renderer, text, severity, subtype) {
         if (await renderer.sendOperationalNoticeAsText(text))
@@ -1005,10 +1018,28 @@ export class ResponseEngine {
         return true;
     }
     async retryAfterContextRecovery(prompt, opts) {
-        const { streamKey, renderer, agent, session, absoluteProjectPath, effectiveSystemPrompt, modelOverride, runtimeEnv, resetTimer, shouldSuppress, proactive, turnLease, } = opts;
+        const { streamKey, renderer, agent, session, absoluteProjectPath, effectiveSystemPrompt, modelOverride, runtimeEnv, resetTimer, shouldSuppress, proactive, turnLease, beforeRunQuery, } = opts;
         if (!session.agentSessionId || !canCompactAgent(agent)) {
             throw new Error('CONTEXT_COMPACT_FAILED');
         }
+        // A topic may have discovered and activated its first backend earlier in
+        // this logical turn. The Session event is authoritative at that point,
+        // while the original override can still describe the pre-run UNBOUND
+        // snapshot. Compact and retry must address the accepted backend under the
+        // same complete TurnLease or a runner could create a second backend.
+        const recoveryModelOverride = session.threadId
+            ? {
+                ...(modelOverride || {}),
+                backend: { kind: 'topic', agentSessionId: session.agentSessionId },
+                turn: {
+                    sessionId: turnLease.sessionId,
+                    taskId: turnLease.taskId,
+                    turnId: turnLease.turnId,
+                    generation: turnLease.generation,
+                    inputId: turnLease.inputId,
+                },
+            }
+            : modelOverride;
         // text event 在进入 renderer 前已经剔除了上下文超限错误行。保留缓冲中的
         // 有效正文，由 sendOperationalNoticeAsText 先 flush，避免恢复过程丢失已有模型输出。
         await this.emitOperationalNotice(renderer, '上下文过长，正在压缩会话...', 'warn', 'compact-trigger');
@@ -1016,15 +1047,17 @@ export class ResponseEngine {
         this.announcedCompactStarts.add(session.id);
         let compacted;
         try {
-            compacted = await agent.compact(session.id, session.agentSessionId, absoluteProjectPath);
+            compacted = await agent.compact(session.id, session.agentSessionId, absoluteProjectPath, recoveryModelOverride);
         }
         finally {
             this.announcedCompactStarts.delete(session.id);
         }
-        if (compacted) {
+        const compactResult = compacted;
+        if (compactResult === true || compactResult?.ok === true) {
             await this.emitOperationalNotice(renderer, '✅ 压缩完成，继续处理...', 'info', 'compact-retry');
             await renderer.flush();
-            const retryStream = await agent.runQuery(session.id, prompt, absoluteProjectPath, session.agentSessionId, undefined, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
+            beforeRunQuery?.();
+            const retryStream = await agent.runQuery(session.id, prompt, absoluteProjectPath, session.agentSessionId, undefined, effectiveSystemPrompt, this.sessionManager, recoveryModelOverride, runtimeEnv);
             if (await this.cancelStaleRunnerStart(agent, session.id, streamKey, turnLease, turnLease.taskId)) {
                 throw new Error('RUNNER_START_SUPERSEDED');
             }
@@ -1032,9 +1065,9 @@ export class ResponseEngine {
             return await this.processEventStream(retryStream, session, agent, renderer, resetTimer, shouldSuppress, proactive, undefined, // 重试分支不调插件钩子
             undefined, turnLease, opts.permissionMode, opts.proactiveSelfAid);
         }
-        // Dropping the whole session hides the root cause and can replay side
-        // effects in unattended trigger tasks. Surface an actionable failure
-        // instead; callers may explicitly start a fresh task if that is desired.
+        if (compactResult && typeof compactResult === 'object' && compactResult.message) {
+            logger.warn(`[ResponseEngine] Context compact failed: ${compactResult.message}`);
+        }
         throw new Error('CONTEXT_COMPACT_FAILED');
     }
     async recoverFromContextLimit(initialResult, opts) {
@@ -1074,6 +1107,61 @@ export class ResponseEngine {
             && message.source === 'trigger'
             && !!message.triggerMeta?.triggerId;
     }
+    /**
+     * A fullaccess Trigger may run with no current relation access for its
+     * origin actor, but only after the daemon gate and persisted owner
+     * provenance still validate. This is intentionally stricter than merely
+     * checking the message's requested permission mode.
+     */
+    isCurrentFullAccessTrigger(message) {
+        const trigger = message.triggerMeta;
+        if (message.source !== 'trigger'
+            || trigger?.permissionModeOverride !== 'fullaccess'
+            || typeof trigger.authorizedBy !== 'string' || !trigger.authorizedBy
+            || typeof trigger.triggerId !== 'string' || !trigger.triggerId
+            || typeof trigger.runId !== 'string' || !trigger.runId
+            || typeof trigger.attemptId !== 'string' || !trigger.attemptId) {
+            return false;
+        }
+        try {
+            return isFullAccessEnabled()
+                && new Set(loadDaemonConfig().owners ?? []).has(trigger.authorizedBy);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * The authorization envelope is immutable for one logical run, but the
+     * daemon gate, approving owner, and runner profile are live policy. Check
+     * them immediately before every Runner invocation, including retries.
