evolcore 0.0.20 → 0.0.22

package/dist/agents/claude-runner.js

@@ -5,7 +5,7 @@ import { resolveAnthropicConfig } from './baseagent.js';
 import { buildModelRequestHeaders } from './request-identity.js';
 import { DEFAULT_PERMISSION_MODE } from '../types.js';
 import { renderActionAsText } from '../core/interaction-router.js';
-import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
+import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../core/message/message-utils.js';
 import path from 'path';
 import fs from 'fs';
 import os from 'os';
@@ -21,12 +21,13 @@ import { getPackageRoot, resolvePaths } from '../paths.js';
 import { resolveEffective } from '../config/config-manager.js';
 import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
-import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
-import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/protected-paths.js';
-import { buildHClassGuardCommand, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, recordSandboxInitializationFailure, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
+import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
+import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
+import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, recordSandboxInitializationFailure, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
-import { isManagedSessionRuntimeDir } from '../cli/task-context.js';
+import { getManagedTaskTempDir, isManagedSessionRuntimeDir } from '../cli/task-context.js';
+import { hasTrustedFullAccessContext } from './runner-types.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
 // Built-in tools execute inside the Claude runtime and are covered by the
@@ -65,10 +66,18 @@ const CLAUDE_BUILTIN_TOOLS = new Set([
     'Write',
 ]);
 function spawnClaudeWithHClassGuard(options, root, onStderr) {
+    const preflight = collectSandboxGuardDiagnostics(root);
+    logger.info(`[ClaudeSandbox] H-class guard preflight ${JSON.stringify(summarizeSandboxGuardDiagnostics(preflight))}`);
     const guarded = buildHClassGuardCommand(options.command, options.args, root);
     if (!guarded) {
         throw new Error('Claude owner bypass 缺少 EvolCore H 类路径隔离运行时，已拒绝启动');
     }
+    const launch = summarizeBubblewrapArgsForLog(guarded.args);
+    const postBuild = collectSandboxGuardDiagnostics(root);
+    logger.info(`[ClaudeSandbox] H-class guard launch ${JSON.stringify({
+        ...launch,
+        diagnostics: summarizeSandboxGuardDiagnostics(postBuild),
+    })}`);
     const child = spawn(guarded.command, guarded.args, {
         cwd: options.cwd,
         env: options.env,
@@ -111,23 +120,6 @@ function stableClaudePermissionValue(value, depth = 0) {
         .sort()
         .map(key => [key, stableClaudePermissionValue(record[key], depth + 1)]));
 }
-function collectClaudePermissionStrings(value, output = []) {
-    if (typeof value === 'string') {
-        output.push(value);
-        return output;
-    }
-    if (Array.isArray(value)) {
-        for (const entry of value)
-            collectClaudePermissionStrings(entry, output);
-        return output;
-    }
-    if (!value || typeof value !== 'object')
-        return output;
-    for (const entry of Object.values(value)) {
-        collectClaudePermissionStrings(entry, output);
-    }
-    return output;
-}
 function inspectClaudePermissionExpansion(input, options, projectPath) {
     const blockedPath = typeof options.blockedPath === 'string' && options.blockedPath.length > 0
         ? options.blockedPath
@@ -161,9 +153,6 @@ function inspectClaudePermissionExpansion(input, options, projectPath) {
             break;
         }
     }
-    if (!protectedReason && collectClaudePermissionStrings(rawSuggestions).some(containsHClassReference)) {
-        protectedReason = '🔒 Claude SDK 权限规则涉及 EvolCore H 类受保护路径，已拒绝';
-    }
     const hasDirectoryExpansion = rawSuggestions.some(entry => {
         if (!entry || typeof entry !== 'object' || Array.isArray(entry))
             return false;
@@ -600,7 +589,7 @@ class MessageStream {
 }
 export class AgentRunner {
     name = 'claude';
-    capabilities = { clear: true, compact: true, fork: true, forkAtTurn: true, askUserQuestion: true, planApproval: true, fileRewind: 'checkpoint' };
+    capabilities = { fullaccess: true, clear: true, compact: true, fork: true, forkAtTurn: true, askUserQuestion: true, planApproval: true, fileRewind: 'checkpoint' };
     apiKey;
     model;
     effort;
@@ -609,6 +598,8 @@ export class AgentRunner {
     customHeaders;
     customQueryParams;
     config;
+    agentAid;
+    agentConfig;
     activeSessions = new Map();
     activeStreams = new Map();
     activeMessageStreams = new Map();
@@ -636,6 +627,7 @@ export class AgentRunner {
             reason: detail.message.slice(0, 512),
             sessionId,
             agentAid: context?.selfAid,
+            agentName: context?.agentName,
             permissionMode,
             role: context?.role,
             callId: inputId,
@@ -654,6 +646,7 @@ export class AgentRunner {
             policyCode: SANDBOX_INITIALIZATION_FAILED,
             decisionSource: 'infrastructure',
             agentAid: context?.selfAid,
+            agentName: context?.agentName,
             permissionMode: permissionMode,
             summary: detail.message.slice(0, 512),
             effect: 'operation_skipped',
@@ -687,12 +680,17 @@ export class AgentRunner {
             this.cleanupSandboxSettingsFile(sessionId, filePath);
         }
     }
-    constructor(apiKey, model, onSessionIdUpdate, baseUrl, config) {
+    constructor(apiKey, model, onSessionIdUpdate, baseUrl, config, runtime) {
+        // Compatibility for legacy direct callers that still pass the removed
+        // internal fields in a synthetic config. AgentLoader uses runtime binding.
