evolcore 0.0.19 → 0.0.21

package/dist/agents/codex-runner.js

@@ -5,10 +5,11 @@
  * Implements the same interface surface as AgentRunner (claude-runner.ts)
  * so MessageProcessor and CommandHandler can work with it transparently.
  */
+import { hasTrustedFullAccessContext } from './runner-types.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
-import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
-import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/protected-paths.js';
+import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
+import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/permission/protected-paths.js';
 import { CodexAppServerClient } from './codex-app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
@@ -16,14 +17,14 @@ import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { auditCodexApprovalDecision, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
-import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
+import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, parseCodexToolCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
-import { ensureProcessManagedTempDir } from '../cli/task-context.js';
+import { ensureProcessManagedTempDir, getManagedTaskTempDir } from '../cli/task-context.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
 import { execFileSync } from 'child_process';
 import { execCodexCliSync, resolveCodexCliPath } from '../utils/codex-cli.js';
@@ -39,6 +40,13 @@ const MIME_EXT = {
     'image/gif': '.gif',
     'image/webp': '.webp',
 };
+const APPROVAL_LOG_SUMMARY_MAX_LENGTH = 256;
+export function formatApprovalLogSummary(summary) {
+    const singleLine = summary.replace(/\s+/gu, ' ').trim();
+    if (singleLine.length <= APPROVAL_LOG_SUMMARY_MAX_LENGTH)
+        return singleLine;
+    return singleLine.slice(0, APPROVAL_LOG_SUMMARY_MAX_LENGTH - 3).trimEnd() + '...';
+}
 class AsyncEventQueue {
     queue = [];
     done = false;
@@ -267,16 +275,21 @@ export class CodexRunner {
     permissionContexts = new Map();
     resolvedConfig;
     pendingInterruptTtlMs = 30_000;
-    constructor(config, callbacks) {
-        this.resolvedConfig = resolveOpenaiConfig(config);
+    constructor(config, callbacks, runtime) {
+        // Compatibility for legacy direct callers that still pass the removed
+        // internal fields in a synthetic config. AgentLoader uses runtime binding.
+        const legacy = config.agents?.codex;
+        const binding = {
+            agentAid: runtime?.agentAid ?? legacy?.['evolcoreAgentAid'],
+            agentConfig: runtime?.agentConfig ?? legacy?.['evolcoreAgentConfig'],
+        };
+        this.resolvedConfig = resolveOpenaiConfig(config, undefined, binding);
         this.resolvedConfig.headers = buildModelRequestHeaders({
             baseagent: 'codex',
             baseUrl: this.resolvedConfig.baseUrl,
-            agentAid: config.agents?.codex?.evolcoreAgentAid,
+            agentAid: this.resolvedConfig.agentAid,
             configuredHeaders: this.resolvedConfig.headers,
         });
-        this.resolvedConfig.evolcoreAgentAid = config.agents?.codex?.evolcoreAgentAid;
-        this.resolvedConfig.evolcoreAgentConfig = config.agents?.codex?.evolcoreAgentConfig;
         this.capabilities = {
             clear: false,
             compact: true,
@@ -288,6 +301,7 @@ export class CodexRunner {
             planApproval: false,
             // Current file rewind is intentionally degraded: it restores touched files from Git HEAD.
             fileRewind: 'git-head',
+            fullaccess: true,
         };
         this.model = this.resolvedConfig.model;
         if (this.resolvedConfig.effort)
@@ -316,7 +330,7 @@ export class CodexRunner {
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommandArgv(command, managedTempDir, dialect = 'posix') {
+    approvedLiteralEvolcoreCommand(command, managedTempDir, dialect = 'posix') {
         const parseOptions = {
             allowManagedTmpDir: true,
             dialect,
@@ -324,47 +338,100 @@ export class CodexRunner {
         };
         const classification = classifyEvolcoreShellCommand(command, parseOptions);
         if (classification.kind === 'bounded-output')
-            return classification.command.argv;
-        if (classification.kind !== 'literal')
-            return undefined;
+            return { argv: classification.command.argv };
         // Keep the approval/delegation parser aligned with the preflight parser:
         // the session-managed `$TMPDIR` token is a permitted EC path reference.
-        const argv = parseLiteralShellArgv(command, parseOptions);
-        if (argv && containsLiteralManagedTmpDirOutsideSendContent(argv))
-            return undefined;
-        return argv?.[0] === 'ec' ? argv : undefined;
-    }
-    approvedEvolcoreCommandArgv(toolInput, managedTempDir) {
+        const parsed = parseLiteralShellCommand(command, parseOptions);
+        if (!parsed.ok)
+            return { parseFailure: parsed };
+        if (parsed.argv[0] !== 'ec')
+            return {};
+        if (containsLiteralManagedTmpDirOutsideSendContent(parsed.argv)) {
+            return { parseFailure: {
+                    issue: 'unsafe-expansion',
+                    offset: 0,
+                    tokenIndex: 0,
+                    dialect: dialect ?? 'posix',
+                    inputLength: command.length,
+                } };
+        }
+        return { argv: parsed.argv };
+    }
+    resolveCanonicalEcApproval(toolInput, managedTempDir) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
             : undefined;
         if (explicitArgv?.[0] === 'ec') {
-            return explicitArgv.some(value => value.includes('\0'))
-                || containsLiteralManagedTmpDirOutsideSendContent(explicitArgv)
-                ? undefined
-                : explicitArgv;
+            if (explicitArgv.some(value => value.includes('\0'))) {
+                return { parseFailure: {
+                        issue: 'invalid-control-char', offset: 0,
+                        tokenIndex: explicitArgv.findIndex(value => value.includes('\0')),
+                        dialect: 'posix', inputLength: 0,
+                    } };
+            }
+            return containsLiteralManagedTmpDirOutsideSendContent(explicitArgv)
+                ? { parseFailure: { issue: 'unsafe-expansion', offset: 0, tokenIndex: 0, dialect: 'posix', inputLength: 0 } }
+                : { argv: explicitArgv };
         }
         const explicitCarrier = explicitArgv
             ? resolveCodexShellCarrierArgv(explicitArgv)
             : undefined;
         if (explicitCarrier !== undefined) {
-            return this.approvedLiteralEvolcoreCommandArgv(explicitCarrier.command, managedTempDir, explicitCarrier.dialect);
+            return this.approvedLiteralEvolcoreCommand(explicitCarrier.command, managedTempDir, explicitCarrier.dialect);
+        }