+     */
+    assertCurrentFullAccessExecutionAuthorization(authorization, agent) {
+        if (authorization.permissionMode !== 'fullaccess'
+            || authorization.processRole !== 'fullaccess-run'
+            || authorization.dataScope !== 'daemon'
+            || typeof authorization.authorizedBy !== 'string'
+            || !authorization.authorizedBy) {
+            throw new Error('fullaccess execution authorization is missing or malformed');
+        }
+        if (authorization.source === 'trigger'
+            && (!authorization.triggerId || !authorization.runId || !authorization.attemptId)) {
+            throw new Error('fullaccess Trigger authorization lacks scheduler identity or approval provenance');
+        }
+        if (authorization.source !== 'fullaccess-command' && authorization.source !== 'trigger') {
+            throw new Error('fullaccess execution authorization has an unsupported source');
+        }
+        if (!isFullAccessEnabled()) {
+            throw new Error('fullaccess execution is disabled by daemon.json');
+        }
+        const currentOwners = new Set(loadDaemonConfig().owners ?? []);
+        if (!currentOwners.has(authorization.authorizedBy)) {
+            throw new Error('fullaccess execution authorization is no longer owned');
+        }
+        if (agent.capabilities?.fullaccess !== true) {
+            throw new Error(`baseagent ${agent.name} does not provide a complete fullaccess execution profile`);
+        }
+    }
     resolveTriggerExecutionIdentity(message, selfAid) {
         if (message.source !== 'trigger' || !message.triggerMeta?.triggerId)
             return undefined;
@@ -1241,7 +1329,7 @@ export class ResponseEngine {
     static COMMAND_PREFIXES = [
         '/new', '/pwd', '/help', '/status', '/restart',
         '/model', '/effort', '/agent', '/slist', '/session', '/rename', '/repair', '/fork',
-        '/stop', '/pause', '/resume', '/clear', '/compact', '/del', '/perm', '/file', '/check',
+        '/stop', '/pause', '/resume', '/clear', '/compact', '/renew', '/del', '/perm', '/file', '/check',
         '/s ', '/name ', '/rewind', '/rw', '/rw ', '/activity', '/observable', '/chatmode',
         '/aid', '/upgrade', '/evolagent',
     ];
@@ -1254,6 +1342,39 @@ export class ResponseEngine {
      * 处理消息（主入口）
      */
     async processMessage(message) {
+        const fallbackFullAccessAudit = this.resolveFullAccessAuditCandidate(message);
+        let outerFailureReason;
+        try {
+            await this.processMessageWithMonitors(message);
+        }
+        catch (error) {
+            outerFailureReason = error instanceof Error ? error.message : String(error);
+            throw error;
+        }
+        finally {
+            if (fallbackFullAccessAudit && !this.fullAccessTerminalMessages.has(message)) {
+                auditFullAccessEvent({
+                    event: fallbackFullAccessAudit.authorization.source === 'trigger'
+                        ? 'fullaccess.trigger.execution.ended'
+                        : 'fullaccess.execution.ended',
+                    source: fallbackFullAccessAudit.authorization.source,
+                    actorId: fallbackFullAccessAudit.authorization.authorizedBy,
+                    processRole: fallbackFullAccessAudit.processRole,
+                    agentAid: message.selfAID,
+                    messageId: message.messageId,
+                    triggerId: fallbackFullAccessAudit.authorization.triggerId,
+                    runId: fallbackFullAccessAudit.authorization.runId,
+                    attemptId: fallbackFullAccessAudit.authorization.attemptId,
+                    result: 'blocked',
+                    reason: outerFailureReason ?? 'fullaccess execution stopped before permission setup',
+                    executed: false,
+                    executionState: 'blocked',
+                });
+                this.fullAccessTerminalMessages.add(message);
+            }
+        }
+    }
+    async processMessageWithMonitors(message) {
         const idleMs = (this.globalSettings.idleMonitor?.timeout ?? 120) * 1000;
         const totalExecutionMs = this.totalExecutionLimitMs();
         if (message.handoffDelivery
@@ -1317,7 +1438,15 @@ export class ResponseEngine {
         // ── 角色访问控制检查：读取该用户角色的 allowAccess 配置，false 则拦截并回复权限不足 ──
         const userRole = session.identity?.role || 'none';
         const isInternalHandoff = message.source === 'handoff';
-        if (!isInternalHandoff && !checkRoleAccess(userRole, selfAidForAccess)) {
+        const fullAccessAuditCandidate = this.resolveFullAccessAuditCandidate(message);
+        const isCurrentFullAccessCommand = fullAccessAuditCandidate?.authorization.source === 'fullaccess-command'
+            && fullAccessAuditCandidate.processRole === 'fullaccess-run';
+        const isCurrentFullAccessTrigger = fullAccessAuditCandidate?.authorization.source === 'trigger'
+            && fullAccessAuditCandidate.processRole === 'fullaccess-run';
+        if (!isInternalHandoff
+            && !isCurrentFullAccessCommand
+            && !isCurrentFullAccessTrigger
+            && !checkRoleAccess(userRole, selfAidForAccess)) {
             logger.warn(`[ResponseEngine] Access denied: role=${userRole} peerKey=${message.channelId} session=${session.id}`);
             const channelKey = session.metadata?.channelKey || message.channel;
             const channelInfo = this.resolveChannelInfo(channelKey);
@@ -1538,6 +1667,55 @@ export class ResponseEngine {
             this.activeMonitors.delete(streamKey);
         }
     }
+    resolveFullAccessAuditCandidate(message) {
+        const commandAuthorization = message.executionPermissionOverride;
+        if (commandAuthorization?.permissionMode === 'fullaccess'
+            && commandAuthorization.processRole === 'fullaccess-run'
+            && commandAuthorization.dataScope === 'daemon'
+            && commandAuthorization.source === 'fullaccess-command'
+            && typeof commandAuthorization.authorizedBy === 'string'
+            && commandAuthorization.authorizedBy.length > 0) {
+            let currentOwner = false;
+            try {
+                currentOwner = isFullAccessEnabled()
+                    && new Set(loadDaemonConfig().owners ?? []).has(commandAuthorization.authorizedBy);
+            }
+            catch {
+                // Runtime validation will fail closed; the audit must still retain the
+                // attempted authorization without falsely labeling it active.
+            }
+            return {
+                authorization: commandAuthorization,
+                processRole: currentOwner ? 'fullaccess-run' : 'none',
+            };
+        }
+        const trigger = message.triggerMeta;
+        if (message.source === 'trigger'
+            && trigger?.permissionModeOverride === 'fullaccess'
+            && typeof trigger.authorizedBy === 'string' && trigger.authorizedBy.length > 0
+            && typeof trigger.triggerId === 'string' && trigger.triggerId.length > 0
+            && typeof trigger.runId === 'string' && trigger.runId.length > 0
+            && typeof trigger.attemptId === 'string' && trigger.attemptId.length > 0) {
+            const current = this.isCurrentFullAccessTrigger(message);
+            return {
+                authorization: {
+                    permissionMode: 'fullaccess',
+                    processRole: 'fullaccess-run',
+                    dataScope: 'daemon',
+                    source: 'trigger',
+                    authorizedBy: trigger.authorizedBy,
+                    triggerId: trigger.triggerId,
+                    runId: trigger.runId,
+                    attemptId: trigger.attemptId,
+                },
+                // Keep attempted authorization details for audit correlation, but do
+                // not claim an active fullaccess identity when the process gate or
+                // approval provenance has since become invalid.
