evolcore 0.0.20 → 0.0.22

package/dist/core/message/response-engine.js

@@ -37,7 +37,7 @@ import { resolveAgentLifecycle } from '../../config/lifecycle.js';
 import { authorizationConfigRevision, checkRoleAccess, getFirstStaticAgentOwner, listStaticAgentAdmins, listStaticAgentOwners, resolvePeerRoleDetail, roleToSessionIdentity, } from '../../config/peer-role-resolver.js';
 import { insertUsageEvent, insertContextBreakdown, insertModelCalls } from '../../stats/writer.js';
 import { normalizeUsage } from '../../stats/normalizer.js';
-import { resolvePrices } from '../../stats/price-resolver.js';
+import { resolvePrices, roundCostForOutput } from '../../stats/price-resolver.js';
 import { getBudgetStatus } from '../../stats/budget.js';
 import { formatUsageSubjectKey, getRoleBudgetStatus } from '../../stats/role-budget.js';
 import { snapshot } from './response-snapshot.js';
@@ -47,8 +47,18 @@ import { registerBuiltinModes } from '../../response-system/modes/index.js';
 import { deriveSessionTitle, shouldAutoFillSessionTitle } from '../session/session-title.js';
 import { SessionTurnCoordinator } from '../session/session-turn-coordinator.js';
 import { recordTriggerExecutionAnomaly } from '../../trigger/anomaly-store.js';
-import { classifyToolErrorCode } from '../permission/tool-error-code.js';
+import { classifyToolErrorCode, normalizeToolErrorCode } from '../permission/tool-error-code.js';
+import { normalizeExecutionPermissionMode } from '../permission/mode.js';
 import { buildToolLifecycleEventKey } from '../audit/event-key.js';
+import { isFullAccessEnabled, loadDaemonConfig } from '../../config-store.js';
+import { auditFullAccessEvent } from '../auth/authorization-audit.js';
+const INBOUND_MESSAGE_LOG_TEXT_MAX_LENGTH = 240;
+export function formatInboundMessageLogText(text) {
+    const singleLine = text.replace(/\s+/gu, ' ').trim();
+    if (singleLine.length <= INBOUND_MESSAGE_LOG_TEXT_MAX_LENGTH)
+        return singleLine;
+    return singleLine.slice(0, INBOUND_MESSAGE_LOG_TEXT_MAX_LENGTH - 3).trimEnd() + '...';
+}
 export class PauseController {
     state = 'running';
     waiters = new Set();
@@ -505,6 +515,7 @@ export class ResponseEngine {
     /** sessionId → 尚未收到 runner:task-notification 的子任务。 */
     activeRunnerTasks = new Map();
     triggerTerminalMessages = new WeakSet();
+    fullAccessTerminalMessages = new WeakSet();
     agentDelegationRegistry;
     turnCoordinator;
     /** 响应模式协调器（插件化机制中枢）。内置模式在构造时注册。 */
@@ -626,20 +637,44 @@ export class ResponseEngine {
         // 监听中断事件，标记被中断的 session
         this.eventBus.subscribe('task:interrupted', (event) => {
             if ('sessionId' in event && event.sessionId) {
+                const eventIdentity = event;
+                const eventTaskId = eventIdentity.taskId;
+                const activeTask = this.activeTaskSpans.get(event.sessionId);
+                // A delayed interruption from an older task must never invalidate a
+                // newer task that has already claimed the same session.
+                if (eventTaskId && activeTask && activeTask.taskId !== eventTaskId)
+                    return;
                 const reason = (event.reason || 'new_message');
-                this.turnCoordinator.invalidate(event.sessionId, reason);
+                const currentTurn = this.turnCoordinator.invalidate(event.sessionId, reason, { taskId: eventTaskId, generation: eventIdentity.generation });
+                if ((eventTaskId || eventIdentity.generation !== undefined) && !currentTurn)
+                    return;
                 this.interruptedSessions.set(event.sessionId, reason);
                 this.cancelRetryDelays(event.sessionId);
-                this.agentDelegationRegistry?.revokeSession(event.sessionId);
+                // The event can be delayed relative to a newer task on the same
+                // session. Revoke only when the producer supplied the matching task;
+                // the interrupt path below performs the authoritative task-scoped
+                // revocation for legacy events without a taskId.