+        const legacy = config?.agents?.claude;
         this.apiKey = apiKey;
         this.model = model || 'sonnet';
         this.effort = undefined;
         this.baseUrl = baseUrl;
         this.config = config;
+        this.agentAid = runtime?.agentAid ?? legacy?.['evolcoreAgentAid'];
+        this.agentConfig = runtime?.agentConfig ?? legacy?.['evolcoreAgentConfig'];
         this.onSessionIdUpdate = onSessionIdUpdate;
         if (config) {
             const anthropic = resolveAnthropicConfig(config);
@@ -700,7 +698,7 @@ export class AgentRunner {
             this.customHeaders = buildModelRequestHeaders({
                 baseagent: 'claude',
                 baseUrl: anthropic.baseUrl,
-                agentAid: config.agents?.claude?.evolcoreAgentAid,
+                agentAid: this.agentAid,
                 configuredHeaders: anthropic.headers,
             });
             this.customQueryParams = anthropic.queryParams;
@@ -721,6 +719,20 @@ export class AgentRunner {
             ...(evolcoreSessionId ? { EVOLCORE_SESSION_ID: evolcoreSessionId } : {}),
             ...(runtimeEnv ?? {}),
         }, { lockExecutableResolution: permissionMode === 'readonly' });
+        const trustedRootFullAccess = permissionMode === 'fullaccess'
+            && typeof process.getuid === 'function'
+            && process.getuid() === 0
+            && typeof evolcoreSessionId === 'string'
+            && hasTrustedFullAccessContext(this.permissionContexts.get(evolcoreSessionId));
+        // Claude Code refuses --dangerously-skip-permissions as root unless its
+        // caller asserts that the execution is intentionally sandbox-managed.
+        // EvolCore fullaccess is an explicit daemon-owner-authorized host run, so
+        // scope this assertion to that single trusted call. Never inherit a
+        // process-wide IS_SANDBOX into ordinary or untrusted Claude sessions.
+        if (trustedRootFullAccess)
+            env.IS_SANDBOX = '1';
+        else
+            delete env.IS_SANDBOX;
         const bubblewrapPath = resolveBubblewrapPath();
         return bubblewrapPath
             ? prependExecutableDirectory(env, bubblewrapPath)
@@ -744,11 +756,10 @@ export class AgentRunner {
         return entry?.cache;
     }
     async resolveCapabilityRunOptions(projectPath) {
-        const claudeConfig = this.config?.agents?.claude;
-        let agentConfig = claudeConfig?.evolcoreAgentConfig;
-        if (claudeConfig?.evolcoreAgentAid) {
+        let agentConfig = this.agentConfig;
+        if (this.agentAid) {
             try {
-                agentConfig = resolveEffective({ self: claudeConfig.evolcoreAgentAid }, { cache: true, expand: true });
+                agentConfig = resolveEffective({ self: this.agentAid }, { cache: true, expand: true });
             }
             catch { }
         }
@@ -826,14 +837,16 @@ export class AgentRunner {
         this.permissionContexts.set(sessionId, context);
     }
     toSdkPermissionMode(mode) {
+        if (mode === 'fullaccess')
+            return 'bypassPermissions';
         const normalized = normalizePermissionMode(mode ?? this.permissionMode);
         // Public permission policy is enforced by PreToolUse. Keeping the SDK in
         // default mode preserves canUseTool reachability for request mode.
         return normalized.workflow === 'plan' ? 'plan' : 'default';
     }
     // ── Compactable 接口 ──
-    async compact(sessionId, agentSessionId, projectPath) {
-        return this.compactSession(sessionId, agentSessionId, projectPath);
+    async compact(sessionId, agentSessionId, projectPath, modelOverride) {
+        return this.compactSession(sessionId, agentSessionId, projectPath, modelOverride);
     }
     syncFromUserSettings() {
         try {
@@ -972,7 +985,7 @@ export class AgentRunner {
                     : '回复 /ask 1，或 /ask <自定义内容>';
                 const fallbackText = `💬 ${q.header || q.question}\n${q.header ? q.question + '\n' : ''}${optionLines}\n\n${answerHint}`;
                 const result = await sendInteractionPayload(permCtx.adapter, envelope, interaction, fallbackText, permCtx.replyContext);
-                cardSent = !!result;
+                cardSent = isInteractionSendAccepted(result);
             }
             catch (err) {
                 logger.warn(`[AgentRunner] AskUserQuestion card send failed for q${i}:`, err);
@@ -1393,7 +1406,7 @@ export class AgentRunner {
                 });
                 const fallbackText = '📋 计划审批：AI 已完成规划，等待审批。\n回复 /ask 1 批准 / /ask 2 拒绝';
                 const result = await sendInteractionPayload(permCtx.adapter, envelope, interaction, fallbackText, permCtx.replyContext);
-                cardSent = !!result;
+                cardSent = isInteractionSendAccepted(result);
             }
             catch (err) {
                 logger.warn('[AgentRunner] ExitPlanMode card send failed:', err);
@@ -1441,7 +1454,7 @@ export class AgentRunner {
      * SDK 原始事件 → 标准 AgentEvent 转换
      * 所有 SDK 特有的事件类型引用封装在此方法内
      */
-    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode) {
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn) {
         let lastSessionId;
         let hasTurnActivity = false;
         let ignoredPreTurnResult = false;
@@ -1458,6 +1471,7 @@ export class AgentRunner {
         let turnCount = 0;
         const seenMessageIds = new Set();
         let lastModelCall;
+        let lastAssistantWasSynthetic = false;
         let lastAssistantUuid;
         // 流式收集各次大模型调用（fallback：SDK iterations 为空时使用）
         const collectedCalls = [];
@@ -1466,8 +1480,15 @@ export class AgentRunner {
                 // 提取 session_id（任意 SDK 事件都可能携带）
                 if (event.session_id && event.session_id !== lastSessionId) {
                     lastSessionId = event.session_id;
-                    this.updateSessionId(sessionId, event.session_id);
-                    yield { type: 'session_id', sessionId: event.session_id };
+                    if (await this.acceptDiscoveredSessionId(sessionId, event.session_id, turn)) {
+                        yield { type: 'session_id', sessionId: event.session_id };
+                    }
+                    else {
+                        logger.warn(`[AgentRunner] Rejected stale backend discovery: sessionId=${sessionId} backend=${event.session_id} turn=${turn?.turnId ?? 'legacy'}`);
+                        const error = new Error('backend discovery rejected by active turn lease');
+                        error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+                        throw error;
+                    }
                 }
                 if (event.type === 'user' && event.uuid === inputId) {
                     hasTurnActivity = true;
@@ -1563,7 +1584,9 @@ export class AgentRunner {
                     const streamEvent = event.event;
                     if (streamEvent?.type === 'message_start' && streamEvent.message?.usage) {
