evolcore 0.0.2 → 0.0.3

package/dist/core/message/response-engine.js

@@ -428,14 +428,47 @@ export class ResponseEngine {
         if (!session)
             return;
         this.turnCoordinator.hydrate(session);
-        this.turnCoordinator.invalidate(sessionId, reason);
+        const interruptedTurn = this.turnCoordinator.invalidate(sessionId, reason);
+        const interruptedTaskId = interruptedTurn?.active?.taskId;
         this.interruptedSessions.set(sessionId, reason);
         await this.interactionRouter?.cancelAll(sessionId, reason);
-        const agent = this.getAgent(session.metadata?.channelKey || session.channel, session.baseagent, session.selfAID);
-        await agent.interrupt(sessionId).catch(error => {
+        const channelKey = session.metadata?.channelKey || session.channel;
+        const agent = this.getAgent(channelKey, session.baseagent, session.selfAID);
+        const terminalStatus = (() => {
+            // TimeoutController owns timeout delivery (including user-facing timeout
+            // details) and already guarantees a single terminal status. Sending it
+            // here as well would race that barrier and duplicate status.timeout.
+            if (!interruptedTaskId || reason === 'timeout')
+                return Promise.resolve();
+            const channelInfo = this.resolveChannelInfo(channelKey);
+            if (!channelInfo)
+                return Promise.resolve();
+            const envelope = buildEnvelope({
+                taskId: interruptedTaskId,
+                sessionId: session.id,
+                channel: channelInfo.adapter.channelName,
+                channelId: session.channelId,
+                agentName: agent.name,
+                chatmode: this.resolveEffectiveChatmodeForSession(session, channelKey, session.channelId),
+                replyContext: {
+                    ...(session.metadata?.replyContext ?? {}),
+                    sessionId: session.id,
+                    threadId: session.threadId || session.metadata?.replyContext?.threadId,
+                },
+            });
+            const payload = {
+                kind: 'status.interrupted',
+                metadata: { reason },
+            };
+            return channelInfo.adapter.send(envelope, payload).then(() => undefined).catch(error => {
+                logger.debug(`[ResponseEngine] interrupt terminal status failure: session=${sessionId} task=${interruptedTaskId} error=${error instanceof Error ? error.message : String(error)}`);
+            });
+        })();
+        const runnerInterrupt = agent.interrupt(sessionId).catch(error => {
             logger.debug(`[ResponseEngine] interrupt barrier runner failure: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
         });
-        const taskId = await this.turnCoordinator.completeInterrupt(session, reason);
+        await Promise.all([terminalStatus, runnerInterrupt]);
+        const taskId = (await this.turnCoordinator.completeInterrupt(session, reason)) ?? interruptedTaskId;
         if (taskId) {
             this.sessionManager.clearProcessingIfTask(sessionId, taskId);
             if (this.activeTaskRuntimeContexts.get(sessionId)?.taskId === taskId) {
@@ -986,19 +1019,34 @@ export class ResponseEngine {
         let rejectFn;
         let lastIdleSec = 0;
         let timeoutTriggered = false;
+        const timeoutControl = {
+            claimedByInternal: false,
+            terminalDelivered: false,
+            claim: () => {
+                if (!timeoutControl.error || this.interruptedSessions.get(session.id) !== 'timeout')
+                    return undefined;
+                timeoutControl.claimedByInternal = true;
+                return timeoutControl.error;
+            },
+        };
         const rejectAfterInterruptBarrier = (error) => {
             if (timeoutTriggered)
                 return;
             timeoutTriggered = true;
+            timeoutControl.error = error;
             this.timeoutErrors.set(session.id, error);
             this.turnCoordinator.hydrate(session);
             this.turnCoordinator.invalidate(session.id, 'timeout');
             this.interruptedSessions.set(session.id, 'timeout');
-            void this.interruptSession(session.id, 'timeout')
+            const barrier = this.interruptSession(session.id, 'timeout')
                 .catch(interruptError => {