+                const interruptedTaskId = eventTaskId;
+                if (interruptedTaskId && activeTask?.taskId === interruptedTaskId) {
+                    this.agentDelegationRegistry?.revokeTask(event.sessionId, interruptedTaskId);
+                }
             }
         });
         this.eventBus.subscribe('task:completed', event => {
-            if ('sessionId' in event && event.sessionId)
-                this.activeTaskSpans.delete(event.sessionId);
+            if ('sessionId' in event && event.sessionId) {
+                const taskId = event.taskId;
+                const active = this.activeTaskSpans.get(event.sessionId);
+                if (!taskId || active?.taskId === taskId)
+                    this.activeTaskSpans.delete(event.sessionId);
+            }
         });
         this.eventBus.subscribe('task:error', event => {
-            if ('sessionId' in event && event.sessionId)
-                this.activeTaskSpans.delete(event.sessionId);
+            if ('sessionId' in event && event.sessionId) {
+                const taskId = event.taskId;
+                const active = this.activeTaskSpans.get(event.sessionId);
+                if (!taskId || active?.taskId === taskId)
+                    this.activeTaskSpans.delete(event.sessionId);
+            }
         });
         // 初始化响应模式协调器，注册内置模式（interactive/proactive）
         const registry = new ResponseModeRegistry();
@@ -988,7 +1023,8 @@ export class ResponseEngine {
         const active = this.activeRenderers.get(sessionId);
         if (!active || active.suppressActivities)
             return;
-        void this.emitOperationalNotice(active.renderer, '\u23f3 会话压缩中...', 'info', 'compact-start');
+        void this.emitOperationalNotice(active.renderer, '\u23f3 会话压缩中...', 'info', 'compact-start')
+            .catch(error => logger.warn(`[ResponseEngine] compact-start notice send failed: ${error instanceof Error ? error.message : String(error)}`));
     }
     async emitOperationalNotice(renderer, text, severity, subtype) {
         if (await renderer.sendOperationalNoticeAsText(text))
@@ -1006,10 +1042,28 @@ export class ResponseEngine {
         return true;
     }
     async retryAfterContextRecovery(prompt, opts) {
-        const { streamKey, renderer, agent, session, absoluteProjectPath, effectiveSystemPrompt, modelOverride, runtimeEnv, resetTimer, shouldSuppress, proactive, turnLease, } = opts;
+        const { streamKey, renderer, agent, session, absoluteProjectPath, effectiveSystemPrompt, modelOverride, runtimeEnv, resetTimer, shouldSuppress, proactive, turnLease, beforeRunQuery, } = opts;
         if (!session.agentSessionId || !canCompactAgent(agent)) {
             throw new Error('CONTEXT_COMPACT_FAILED');
         }
+        // A topic may have discovered and activated its first backend earlier in
+        // this logical turn. The Session event is authoritative at that point,
+        // while the original override can still describe the pre-run UNBOUND
+        // snapshot. Compact and retry must address the accepted backend under the
+        // same complete TurnLease or a runner could create a second backend.
+        const recoveryModelOverride = session.threadId
+            ? {
+                ...(modelOverride || {}),
+                backend: { kind: 'topic', agentSessionId: session.agentSessionId },
+                turn: {
+                    sessionId: turnLease.sessionId,
+                    taskId: turnLease.taskId,
+                    turnId: turnLease.turnId,
+                    generation: turnLease.generation,
+                    inputId: turnLease.inputId,
+                },
+            }
+            : modelOverride;
         // text event 在进入 renderer 前已经剔除了上下文超限错误行。保留缓冲中的
         // 有效正文，由 sendOperationalNoticeAsText 先 flush，避免恢复过程丢失已有模型输出。
         await this.emitOperationalNotice(renderer, '上下文过长，正在压缩会话...', 'warn', 'compact-trigger');
@@ -1017,15 +1071,17 @@ export class ResponseEngine {
         this.announcedCompactStarts.add(session.id);
         let compacted;
         try {
-            compacted = await agent.compact(session.id, session.agentSessionId, absoluteProjectPath);
+            compacted = await agent.compact(session.id, session.agentSessionId, absoluteProjectPath, recoveryModelOverride);
         }
         finally {
             this.announcedCompactStarts.delete(session.id);
         }
-        if (compacted) {
+        const compactResult = compacted;
+        if (compactResult === true || compactResult?.ok === true) {
             await this.emitOperationalNotice(renderer, '✅ 压缩完成，继续处理...', 'info', 'compact-retry');
             await renderer.flush();
-            const retryStream = await agent.runQuery(session.id, prompt, absoluteProjectPath, session.agentSessionId, undefined, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
+            beforeRunQuery?.();
+            const retryStream = await agent.runQuery(session.id, prompt, absoluteProjectPath, session.agentSessionId, undefined, effectiveSystemPrompt, this.sessionManager, recoveryModelOverride, runtimeEnv);
             if (await this.cancelStaleRunnerStart(agent, session.id, streamKey, turnLease, turnLease.taskId)) {
                 throw new Error('RUNNER_START_SUPERSEDED');
             }
@@ -1033,9 +1089,9 @@ export class ResponseEngine {
             return await this.processEventStream(retryStream, session, agent, renderer, resetTimer, shouldSuppress, proactive, undefined, // 重试分支不调插件钩子
             undefined, turnLease, opts.permissionMode, opts.proactiveSelfAid);
         }
-        // Dropping the whole session hides the root cause and can replay side
-        // effects in unattended trigger tasks. Surface an actionable failure
-        // instead; callers may explicitly start a fresh task if that is desired.