                         hasTurnActivity = true;
+                        lastAssistantWasSynthetic = streamEvent.message.model === '<synthetic>';
                         lastModelCall = {
+                            messageId: streamEvent.message.id,
                             uuid: event.uuid,
                             model: streamEvent.message.model,
                             tokenUsage: streamEvent.message.usage,
@@ -1573,6 +1596,7 @@ export class AgentRunner {
                             call_index: collectedCalls.length,
                             model: streamEvent.message.model ?? callModel ?? this.model,
                             request_id: event.request_id,
+                            message_id: streamEvent.message.id,
                             tokenUsage: { ...streamEvent.message.usage },
                         });
                     }
@@ -1625,27 +1649,40 @@ export class AgentRunner {
                     yield { type: 'state_changed', state: event.state };
                 }
                 // assistant: 提取 tool_use 和文本（仅无 text_delta 时提取文本）
-                if (event.type === 'assistant' && event.message?.content) {
-                    hasTurnActivity = true;
-                    lastAssistantUuid = event.uuid ?? lastAssistantUuid;
-                    const msgId = event.message.id;
-                    if (!msgId || !seenMessageIds.has(msgId)) {
-                        if (msgId)
-                            seenMessageIds.add(msgId);
-                        turnCount++;
-                    }
-                    if (event.message.usage) {
+                if (event.type === 'assistant') {
+                    const isSyntheticAssistant = event.message?.model === '<synthetic>'
+                        || (typeof event.error === 'string' && event.isApiErrorMessage === true);
+                    lastAssistantWasSynthetic = isSyntheticAssistant;
+                    if (event.message && (event.message.usage || isSyntheticAssistant)) {
+                        // A message id is stable across the partial stream and the final
+                        // assistant event. Never merge a synthetic/API-error assistant into
+                        // the preceding real call, even if an upstream adapter reuses an id
+                        // or omits the usage object on the error frame.
+                        const sameModelCall = !isSyntheticAssistant
+                            && typeof event.message.id === 'string'
+                            && event.message.id === lastModelCall?.messageId;
                         lastModelCall = {
-                            ...lastModelCall,
+                            ...(sameModelCall ? lastModelCall : undefined),
                             messageId: event.message.id,
+                            uuid: event.uuid,
                             requestId: event.request_id,
                             model: event.message.model,
-                            tokenUsage: {
+                            tokenUsage: sameModelCall ? {
                                 ...event.message.usage,
                                 ...(lastModelCall?.tokenUsage ?? {}),
-                            },
+                            } : { ...(event.message.usage ?? {}) },
                         };
                     }
+                    if (!event.message?.content)
+                        continue;
+                    hasTurnActivity = true;
+                    lastAssistantUuid = event.uuid ?? lastAssistantUuid;
+                    const msgId = event.message.id;
+                    if (!msgId || !seenMessageIds.has(msgId)) {
+                        if (msgId)
+                            seenMessageIds.add(msgId);
+                        turnCount++;
+                    }
                     // 统计本轮 base agent 全部输出字符数（text + tool_use input）
                     let turnOutputChars = 0;
                     for (const content of event.message.content) {
@@ -1720,6 +1757,18 @@ export class AgentRunner {
                     // 非 Claude（DeepSeek/OpenAI 兼容）：cache_read 是服务端 KV cache 不占上下文窗口，
                     // input_tokens 本身就是完整的上下文输入量。
                     const u = event.usage;
+                    // Claude Code represents transport/API failures as a fresh
+                    // `<synthetic>` assistant message. Its usage describes the failed
+                    // terminal request (normally zero); event.usage remains the aggregate
+                    // of earlier successful calls in the query and must not be presented
+                    // as the failed request's context usage.
+                    const isSyntheticError = event.is_error === true
+                        && (lastAssistantWasSynthetic || lastModelCall?.model === '<synthetic>');
+                    const syntheticUsage = lastModelCall?.tokenUsage ?? {
+                        input_tokens: 0,
+                        output_tokens: 0,
+                    };
+                    const terminalUsage = isSyntheticError ? syntheticUsage : u;
                     const effectiveModel = callModel ?? this.model;
                     const isClaudeModel = isClaudeContextUsageModel(effectiveModel);
                     const totalTokens = contextTokensForUsage(u, !!isClaudeModel);
@@ -1762,7 +1811,11 @@ export class AgentRunner {
                     // 组装 modelCalls：优先 SDK iterations，fallback 流式收集，兜底降级单行。
                     const callModel_ = callModel ?? this.model;
                     let modelCalls;
-                    const iterArr = Array.isArray(u?.iterations) && u.iterations.length > 0 ? u.iterations : null;
+                    const iterArr = !isSyntheticError
+                        && Array.isArray(u?.iterations)
+                        && u.iterations.length > 0
+                        ? u.iterations
+                        : null;
                     if (iterArr) {
                         modelCalls = iterArr.map((it, i) => ({
                             call_index: i, model: callModel_, tokenUsage: it, contextUsage: contextUsageForCall(it),
@@ -1774,16 +1827,19 @@ export class AgentRunner {
                             contextUsage: contextUsageForCall(call.tokenUsage),
                         }));
                     }
-                    else if (u) {
+                    else if (u && !isSyntheticError) {
                         // 降级：无逐次数据，写一条累计行
                         modelCalls = [{ call_index: 0, model: callModel_, tokenUsage: u, contextUsage: contextUsageForCall(u), degraded: true }];
                     }
                     // `event.usage` is aggregate query usage when the SDK made multiple
                     // model calls. The top-level context field must describe a single
-                    // current request; aggregate usage remains available in tokenUsage.