                 logger.debug(`[ResponseEngine] Timeout interrupt barrier failed: ${interruptError instanceof Error ? interruptError.message : String(interruptError)}`);
-            })
-                .finally(() => rejectFn(error));
+            });
+            timeoutControl.barrier = barrier;
+            void barrier.finally(() => {
+                if (!timeoutControl.claimedByInternal)
+                    rejectFn(error);
+            });
         };
         const triggerAttemptId = message.replyContext?.metadata?.triggerAttemptId;
         const resetTimer = (eventType, toolName) => {
@@ -1052,13 +1100,27 @@ export class ResponseEngine {
             totalExecutionTimer.unref?.();
         });
         try {
+            const processingPromise = this._processMessageInternal(message, session, absoluteProjectPath, resetTimer, shouldSuppress, () => lastIdleSec, outputState, timeoutControl);
+            const guardedProcessingPromise = processingPromise.then(async () => {
+                if (!timeoutControl.error)
+                    return;
+                await timeoutControl.barrier;
+                throw timeoutControl.error;
+            });
             await Promise.race([
-                this._processMessageInternal(message, session, absoluteProjectPath, resetTimer, shouldSuppress, () => lastIdleSec, outputState),
+                guardedProcessingPromise,
                 timeoutPromise,
                 totalExecutionPromise,
             ]);
         }
         catch (error) {
+            if (error instanceof Error && (error.message === 'SDK_TIMEOUT' || error.message === 'TOTAL_EXECUTION_TIMEOUT')) {
+                await timeoutControl.barrier;
+                if (!timeoutControl.terminalDelivered) {
+                    await timeoutControl.deliverUnhandled?.(error);
+                }
+                this.timeoutErrors.delete(session.id);
+            }
             // 超时错误：kill 级别已发送诊断信息，无需再发
             // 非超时错误走通用处理
             // 记录错误到健康状态（复用已有 session）
@@ -1112,7 +1174,7 @@ export class ResponseEngine {
             : 60 * 60 * 1000;
     }
     /** 自动安全模式已禁用：仅保留错误计数，不再自动切换状态 */
-    async _processMessageInternal(message, session, absoluteProjectPath, resetTimer, shouldSuppress, getLastIdleSec, outputState = { middleOutputMode: 'all' }) {
+    async _processMessageInternal(message, session, absoluteProjectPath, resetTimer, shouldSuppress, getLastIdleSec, outputState = { middleOutputMode: 'all' }, timeoutControl) {
         const messageId = `${message.channel}_${message.channelId}_${message.timestamp || Date.now()}`;
         const channelKey = this.messageChannelKey(message, session);
         const channelInfo = this.resolveChannelInfo(channelKey);
@@ -1386,6 +1448,71 @@ export class ResponseEngine {
             replyContext: taskReplyContext(),
             causation: taskCausation,
         });
+        if (timeoutControl) {
+            timeoutControl.deliverUnhandled = async (timeoutError) => {
+                if (timeoutControl.terminalDelivered)
+                    return;
+                timeoutControl.terminalDelivered = true;
+                const isTotalExecutionTimeout = timeoutError.message === 'TOTAL_EXECUTION_TIMEOUT';
+                const totalExecutionMs = this.totalExecutionLimitMs();
+                const statusPayload = {
+                    kind: 'status.timeout',
+                    metadata: isTotalExecutionTimeout
+                        ? { totalExecutionMs }
+                        : { idleSec: getLastIdleSec?.() || undefined },
+                };
+                const idleSec = getLastIdleSec?.() || 0;
+                const userMessage = isTotalExecutionTimeout
+                    ? `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`
+                    : idleSec > 0
+                        ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断`
+                        : '⚠️ 任务超时，已自动中断';
+                agent.cleanupStream(streamKey);
+                this.sessionManager.clearProcessingIfTask(session.id, taskId);
+                if (this.activeTaskRuntimeContexts.get(session.id)?.taskId === taskId) {
+                    this.activeTaskRuntimeContexts.delete(session.id);
+                }
+                this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                const daemonTrigger = this.isTrustedDaemonTrigger(message);
+                if (!daemonTrigger) {
+                    await adapter.send(envelope, statusPayload).catch(() => { });
+                }
+                await adapter.send(envelope, {