+        if (hasCodexCmdCarrierEcIntent(toolInput)) {
+            const parsed = parseCodexToolCommand(toolInput);
+            if (!parsed.ok)
+                return { parseFailure: parsed };
+            if (parsed.argv[0] === 'ec') {
+                return containsLiteralManagedTmpDirOutsideSendContent(parsed.argv)
+                    ? { parseFailure: {
+                            issue: 'unsafe-expansion', offset: 0, tokenIndex: 0,
+                            dialect: 'cmd', inputLength: 0,
+                        } }
+                    : { argv: parsed.argv };
+            }
+            const command = typeof toolInput.command === 'string' ? toolInput.command : '';
+            const classification = classifyEvolcoreShellCommand(command, { dialect: 'cmd' });
+            return {
+                parseFailure: {
+                    issue: classification.kind === 'composite' ? classification.issue : 'shell-composition',
+                    offset: 0,
+                    tokenIndex: 0,
+                    dialect: 'cmd',
+                    inputLength: command.length,
+                },
+            };
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
-        const directArgv = this.approvedLiteralEvolcoreCommandArgv(command, managedTempDir);
-        if (directArgv)
-            return directArgv;
-        const wrappedArgv = parseLiteralShellArgv(command, {
+        const canonicalCommand = parseCodexShellCommandArgv(command, {
             allowManagedTmpDir: true,
             ...(managedTempDir ? { managedTempDir } : {}),
         });
-        const shellCarrier = wrappedArgv
-            ? resolveCodexShellCarrierArgv(wrappedArgv)
-            : undefined;
-        return shellCarrier === undefined
-            ? undefined
-            : this.approvedLiteralEvolcoreCommandArgv(shellCarrier.command, managedTempDir, shellCarrier.dialect);
+        if (canonicalCommand?.[0] === 'ec') {
+            return containsLiteralManagedTmpDirOutsideSendContent(canonicalCommand)
+                ? { parseFailure: {
+                        issue: 'unsafe-expansion',
+                        offset: 0,
+                        tokenIndex: 0,
+                        dialect: 'posix',
+                        inputLength: command.length,
+                    } }
+                : { argv: canonicalCommand };
+        }
+        const outer = parseLiteralShellCommand(command, {
+            allowManagedTmpDir: true,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        });
+        if (!outer.ok) {
+            const classification = classifyEvolcoreShellCommand(command, {
+                allowManagedTmpDir: true,
+                ...(managedTempDir ? { managedTempDir } : {}),
+            });
+            return classification.kind === 'composite' ? { parseFailure: outer } : {};
+        }
+        return {};
     }
     isManagedEvolcoreCommandIntent(toolInput) {
         if (Array.isArray(toolInput.commandArgv)) {
@@ -374,10 +441,11 @@ export class CodexRunner {
             if (!rawArgv.every(value => typeof value === 'string'))
                 return false;
             const shellCarrier = resolveCodexShellCarrierArgv(rawArgv);
-            return shellCarrier !== undefined
-                && classifyEvolcoreShellCommand(shellCarrier.command, {
-                    dialect: shellCarrier.dialect,
-                }).kind !== 'none';
+            return hasCodexCmdCarrierEcIntent(toolInput)
+                || shellCarrier !== undefined
+                    && classifyEvolcoreShellCommand(shellCarrier.command, {
+                        dialect: shellCarrier.dialect,
+                    }).kind !== 'none';
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         return classifyEvolcoreShellCommand(command).kind !== 'none';
@@ -430,8 +498,7 @@ export class CodexRunner {
         }
     }
     async persistDelegationCarrier(sessionManager, sessionId, threadId, carrier) {
-        if (typeof sessionManager?.getSessionById !== 'function'
-            || typeof sessionManager?.updateSession !== 'function')
+        if (typeof sessionManager?.getSessionById !== 'function')
             return;
         try {
             const session = await sessionManager.getSessionById(sessionId);
@@ -440,12 +507,16 @@ export class CodexRunner {
             const current = session.metadata?.[CODEX_DELEGATION_CARRIER_METADATA_KEY];
             if (current?.threadId === threadId && current?.carrier === carrier)
                 return;
-            await sessionManager.updateSession(sessionId, {
-                metadata: {
-                    ...(session.metadata ?? {}),
+            if (typeof sessionManager.patchSessionMetadata === 'function') {
+                await sessionManager.patchSessionMetadata(sessionId, {
                     [CODEX_DELEGATION_CARRIER_METADATA_KEY]: { threadId, carrier },
-                },
-            });
+                });
+            }
+            else if (typeof sessionManager.updateSession === 'function') {
+                await sessionManager.updateSession(sessionId, {
+                    metadata: { [CODEX_DELEGATION_CARRIER_METADATA_KEY]: { threadId, carrier } },
+                });
+            }
         }
         catch (error) {
             logger.warn(`[CodexRunner] failed to persist delegation carrier: session=${sessionId} thread=${threadId} error=${error}`);
@@ -485,7 +556,7 @@ export class CodexRunner {
         return Object.keys(merged).length > 0 ? merged : null;
     }
     async resolveCapabilityThreadConfig(projectPath) {
-        const agentConfig = this.resolvedConfig.evolcoreAgentConfig;
+        const agentConfig = this.resolvedConfig.agentConfig;
         if (!agentConfig) {
             return {
                 skills: { config: [{ name: 'eclink', enabled: false }] },
@@ -732,6 +803,8 @@ export class CodexRunner {
     chatModes = new Map();
     /** 将权限模式映射为 Codex app-server 的 approvalPolicy（纯函数，无副作用，供 per-call 派生用）。 */
     toApprovalPolicy(mode) {
+        if (mode === 'fullaccess')
+            return 'never';
         // `untrusted` guarantees that commands outside Codex's trusted read-only
         // set reach the EvolCore bridge for EvolCore's per-mode decision.
         void mode;
@@ -814,6 +887,12 @@ export class CodexRunner {
                     filesystem: {
                         ...buildCodexProtectedFilesystemRules(resolveRoot(), {
                             denyLClassRead: mode === 'readonly',
+                            // The app-server itself is launched behind EvolCore's Linux
+                            // H-class guard, which already mounts every L-class directory
+                            // read-only. Avoid Codex's per-file glob expansion inside that
+                            // nested mount namespace; it can fail while creating a missing
+                            // target such as triggers/history.jsonl.