-                    const contextUsage = lastModelCall?.contextUsage
-                        ?? modelCalls?.at(-1)?.contextUsage
-                        ?? aggregateContextUsage;
+                    // current request. For normal results aggregate usage remains available
+                    // in tokenUsage; synthetic errors use their own terminal usage instead.
+                    const contextUsage = isSyntheticError
+                        ? lastModelCall?.contextUsage
+                        : lastModelCall?.contextUsage
+                            ?? modelCalls?.at(-1)?.contextUsage
+                            ?? aggregateContextUsage;
                     const completeEvent = {
                         type: 'complete',
                         result: cleanResult,
@@ -1796,7 +1852,7 @@ export class AgentRunner {
                         terminalReason: event.terminal_reason,
                         sessionTitle: event.session_title,
                         numTurns: event.num_turns,
-                        tokenUsage: event.usage,
+                        tokenUsage: terminalUsage,
                         contextUsage,
                         lastModelCall,
                         modelCalls,
@@ -1871,6 +1927,7 @@ export class AgentRunner {
                     policyCode: 'claude_startup_arguments_too_long',
                     decisionSource: 'infrastructure',
                     agentAid: this.permissionContexts.get(sessionId)?.selfAid,
+                    agentName: this.permissionContexts.get(sessionId)?.agentName,
                     summary: detail.message.slice(0, 512),
                     effect: 'operation_skipped',
                 });
@@ -1904,6 +1961,9 @@ export class AgentRunner {
         }
     }
     async runQuery(sessionId, prompt, projectPath, initialClaudeSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
+        // Validate the daemon-injected session namespace before the SDK inherits
+        // the process environment for any temporary state.
+        getManagedTaskTempDir(runtimeEnv);
         // 记录当前 evolcore session ID，用于 Agent ctl 环境变量注入
         // 同步用户级配置到内存
         this.syncFromUserSettings();
@@ -1922,8 +1982,22 @@ export class AgentRunner {
         }
         ensureDir(projectPath);
         ensureDir(path.join(projectPath, '.claude'));
-        // 优先使用传入的 agentSessionId（从数据库恢复），否则使用内存中的
-        let agentSessionId = initialClaudeSessionId || this.activeSessions.get(sessionId);
+        const topicBinding = modelOverride?.backend?.kind === 'topic';
+        if (topicBinding && (!modelOverride?.turn || modelOverride.turn.sessionId !== sessionId || !this.onSessionIdUpdate)) {
+            const error = new Error('topic backend run requires an active TurnLease and binding callback');
+            error.code = 'TOPIC_TURN_LEASE_REQUIRED';
+            throw error;
+        }
+        const topicAgentSessionId = topicBinding ? modelOverride?.backend?.agentSessionId ?? null : null;
+        const cachedAgentSessionId = topicBinding
+            ? (topicAgentSessionId && this.activeSessions.get(sessionId) === topicAgentSessionId
+                ? topicAgentSessionId
+                : undefined)
+            : this.activeSessions.get(sessionId);
+        let agentSessionId = initialClaudeSessionId || cachedAgentSessionId;
+        if (topicBinding && topicAgentSessionId !== agentSessionId) {
+            agentSessionId = topicAgentSessionId || undefined;
+        }
         // 验证会话文件是否存在且有效（仅在有 agentSessionId 时）
         if (agentSessionId) {
             const homeDir = os.homedir();
@@ -1954,11 +2028,18 @@ export class AgentRunner {
                 }
             }
             if (!isValid) {
+                if (topicBinding) {
+                    const error = new Error(`bound topic backend is unavailable: ${agentSessionId}`);
+                    error.code = 'TOPIC_BACKEND_UNAVAILABLE';
+                    throw error;
+                }
                 logger.warn(`[AgentRunner] Invalid session file, starting new session`);
                 agentSessionId = undefined;
                 this.activeSessions.delete(sessionId);
                 if (this.onSessionIdUpdate) {
-                    this.onSessionIdUpdate(sessionId, '');
+                    void Promise.resolve(this.onSessionIdUpdate(sessionId, '')).catch(error => {
+                        logger.debug(`[AgentRunner] ignored empty session binding callback failure: ${error instanceof Error ? error.message : String(error)}`);
+                    });
                 }
             }
         }
@@ -1973,9 +2054,11 @@ export class AgentRunner {
         // 缺省回落 agent 级 this.permissionMode。作为 per-call 入参（hook/canUseTool 闭包捕获），
         // 不写实例字段，多对端并发互不污染（与 model/effort 同构）。
         const requestedPermissionMode = modelOverride?.permissionMode || this.permissionMode;
-        const normalizedPermission = normalizePermissionMode(requestedPermissionMode);
-        const callPermissionMode = normalizedPermission.mode;
+        const callPermissionMode = normalizeExecutionPermissionMode(requestedPermissionMode);
         const runPermissionContext = this.permissionContexts.get(sessionId);
+        if (callPermissionMode === 'fullaccess' && !hasTrustedFullAccessContext(runPermissionContext)) {
+            throw new Error('Claude fullaccess requires a trusted per-call execution authorization');
+        }
         const executionSandbox = resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
         const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
         if (executionSandbox.state !== 'off') {
@@ -1990,6 +2073,7 @@ export class AgentRunner {
                     reason: detail.message.slice(0, 512),
                     sessionId,
                     agentAid: context?.selfAid,
+                    agentName: context?.agentName,
                     permissionMode: callPermissionMode,
                     role: context?.role,
                     callId: inputId,
@@ -2008,6 +2092,7 @@ export class AgentRunner {
                     policyCode: SANDBOX_INITIALIZATION_FAILED,
                     decisionSource: 'infrastructure',
                     agentAid: context?.selfAid,
+                    agentName: context?.agentName,
                     permissionMode: callPermissionMode,
                     summary: detail.message.slice(0, 512),