+                processRole: current ? 'fullaccess-run' : 'none',
+            };
+        }
+        return undefined;
+    }
     /** 获取回复上下文（跟着任务走） */
     getReplyContext(message) {
         return message.replyContext;
@@ -1550,10 +1728,10 @@ export class ResponseEngine {
             ? configuredSeconds * 1000
             : undefined;
     }
-    retryAttemptTimeoutMs() {
+    apiRetryTimeoutMs() {
         if (this.globalSettings.idleMonitor?.enabled === false)
             return undefined;
-        const configuredSeconds = this.globalSettings.idleMonitor?.retryAttemptTimeout
+        const configuredSeconds = this.globalSettings.idleMonitor?.apiRetryTimeout
             ?? this.globalSettings.idleMonitor?.timeout
             ?? 120;
         return typeof configuredSeconds === 'number'
@@ -1606,7 +1784,9 @@ export class ResponseEngine {
         const owningAgentForTask = this.agentRegistry?.resolveByChannel(channelKey)
             ?? (taskAgentAid ? this.agentRegistry?.get(taskAgentAid) : null);
         const runnerSelfAid = owningAgentForTask?.aid || session.selfAID || message.selfAID;
-        const lifecycle = owningAgentForTask?.config?.lifecycle;
+        const lifecycle = owningAgentForTask
+            ? resolveAgentLifecycle(owningAgentForTask.config)
+            : undefined;
         const isActive = lifecycle === 'active';
         const isBootstrapping = lifecycle === 'bootstrapping';
         // Per-method agent name for stats bucketing (agent.name or '<unknown>')
@@ -1617,10 +1797,12 @@ export class ResponseEngine {
             return;
         }
         // Agent-owned turns are runnable only in the two explicit execution
-        // states. An untransitioned `created` agent or a malformed/missing
-        // lifecycle must not fall through to a base runner's default prompt.
+        // states. An untransitioned `created` agent or malformed lifecycle must
+        // not fall through to a base runner's default prompt. Missing lifecycle
+        // is normalized to active for legacy configurations.
         if (owningAgentForTask && !isActive && !isBootstrapping) {
-            const blockedLifecycle = lifecycle ?? 'missing';
+            const blockedLifecycle = lifecycle
+                ?? `invalid (${String(owningAgentForTask.config.lifecycle)})`;
             logger.error(`[ResponseEngine] Agent lifecycle is not runnable: agent=${owningAgentForTask.aid} lifecycle=${blockedLifecycle}`);
             this.publishTriggerExecutionFailure(message, `agent_lifecycle_not_runnable:${blockedLifecycle}`);
             return;
@@ -1628,7 +1810,9 @@ export class ResponseEngine {
         // 二次拦截：如果命令消息绕过 MessageBridge 的 handleCommand 泄漏到这里，
         // 静默丢弃而不是发送给 Agent（命令已在 MessageBridge 层处理过）
         const rawContent = message.content.replace(/^(>[^\n]*\n)+\n?/, '').trim();
-        if (rawContent.startsWith('/') && this.isKnownCommand(rawContent)) {
+        if (!message.executionPermissionOverride
+            && rawContent.startsWith('/')
+            && this.isKnownCommand(rawContent)) {
             logger.warn(`[ResponseEngine] Command leaked past MessageBridge, dropped: "${rawContent.substring(0, 40)}"`);
             this.publishTriggerExecutionFailure(message, 'trigger_command_not_supported');
             return;
@@ -1865,7 +2049,7 @@ export class ResponseEngine {
             },
             modeConfig: resolvedMode.context.modeConfig,
             state: modeState,
-            isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, chatType, session.selfAID || message.selfAID),
+            isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, chatType, selfAid),
             logger,
         } : null;
         if (resolvedMode?.mode.beforeProcess && modeProcessCtx) {
@@ -1970,6 +2154,17 @@ export class ResponseEngine {
         let streamResult = { isError: false, lastReplyText: '', fullText: '', hasReceivedText: false };
         let startTime = runnerStartedAt;
         let protocolReplayAttempts = 0;
+        // These values span the outer task try/catch/finally so fullaccess audit
+        // completion and context cleanup also cover setup failures.
+        let fullAccessAuthorization;
+        let fullAccessAuditStartedAt;
+        let fullAccessAuditBaseagent;
+        let fullAccessAuditModel;
+        let fullAccessAuditProcessRole = 'none';
+        let fullAccessRunnerInvoked = false;
+        let fullAccessExecutionFailed = false;
+        let fullAccessExecutionFailureReason;
+        let activePermissionContext;
         try {
             const isBackground = this.isBackgroundSession(session, message.channel, message.channelId);
             // 记录收到消息
@@ -2057,7 +2252,8 @@ export class ResponseEngine {
             const imageInfo = message.images && message.images.length > 0 ? ` [${message.images.length} image(s)]` : '';
             const modeInfo = isBackground ? ' [\u540e\u53f0]' : '';
             const e2eeInfo = message.replyContext?.metadata?.encrypted != null ? ` encrypt=${message.replyContext.metadata.encrypted}` : '';
-            logger.info(`[${message.channel}] ${message.channelId}: ${message.content}${imageInfo}${modeInfo}${e2eeInfo}`);
+            const contentPreview = formatInboundMessageLogText(message.content);
+            logger.info(`[${message.channel}] ${message.channelId}: ${contentPreview}${imageInfo}${modeInfo}${e2eeInfo}`);
             // 构建 peer 标识（优先 peerName，退化到 peerId / channelId）
             const peerName = session.metadata?.peerName ?? message.peerName;
             const peerId = session.metadata?.peerId ?? message.peerId ?? message.channelId;
@@ -2101,7 +2297,6 @@ export class ResponseEngine {
                 suppressIntermediateText: isProactive ? false : middleOutputMode === 'none',
                 operationalNoticesAsText: !isProactive && middleOutputMode !== 'none',
                 fileMarkerPattern: options?.fileMarkerPattern,
-                diagEnabled: this.globalSettings.debug?.flusherDiag,
                 send: async (payload) => {
                     if (turnLease && !this.turnCoordinator.canPublish(turnLease)) {
                         snapshot.pushOutbound(session.id, taskId, { kind: payload.kind, decision: 'suppressed-stale-turn' });
@@ -2140,7 +2335,7 @@ export class ResponseEngine {
                         this.touchAgentActivity(channelKey);
                     const enrichedEnvelope = withEnvelopeReplyContext(envelope, opts);
                     snapshot.pushOutbound(session.id, taskId, { kind: payload.kind, decision: 'sent' });
-                    await adapter.send(enrichedEnvelope, payload);
+                    return await adapter.send(enrichedEnvelope, payload);
                 },
             });
             this.activeRenderers.set(session.id, {
@@ -2149,11 +2344,6 @@ export class ResponseEngine {
                 suppressActivities: shouldSuppress(),
             });
             renderer.addLifecycle('started');
-            // 预压缩与任务过程中的自动压缩共用同一投影规则：interactive 的 text/all
-            // 均以普通非最终文本显示运行提示；none 不显示。其它 activity 在 all 下仍保持结构化。
-            // 它仍发生在真正的 prompt 执行之前。
-            await this.runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, renderer);
-            startTime = Date.now();
             if (isProactive) {
                 logger.info(`[ResponseEngine] proactive mode: outputs via thought.put task=${taskId}`);
             }
@@ -2270,12 +2460,21 @@ export class ResponseEngine {
                 };
             })();
             let effectivePermissionMode = 'readonly';
+            // Allocate/register the session-owned root before any runner preflight
+            // context is installed. Codex may already own a stronger directory;
+            // other runners receive a private child of the process TMPDIR.