+                            expandLClassReadDeny: process.platform !== 'linux',
                         }),
                         ...this.resolveGitMetadataWriteRules(projectPath, mode),
                         ...(bootstrapAgentMdPath ? {
@@ -841,14 +920,17 @@ export class CodexRunner {
             sandbox: decision.state === 'off' ? 'danger-full-access' : undefined,
         };
     }
-    buildLifecycleLockdownConfig() {
+    isTrustedFullAccessSession(sessionKey) {
+        return hasTrustedFullAccessContext(this.permissionContexts.get(sessionKey));
+    }
+    buildLifecycleLockdownConfig(permissionMode) {
         return {
             features: {
                 // The app-server is launched with allow_managed_hooks_only=true, so
                 // enabling the feature exposes only EvolCore's requirements-managed
                 // PreToolUse hook. Disabling it here suppresses that managed hook too
                 // and bypasses the pause/proactive policy boundary entirely.
-                hooks: true,
+                hooks: permissionMode !== 'fullaccess',
             },
         };
     }
@@ -895,6 +977,11 @@ export class CodexRunner {
                 return { ok: true, applicable: true, decision: 'deny', reason: '工具调用已取消' };
             }
         }
+        if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
+            return this.isTrustedFullAccessSession(sessionKey)
+                ? { ok: true, applicable: true, decision: 'allow' }
+                : { ok: false, applicable: true, decision: 'deny', reason: 'Untrusted fullaccess execution context' };
+        }
         // A tracked interactive thread still needs an authenticated, explicit
         // allow so the managed hook can fail closed when no runner matches.
         if (!context.preToolUsePolicyHook)
@@ -922,6 +1009,7 @@ export class CodexRunner {
         this.activeStreams.delete(key);
         this.activeAbortControllers.delete(key);
         this.pendingInterrupts.delete(key);
+        this.chatModes.delete(key);
         const release = this.activeOperationReleases.get(key);
         if (release) {
             this.activeOperationReleases.delete(key);
@@ -1032,8 +1120,22 @@ export class CodexRunner {
         }
     }
     // ── Core: runQuery ──
+    cachedThreadForTopic(sessionId, agentSessionId) {
+        if (!agentSessionId)
+            return undefined;
+        return this.activeSessions.get(sessionId) === agentSessionId ? agentSessionId : undefined;
+    }
     async runQuery(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
-        const knownThreadId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        const topicBinding = modelOverride?.backend?.kind === 'topic';
+        if (topicBinding && (!modelOverride?.turn || modelOverride.turn.sessionId !== sessionId || !this.onSessionIdUpdate)) {
+            const error = new Error('topic backend run requires an active TurnLease and binding callback');
+            error.code = 'TOPIC_TURN_LEASE_REQUIRED';
+            throw error;
+        }
+        const topicAgentSessionId = topicBinding ? modelOverride?.backend?.agentSessionId ?? null : undefined;
+        const knownThreadId = topicBinding
+            ? this.cachedThreadForTopic(sessionId, topicAgentSessionId)
+            : initialAgentSessionId || this.activeSessions.get(sessionId);
         const operationKey = this.threadOperationKey(knownThreadId, sessionId);
         const release = await this.acquireThreadOperation(operationKey, 'thread/resume+turn/start');
         try {
@@ -1047,7 +1149,14 @@ export class CodexRunner {
         }
     }
     async runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
-        let agentSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        // A daemon-managed task must never fall back to the app-server's
+        // process-wide TMPDIR if its session namespace disappeared.
+        getManagedTaskTempDir(runtimeEnv);
+        const topicBinding = modelOverride?.backend?.kind === 'topic';
+        const topicAgentSessionId = topicBinding ? modelOverride?.backend?.agentSessionId ?? null : undefined;
+        let agentSessionId = topicBinding
+            ? (topicAgentSessionId || undefined)
+            : initialAgentSessionId || this.activeSessions.get(sessionId);
         const resumingThread = !!agentSessionId;
         const callModel = modelOverride?.model || this.model;
         const callEffort = modelOverride?.effortMode === 'model_default'
@@ -1057,8 +1166,10 @@ export class CodexRunner {
         // 写入 chatModes 供异步审批回调按 sessionKey 读取，并据此派生本次 thread 的 approvalPolicy/sandbox，
         // 不依赖共享的 this.approvalPolicy/this.sandboxMode（多会话并发互不污染）。
         const requestedPermissionMode = modelOverride?.permissionMode || this.currentMode;
-        const normalizedPermission = normalizePermissionMode(requestedPermissionMode);
-        const callMode = normalizedPermission.mode;
+        const callMode = normalizeExecutionPermissionMode(requestedPermissionMode);
+        if (callMode === 'fullaccess' && !hasTrustedFullAccessContext(this.permissionContexts.get(sessionId))) {
+            throw new Error('Codex fullaccess requires a trusted per-call execution authorization');
+        }
         this.chatModes.set(sessionId, callMode);
         const callApprovalPolicy = this.toApprovalPolicy(callMode);
         const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath);
@@ -1066,8 +1177,11 @@ export class CodexRunner {
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
-        const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, callMode);
-        await this.assertProactiveHookAvailability(sessionId, appServer);
+        const externalToolConfig = callMode === 'fullaccess'
+            ? {}
+            : await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, callMode);
+        if (callMode !== 'fullaccess')
+            await this.assertProactiveHookAvailability(sessionId, appServer);
         const managedTempInstruction = this.managedTempInstruction(sessionId);
         const developerInstructions = [systemPromptAppend, managedTempInstruction].filter(Boolean).join('\n\n') || undefined;
         let knownDelegationCarrier = agentSessionId
@@ -1075,11 +1189,12 @@ export class CodexRunner {
             : undefined;
         if (agentSessionId && !knownDelegationCarrier) {
             knownDelegationCarrier = await this.loadPersistedDelegationCarrier(sessionManager, sessionId, agentSessionId);
-            if (knownDelegationCarrier) {
-                this.threadDelegationCarriers.set(agentSessionId, knownDelegationCarrier);
-            }
         }
         const delegationCarrierCandidate = knownDelegationCarrier ?? this.createDelegationCarrier();
+        // Keep newly discovered carrier state local until generation-aware
+        // activation accepts the backend. A stale run must not publish a carrier
+        // that a later generation could mistake for its own thread.