+                    kind: 'result.error',
+                    text: userMessage,
+                    reason: isTotalExecutionTimeout ? 'total_execution_timeout' : 'timeout',
+                }).catch(() => { });
+                if (daemonTrigger) {
+                    await adapter.send(envelope, statusPayload).catch(() => { });
+                }
+                this.touchAgentActivity(channelKey);
+                this.publishTriggerExecutionFailure(message, timeoutError.message, {
+                    messageId,
+                    causation: taskCausation,
+                });
+                const errorType = prefixErrorType(ERROR_PREFIX.INFRA, classifyError(timeoutError));
+                this.eventBus.publish({
+                    type: 'task:error',
+                    sessionId: session.id,
+                    error: timeoutError.message,
+                    errorType,
+                    agentName: agentNameForStats,
+                    causation: taskCausation,
+                });
+                recordCausationSpan(taskCausation, 'task.run', {
+                    status: 'failed',
+                    refs: { taskId, sessionId: session.id, messageId },
+                    reason: errorType,
+                });
+                logger.message({
+                    msgId: messageId,
+                    sessionId: session.id,
+                    dir: 'inbound',
+                    status: 'failed',
+                    error: timeoutError.message,
+                });
+            };
+        }
         try {
             const isBackground = this.isBackgroundSession(session, message.channel, message.channelId);
             // 记录收到消息
@@ -1474,10 +1601,24 @@ export class ResponseEngine {
             const peerShort = peerId ? peerId.split('.')[0].split(':')[0] : '?';
             const peerLabel = peerName && peerName !== peerShort ? `${peerShort}(${peerName})` : peerShort;
             logger.info(`[ResponseEngine] session=${session.id} task=${taskId} peer=${peerLabel} chatType=${session.chatType} chatMode=${effectiveChatMode} baseagent=${session.baseagent} msgChatType=${message.chatType ?? 'n/a'}`);
+            // Establish the durable turn before exposing any processing state. This
+            // lets an immediate /stop or replacement message close the same task and
+            // prevents a BusinessTrip reaction from becoming orphaned during setup.
+            turnLease = await this.turnCoordinator.begin(session, taskId);
             // 记录开始处理
             const taskEncrypt = message.replyContext?.metadata?.encrypted != null ? !!(message.replyContext.metadata.encrypted) : undefined;
             this.eventBus.publish({ type: 'task:started', sessionId: session.id, agentName: agentNameForStats, encrypt: taskEncrypt, chatmode, causation: taskCausation });
             this.touchAgentActivity(channelKey);
+            // Upgrade the channel acknowledgement at task start, before compaction and
+            // runner setup, so processing feedback remains visible for the whole run.
+            // Trigger messageId is an internal runId and has no channel reaction.
+            if (message.messageId && message.source !== 'trigger') {
+                adapter.promoteAck?.(message.messageId, {
+                    taskId,
+                    channelId: message.channelId,
+                    messageIds: message.sourceMessageIds,
+                }).catch(() => { });
+            }
             adapter.send(envelope, { kind: 'status.started' }).catch(() => { });
             await this.runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, adapter, envelope, false);
             logger.message({
@@ -1659,7 +1800,6 @@ export class ResponseEngine {
                     recordTriggerExecutionAnomaly(triggerRunId, anomaly);
                 }
                 : undefined;
-            turnLease = await this.turnCoordinator.begin(session, taskId);
             // 设置权限审批的交互上下文（支持交互卡片）
             agent.setPermissionContext?.(session.id, {
                 sendPrompt: permissionPromptForOrigin,
@@ -2270,11 +2410,6 @@ export class ResponseEngine {
                         logger.error('[ResponseEngine] Failed to record retry health status:', statusError);
                     }
                 };
-                // Runner 开始执行前：将 Pin 升级为 CheckMark（表示"正在处理"）。
-                // Trigger messageId is an internal runId, so there is no channel ack to promote.