+            const sessionRuntimeDir = agent.getManagedTempDir?.(session.id) ?? ensureSessionRuntimeDir(session.id);
             const recordExecutionAnomaly = triggerRunId
                 ? (anomaly) => {
                     recordTriggerExecutionAnomaly(triggerRunId, {
                         ...anomaly,
                         correlationId: anomaly.correlationId ?? anomaly.requestId,
                         agentAid: anomaly.agentAid ?? session.selfAID ?? message.selfAID,
+                        agentName: anomaly.agentName
+                            ?? (agentNameForStats !== '<unknown>' ? agentNameForStats : undefined)
+                            ?? anomaly.agentAid
+                            ?? session.selfAID
+                            ?? message.selfAID,
                         sessionId: anomaly.sessionId ?? session.id,
                         permissionMode: anomaly.permissionMode ?? effectivePermissionMode,
                     });
@@ -2286,7 +2485,7 @@ export class ResponseEngine {
                 : undefined;
             const pureSessionPolicyHook = runModeConfig?.policyHook;
             // 设置权限审批的交互上下文（支持交互卡片）
-            agent.setPermissionContext?.(session.id, {
+            const permissionContext = {
                 sendPrompt: permissionPromptForOrigin,
                 adapter: permissionAdapter,
                 channelId: permissionChannelId,
@@ -2300,12 +2499,14 @@ export class ResponseEngine {
                 chatmode: isProactive ? 'proactive' : 'interactive',
                 role: peerRole,
                 chatType: authChatType,
-                selfAid: session.selfAID || message.selfAID,
+                selfAid,
+                managedTempDir: sessionRuntimeDir,
                 allowReadonlySourceDiagnostics: effectiveAgentConfig?.readonlySourceDiagnostics === true,
                 peerKey: authPeerKey,
                 causation: taskCausation,
                 approvalRouting,
                 approvalInteractionPolicy: authorizationIdentity ? 'deny' : 'interactive',
+                permissionMode: effectivePermissionMode,
                 recordExecutionAnomaly,
                 pauseController: taskPauseController,
                 preToolUsePolicyHook: pureSessionPolicyHook,
@@ -2318,6 +2519,7 @@ export class ResponseEngine {
                     })
                     : undefined,
                 turn: {
+                    sessionId: turnLease.sessionId,
                     taskId,
                     turnId: turnLease.turnId,
                     generation: turnLease.generation,
@@ -2419,7 +2621,9 @@ export class ResponseEngine {
                         return undefined;
                     };
                 })(),
-            });
+            };
+            activePermissionContext = permissionContext;
+            agent.setPermissionContext?.(session.id, permissionContext);
             // per-session 权限模式在 try 内、peerKey 解析后设置（见 resolvePermissionMode 调用）
             // 标记会话为处理中（实时持久化，重启后可恢复）
             this.sessionManager.markProcessing(session.id, taskId);
@@ -2469,21 +2673,68 @@ export class ResponseEngine {
                 // 这样单条和积压合并批次不会因队列状态不同而切换关系级配置。
                 const normalizedBaseagent = normalizeBaseagent(agent.name);
                 // 设置 per-call 权限模式：只按当前角色定义解析（不读物理配置层或 session.metadata）。
-                // Trigger 只能降低本次调用权限，不能突破当前角色的权限上限。
+                // 普通 Trigger override 只能降低权限；可信 /fa 或 scheduler fullaccess
+                // 使用独立授权路径，不进入角色 authority ceiling。
                 // 作为 per-call 入参随 modelOverride 传入 runQuery —— 与 model/effort 同构，
                 // 不写 AgentRunner 实例字段，多对端/多会话并发共享同一 runner 实例时互不污染。
                 const triggerPermissionModeOverride = message.triggerMeta?.permissionModeOverride;
-                try {
-                    effectivePermissionMode = constrainRuntimePermissionMode({
-                        selfAid: selfAid || undefined,
-                        role: peerRole,
-                        requestedValue: triggerPermissionModeOverride,
-                    }).effectiveValue;
+                const commandFullAccess = message.executionPermissionOverride;
+                const triggerFullAccess = triggerPermissionModeOverride === 'fullaccess';
+                if (commandFullAccess || triggerFullAccess) {
+                    if (commandFullAccess) {
+                        if (commandFullAccess.permissionMode !== 'fullaccess'
+                            || commandFullAccess.processRole !== 'fullaccess-run'
+                            || commandFullAccess.dataScope !== 'daemon'
+                            || commandFullAccess.source !== 'fullaccess-command'
+                            || !commandFullAccess.authorizedBy) {
+                            throw new Error('fullaccess command authorization is missing or malformed');
+                        }
+                        fullAccessAuthorization = commandFullAccess;
+                    }
+                    else {
+                        if (message.source !== 'trigger'
+                            || !message.triggerMeta?.triggerId
+                            || !message.triggerMeta.runId
+                            || !message.triggerMeta.attemptId
+                            || !message.triggerMeta.authorizedBy) {
+                            throw new Error('fullaccess Trigger override lacks trusted scheduler identity or approval provenance');
+                        }
+                        const currentOwners = new Set(loadDaemonConfig().owners ?? []);
+                        if (!currentOwners.has(message.triggerMeta.authorizedBy)) {
+                            throw new Error('fullaccess Trigger approval is no longer owned');
+                        }
+                        fullAccessAuthorization = {
+                            permissionMode: 'fullaccess',
+                            processRole: 'fullaccess-run',
+                            dataScope: 'daemon',
+                            source: 'trigger',
+                            triggerId: message.triggerMeta.triggerId,
+                            runId: message.triggerMeta.runId,
+                            attemptId: message.triggerMeta.attemptId,
+                            authorizedBy: message.triggerMeta.authorizedBy,
+                        };
+                    }
+                    this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent);