+        if (compactResult && typeof compactResult === 'object' && compactResult.message) {
+            logger.warn(`[ResponseEngine] Context compact failed: ${compactResult.message}`);
+        }
         throw new Error('CONTEXT_COMPACT_FAILED');
     }
     async recoverFromContextLimit(initialResult, opts) {
@@ -1075,6 +1131,61 @@ export class ResponseEngine {
             && message.source === 'trigger'
             && !!message.triggerMeta?.triggerId;
     }
+    /**
+     * A fullaccess Trigger may run with no current relation access for its
+     * origin actor, but only after the daemon gate and persisted owner
+     * provenance still validate. This is intentionally stricter than merely
+     * checking the message's requested permission mode.
+     */
+    isCurrentFullAccessTrigger(message) {
+        const trigger = message.triggerMeta;
+        if (message.source !== 'trigger'
+            || trigger?.permissionModeOverride !== 'fullaccess'
+            || typeof trigger.authorizedBy !== 'string' || !trigger.authorizedBy
+            || typeof trigger.triggerId !== 'string' || !trigger.triggerId
+            || typeof trigger.runId !== 'string' || !trigger.runId
+            || typeof trigger.attemptId !== 'string' || !trigger.attemptId) {
+            return false;
+        }
+        try {
+            return isFullAccessEnabled()
+                && new Set(loadDaemonConfig().owners ?? []).has(trigger.authorizedBy);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * The authorization envelope is immutable for one logical run, but the
+     * daemon gate, approving owner, and runner profile are live policy. Check
+     * them immediately before every Runner invocation, including retries.
+     */
+    assertCurrentFullAccessExecutionAuthorization(authorization, agent) {
+        if (authorization.permissionMode !== 'fullaccess'
+            || authorization.processRole !== 'fullaccess-run'
+            || authorization.dataScope !== 'daemon'
+            || typeof authorization.authorizedBy !== 'string'
+            || !authorization.authorizedBy) {
+            throw new Error('fullaccess execution authorization is missing or malformed');
+        }
+        if (authorization.source === 'trigger'
+            && (!authorization.triggerId || !authorization.runId || !authorization.attemptId)) {
+            throw new Error('fullaccess Trigger authorization lacks scheduler identity or approval provenance');
+        }
+        if (authorization.source !== 'fullaccess-command' && authorization.source !== 'trigger') {
+            throw new Error('fullaccess execution authorization has an unsupported source');
+        }
+        if (!isFullAccessEnabled()) {
+            throw new Error('fullaccess execution is disabled by daemon.json');
+        }
+        const currentOwners = new Set(loadDaemonConfig().owners ?? []);
+        if (!currentOwners.has(authorization.authorizedBy)) {
+            throw new Error('fullaccess execution authorization is no longer owned');
+        }
+        if (agent.capabilities?.fullaccess !== true) {
+            throw new Error(`baseagent ${agent.name} does not provide a complete fullaccess execution profile`);
+        }
+    }
     resolveTriggerExecutionIdentity(message, selfAid) {
         if (message.source !== 'trigger' || !message.triggerMeta?.triggerId)
             return undefined;
@@ -1187,7 +1298,7 @@ export class ResponseEngine {
             causation: opts.causation ?? message.causation,
         });
     }
-    publishTriggerExecutionSkipped(message, reason, causation) {
+    publishTriggerExecutionSkipped(message, reason, causation, interruption) {
         const terminal = this.claimTriggerTerminal(message);
         if (!terminal)
             return;
@@ -1200,6 +1311,7 @@ export class ResponseEngine {
             attemptId: trigger.attemptId,
             originTriggerId: trigger.triggerId,
             reason,
+            ...(interruption ?? {}),
             targetChannel: message.channel,
             targetChannelId: message.channelId,
             fireTime: trigger.fireTime,
@@ -1207,16 +1319,25 @@ export class ResponseEngine {
         });
     }