                     effect: 'operation_skipped',
@@ -2054,6 +2139,7 @@ export class AgentRunner {
                 summary,
                 sessionId,
                 agentAid: ctx?.selfAid,
+                agentName: ctx?.agentName,
                 permissionMode: callPermissionMode,
                 channel: ctx?.channel,
                 actorId: ctx?.userId,
@@ -2074,6 +2160,7 @@ export class AgentRunner {
                     policyCode: code,
                     decisionSource: 'policy',
                     agentAid: ctx?.selfAid,
+                    agentName: ctx?.agentName,
                     permissionMode: callPermissionMode,
                     summary,
                     effect: 'operation_skipped',
@@ -2122,6 +2209,14 @@ export class AgentRunner {
                 delete toolInput.pages;
             }
             let updatedInput = toolInput === originalInput ? undefined : toolInput;
+            if (callPermissionMode === 'fullaccess') {
+                if (!hasTrustedFullAccessContext(this.permissionContexts.get(sessionId))) {
+                    return hookDecision('deny', 'fullaccess execution authorization is no longer active', updatedInput);
+                }
+                return hookDecision('allow', undefined, toolName === 'Bash'
+                    ? { ...toolInput, dangerouslyDisableSandbox: true }
+                    : updatedInput);
+            }
             const preparedSafeOutputCommand = toolName === 'Bash' && typeof toolInput.command === 'string'
                 ? toolInput.command
                 : undefined;
@@ -2143,6 +2238,7 @@ export class AgentRunner {
                 : undefined;
             const preflight = evaluateToolPreflight(toolName, toolInput, {
                 sessionId,
+                managedTempDir: permCtx?.managedTempDir,
                 selfAid: permCtx?.selfAid,
                 channel: permCtx?.channel,
                 userId: permCtx?.userId,
@@ -2179,6 +2275,7 @@ export class AgentRunner {
                 const permCtx = this.permissionContexts.get(sessionId);
                 const readonlyContext = {
                     sessionId,
+                    managedTempDir: permCtx?.managedTempDir,
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
@@ -2250,6 +2347,20 @@ export class AgentRunner {
             if (toolName === 'ExitPlanMode') {
                 return await this.handleExitPlanMode(sessionId, input, options);
             }
+            if (callPermissionMode === 'fullaccess') {
+                if (!hasTrustedFullAccessContext(this.permissionContexts.get(sessionId))) {
+                    return {
+                        behavior: 'deny',
+                        message: 'fullaccess execution authorization is no longer active',
+                        decisionClassification: 'user_reject',
+                    };
+                }
+                return {
+                    behavior: 'allow',
+                    updatedInput: toolName === 'Bash' ? { ...input, dangerouslyDisableSandbox: true } : input,
+                    decisionClassification: 'user_permanent',
+                };
+            }
             if (toolName === 'Bash' && 'dangerouslyDisableSandbox' in input) {
                 input = { ...input };
                 delete input.dangerouslyDisableSandbox;
@@ -2267,6 +2378,7 @@ export class AgentRunner {
             const permCtx = this.permissionContexts.get(sessionId);
             const preflight = evaluateToolPreflight(toolName, input, {
                 sessionId,
+                managedTempDir: permCtx?.managedTempDir,
                 selfAid: permCtx?.selfAid,
                 channel: permCtx?.channel,
                 userId: permCtx?.userId,
@@ -2339,6 +2451,7 @@ export class AgentRunner {
                 const permCtx = this.permissionContexts.get(sessionId);
                 const readonlyContext = {
                     sessionId,
+                    managedTempDir: permCtx?.managedTempDir,
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
@@ -2403,7 +2516,9 @@ export class AgentRunner {
             };
         };
         const useSettingSources = this.config?.agents?.claude?.useSettingSources !== false;
-        const settingSources = useSettingSources ? ['project', 'user'] : [];
+        const settingSources = callPermissionMode === 'fullaccess'
+            ? []
+            : useSettingSources ? ['project', 'user'] : [];
         const enableSummaries = this.config?.agents?.claude?.agentProgressSummaries !== false;
         const excludeDynamic = this.config?.agents?.claude?.excludeDynamicSections === true;
         // 公共 options（新旧模式共用）
@@ -2426,7 +2541,9 @@ export class AgentRunner {
         }
         const sdkModel = resolveSdkModel(callModel, this.baseUrl);
         const capabilityOptions = await this.resolveCapabilityRunOptions(projectPath);
-        const managedSettings = buildClaudeManagedLockdownSettings(capabilityOptions);
+        const managedSettings = callPermissionMode === 'fullaccess'
+            ? undefined
+            : buildClaudeManagedLockdownSettings(capabilityOptions);
         const sandboxOptions = executionSandbox.state === 'off'
             ? { enabled: false }
             : await (async () => {
@@ -2466,9 +2583,11 @@ export class AgentRunner {
                 };
             })();
         if (executionSandbox.state === 'off') {
-            logger.info(process.platform === 'linux'
-                ? '[ClaudeSandbox] task sandbox disabled for authenticated owner bypass; outer H-class guard remains active'
-                : '[ClaudeSandbox] disabled for authenticated owner bypass task');
+            logger.info(callPermissionMode === 'fullaccess'
+                ? '[ClaudeSandbox] disabled for trusted per-call fullaccess execution'
+                : process.platform === 'linux'
+                    ? '[ClaudeSandbox] task sandbox disabled for authenticated owner bypass; outer H-class guard remains active'
+                    : '[ClaudeSandbox] disabled for authenticated owner bypass task');
         }
         const handleClaudeStderr = (msg) => {
             const trimmed = msg.trim();
@@ -2494,16 +2613,17 @@ export class AgentRunner {
             model: sdkModel,
             ...capabilityOptions,
             strictMcpConfig: false,