+        let carrierToPublish;
         const hasTaskDelegation = typeof runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] === 'string';
         const threadOptions = {
             model: callModel,
@@ -1087,7 +1202,7 @@ export class CodexRunner {
             approvalPolicy: effectiveApprovalPolicy,
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig()), callMode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig(callMode)), callMode),
             ...(developerInstructions ? { developerInstructions } : {}),
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
@@ -1099,11 +1214,17 @@ export class CodexRunner {
         if (!threadId)
             throw new Error('Codex app-server did not return a thread id');
         if (!resumingThread) {
-            this.threadDelegationCarriers.set(threadId, delegationCarrierCandidate);
-            await this.persistDelegationCarrier(sessionManager, sessionId, threadId, delegationCarrierCandidate);
+            carrierToPublish = { threadId, carrier: delegationCarrierCandidate };
         }
         else if (hasTaskDelegation && !knownDelegationCarrier) {
-            let recoveredCarrier = await this.readThreadDelegationCarrier(appServer, threadId);
+            // A BOUND topic cannot silently fork to migrate carrier metadata: its
+            // active-turn activation is allowed to confirm only the authoritative
+            // backend ID, so a fork would deterministically conflict. threadResume
+            // already received the candidate in this turn's environment config;
+            // publish it for the same thread after binding confirmation instead.
+            let recoveredCarrier = topicBinding
+                ? delegationCarrierCandidate
+                : await this.readThreadDelegationCarrier(appServer, threadId);
             if (!recoveredCarrier) {
                 const staleThreadId = threadId;
                 logger.warn(`[CodexRunner] loaded thread has no recoverable delegation carrier; forking once to preserve history: thread=${staleThreadId}`);
@@ -1121,19 +1242,35 @@ export class CodexRunner {
                 threadId = forkedThreadId;
                 recoveredCarrier = delegationCarrierCandidate;
             }
-            this.threadDelegationCarriers.set(threadId, recoveredCarrier);
-            await this.persistDelegationCarrier(sessionManager, sessionId, threadId, recoveredCarrier);
+            carrierToPublish = { threadId, carrier: recoveredCarrier };
         }
         else if (knownDelegationCarrier) {
-            this.threadDelegationCarriers.set(threadId, knownDelegationCarrier);
-            await this.persistDelegationCarrier(sessionManager, sessionId, threadId, knownDelegationCarrier);
+            carrierToPublish = { threadId, carrier: knownDelegationCarrier };
         }
         agentSessionId = threadId;
+        const turn = modelOverride?.turn;
+        const bindingResult = this.onSessionIdUpdate
+            ? ((turn === undefined
+                ? await this.onSessionIdUpdate(sessionId, threadId)
+                : await this.onSessionIdUpdate(sessionId, threadId, { turn }))
+                ?? 'legacy_updated')
+            : 'legacy_updated';
+        const bindingAccepted = bindingResult === 'activated'
+            || bindingResult === 'already_active'
+            || bindingResult === 'legacy_updated';
+        if (!bindingAccepted) {
+            const error = new Error(`backend discovery rejected: ${bindingResult}`);
+            error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+            throw error;
+        }
         this.activeSessions.set(sessionId, threadId);
+        if (carrierToPublish) {
+            this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+            await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
+        }
         this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         this.threadProjectPaths.set(threadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(threadId, externalToolConfig);
-        this.onSessionIdUpdate?.(sessionId, threadId);
         const controller = new AbortController();
         this.activeAbortControllers.set(sessionId, controller);
         const tempFiles = [];
@@ -1180,7 +1317,7 @@ export class CodexRunner {
             this.activeAbortControllers.delete(sessionId);
             this.activeStreams.delete(sessionId);
             logger.info(`[CodexRunner] Applied pending interrupt before turn start: ${sessionId}`);
-            return this.transformAppServerStream(queue, sessionId, state, unsubscribe, tempFiles);
+            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
         }
         try {
             const turnResponse = await appServer.turnStart(threadId, input, {
@@ -1216,7 +1353,7 @@ export class CodexRunner {
             this.cleanupTempFiles(tempFiles);
             throw error;
         }
-        return this.transformAppServerStream(queue, sessionId, state, unsubscribe, tempFiles);
+        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
     }
     // ── Interrupt ──
     async interrupt(sessionKey) {
@@ -1266,40 +1403,82 @@ export class CodexRunner {
     // ── Session commands ──
     updateSessionId(sessionId, agentSessionId) {
         const previousThreadId = this.activeSessions.get(sessionId);