+                    effectivePermissionMode = 'fullaccess';
                 }
-                catch (e) {
-                    logger.warn(`[ResponseEngine] permission mode resolution failed, using fallback: ${e instanceof Error ? e.message : String(e)}`);
-                    effectivePermissionMode = 'readonly';
+                else {
+                    try {
+                        effectivePermissionMode = constrainRuntimePermissionMode({
+                            selfAid: selfAid || undefined,
+                            role: peerRole,
+                            requestedValue: triggerPermissionModeOverride,
+                        }).effectiveValue;
+                    }
+                    catch (e) {
+                        logger.warn(`[ResponseEngine] permission mode resolution failed, using fallback: ${e instanceof Error ? e.message : String(e)}`);
+                        effectivePermissionMode = 'readonly';
+                    }
                 }
+                // The mode is resolved after the initial context is assembled. Keep
+                // the runner-held object live so preflight, approvals, and audit
+                // records all observe the same normalized value.
+                permissionContext.permissionMode = effectivePermissionMode;
+                permissionContext.executionPermission = fullAccessAuthorization;
                 // 按 关系级 > agent级 > 全局 解析本次调用的模型/强度，作为 per-call 入参传入 runQuery。
                 // 不缓存、不绑会话——改关系级/agent级后该范围所有会话的下条消息即时生效；
                 // 多对端并发各自独立解析、各自传参，无共享状态可被污染。
@@ -2617,7 +2868,9 @@ export class ResponseEngine {
                 }
                 // permissionMode 随角色策略或 trigger override 传入；单 runner
                 // 嵌入/测试路径没有 self/peer 作用域时，避免制造无配置来源的 override。
-                const shouldPassPermissionMode = !!message.triggerMeta?.permissionModeOverride || !!selfAid;
+                const shouldPassPermissionMode = !!fullAccessAuthorization
+                    || !!message.triggerMeta?.permissionModeOverride
+                    || !!selfAid;
                 if (shouldPassPermissionMode) {
                     modelOverride = { ...(modelOverride || {}), permissionMode: effectivePermissionMode };
                 }
@@ -2633,6 +2886,61 @@ export class ResponseEngine {
                         sessionTitle: deriveSessionTitle(session.name, message.content, session.threadId),
                     };
                 }
+                // Capture the authoritative topic binding after begin() has durably
+                // published this logical run's TurnLease. A topic UNBOUND value is
+                // explicit and must never fall back to runner-local cache. This must
+                // happen before task-start auto compact because compact is a backend
+                // management action just like the subsequent runQuery.
+                let runAgentSessionId = session.agentSessionId;
+                if (session.threadId
+                    && typeof this.sessionManager.getSessionById === 'function') {
+                    const latestBackendSession = await this.sessionManager.getSessionById(session.id);
+                    if (!latestBackendSession || latestBackendSession.threadId !== session.threadId) {
+                        throw new Error('topic session changed before backend run started');
+                    }
+                    runAgentSessionId = latestBackendSession.agentSessionId;
+                    session.agentSessionId = runAgentSessionId;
+                    session.metadata = latestBackendSession.metadata;
+                }
+                modelOverride = {
+                    ...(modelOverride || {}),
+                    ...(session.threadId
+                        ? { backend: { kind: 'topic', agentSessionId: runAgentSessionId ?? null } }
+                        : {}),
+                    turn: {
+                        sessionId: turnLease.sessionId,
+                        taskId,
+                        turnId: turnLease.turnId,
+                        generation: turnLease.generation,
+                        inputId: turnLease.inputId,
+                    },
+                };
+                const refreshTopicBindingForLogicalRetry = async () => {
+                    if (!session.threadId || typeof this.sessionManager.getSessionById !== 'function')
+                        return;
+                    const latest = await this.sessionManager.getSessionById(session.id);
+                    if (!latest || latest.threadId !== session.threadId) {
+                        throw new Error('topic session changed during backend run');
+                    }
+                    const latestAgentSessionId = latest.agentSessionId;
+                    session.agentSessionId = latestAgentSessionId;
+                    session.metadata = latest.metadata;
+                    if (latestAgentSessionId === runAgentSessionId)
+                        return;
+                    logger.info(`[ResponseEngine] Refreshing authoritative topic backend for logical retry: `
+                        + `session=${session.id} task=${taskId} backend=${latestAgentSessionId ?? 'none'}`);
+                    runAgentSessionId = latestAgentSessionId;
+                    modelOverride = {
+                        ...(modelOverride || {}),
+                        backend: { kind: 'topic', agentSessionId: runAgentSessionId ?? null },
+                    };
+                };
+                // 预压缩必须使用与本轮 runQuery 相同的有效模型/强度覆盖。
+                // 模型解析完成后再执行，避免关系级模型存在时回落到 runner 默认模型。
+                await this.runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, renderer, modelOverride, fullAccessAuthorization
+                    ? () => this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent)
+                    : undefined);
+                startTime = Date.now();
                 const causationPath = inputCausation.trigger?.path ?? [];
                 const originNode = causationPath[0];
                 logger.info(`[ResponseEngine] execution context session=${session.id}`
@@ -2884,7 +3192,6 @@ export class ResponseEngine {
                 // private child of the process-provided TMPDIR. Both paths are passed
                 // explicitly so sandboxed helper commands never fall back to a shared
                 // agent or project directory for transient state.