-            managedSettings,
+            ...(managedSettings ? { managedSettings } : {}),
             ...(callEffort ? { effort: callEffort } : {}),
             ...(this.claudeExecutablePath ? { pathToClaudeCodeExecutable: this.claudeExecutablePath } : {}),
-            ...(executionSandbox.state === 'off' && process.platform === 'linux' ? {
+            ...(executionSandbox.state === 'off' && callPermissionMode !== 'fullaccess' && process.platform === 'linux' ? {
                 spawnClaudeCodeProcess: (options) => spawnClaudeWithHClassGuard(options, resolvePaths().root, handleClaudeStderr),
             } : {}),
             autoCompactWindow: autoCompactWindowForModel(sdkModel),
             advisorModel: 'haiku',
             canUseTool: canUseToolCallback,
             permissionMode: sdkPermissionMode,
+            ...(callPermissionMode === 'fullaccess' ? { allowDangerouslySkipPermissions: true } : {}),
             sandbox: sandboxOptions,
             persistSession: true,
             includePartialMessages: true,
@@ -2625,9 +2745,14 @@ export class AgentRunner {
                 const currentSession = await sessionManager.getSessionById?.(sessionId);
                 if (currentSession?.metadata?.resumeAt) {
                     resumeAt = currentSession.metadata.resumeAt;
-                    const newMeta = { ...currentSession.metadata };
-                    delete newMeta.resumeAt;
-                    await sessionManager.updateSession(sessionId, { metadata: newMeta });
+                    if (typeof sessionManager.patchSessionMetadata === 'function') {
+                        await sessionManager.patchSessionMetadata(sessionId, { resumeAt: undefined });
+                    }
+                    else {
+                        const newMeta = { ...currentSession.metadata };
+                        delete newMeta.resumeAt;
+                        await sessionManager.updateSession(sessionId, { metadata: newMeta });
+                    }
                     logger.info(`[AgentRunner] Consuming resumeAt: ${resumeAt}`);
                 }
             }
@@ -2639,10 +2764,14 @@ export class AgentRunner {
         const msgStream = new MessageStream();
         if (images && images.length > 0) {
             logger.info('[AgentRunner] Creating query with images:', images.length, 'first image size:', images[0]?.data?.length ?? 0);
-            logger.debug('[AgentRunner] Skipping resume for image message to avoid history conflict');
             msgStream.push(prompt, images, inputId);
             try {
-                sdkStream = createQuery(msgStream);
+                // Topic bindings are authoritative for every input shape.  Starting
+                // an unresumed Claude query for a bound topic would discover a second
+                // backend and then fail activation with a binding conflict.
+                sdkStream = topicBinding
+                    ? createQuery(msgStream, agentSessionId, resumeAt)
+                    : createQuery(msgStream);
             }
             catch (error) {
                 this.cleanupSandboxSettingsFile(sessionId, sandboxSettingsFile);
@@ -2676,14 +2805,16 @@ export class AgentRunner {
         }
         this.activeMessageStreams.set(sessionId, msgStream);
         this.activeQueries.set(sessionId, sdkStream);
-        const donePromise = new Promise(resolve => this.streamDoneResolvers.set(sessionId, resolve));
+        let resolveDone;
+        const donePromise = new Promise(resolve => { resolveDone = resolve; });
+        this.streamDoneResolvers.set(sessionId, resolveDone);
         this.streamDone.set(sessionId, donePromise);
         // 保存 interrupt 能力（不写 activeStreams，由 registerStream 管理活跃状态）
         if ('interrupt' in sdkStream && typeof sdkStream.interrupt === 'function') {
             this.interruptFns.set(sessionId, () => sdkStream.interrupt());
         }
         // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
-        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode);
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn);
         const self = this;
         return (async function* () {
             try {
@@ -2691,10 +2822,15 @@ export class AgentRunner {
             }
             finally {
                 self.cleanupSandboxSettingsFile(sessionId, sandboxSettingsFile);
-                self.streamDoneResolvers.get(sessionId)?.();
-                self.streamDoneResolvers.delete(sessionId);
-                self.streamDone.delete(sessionId);
-                self.activeQueries.delete(sessionId);
+                resolveDone();
+                if (self.streamDoneResolvers.get(sessionId) === resolveDone)
+                    self.streamDoneResolvers.delete(sessionId);
+                if (self.streamDone.get(sessionId) === donePromise)
+                    self.streamDone.delete(sessionId);
+                if (self.activeQueries.get(sessionId) === sdkStream)
+                    self.activeQueries.delete(sessionId);
+                if (self.activeMessageStreams.get(sessionId) === msgStream)
+                    self.activeMessageStreams.delete(sessionId);
             }
         })();
     }
@@ -2762,19 +2898,64 @@ export class AgentRunner {
     injectUserMessage(sessionId, text) {
         this.activeMessageStreams.get(sessionId)?.push(text);
     }
+    async acceptDiscoveredSessionId(sessionId, agentSessionId, turn) {
+        const result = this.onSessionIdUpdate
+            ? (turn === undefined
+                ? await this.onSessionIdUpdate(sessionId, agentSessionId)
+                : await this.onSessionIdUpdate(sessionId, agentSessionId, { turn }))
+            : 'legacy_updated';
+        const accepted = result === undefined || result === 'activated' || result === 'already_active' || result === 'legacy_updated';
+        if (accepted) {
+            this.activeSessions.set(sessionId, agentSessionId);
+        }
+        return accepted;
+    }
     updateSessionId(sessionId, agentSessionId) {
         logger.info(`[AgentRunner] updateSessionId called: sessionId=${sessionId}, agentSessionId=${agentSessionId}`);
-        this.activeSessions.set(sessionId, agentSessionId);
-        if (this.onSessionIdUpdate) {
-            this.onSessionIdUpdate(sessionId, agentSessionId);
+        const previousAgentSessionId = this.activeSessions.get(sessionId);