-        if (previousThreadId && previousThreadId !== agentSessionId) {
-            this.threadProjectPaths.delete(previousThreadId);
-            this.threadDelegationCarriers.delete(previousThreadId);
-            this.unbindExternalToolBoundary(previousThreadId);
-            this.clearTrackedApprovalItemsForThread(previousThreadId);
-        }
-        if (agentSessionId) {
-            this.activeSessions.set(sessionId, agentSessionId);
-            this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${agentSessionId}`);
-        }
-        else {
-            this.activeSessions.delete(sessionId);
+        const applyLocal = () => {
+            const currentThreadId = this.activeSessions.get(sessionId);
+            if (currentThreadId !== previousThreadId && !(previousThreadId === undefined && currentThreadId === undefined))
+                return;
+            if (previousThreadId && previousThreadId !== agentSessionId) {
+                this.threadProjectPaths.delete(previousThreadId);
+                this.threadDelegationCarriers.delete(previousThreadId);
+                this.unbindExternalToolBoundary(previousThreadId);
+                this.clearTrackedApprovalItemsForThread(previousThreadId);
+            }
+            if (agentSessionId)
+                this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${agentSessionId}`);
+            this.pruneThreadOperationLocks();
+            if (agentSessionId)
+                this.activeSessions.set(sessionId, agentSessionId);
+            else
+                this.activeSessions.delete(sessionId);
+        };
+        if (!this.onSessionIdUpdate) {
+            applyLocal();
+            return;
         }
-        this.pruneThreadOperationLocks();
-        this.onSessionIdUpdate?.(sessionId, agentSessionId);
+        void this.onSessionIdUpdate(sessionId, agentSessionId).then(result => {
+            if (result === 'activated' || result === 'already_active' || result === 'legacy_updated' || !agentSessionId) {
+                applyLocal();
+            }
+        }).catch(error => {
+            logger.warn(`[CodexRunner] session binding callback failed: ${error instanceof Error ? error.message : String(error)}`);
+            if (!agentSessionId)
+                applyLocal();
+        });
     }
     async closeSession(sessionId) {
+        const capturedThreadId = this.activeSessions.get(sessionId);
+        const capturedPermissionContext = this.permissionContexts.get(sessionId);
+        const capturedStream = this.activeStreams.get(sessionId);
+        const capturedController = this.activeAbortControllers.get(sessionId);
+        const capturedTurn = this.activeTurns.get(sessionId);
         this.permissionContexts.get(sessionId)?.pauseController?.cancel();
-        const threadId = this.activeSessions.get(sessionId);
-        this.activeSessions.delete(sessionId);
-        this.activeStreams.delete(sessionId);
-        this.activeAbortControllers.delete(sessionId);
-        this.activeTurns.delete(sessionId);
-        this.pendingInterrupts.delete(sessionId);
-        this.permissionContexts.delete(sessionId);
-        this.chatModes.delete(sessionId);
-        this.cleanupSessionTempDir(sessionId);
-        if (threadId) {
-            this.threadProjectPaths.delete(threadId);
-            this.threadDelegationCarriers.delete(threadId);
-            this.unbindExternalToolBoundary(threadId);
+        // Do not call interrupt(sessionId) here: a new run may have replaced the
+        // session-scoped maps while an older close was waiting. Interrupt and
+        // clean only the exact lifecycle captured at entry.
+        if (capturedTurn) {
+            await this.interruptAppServerTurn(capturedTurn.threadId, capturedTurn.turnId).catch(() => { });
+        }
+        capturedController?.abort('Session closed');
+        const lifecycleReplaced = (capturedStream !== undefined && this.activeStreams.get(sessionId) !== capturedStream)
+            || (capturedController !== undefined && this.activeAbortControllers.get(sessionId) !== capturedController)
+            || (capturedTurn !== undefined && this.activeTurns.get(sessionId) !== capturedTurn)
+            || (capturedPermissionContext !== undefined && this.permissionContexts.get(sessionId) !== capturedPermissionContext)
+            || (capturedThreadId !== undefined && this.activeSessions.get(sessionId) !== capturedThreadId);
+        if (capturedStream !== undefined && this.activeStreams.get(sessionId) === capturedStream)
+            this.activeStreams.delete(sessionId);
+        if (capturedController !== undefined && this.activeAbortControllers.get(sessionId) === capturedController)
+            this.activeAbortControllers.delete(sessionId);
+        if (capturedTurn !== undefined && this.activeTurns.get(sessionId) === capturedTurn)
+            this.activeTurns.delete(sessionId);
+        if (this.pendingInterrupts.has(sessionId) && !lifecycleReplaced)
+            this.pendingInterrupts.delete(sessionId);
+        if (this.permissionContexts.get(sessionId) === capturedPermissionContext)
+            this.permissionContexts.delete(sessionId);
+        // Session-level configuration and thread indexes are shared by later
+        // runs. Only remove them when the captured lifecycle still owns the key.