     /** Close the internal daemon conversation before returning from an interrupted Trigger turn. */
-    async publishTriggerExecutionInterrupted(message, adapter, envelope, reason, causation) {
+    async publishTriggerExecutionInterrupted(message, adapter, envelope, reason, causation, generation) {
+        const interruption = reason === 'stale_generation'
+            ? {
+                reasonCode: 'stale_generation',
+                decisionSource: 'infrastructure',
+                executionState: 'interrupted',
+                ...(generation?.expected !== undefined ? { generation: generation.expected } : {}),
+                ...(generation?.current !== undefined ? { currentGeneration: generation.current } : {}),
+            }
+            : undefined;
         if (this.isTrustedDaemonTrigger(message)) {
             await adapter.send(envelope, {
                 kind: 'status.interrupted',
-                metadata: { reason },
+                metadata: { reason, ...(interruption ?? {}) },
             }).catch(error => {
                 logger.warn(`[ResponseEngine] Failed to close interrupted Trigger run=${message.triggerMeta?.runId ?? '<unknown>'}: ${error instanceof Error ? error.message : String(error)}`);
             });
         }
-        this.publishTriggerExecutionSkipped(message, reason, causation);
+        this.publishTriggerExecutionSkipped(message, reason, causation, interruption);
     }
     publishTriggerExecutionCompleted(message, messageId, durationMs, causation) {
         const terminal = this.claimTriggerTerminal(message);
@@ -1242,7 +1363,7 @@ export class ResponseEngine {
     static COMMAND_PREFIXES = [
         '/new', '/pwd', '/help', '/status', '/restart',
         '/model', '/effort', '/agent', '/slist', '/session', '/rename', '/repair', '/fork',
-        '/stop', '/pause', '/resume', '/clear', '/compact', '/del', '/perm', '/file', '/check',
+        '/stop', '/pause', '/resume', '/clear', '/compact', '/renew', '/del', '/perm', '/file', '/check',
         '/s ', '/name ', '/rewind', '/rw', '/rw ', '/activity', '/observable', '/chatmode',
         '/aid', '/upgrade', '/evolagent',
     ];
@@ -1255,6 +1376,39 @@ export class ResponseEngine {
      * 处理消息（主入口）
      */
     async processMessage(message) {
+        const fallbackFullAccessAudit = this.resolveFullAccessAuditCandidate(message);
+        let outerFailureReason;
+        try {
+            await this.processMessageWithMonitors(message);
+        }
+        catch (error) {
+            outerFailureReason = error instanceof Error ? error.message : String(error);
+            throw error;
+        }
+        finally {
+            if (fallbackFullAccessAudit && !this.fullAccessTerminalMessages.has(message)) {
+                auditFullAccessEvent({
+                    event: fallbackFullAccessAudit.authorization.source === 'trigger'
+                        ? 'fullaccess.trigger.execution.ended'
+                        : 'fullaccess.execution.ended',
+                    source: fallbackFullAccessAudit.authorization.source,
+                    actorId: fallbackFullAccessAudit.authorization.authorizedBy,
+                    processRole: fallbackFullAccessAudit.processRole,
+                    agentAid: message.selfAID,
+                    messageId: message.messageId,
+                    triggerId: fallbackFullAccessAudit.authorization.triggerId,
+                    runId: fallbackFullAccessAudit.authorization.runId,
+                    attemptId: fallbackFullAccessAudit.authorization.attemptId,
+                    result: 'blocked',
+                    reason: outerFailureReason ?? 'fullaccess execution stopped before permission setup',
+                    executed: false,
+                    executionState: 'blocked',
+                });
+                this.fullAccessTerminalMessages.add(message);
+            }
+        }
+    }
+    async processMessageWithMonitors(message) {
         const idleMs = (this.globalSettings.idleMonitor?.timeout ?? 120) * 1000;
         const totalExecutionMs = this.totalExecutionLimitMs();
         if (message.handoffDelivery
@@ -1318,7 +1472,15 @@ export class ResponseEngine {
         // ── 角色访问控制检查：读取该用户角色的 allowAccess 配置，false 则拦截并回复权限不足 ──