+        const canApply = () => {
+            const current = this.activeSessions.get(sessionId);
+            return current === previousAgentSessionId || (previousAgentSessionId === undefined && current === undefined);
+        };
+        if (!this.onSessionIdUpdate) {
+            if (!canApply())
+                return;
+            if (agentSessionId)
+                this.activeSessions.set(sessionId, agentSessionId);
+            else if (this.activeSessions.get(sessionId) === previousAgentSessionId)
+                this.activeSessions.delete(sessionId);
+            return;
         }
+        void Promise.resolve(this.onSessionIdUpdate(sessionId, agentSessionId)).then(result => {
+            if (!canApply())
+                return;
+            if (result === undefined || result === 'activated' || result === 'already_active' || result === 'legacy_updated') {
+                if (agentSessionId)
+                    this.activeSessions.set(sessionId, agentSessionId);
+                else if (this.activeSessions.get(sessionId) === previousAgentSessionId)
+                    this.activeSessions.delete(sessionId);
+            }
+            else if (!agentSessionId) {
+                if (this.activeSessions.get(sessionId) === previousAgentSessionId)
+                    this.activeSessions.delete(sessionId);
+            }
+        }).catch(error => {
+            logger.warn(`[AgentRunner] session binding callback failed: ${error instanceof Error ? error.message : String(error)}`);
+            if (!agentSessionId && canApply() && this.activeSessions.get(sessionId) === previousAgentSessionId) {
+                this.activeSessions.delete(sessionId);
+            }
+        });
     }
-    runSessionCommand(prompt, agentSessionId, projectPath) {
+    runSessionCommand(prompt, agentSessionId, projectPath, modelOverride) {
+        const callModel = modelOverride?.model || this.model;
+        const callEffort = (modelOverride?.effortMode === 'model_default'
+            ? undefined
+            : modelOverride?.effort ?? this.effort);
         return query({
             prompt,
             options: {
                 cwd: projectPath,
-                model: resolveSdkModel(this.model, this.baseUrl),
+                model: resolveSdkModel(callModel, this.baseUrl),
                 resume: agentSessionId,
                 maxTurns: 1,
                 tools: [],
@@ -2783,6 +2964,7 @@ export class AgentRunner {
                 strictMcpConfig: true,
                 settingSources: [],
                 managedSettings: buildClaudeManagedLockdownSettings(),
+                ...(callEffort ? { effort: callEffort } : {}),
                 permissionMode: this.toSdkPermissionMode(),
                 env: this.getAgentEnv()
             }
@@ -2791,31 +2973,74 @@ export class AgentRunner {
     /**
      * 主动压缩会话上下文
      */
-    async compactSession(sessionId, agentSessionId, projectPath) {
+    async compactSession(sessionId, agentSessionId, projectPath, modelOverride) {
+        const startedAt = Date.now();
+        let eventCount = 0;
+        let lastEvent;
         try {
-            logger.info(`[AgentRunner] Compacting session: ${agentSessionId}`);
-            const stream = this.runSessionCommand('/compact', agentSessionId, projectPath);
+            logger.info(`[AgentRunner] Compacting session: session=${sessionId} agent=${agentSessionId} project=${projectPath}`);
+            const stream = this.runSessionCommand('/compact', agentSessionId, projectPath, modelOverride);
             this.activeStreams.set(sessionId, stream);
             try {
-                let receivedBoundary = false;
+                let boundary;
+                let compactStatus;
                 for await (const event of stream) {
-                    if (event.type === 'system' && event.subtype === 'compact_boundary') {
-                        logger.info(`[AgentRunner] Compact completed, pre_tokens: ${event.compact_metadata?.pre_tokens}`);
-                        receivedBoundary = true;
+                    eventCount += 1;
+                    lastEvent = { type: event?.type, subtype: event?.subtype };
+                    if (event.type === 'system' && event.subtype === 'status' && event.compact_result) {
+                        compactStatus = {
+                            result: event.compact_result,
+                            error: event.compact_error,
+                        };
                     }
+                    if (event.type === 'system' && event.subtype === 'compact_boundary')
+                        boundary = event;
+                }
+                const durationMs = Date.now() - startedAt;
+                if (compactStatus?.result === 'failed') {
+                    const result = {
+                        ok: false,
+                        code: 'sdk_error',
+                        message: compactStatus.error || 'Claude SDK reported compact failure',
+                        durationMs,
+                        eventCount,
+                        lastEvent,
+                    };
+                    logger.warn(`[AgentRunner] Compact failed: session=${sessionId} agent=${agentSessionId} code=${result.code} events=${eventCount} durationMs=${durationMs} message=${result.message}`);
+                    return result;
                 }
-                if (!receivedBoundary) {
-                    logger.warn(`[AgentRunner] Compact stream ended without compact_boundary event`);
+                if (!boundary) {
+                    const result = {
+                        ok: false,
+                        code: 'missing_boundary',
+                        message: 'Compact stream ended without compact_boundary event',
+                        durationMs,
+                        eventCount,
+                        lastEvent,
+                    };
+                    logger.warn(`[AgentRunner] Compact failed: session=${sessionId} agent=${agentSessionId} code=${result.code} events=${eventCount} durationMs=${durationMs}`);
+                    return result;
                 }
-                return receivedBoundary;
+                const result = {
+                    ok: true,
+                    durationMs,
+                    eventCount,
+                    preTokens: boundary.compact_metadata?.pre_tokens,