+        if (!lifecycleReplaced) {
+            if (this.activeSessions.get(sessionId) === capturedThreadId)
+                this.activeSessions.delete(sessionId);
+            this.chatModes.delete(sessionId);
+            this.cleanupSessionTempDir(sessionId);
+            if (capturedThreadId) {
+                this.threadProjectPaths.delete(capturedThreadId);
+                this.threadDelegationCarriers.delete(capturedThreadId);
+                this.unbindExternalToolBoundary(capturedThreadId);
+            }
+            this.clearTrackedApprovalItemsForThread(capturedThreadId);
+            this.pruneThreadOperationLocks();
         }
-        this.clearTrackedApprovalItemsForThread(threadId);
-        this.pruneThreadOperationLocks();
     }
     resolveSessionFile(agentSessionId, _projectPath) {
         // Codex session 文件: ~/.codex/sessions/YYYY/MM/DD/rollout-*-{threadId}.jsonl
@@ -1333,54 +1512,67 @@ export class CodexRunner {
         this.unbindExternalToolBoundary(threadId);
         this.clearTrackedApprovalItemsForThread(threadId);
         this.pruneThreadOperationLocks();
-        this.onSessionIdUpdate?.(sessionId, '');
+        await this.onSessionIdUpdate?.(sessionId, '');
         return true;
     }
-    async compactSession(_sessionId, agentSessionId, _projectPath) {
+    async compactSession(_sessionId, agentSessionId, _projectPath, modelOverride) {
+        const startedAt = Date.now();
+        const finish = (result) => {
+            logger.info(`[CodexRunner] Compact result: thread=${agentSessionId} ok=${result.ok} code=${result.ok ? 'ok' : result.code} durationMs=${result.durationMs}`);
+            return result;
+        };
         const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId, _sessionId), 'compact');
         try {
             const appServer = this.getAppServerClient();
             this.onCompactStart?.(_sessionId);
             try {
-                return await this.startAndWaitForCompact(appServer, agentSessionId);
+                await this.startAndWaitForCompact(appServer, agentSessionId);
+                return finish({ ok: true, durationMs: Date.now() - startedAt });
             }
             catch (error) {
                 if (!this.isThreadNotFoundError(error))
                     throw error;
                 logger.info(`[CodexRunner] Compact thread not loaded, resuming before compact: ${agentSessionId}`);
-                // 优先用 per-session 模式派生（与 runQuery 一致），缺省回落实例级
-                const compactMode = this.chatModes.get(_sessionId) ?? this.currentMode;
+                const compactMode = normalizeExecutionPermissionMode(modelOverride?.permissionMode ?? this.chatModes.get(_sessionId) ?? this.currentMode);
+                const compactModel = modelOverride?.model || this.model;
+                const compactEffort = modelOverride?.effortMode === 'model_default'
+                    ? undefined
+                    : modelOverride?.effort ?? this.effort;
                 const compactPolicy = this.toApprovalPolicy(compactMode);
                 const executionSandbox = this.buildExecutionSandboxOptions(_sessionId, compactMode, _projectPath);
                 const capabilityConfig = await this.resolveCapabilityThreadConfig(_projectPath);
-                const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, _projectPath, capabilityConfig, compactMode);
-                await this.assertProactiveHookAvailability(_sessionId, appServer);
+                const externalToolConfig = compactMode === 'fullaccess'
+                    ? {}
+                    : await this.resolveExternalToolApprovalConfig(appServer, _projectPath, capabilityConfig, compactMode);
+                if (compactMode !== 'fullaccess')
+                    await this.assertProactiveHookAvailability(_sessionId, appServer);
                 const compactDelegationCarrier = this.threadDelegationCarriers.get(agentSessionId)
                     ?? this.createDelegationCarrier();
                 await appServer.threadResume(agentSessionId, _projectPath, {
-                    model: this.model,
-                    effort: this.effort,
+                    model: compactModel,
+                    effort: compactEffort,
                     approvalPolicy: compactPolicy,
                     approvalsReviewer: 'user',
                     ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig()), compactMode),
+                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
                 });
                 this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
                 this.threadDelegationCarriers.set(agentSessionId, compactDelegationCarrier);
                 this.bindExternalToolBoundary(agentSessionId, externalToolConfig);
-                return await this.startAndWaitForCompact(appServer, agentSessionId);
+                await this.startAndWaitForCompact(appServer, agentSessionId);
+                return finish({ ok: true, durationMs: Date.now() - startedAt });
             }
         }
         catch (error) {
-            logger.error('[CodexRunner] Compact failed:', error);
-            return false;
+            const message = error instanceof Error ? error.message : String(error);
+            return finish({ ok: false, code: 'sdk_error', message, durationMs: Date.now() - startedAt });
         }
         finally {
             release();
         }
     }
-    async compact(sessionId, agentSessionId, projectPath) {
-        return this.compactSession(sessionId, agentSessionId, projectPath);
+    async compact(sessionId, agentSessionId, projectPath, modelOverride) {
+        return this.compactSession(sessionId, agentSessionId, projectPath, modelOverride);
     }
     async startAndWaitForCompact(appServer, threadId) {
         const completion = this.waitForThreadCompacted(appServer, threadId, Date.now());
@@ -1527,7 +1719,7 @@ export class CodexRunner {
             approvalPolicy: this.toApprovalPolicy(mode),
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, delegationCarrier), this.buildLifecycleLockdownConfig()), mode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, delegationCarrier), this.buildLifecycleLockdownConfig(mode)), mode),
         });
         const forkedThreadId = response.thread?.id;
         if (!forkedThreadId)
@@ -1654,7 +1846,12 @@ export class CodexRunner {
         }
         if (request.method === 'item/tool/requestUserInput') {
             const trackedItem = this.findTrackedApprovalItem(params);
+            const requestSessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
+            const trustedFullAccess = (this.chatModes.get(requestSessionKey) ?? this.currentMode) === 'fullaccess'
+                && this.isTrustedFullAccessSession(requestSessionKey);
             if (trackedItem?.type === 'mcpToolCall') {
+                if (trustedFullAccess)
+                    return this.handleMcpToolApproval(params, trackedItem);
                 const unattendedDenial = await this.denyUnattendedExternalToolApproval(params, `MCP:${String(trackedItem.server || 'unknown')}/${String(trackedItem.tool || 'unknown')}`, request.id);
                 if (unattendedDenial)
                     return unattendedDenial;
@@ -1664,6 +1861,12 @@ export class CodexRunner {
                 return this.handleToolRequestUserInput(params);
             }
             if (this.looksLikeExternalToolApproval(params.questions)) {
+                // In trusted fullaccess, an untracked approval prompt is still an SDK
+                // permission surface, not ordinary model/user interaction. The
+                // fullaccess branch in handleMcpToolApproval deliberately does not
+                // require capability-bound metadata and selects a one-shot allow.
+                if (trustedFullAccess)
+                    return this.handleMcpToolApproval(params, {});
                 const unattendedDenial = await this.denyUnattendedExternalToolApproval(params, 'MCP:untracked', request.id);
                 if (unattendedDenial)
                     return unattendedDenial;
@@ -1690,6 +1893,17 @@ export class CodexRunner {
                 ? 'FileChange'
                 : 'Bash';
         const toolInput = this.buildPermissionInput(request.method, params);
+        // A trusted fullaccess run has already been explicitly authorized by the
+        // daemon owner. Do not route its approvals through ordinary capability,
+        // workspace, or unattended-trigger policy checks.