-                if (message.messageId && message.source !== 'trigger') {
-                    adapter.promoteAck?.(message.messageId).catch(() => { });
-                }
                 while (true) {
                     let streamRegistered = false;
                     try {
@@ -2383,6 +2518,10 @@ export class ResponseEngine {
                     throw error;
                 }
             }
+            const pendingTimeoutError = timeoutControl?.claim();
+            if (pendingTimeoutError) {
+                throw pendingTimeoutError;
+            }
             if (permissionTerminalFailure) {
                 renderer.discardPending();
                 streamResult = {
@@ -2734,6 +2873,12 @@ export class ResponseEngine {
                     return;
                 }
                 const durationMs = Date.now() - startTime;
+                const statsModel = streamResult.lastModelCall?.model
+                    || streamResult.model
+                    || streamResult.contextUsage?.model
+                    || modelOverride?.model
+                    || agentModel
+                    || 'unknown';
                 // ── Stats: 写入 usage_events（在 status.completed 之前，以便带上 cost） ──
                 // cost 含原价(official)与网关实际价(gateway)两套，由 insertUsageEvent 写库时一并算出。
                 let turnCost = { official: null, gateway: null };
@@ -2745,7 +2890,6 @@ export class ResponseEngine {
                             || (configActorId
                                 ? formatPeerKey(configChannelType, configActorId)
                                 : formatPeerKey(configChannelType, message.channelId));
-                        const statsModel = streamResult.contextUsage?.model || 'unknown';
                         const ctxPct = streamResult.contextUsage?.percentage;
                         const event = normalizeUsage(streamResult.tokenUsage, {
                             ts: Date.now(),
@@ -2803,7 +2947,6 @@ export class ResponseEngine {
                 try {
                     const { resolveModelSpec } = await import('../../stats/billing.js');
                     const { querySessionSummary } = await import('../../stats/query.js');
-                    const statsModel = streamResult.contextUsage?.model || 'unknown';
                     modelSpec = resolveModelSpec(resolveRoot(), statsModel);
                     const sum = querySessionSummary(resolveRoot(), session.id);
                     if (sum.calls > 0) {
@@ -2848,7 +2991,7 @@ export class ResponseEngine {
                         let lastModelCall = streamResult.lastModelCall;
                         if (lastModelCall?.tokenUsage) {
                             try {
-                                const lastModel = lastModelCall.model || streamResult.contextUsage?.model || 'unknown';
+                                const lastModel = lastModelCall.model || statsModel;
                                 const lastEvent = normalizeUsage(lastModelCall.tokenUsage, {
                                     ts: Date.now(), agent_aid: '', peer_key: '', session_id: session.id,
                                     model: lastModel, turns: 1,
@@ -2950,7 +3093,14 @@ export class ResponseEngine {
             });
         }
         catch (error) {
-            if (error instanceof Error && (error.message === 'SDK_TIMEOUT' || error.message === 'TOTAL_EXECUTION_TIMEOUT')) {
+            const authoritativeTimeoutError = timeoutControl?.claim();
+            if (authoritativeTimeoutError) {
+                error = authoritativeTimeoutError;
+                await timeoutControl?.barrier;
+            }
+            const handlingTimeout = error instanceof Error
+                && (error.message === 'SDK_TIMEOUT' || error.message === 'TOTAL_EXECUTION_TIMEOUT');
+            if (handlingTimeout) {
                 this.timeoutErrors.delete(session.id);
             }
             const leaseWasCurrent = !!turnLease && this.turnCoordinator.isCurrent(turnLease);
@@ -3055,7 +3205,7 @@ export class ResponseEngine {
             if (isUserInterrupt) {
                 logger.info(`[ResponseEngine] User interrupt by new_message, skip sending error message`);
             }
-            else if (error?._errorAlreadySent && !retryExhaustedCount) {