+                    postTokens: boundary.compact_metadata?.post_tokens,
+                };
+                logger.info(`[AgentRunner] Compact completed: session=${sessionId} agent=${agentSessionId} events=${eventCount} durationMs=${durationMs} pre_tokens=${result.preTokens ?? 'unknown'} post_tokens=${result.postTokens ?? 'unknown'}`);
+                return result;
             }
             finally {
                 this.activeStreams.delete(sessionId);
             }
         }
         catch (error) {
-            logger.error('[AgentRunner] Compact failed:', error);
-            return false;
+            const durationMs = Date.now() - startedAt;
+            const message = error instanceof Error ? error.message : String(error);
+            const result = { ok: false, code: 'sdk_error', message, durationMs, eventCount, lastEvent };
+            logger.error(`[AgentRunner] Compact failed: session=${sessionId} agent=${agentSessionId} project=${projectPath} code=${result.code} events=${eventCount} durationMs=${durationMs} error=${message}`);
+            return result;
         }
     }
     /**
@@ -2836,7 +3061,7 @@ export class AgentRunner {
                 }
                 if (cleared) {
                     this.activeSessions.delete(sessionId);
-                    this.onSessionIdUpdate?.(sessionId, '');
+                    await this.onSessionIdUpdate?.(sessionId, '');
                 }
                 else {
                     logger.warn('[AgentRunner] Clear stream ended without session reset signal');
@@ -2853,16 +3078,76 @@ export class AgentRunner {
         }
     }
     async closeSession(sessionId) {
+        const capturedAgentSessionId = this.activeSessions.get(sessionId);
+        const capturedPermissionContext = this.permissionContexts.get(sessionId);
         this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const query = this.activeQueries.get(sessionId);
+        const messageStream = this.activeMessageStreams.get(sessionId);
+        const registeredStream = this.activeStreams.get(sessionId);
+        const interrupt = this.interruptFns.get(sessionId);
+        const done = this.streamDone.get(sessionId);
+        const resolveDone = this.streamDoneResolvers.get(sessionId);
+        let interruptError;
+        if (interrupt) {
+            try {
+                await interrupt();
+            }
+            catch (error) {
+                interruptError = error;
+            }
+        }
+        messageStream?.end();
         if (query && typeof query.close === 'function')
-            query.close();
-        this.activeSessions.delete(sessionId);
-        this.activeStreams.delete(sessionId);
-        this.interruptFns.delete(sessionId);
-        this.activeQueries.delete(sessionId);
-        this.permissionContexts.delete(sessionId);
+            await query.close();
+        if (done && registeredStream) {
+            let timer;
+            try {
+                await Promise.race([
+                    done,
+                    new Promise((_, reject) => {
+                        timer = setTimeout(() => reject(new Error(`Claude session did not become quiescent: ${sessionId}`)), 30_000);
+                        timer.unref?.();
+                    }),
+                ]);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        }
+        else if (done) {
+            // runQuery resolved but ResponseEngine never registered/consumed the
+            // wrapper. No consumer can reach its finally block, so close the exact
+            // captured lifecycle explicitly.
+            resolveDone?.();
+        }
+        const lifecycleReplaced = (query && this.activeQueries.get(sessionId) !== undefined && this.activeQueries.get(sessionId) !== query)
+            || (messageStream && this.activeMessageStreams.get(sessionId) !== undefined && this.activeMessageStreams.get(sessionId) !== messageStream)
+            || (registeredStream && this.activeStreams.get(sessionId) !== undefined && this.activeStreams.get(sessionId) !== registeredStream);
+        if (lifecycleReplaced) {
+            const error = new Error(`Claude session lifecycle changed during close: ${sessionId}`);
+            error.code = 'BACKEND_RUNTIME_REPLACED';
+            throw error;
+        }
+        if (this.activeQueries.get(sessionId) === query)
+            this.activeQueries.delete(sessionId);
+        if (this.activeMessageStreams.get(sessionId) === messageStream)
+            this.activeMessageStreams.delete(sessionId);
+        if (this.activeStreams.get(sessionId) === registeredStream)
+            this.activeStreams.delete(sessionId);
+        if (this.interruptFns.get(sessionId) === interrupt)
+            this.interruptFns.delete(sessionId);
+        if (this.streamDone.get(sessionId) === done)
+            this.streamDone.delete(sessionId);
+        if (this.streamDoneResolvers.get(sessionId) === resolveDone)
+            this.streamDoneResolvers.delete(sessionId);
+        if (this.activeSessions.get(sessionId) === capturedAgentSessionId)
+            this.activeSessions.delete(sessionId);
+        if (this.permissionContexts.get(sessionId) === capturedPermissionContext)
+            this.permissionContexts.delete(sessionId);
         this.cleanupSandboxSettingsFiles(sessionId);
+        if (interruptError)
+            throw interruptError;
     }
     async dispose() {
         const interrupts = [...this.interruptFns.values()].map(async (interrupt) => {
@@ -2978,9 +3263,9 @@ export class ClaudeAgentPlugin {
         const syntheticConfig = { agents: { claude: override } };
         const anthropic = resolveAnthropicConfig(syntheticConfig, override);
         const merged = {
-            agents: { claude: { ...(override || {}), evolcoreAgentAid: agent.aid, evolcoreAgentConfig: agent.config } },
+            agents: { claude: { ...(override || {}) } },
         };
-        const agentRunner = new AgentRunner(anthropic.apiKey, anthropic.model, callbacks.onSessionIdUpdate, anthropic.baseUrl, merged);
+        const agentRunner = new AgentRunner(anthropic.apiKey, anthropic.model, callbacks.onSessionIdUpdate, anthropic.baseUrl, merged, { agentAid: agent.aid, agentConfig: agent.config });
         if (anthropic.effort) {
             agentRunner.setEffort(anthropic.effort);
         }