+        if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
+            if (!this.isTrustedFullAccessSession(sessionKey)) {
+                return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            }
+            const response = this.toAppServerApprovalResponse(request.method, 'allow', toolInput, false);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'allow', 'approval', undefined, 'trusted fullaccess execution');
+            return response;
+        }
         // proactive 模式行为策略（首次工具调用必须是 ec msg send）
         const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         if (policyResult?.block) {
@@ -1705,6 +1919,11 @@ export class CodexRunner {
                     toolName,
                     ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
                     policyCode: policyResult.policyCode ?? 'session_policy_hook',
+                    decisionSource: 'policy',
+                    agentAid: permissionContext?.selfAid,
+                    agentName: permissionContext?.agentName,
+                    sessionId: sessionKey,
+                    permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
                     summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
                     effect: 'operation_skipped',
                 });
@@ -1727,13 +1946,15 @@ export class CodexRunner {
         }
         const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
         const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
-        logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${summary}`);
+        const logSummary = formatApprovalLogSummary(summary);
+        logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${logSummary}`);
         const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
             || request.method === 'execCommandApproval';
         const managedEcIntent = isCommandApproval && this.isManagedEvolcoreCommandIntent(toolInput);
-        const approvedCommand = isCommandApproval
-            ? this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionKey))
+        const canonicalEcApproval = isCommandApproval
+            ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey))
             : undefined;
+        const approvedCommand = canonicalEcApproval?.argv;
         const denyInfrastructure = async (policyCode, message) => {
             logger.warn(`[CodexRunner] ${message}: session=${sessionKey} requestId=${request.id ?? '<missing>'}`);
             try {
@@ -1747,8 +1968,9 @@ export class CodexRunner {
                     policyCode,
                     decisionSource: 'infrastructure',
                     agentAid: permissionContext?.selfAid,
+                    agentName: permissionContext?.agentName,
                     sessionId: sessionKey,
-                    permissionMode: normalizePermissionMode(sessionMode).mode,
+                    permissionMode: normalizeExecutionPermissionMode(sessionMode),
                     summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
                     effect: 'operation_skipped',
                 });
@@ -1757,11 +1979,13 @@ export class CodexRunner {
                 logger.warn(`[CodexRunner] failed to record infrastructure approval denial: session=${sessionKey} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
             }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode, message);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode, message, canonicalEcApproval?.parseFailure);
             return response;
         };
         if (managedEcIntent && !approvedCommand) {
-            return await denyInfrastructure('ec_command_not_canonical', 'EC command approval denied because no canonical argv could be derived');
+            return await denyInfrastructure('ec_command_not_canonical', canonicalEcApproval?.parseFailure
+                ? `EC command approval denied because canonical argv parsing failed (${canonicalEcApproval.parseFailure.issue})`
+                : 'EC command approval denied because no canonical argv could be derived');
         }
         try {
             const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
@@ -1798,20 +2022,22 @@ export class CodexRunner {
             throw error;
         }
     }
-    logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode, reason) {
+    logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode, reason, parseFailure) {
         const context = this.permissionContexts.get(sessionKey);
         auditCodexApprovalDecision({
             requestId: request.id !== undefined ? String(request.id) : undefined,
             method: request.method,
             sessionId: sessionKey,
             agentAid: context?.selfAid,
+            agentName: context?.agentName,
             toolName,
             decision,
             decisionSource,
             policyCode,
-            permissionMode: normalizePermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode).mode,
+            permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
             role: context?.role,
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
+            parseFailure,
         });
         logger.info(`[CodexRunner] app-server approval audit ${JSON.stringify({
             requestId: request.id !== undefined ? String(request.id) : undefined,
@@ -1821,6 +2047,7 @@ export class CodexRunner {
             decision,
             decisionSource,
             ...(policyCode ? { policyCode } : {}),
+            ...(parseFailure ? { parseFailure } : {}),
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             executed: false,
         })}`);
@@ -1910,6 +2137,12 @@ export class CodexRunner {
                     ? { requestId: String(requestId) }
                     : {}),
                 policy: context.approvalRouting?.approverPolicy ?? 'requester',
+                policyCode: 'permission_mode_denied',
+                decisionSource: 'policy',
+                agentAid: context.selfAid,
+                agentName: context.agentName,
+                sessionId: sessionKey,
+                permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
                 summary: `${toolName} runtime authorization denied by unattended Trigger policy`,
                 effect: 'operation_skipped',
             });
@@ -1924,6 +2157,27 @@ export class CodexRunner {
         const questions = Array.isArray(params.questions) ? params.questions : [];
         if (questions.length === 0)
             throw new Error('Codex MCP 审批未包含问题，已拒绝');
+        const sessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
+        if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
+            if (!this.isTrustedFullAccessSession(sessionKey))
+                return this.denyUntrackedExternalToolApproval(params);
+            const answers = {};
+            for (const question of questions) {
+                const questionId = typeof question.id === 'string' ? question.id : `q-${Object.keys(answers).length + 1}`;
+                const labels = Array.isArray(question.options)
+                    ? question.options.map((option) => typeof option?.label === 'string' ? option.label.trim() : '').filter(Boolean)
+                    : [];
+                let answer = '';
+                try {
+                    answer = this.selectMcpApprovalAnswer(question, true);
+                }
+                catch {
+                    answer = labels[0] ?? 'allow';
+                }
+                answers[questionId] = { answers: [answer] };
+            }
+            return { answers };
+        }
         const hasExactIdentity = typeof trackedItem.server === 'string'
             && trackedItem.server.length > 0
             && typeof trackedItem.tool === 'string'
@@ -1940,7 +2194,6 @@ export class CodexRunner {
             logger.warn(`[CodexRunner] MCP approval denied because the hardened external-tool config is unbound: thread=${threadId ?? '<missing>'}`);
             return this.denyUntrackedExternalToolApproval(params);
         }
-        const sessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
         const server = trackedItem.server;
         const tool = trackedItem.tool;
         const isAppCall = typeof trackedItem.mcpAppResourceUri === 'string'
@@ -1964,7 +2217,7 @@ export class CodexRunner {
         };
         const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         const workspacePath = this.resolvePermissionWorkspacePath(params);
-        const mode = normalizePermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode).mode;
+        const mode = normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode);
         // MCP servers are inherited unless capability config explicitly disables
         // them. Apps retain their separate request/bypass lifecycle policy.