-                const sessionRuntimeDir = agent.getManagedTempDir?.(session.id) ?? ensureSessionRuntimeDir(session.id);
                 const taskRuntimeContext = {
                     taskId,
                     sessionId: session.id,
@@ -2898,6 +3205,12 @@ export class ResponseEngine {
                     peerName: peerName || undefined,
                     peerType: message.peerType || session.metadata?.peerType || undefined,
                     peerRole,
+                    ...(fullAccessAuthorization ? {
+                        processRole: fullAccessAuthorization.processRole,
+                        dataScope: fullAccessAuthorization.dataScope,
+                        authorizedBy: fullAccessAuthorization.authorizedBy,
+                        executionSource: fullAccessAuthorization.source,
+                    } : {}),
                     threadId: session.threadId || undefined,
                     sessionRuntimeDir,
                     runtimeLockDir: ensureRuntimeLockDir(sessionRuntimeDir),
@@ -2906,15 +3219,6 @@ export class ResponseEngine {
                 };
                 this.activeTaskRuntimeContexts.set(session.id, taskRuntimeContext);
                 runtimeEnv = buildTaskRuntimeEnv(taskRuntimeContext);
-                modelOverride = {
-                    ...(modelOverride || {}),
-                    turn: {
-                        taskId,
-                        turnId: turnLease.turnId,
-                        generation: turnLease.generation,
-                        inputId: turnLease.inputId,
-                    },
-                };
                 if (this.agentDelegationRegistry && configActorId && selfAid && peerKey) {
                     const delegationToken = this.agentDelegationRegistry.issue({
                         sessionId: session.id,
@@ -2927,13 +3231,14 @@ export class ResponseEngine {
                         selfAid,
                         peerKey,
                         issuedRole: peerRole,
+                        ...(fullAccessAuthorization ? { executionIdentity: fullAccessAuthorization } : {}),
                     });
                     runtimeEnv[AGENT_DELEGATION_TOKEN_ENV] = delegationToken;
                 }
                 const retryScheduler = new RetryScheduler(fallbackCandidates, modelOverride?.model || agentModel, model => (typeof agent.resolveModelId === 'function'
                     ? (agent.resolveModelId(model) ?? model)
                     : model));
-                const retryAttemptTimeoutMs = this.retryAttemptTimeoutMs();
+                const apiRetryTimeoutMs = this.apiRetryTimeoutMs();
                 const retryInputIsAtMostOnce = agent.retryInputSemantics === 'at_most_once';
                 let runAttempt = 1;
                 const recordRetryHealthError = async (retryError) => {
@@ -2951,11 +3256,45 @@ export class ResponseEngine {
                 };
                 while (true) {
                     let streamRegistered = false;
-                    const shouldTimeoutRetryAttempt = retryScheduler.shouldTimeoutAttempt() && retryAttemptTimeoutMs !== undefined;
+                    const shouldTimeoutRetryAttempt = retryScheduler.shouldTimeoutAttempt() && apiRetryTimeoutMs !== undefined;
                     let attemptTimeout;
                     try {
-                        logger.info(`[ResponseEngine] agent.runQuery start: agent=${agent.name} session=${session.id} task=${taskId} attempt=${runAttempt} apiRetries=${retryScheduler.apiRetryAttemptsMade} agentSessionId=${session.agentSessionId ?? 'none'}`);
-                        const stream = await agent.runQuery(session.id, effectivePrompt, absoluteProjectPath, session.agentSessionId, renderResult?.images.length ? renderResult.images : message.images, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
+                        logger.info(`[ResponseEngine] agent.runQuery start: agent=${agent.name} session=${session.id} task=${taskId} attempt=${runAttempt} apiRetries=${retryScheduler.apiRetryAttemptsMade} agentSessionId=${runAgentSessionId ?? 'none'} topicBinding=${session.threadId ? 'authoritative' : 'legacy'}`);
+                        if (fullAccessAuthorization) {
+                            this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent);
+                            if (fullAccessAuditStartedAt === undefined) {
+                                fullAccessAuditProcessRole = 'fullaccess-run';
+                                fullAccessAuditStartedAt = Date.now();
+                                fullAccessAuditBaseagent = normalizedBaseagent.canonical;
+                                fullAccessAuditModel = modelOverride?.model || agentModel;
+                                auditFullAccessEvent({
+                                    event: fullAccessAuthorization.source === 'trigger'
+                                        ? 'fullaccess.trigger.execution.started'
+                                        : 'fullaccess.execution.started',
+                                    source: fullAccessAuthorization.source,
+                                    actorId: fullAccessAuthorization.authorizedBy,
+                                    processRole: fullAccessAuditProcessRole,
+                                    agentAid: selfAid,
+                                    agentName: agentNameForStats,
+                                    sessionId: session.id,
+                                    taskId,
+                                    messageId: message.messageId,
+                                    triggerId: fullAccessAuthorization.triggerId,
+                                    runId: fullAccessAuthorization.runId,
+                                    attemptId: fullAccessAuthorization.attemptId,
+                                    dataScope: fullAccessAuthorization.dataScope,
+                                    authorizedBy: fullAccessAuthorization.authorizedBy,
+                                    baseagent: fullAccessAuditBaseagent,
+                                    model: fullAccessAuditModel,
+                                });
+                                // Audit is synchronous today, but it is an observable boundary.
+                                // Revalidate once more so an administrative revocation observed
+                                // there cannot be followed by a privileged Runner call.
+                                this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent);
+                            }
+                            fullAccessRunnerInvoked = true;
+                        }
+                        const stream = await agent.runQuery(session.id, effectivePrompt, absoluteProjectPath, runAgentSessionId, renderResult?.images.length ? renderResult.images : message.images, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
                         // The turn may be superseded while the runner is still creating its
                         // backend query. Replay the interrupt after runQuery resolves, when
                         // every runner is required to have an addressable cancellation handle.