+            else if (error?._errorAlreadySent && !retryExhaustedCount && !isTimeout && !isTotalExecutionTimeout) {
                 logger.info(`[ResponseEngine] Error already sent via renderer, skip sending duplicate message`);
             }
             else {
@@ -3103,6 +3253,9 @@ export class ResponseEngine {
                     }).catch(() => { });
                 }
             }
+            if (handlingTimeout && timeoutControl) {
+                timeoutControl.terminalDelivered = true;
+            }
         }
         // [迁移探针] 任务收尾：记录工具提醒最终状态并落盘（防线 1）
         if (snapshot.isEnabled()) {
@@ -3374,7 +3527,7 @@ export class ResponseEngine {
                     assistantUuid = event.assistantUuid ?? assistantUuid;
                     protocolIncompleteReason = event.protocolIncompleteReason ?? protocolIncompleteReason;
                 }
-                // 记录事件类型：高价值事件（text/tool_use/tool_result/complete/error/compact/task_progress）INFO，
+                // 记录事件类型：高价值事件（含子任务生命周期）INFO，
                 // 框架事件（session_id/state_changed/status）DEBUG
                 let eventDetail = '';
                 if (event.type === 'text' && event.text) {
@@ -3429,6 +3582,97 @@ export class ResponseEngine {
                     });
                     continue;
                 }
+                if (event.type === 'task_started') {
+                    this.eventBus.publish({
+                        type: 'runner:task-started',
+                        sessionId: session.id,
+                        taskId: event.taskId,
+                        taskKind: event.taskKind,
+                        toolUseId: event.toolUseId,
+                        description: event.description,
+                        subagentType: event.subagentType,
+                        taskType: event.taskType,
+                        workflowName: event.workflowName,
+                        prompt: event.prompt,
+                        skipTranscript: event.skipTranscript,
+                        timestamp: Date.now(),
+                        causation,
+                    });
+                    if (!event.skipTranscript) {
+                        renderer.addLifecycle('started', {
+                            scope: 'runner_task',
+                            taskId: event.taskId,
+                            taskKind: event.taskKind,
+                            toolUseId: event.toolUseId,
+                            description: event.description,
+                            subagentType: event.subagentType,
+                            taskType: event.taskType,
+                        }, `${event.taskKind === 'agent' ? 'Agent' : 'Background'} task started: ${event.description}`);
+                    }
+                    continue;
+                }
+                if (event.type === 'background_tasks_changed') {
+                    this.eventBus.publish({
+                        type: 'runner:background-tasks-changed',
+                        sessionId: session.id,
+                        tasks: event.tasks,
+                        timestamp: Date.now(),
+                        causation,
+                    });
+                    continue;
+                }
+                if (event.type === 'task_notification') {
+                    this.eventBus.publish({
+                        type: 'runner:task-notification',
+                        sessionId: session.id,
+                        taskId: event.taskId,
+                        taskKind: event.taskKind,
+                        toolUseId: event.toolUseId,
+                        description: event.description,
+                        subagentType: event.subagentType,
+                        status: event.status,
+                        outputFile: event.outputFile,
+                        summary: event.summary,
+                        usage: event.usage,
+                        skipTranscript: event.skipTranscript,
+                        timestamp: Date.now(),
+                        causation,
+                    });
+                    if (!event.skipTranscript) {
+                        const label = event.description || event.taskId;
+                        renderer.addLifecycle('completed', {
+                            scope: 'runner_task',
+                            taskId: event.taskId,
+                            taskKind: event.taskKind,