         let allow = !policyResult?.block
@@ -2084,7 +2337,8 @@ export class CodexRunner {
                     chatmode: context.chatmode,
                     replyContext: context.replyContext,
                 });
-                sent = !!await sendInteractionPayload(context.adapter, envelope, interaction, undefined, context.replyContext);
+                const receipt = await sendInteractionPayload(context.adapter, envelope, interaction, undefined, context.replyContext);
+                sent = isInteractionSendAccepted(receipt);
             }
             if (!sent) {
                 await sendPrompt(renderActionAsText(interaction));
@@ -2239,7 +2493,7 @@ export class CodexRunner {
             // Revalidate ownership, mode, and parent containment at the final
             // readonly decision. The map entry alone is stale if the directory was
             // replaced between preflight and the approval callback.
-            managedTempDir: this.getManagedTempDir(sessionKey),
+            managedTempDir: permCtx?.managedTempDir ?? this.getManagedTempDir(sessionKey),
             allowReadonlySourceDiagnostics: permCtx?.allowReadonlySourceDiagnostics === true,
         } : undefined;
         if (toolName === 'Bash')
@@ -2355,8 +2609,14 @@ export class CodexRunner {
             && this.fileChangeRequiresExpansion(toolInput, workspacePath, sessionKey);
         // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
-        const mode = normalizePermissionMode(rawMode).mode;
-        const recordBlockedOperation = async (policyCode, operationInput = toolInput, denialReason = 'policy denied') => {
+        const mode = normalizeExecutionPermissionMode(rawMode);
+        if (rawMode === 'fullaccess') {
+            if (!this.isTrustedFullAccessSession(sessionKey)) {
+                return 'deny';
+            }
+            return 'allow';
+        }
+        const recordBlockedOperation = async (policyCode, operationInput = toolInput, denialReason = 'policy denied', matchedPath) => {
             const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
             auditToolPreflightDenial({
                 toolName,
@@ -2365,6 +2625,7 @@ export class CodexRunner {
                 summary,
                 sessionId: sessionKey,
                 agentAid: permissionContext?.selfAid,
+                agentName: permissionContext?.agentName,
                 permissionMode: mode,
                 channel: permissionContext?.channel,
                 actorId: permissionContext?.userId,
@@ -2372,6 +2633,7 @@ export class CodexRunner {
                 selfAid: permissionContext?.selfAid,
                 requestId: typeof requestId === 'string' || typeof requestId === 'number' ? String(requestId) : undefined,
                 taskId: permissionContext?.taskId,
+                matchedPath,
             });
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
@@ -2384,6 +2646,7 @@ export class CodexRunner {
                     policyCode,
                     decisionSource: 'policy',
                     agentAid: permissionContext?.selfAid,
+                    agentName: permissionContext?.agentName,
                     permissionMode: mode,
                     summary,
                     effect: 'operation_skipped',
@@ -2398,7 +2661,7 @@ export class CodexRunner {
             // An unavailable registered root must fail closed; the policy helper
             // distinguishes this explicit empty value from runners without a
             // session-temp capability.
-            managedTempDir: this.getManagedTempDir(sessionKey) ?? '',
+            managedTempDir: permissionContext?.managedTempDir ?? this.getManagedTempDir(sessionKey) ?? '',
             allowProtectedMetadata: false,
             selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
@@ -2413,7 +2676,7 @@ export class CodexRunner {
             logger.warn(`[CodexRunner] tool preflight denied: session=${sessionKey} tool=${toolName} ` +
                 `policy=${preflight.policyCode ?? 'unknown'} reason=${preflight.message ?? 'policy denied'}`);
             if (preflight.policyCode) {
-                await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied');
+                await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied', preflight.matchedPath);
             }
             return 'deny';
         }
@@ -2685,7 +2948,8 @@ export class CodexRunner {
         const input = [{ type: 'text', text: prompt, text_elements: [] }];
         if (!images?.length)
             return input;
-        const tmpDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR
+        const tmpDir = getManagedTaskTempDir(runtimeEnv)
+            ?? runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR
             ?? (sessionId ? this.getManagedTempDir(sessionId) : undefined)
             ?? process.env.TMPDIR;
         if (!tmpDir || !path.isAbsolute(tmpDir))
@@ -2728,7 +2992,7 @@ export class CodexRunner {
         }
         return !state.turnId || !turnId || turnId === state.turnId;
     }
-    async *transformAppServerStream(notifications, sessionId, state, unsubscribe, tempFiles) {
+    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, tempFiles) {
         try {
             yield { type: 'session_id', sessionId: state.threadId };
             for await (const notification of notifications) {
@@ -2739,8 +3003,14 @@ export class CodexRunner {
         }
         finally {
             unsubscribe();
-            this.activeAbortControllers.delete(sessionId);
-            this.activeTurns.delete(sessionId);
+            if (this.activeAbortControllers.get(sessionId) === controller) {
+                this.activeAbortControllers.delete(sessionId);
+            }
+            const activeTurn = this.activeTurns.get(sessionId);
+            if (activeTurn?.threadId === state.threadId
+                && (!state.turnId || activeTurn.turnId === state.turnId)) {
+                this.activeTurns.delete(sessionId);
+            }
             this.cleanupTempFiles(tempFiles);
         }
     }
@@ -3361,11 +3631,9 @@ export class CodexAgentPlugin {
             agents: {
                 codex: {
                     ...(override || {}),
-                    evolcoreAgentAid: agent.config.aid,
-                    evolcoreAgentConfig: agent.config,
                 },
             },
         };
-        return { evolagentName: agent.name, baseagent: 'codex', agent: new CodexRunner(merged, callbacks) };
+        return { evolagentName: agent.name, baseagent: 'codex', agent: new CodexRunner(merged, callbacks, { agentAid: agent.config.aid, agentConfig: agent.config }) };
     }
 }