@@ -2965,16 +3304,20 @@ export class ResponseEngine {
                         agent.registerStream(streamKey, stream);
                         streamRegistered = true;
                         if (shouldTimeoutRetryAttempt) {
-                            attemptTimeout = createRetryAttemptTimeout(retryAttemptTimeoutMs);
+                            attemptTimeout = createRetryAttemptTimeout(apiRetryTimeoutMs);
                             resetTimer('retry_attempt');
                         }
                         const processAttempt = this.processEventStream(stream, session, agent, renderer, (eventType, toolName) => {
                             resetTimer(eventType, toolName);
                             attemptTimeout?.reset();
-                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode, session.selfAID || message.selfAID);
+                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode, selfAid);
                         streamResult = attemptTimeout
                             ? await Promise.race([processAttempt, attemptTimeout.promise])
                             : await processAttempt;
+                        // Activation can complete either before runQuery returns (Codex)
+                        // or while its event stream is consumed (Claude/Gemini/Ecagent).
+                        // Always reconcile from strict latest before any logical retry.
+                        await refreshTopicBindingForLogicalRetry();
                         if (!streamResult.isError) {
                             const protocolDecision = this.turnCoordinator.evaluateCommit(turnLease, this.buildTurnCommitEvidence(session, streamResult));
                             const protocolReason = protocolDecision.ok ? undefined : protocolDecision.reason;
@@ -3010,6 +3353,7 @@ export class ResponseEngine {
                         break; // 成功，跳出重试循环
                     }
                     catch (retryError) {
+                        await refreshTopicBindingForLogicalRetry();
                         const retryAttemptTimedOut = retryError instanceof RetryAttemptTimeoutError;
                         if (retryAttemptTimedOut) {
                             logger.warn(`[ResponseEngine] Retry attempt ${runAttempt} timed out after ${retryError.timeoutMs}ms without agent events; interrupting current stream`);
@@ -3129,9 +3473,12 @@ export class ResponseEngine {
                         resetTimer,
                         shouldSuppress,
                         proactive,
-                        proactiveSelfAid: session.selfAID || message.selfAID,
+                        proactiveSelfAid: selfAid,
                         permissionMode: effectivePermissionMode,
                         turnLease,
+                        beforeRunQuery: fullAccessAuthorization
+                            ? () => this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent)
+                            : undefined,
                     });
                 }
                 else {
@@ -3172,9 +3519,12 @@ export class ResponseEngine {
                     resetTimer,
                     shouldSuppress,
                     proactive,
-                    proactiveSelfAid: session.selfAID || message.selfAID,
+                    proactiveSelfAid: selfAid,
                     permissionMode: effectivePermissionMode,
                     turnLease,
+                    beforeRunQuery: fullAccessAuthorization
+                        ? () => this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent)
+                        : undefined,
                 });
                 // 重试后仍然 prompt_too_long：显示友好提示
                 const retryStillTooLong = streamResult.isError && streamHitContextLimit(streamResult);
@@ -3752,6 +4102,8 @@ export class ResponseEngine {
             });
         }
         catch (error) {
+            fullAccessExecutionFailed = true;
+            fullAccessExecutionFailureReason = error instanceof Error ? error.message : String(error);
             const authoritativeTimeoutError = timeoutControl?.claim();
             if (authoritativeTimeoutError) {
                 error = authoritativeTimeoutError;
@@ -3944,6 +4296,47 @@ export class ResponseEngine {
             }
         }
         finally {
+            if (fullAccessAuthorization) {
+                const startedAt = fullAccessAuditStartedAt;
+                const executed = fullAccessRunnerInvoked;
+                const interrupted = isExpectedTerminalInterrupt(streamResult.terminalReason);
+                const failed = fullAccessExecutionFailed || streamResult.isError;
+                auditFullAccessEvent({
+                    event: fullAccessAuthorization.source === 'trigger'
+                        ? 'fullaccess.trigger.execution.ended'
+                        : 'fullaccess.execution.ended',
+                    source: fullAccessAuthorization.source,
+                    actorId: fullAccessAuthorization.authorizedBy,
+                    processRole: fullAccessAuditProcessRole,
+                    agentAid: selfAid,
+                    agentName: agentNameForStats,
+                    sessionId: session.id,
+                    taskId,
+                    messageId: message.messageId,
+                    triggerId: fullAccessAuthorization.triggerId,
+                    runId: fullAccessAuthorization.runId,
+                    attemptId: fullAccessAuthorization.attemptId,
+                    dataScope: fullAccessAuthorization.dataScope,
+                    authorizedBy: fullAccessAuthorization.authorizedBy,
+                    baseagent: fullAccessAuditBaseagent,
+                    model: fullAccessAuditModel,
+                    result: !executed ? 'blocked' : failed ? 'failed' : interrupted ? 'interrupted' : 'completed',
+                    reason: fullAccessExecutionFailureReason
+                        ?? streamResult.errors?.join('; ')
+                        ?? (!executed ? 'fullaccess execution stopped before Runner invocation' : undefined),
+                    executed,
+                    executionState: !executed ? 'blocked' : failed ? 'failed' : 'completed',
+                    durationMs: executed && startedAt !== undefined ? Date.now() - startedAt : undefined,
+                });
+                this.fullAccessTerminalMessages.add(message);
+            }
+            // The authorization belongs to this logical run only. Clear the live
+            // runner context as well as relying on the Message object to be dropped,
+            // so late callbacks cannot observe a completed fullaccess grant.
+            const completedPermissionContext = activePermissionContext;
+            if (completedPermissionContext && completedPermissionContext.executionPermission === fullAccessAuthorization) {
+                delete completedPermissionContext.executionPermission;
+            }
             // 同一 session 的新任务可能已替换登记；旧任务结束时不得删掉新任务的 renderer。
             if (this.activeRenderers.get(session.id)?.taskId === taskId) {
                 this.activeRenderers.delete(session.id);
@@ -3958,7 +4351,7 @@ export class ResponseEngine {
             snapshot.end(session.id, taskId);
         }
     }
-    async runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, renderer) {
+    async runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, renderer, modelOverride, beforeCompact) {
         if (!session.agentSessionId || !canCompactAgent(agent)) {
             logger.debug(`[ResponseEngine] Auto compact skipped: session=${session.id} agentSessionId=${session.agentSessionId || 'none'} canCompact=${canCompactAgent(agent)} agent=${agent.name}`);
             return;
@@ -3973,13 +4366,20 @@ export class ResponseEngine {
         await renderer.flush();
         this.announcedCompactStarts.add(session.id);
         try {
-            const compacted = await agent.compact(session.id, session.agentSessionId, absoluteProjectPath);
-            if (compacted) {
+            // Auto compact is a privileged backend-management operation for a
+            // fullaccess run. Revalidate immediately before invoking the runner so a
+            // daemon gate/owner revocation observed after task setup cannot still
+            // cause host-level runner activity.