+                            toolUseId: event.toolUseId,
+                            description: event.description,
+                            subagentType: event.subagentType,
+                            status: event.status,
+                            outputFile: event.outputFile,
+                            summary: event.summary,
+                            usage: event.usage,
+                        }, `${event.taskKind === 'agent' ? 'Agent' : 'Background'} task ${event.status}: ${label}`);
+                    }
+                    continue;
+                }
+                if (event.type === 'task_progress') {
+                    this.eventBus.publish({
+                        type: 'runner:task-progress',
+                        sessionId: session.id,
+                        taskId: event.taskId,
+                        taskKind: event.taskKind,
+                        toolUseId: event.toolUseId,
+                        description: event.description,
+                        subagentType: event.subagentType,
+                        summary: event.summary,
+                        lastToolName: event.lastToolName,
+                        totalTokens: event.totalTokens,
+                        toolUses: event.toolUses,
+                        durationMs: event.durationMs,
+                        timestamp: Date.now(),
+                        causation,
+                    });
+                }
                 const isCurrentlyBackground = this.isBackgroundSession(session, session.channel, session.channelId);
                 // === 前台任务：正常处理所有事件 ===
                 if (!isCurrentlyBackground) {
@@ -3570,14 +3814,14 @@ export class ResponseEngine {
                     // 仅记录状态，最终 flush(true) 在流结束后统一执行
                     if (event.type === 'complete') {
                         const isAbort = event.terminalReason === 'aborted_streaming' || event.terminalReason === 'aborted_tools';
-                        logger.info(`[ResponseEngine] ${isAbort ? 'task interrupted' : 'complete event'}: isError=${event.isError} terminalReason=${event.terminalReason ?? 'none'} subtype=${event.subtype ?? 'none'} hasReceivedText=${hasReceivedText}`);
+                        logger.info(`[ResponseEngine] ${isAbort ? 'task interrupted' : 'complete event'}: queryFinal=${event.queryFinal !== false} isError=${event.isError} terminalReason=${event.terminalReason ?? 'none'} subtype=${event.subtype ?? 'none'} hasReceivedText=${hasReceivedText}`);
                         // 自动回填会话名称
                         if (event.sessionTitle && shouldAutoFillSessionTitle(session.name, session.threadId)) {
                             await this.sessionManager.renameSession(session.id, event.sessionTitle);
                             logger.info(`[ResponseEngine] Auto-filled session name: ${event.sessionTitle}`);
                         }
                         // 记录完成状态 + 最后一轮回复文本（后续 complete 覆盖前序）
-                        completeResult = { isError: !!event.isError, subtype: event.subtype, errors: event.errors, terminalReason: event.terminalReason, lastReplyText, fullText: event.result || '', hasReceivedText, numTurns: event.numTurns, ttftMs: event.ttftMs, tokenUsage: event.tokenUsage, contextUsage: event.contextUsage, lastModelCall: event.lastModelCall, modelCalls: event.modelCalls };
+                        completeResult = { isError: !!event.isError, subtype: event.subtype, errors: event.errors, terminalReason: event.terminalReason, lastReplyText, fullText: event.result || '', hasReceivedText, numTurns: event.numTurns, ttftMs: event.ttftMs, model: event.model, tokenUsage: event.tokenUsage, contextUsage: event.contextUsage, lastModelCall: event.lastModelCall, modelCalls: event.modelCalls };
                         if (!event.isError)
                             madeProgress = true;
                         // thought jsonl 写入已下沉到 aun.ts:sendThought 成功后，
@@ -3613,7 +3857,7 @@ export class ResponseEngine {
                         }
                         // 检测 proactive 标志位，设置 lastProactiveFlag 供模式切换提示使用
                         // [迁移点5] 标志位检查：由 ProactiveMode.onComplete 实现
-                        if (modeHooks?.mode?.onComplete && lastReplyText) {
+                        if (event.queryFinal !== false && modeHooks?.mode?.onComplete && lastReplyText) {
                             await modeHooks.mode.onComplete({
                                 session,
                                 state: modeHooks.state,
@@ -3647,7 +3891,7 @@ export class ResponseEngine {
                     logger.info(`[ResponseEngine] Auto-filled session name: ${event.sessionTitle}`);
                 }
                 // 记录完成状态
-                completeResult = { isError: !!event.isError, subtype: event.subtype, errors: event.errors, terminalReason: event.terminalReason, lastReplyText, fullText: event.result || '', hasReceivedText, numTurns: event.numTurns, ttftMs: event.ttftMs, tokenUsage: event.tokenUsage, contextUsage: event.contextUsage, lastModelCall: event.lastModelCall };
+                completeResult = { isError: !!event.isError, subtype: event.subtype, errors: event.errors, terminalReason: event.terminalReason, lastReplyText, fullText: event.result || '', hasReceivedText, numTurns: event.numTurns, ttftMs: event.ttftMs, model: event.model, tokenUsage: event.tokenUsage, contextUsage: event.contextUsage, lastModelCall: event.lastModelCall };
                 if (event.subtype === 'success')
                     madeProgress = true;
             }

package/dist/core/message/send-receipt.js

@@ -0,0 +1,24 @@
+export function sendOperationId(envelope) {
+    return envelope.operationId || envelope.taskId;
+}
+export function sentReceipt(envelope, messageIds, threadId) {
+    const messages = messageIds
+        .filter((messageId) => typeof messageId === 'string' && messageId.length > 0)
+        .map((messageId, partIndex) => ({ messageId, partIndex, threadId }));
+    if (messages.length === 0) {
+        throw new Error(`MISSING_MESSAGE_ID: operation=${sendOperationId(envelope)}`);
+    }
+    return {
+        status: 'sent',
+        operationId: sendOperationId(envelope),
+        messages: messages,
+    };
+}
+export function suppressedReceipt(envelope, reason) {
+    return {
+        status: 'suppressed',
+        operationId: sendOperationId(envelope),
+        messages: [],
+        reason,
+    };
+}

package/dist/core/message/stream-debouncer.js

@@ -27,9 +27,9 @@ export class StreamDebouncer {
      * 否则新建窗口。timer 到期后自动 flush。
      */
     submit(key, message, enqueue) {
-        const { content, images, mentions, messageId, replyContext, ...rest } = message;
+        const { content, images, mentions, messageId, sourceMessageIds, replyContext, ...rest } = message;
         return new Promise((resolve, reject) => {
-            const entry = { messageId, content, images, mentions, replyContext, rest, resolve, reject };
+            const entry = { messageId, sourceMessageIds, content, images, mentions, replyContext, rest, resolve, reject };
             const win = this.pending.get(key);
             if (win) {
                 clearTimeout(win.timer);
@@ -87,12 +87,20 @@ export class StreamDebouncer {
         const allImages = [];
         const allMentions = [];
         const contents = [];
+        const sourceMessageIds = [];
+        const seenSourceMessageIds = new Set();
         for (const e of entries) {
             contents.push(e.content);
             if (e.images)
                 allImages.push(...e.images);
             if (e.mentions)
                 allMentions.push(...e.mentions);
+            for (const id of [...(e.sourceMessageIds ?? []), ...(e.messageId ? [e.messageId] : [])]) {
+                if (!seenSourceMessageIds.has(id)) {
+                    seenSourceMessageIds.add(id);
+                    sourceMessageIds.push(id);
+                }
+            }
         }
         const last = entries[entries.length - 1];
         // 合并后保留最新一条的 messageId（用于 thought 锚定与中断追踪）
@@ -110,6 +118,7 @@ export class StreamDebouncer {
             mentions: allMentions.length > 0 ? allMentions : undefined,
             replyContext: last.replyContext,
             messageId: latestMessageId,
+            sourceMessageIds: sourceMessageIds.length > 0 ? sourceMessageIds : undefined,
         };
         const resolves = entries.map(e => e.resolve);
         const rejects = entries.map(e => e.reject);

package/dist/core/permission/tool-policy.js

@@ -347,25 +347,45 @@ export function checkReadonly(toolName, input, projectPath, context) {