+            beforeCompact?.();
+            const compacted = await agent.compact(session.id, session.agentSessionId, absoluteProjectPath, modelOverride);
+            const compactResult = compacted;
+            if (compactResult === true || compactResult?.ok === true) {
                 await this.emitOperationalNotice(renderer, '✅ 上下文压缩完成，继续处理...', 'info', 'auto-compact-complete');
                 await renderer.flush();
             }
             else {
-                logger.warn(`[ResponseEngine] Auto compact at task.start returned false (session=${session.id})`);
+                const compactFailure = compactResult;
+                logger.warn(`[ResponseEngine] Auto compact at task.start failed: session=${session.id} code=${compactFailure?.code ?? 'sdk_error'} durationMs=${compactFailure?.durationMs ?? 0} message=${compactFailure?.message ?? 'compact failed'}`);
             }
         }
         catch (err) {
@@ -4116,14 +4516,22 @@ export class ResponseEngine {
             const groupName = await adapter?.getGroupName?.(session.metadata.groupId).catch(() => undefined);
             if (groupName) {
                 session.metadata.groupName = groupName;
-                await this.sessionManager.updateSession(session.id, { metadata: session.metadata });
+                await this.sessionManager.patchSessionMetadata?.(session.id, { groupName });
+                if (typeof this.sessionManager.patchSessionMetadata !== 'function') {
+                    await this.sessionManager.updateSession(session.id, { metadata: { groupName } });
+                }
             }
         }
         // 同步服务端 mention_mode，供同一群会话的上下文和菜单展示使用。
         if (message.chatType === 'group' && message.mentionMode && session.metadata?.mentionMode !== message.mentionMode) {
             logger.info(`[ResponseEngine] mentionMode sync: sessionId=${session.id} ${session.metadata?.mentionMode ?? 'none'} -> ${message.mentionMode}`);
             session.metadata = { ...(session.metadata || {}), mentionMode: message.mentionMode };
-            await this.sessionManager.updateSession(session.id, { metadata: session.metadata });
+            if (typeof this.sessionManager.patchSessionMetadata === 'function') {
+                await this.sessionManager.patchSessionMetadata(session.id, { mentionMode: message.mentionMode });
+            }
+            else {
+                await this.sessionManager.updateSession(session.id, { metadata: { mentionMode: message.mentionMode } });
+            }
         }
         // chatMode 策略由 agent/relation behavior 配置在处理阶段解析；此处不再写 session 级参数。
         // replyContext 不再写入 session.metadata（跟着 message 走，避免群聊多人覆盖）
@@ -4161,6 +4569,11 @@ export class ResponseEngine {
         // Per-session agent name for stats bucketing
         const statsChannelKey = session.channel === 'daemon' ? session.channel : (session.metadata?.channelKey || session.channel);
         const agentNameForStats = this.agentRegistry?.resolveByChannel(statsChannelKey)?.name ?? '<unknown>';
+        const lifecycleAgentAid = proactiveSelfAid || session.selfAID;
+        const lifecycleAgentName = agentNameForStats !== '<unknown>'
+            ? agentNameForStats
+            : lifecycleAgentAid || '<unknown>';
+        const lifecyclePermissionMode = normalizeExecutionPermissionMode(permissionMode);
         let hasReceivedText = false;
         let hasProjectedCurrentReplyText = false;
         let hasErrorResult = false; // 是否已有 tool_result/error 事件输出过错误
@@ -4549,8 +4962,9 @@ export class ResponseEngine {
                             input: event.input,
                             ...(event.callId ? { callId: event.callId } : {}),
                             ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
-                            agentAid: session.selfAID ?? 'unknown',
-                            permissionMode: permissionMode ?? 'unknown',
+                            agentName: lifecycleAgentName,
+                            agentAid: lifecycleAgentAid ?? 'unknown',
+                            permissionMode: lifecyclePermissionMode,
                             decision: 'pending',
                             decisionSource: 'runner',
                             executed: false,
@@ -4626,11 +5040,11 @@ export class ResponseEngine {
                             toolName: event.name,
                             isError: event.isError,
                             ...(event.isError ? { errorCode: classifyToolErrorCode({ errorCode: event.errorCode, error: event.error, result: event.result }) } : {}),
-                            agentName: agentNameForStats,
                             ...(event.callId ? { callId: event.callId } : {}),
                             ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
-                            agentAid: session.selfAID ?? 'unknown',
-                            permissionMode: permissionMode ?? 'unknown',
+                            agentName: lifecycleAgentName,
+                            agentAid: lifecycleAgentAid ?? 'unknown',
+                            permissionMode: lifecyclePermissionMode,
                             decision: event.isError ? 'error' : 'allow',
                             decisionSource: 'runner',
                             executed: true,
@@ -4788,7 +5202,12 @@ export class ResponseEngine {
                                 lastReplyText,
                                 updateSessionMeta: async (patch) => {
                                     session.metadata = { ...(session.metadata || {}), ...patch };
-                                    await this.sessionManager.updateSession(session.id, { metadata: session.metadata });
+                                    if (typeof this.sessionManager.patchSessionMetadata === 'function') {
+                                        await this.sessionManager.patchSessionMetadata(session.id, patch);
+                                    }
+                                    else {
+                                        await this.sessionManager.updateSession(session.id, { metadata: patch });
+                                    }
                                 },
                                 logger,
                             });
@@ -4860,11 +5279,15 @@ export class ResponseEngine {
             // and mark the error so outer catch won't send a duplicate message
             const hasErrorSuppressingContent = hasErrorResult || renderer.hasNonLifecycleContent();
             if (hasErrorSuppressingContent) {
+                let errorOutputFlushed = false;
                 try {
                     await renderer.flush(true);
+                    errorOutputFlushed = true;
                 }
-                catch { }
-                if (error instanceof Error) {
+                catch (flushError) {
+                    logger.warn(`[ResponseEngine] Failed to flush error output: ${flushError instanceof Error ? flushError.message : String(flushError)}`);
+                }
+                if (errorOutputFlushed && error instanceof Error) {
                     error._errorAlreadySent = true;
                 }
             }