     logger.warn(`[ReadonlyCheck] 🔒 Unknown tool blocked: tool=${toolName} session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
     return { behavior: 'deny', message: `🔒 只读模式：未声明为只读的工具 ${toolName} 已拒绝执行` };
 }
-/**
- * H 类文件保护（用于 PreToolUse hook）
- * H 类文件只能由受控的人类/daemon 路径处理，agent 不可直接访问
- */
-function collectStringValues(value, output) {
+const NON_FILESYSTEM_METADATA_TOOLS = new Set([
+    'Agent',
+    'AskUserQuestion',
+    'CronCreate',
+    'CronDelete',
+    'CronList',
+    'EnterPlanMode',
+    'ExitPlanMode',
+    'SendMessage',
+    'Skill',
+    'Task',
+    'TaskCreate',
+    'TaskGet',
+    'TaskList',
+    'TaskOutput',
+    'TaskStop',
+    'TaskUpdate',
+    'TeamCreate',
+    'TeamDelete',
+    'TodoWrite',
+    'ToolSearch',
+    'WebFetch',
+    'WebSearch',
+]);
+function collectOpaqueToolStrings(value, output) {
     if (typeof value === 'string') {
-        output.push(value);
+        if (value.trim())
+            output.push(value);
         return;
     }
     if (Array.isArray(value)) {
         for (const entry of value)
-            collectStringValues(entry, output);
+            collectOpaqueToolStrings(entry, output);
         return;
     }
     if (!value || typeof value !== 'object')
         return;
-    for (const [key, entry] of Object.entries(value)) {
-        output.push(key);
-        collectStringValues(entry, output);
+    for (const entry of Object.values(value)) {
+        collectOpaqueToolStrings(entry, output);
     }
 }
 function collectPermissionPathSpec(value, output, projectRootSubpaths) {
@@ -604,9 +624,18 @@ export function checkHClassWrite(toolName, input, context) {
         collectFilesystemGrantPaths(input.additionalPermissions, grantPaths, projectRootGrantSubpaths);
         collectFilesystemGrantPaths(input.permissions, grantPaths, projectRootGrantSubpaths);
     }
-    else {
-        collectStringValues(input, paths);
-    }
+    else if (!NON_FILESYSTEM_METADATA_TOOLS.has(toolName)) {
+        // Opaque external tools may run outside the Claude/Codex filesystem
+        // sandbox. Retain conservative string inspection for those tools, while
+        // excluding known orchestration tools whose payload is only metadata.
+        collectOpaqueToolStrings(input, paths);
+    }
+    // Agent/Skill/Task and other orchestration tools carry natural-language
+    // metadata, not direct filesystem operands. Treating every string in their
+    // payload as a path makes a prompt that merely mentions daemon.json or a
+    // *.json_ backup indistinguishable from an actual file access. Any nested
+    // filesystem operation is checked again when it reaches Read/Write/Bash,
+    // FileChange, or PermissionGrant above.
     const pathOptions = { cwd: context?.projectPath, root: context?.root };
     if (requestsFilesystemRoot(input.permissions) || requestsFilesystemRoot(input.additionalPermissions)) {
         logger.warn(`[H-Class Protection] 🔒 Permission grant covers filesystem root: tool=${toolName} ` +
@@ -729,9 +758,12 @@ export function checkLClassWrite(toolName, input, context) {
         collectFilesystemWriteGrantPaths(input.additionalPermissions, writeGrantPaths, projectRootWriteSubpaths);
         collectFilesystemWriteGrantPaths(input.permissions, writeGrantPaths, projectRootWriteSubpaths);
     }
-    else {
-        collectStringValues(input, paths);
+    else if (!NON_FILESYSTEM_METADATA_TOOLS.has(toolName)) {
+        collectOpaqueToolStrings(input, paths);
     }
+    // Do not infer mutation targets from arbitrary orchestration-tool strings.
+    // Skills commonly pass args: "" and delegation prompts may discuss
+    // protected paths; neither is itself a filesystem mutation.
     const pathOptions = { cwd: context?.projectPath, root: context?.root };
     for (const grantPath of writeGrantPaths) {
         if (grantPath && lClassGrantIncludesProtectedPath(grantPath, pathOptions)) {

package/dist/core/protected-paths.js

@@ -306,6 +306,8 @@ export function hClassGrantIncludesProtectedPath(value, options = {}) {
     return true;
 }
 export function lClassGrantIncludesProtectedPath(value, options = {}) {
+    if (!value.trim())
+        return false;
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());
     const protectedRoot = path.join(root, 'data', 'triggers');
     if (isLClassPath(value, { cwd: options.cwd, root }))