         const userRole = session.identity?.role || 'none';
         const isInternalHandoff = message.source === 'handoff';
-        if (!isInternalHandoff && !checkRoleAccess(userRole, selfAidForAccess)) {
+        const fullAccessAuditCandidate = this.resolveFullAccessAuditCandidate(message);
+        const isCurrentFullAccessCommand = fullAccessAuditCandidate?.authorization.source === 'fullaccess-command'
+            && fullAccessAuditCandidate.processRole === 'fullaccess-run';
+        const isCurrentFullAccessTrigger = fullAccessAuditCandidate?.authorization.source === 'trigger'
+            && fullAccessAuditCandidate.processRole === 'fullaccess-run';
+        if (!isInternalHandoff
+            && !isCurrentFullAccessCommand
+            && !isCurrentFullAccessTrigger
+            && !checkRoleAccess(userRole, selfAidForAccess)) {
             logger.warn(`[ResponseEngine] Access denied: role=${userRole} peerKey=${message.channelId} session=${session.id}`);
             const channelKey = session.metadata?.channelKey || message.channel;
             const channelInfo = this.resolveChannelInfo(channelKey);
@@ -1539,6 +1701,55 @@ export class ResponseEngine {
             this.activeMonitors.delete(streamKey);
         }
     }
+    resolveFullAccessAuditCandidate(message) {
+        const commandAuthorization = message.executionPermissionOverride;
+        if (commandAuthorization?.permissionMode === 'fullaccess'
+            && commandAuthorization.processRole === 'fullaccess-run'
+            && commandAuthorization.dataScope === 'daemon'
+            && commandAuthorization.source === 'fullaccess-command'
+            && typeof commandAuthorization.authorizedBy === 'string'
+            && commandAuthorization.authorizedBy.length > 0) {
+            let currentOwner = false;
+            try {
+                currentOwner = isFullAccessEnabled()
+                    && new Set(loadDaemonConfig().owners ?? []).has(commandAuthorization.authorizedBy);
+            }
+            catch {
+                // Runtime validation will fail closed; the audit must still retain the
+                // attempted authorization without falsely labeling it active.
+            }
+            return {
+                authorization: commandAuthorization,
+                processRole: currentOwner ? 'fullaccess-run' : 'none',
+            };
+        }
+        const trigger = message.triggerMeta;
+        if (message.source === 'trigger'
+            && trigger?.permissionModeOverride === 'fullaccess'
+            && typeof trigger.authorizedBy === 'string' && trigger.authorizedBy.length > 0
+            && typeof trigger.triggerId === 'string' && trigger.triggerId.length > 0
+            && typeof trigger.runId === 'string' && trigger.runId.length > 0
+            && typeof trigger.attemptId === 'string' && trigger.attemptId.length > 0) {
+            const current = this.isCurrentFullAccessTrigger(message);
+            return {
+                authorization: {
+                    permissionMode: 'fullaccess',
+                    processRole: 'fullaccess-run',
+                    dataScope: 'daemon',
+                    source: 'trigger',
+                    authorizedBy: trigger.authorizedBy,
+                    triggerId: trigger.triggerId,
+                    runId: trigger.runId,
+                    attemptId: trigger.attemptId,
+                },
+                // Keep attempted authorization details for audit correlation, but do
+                // not claim an active fullaccess identity when the process gate or
+                // approval provenance has since become invalid.
+                processRole: current ? 'fullaccess-run' : 'none',
+            };
+        }
+        return undefined;
+    }
     /** 获取回复上下文（跟着任务走） */
     getReplyContext(message) {
         return message.replyContext;
@@ -1551,10 +1762,10 @@ export class ResponseEngine {
             ? configuredSeconds * 1000
             : undefined;
     }
-    retryAttemptTimeoutMs() {
+    apiRetryTimeoutMs() {
         if (this.globalSettings.idleMonitor?.enabled === false)
             return undefined;
-        const configuredSeconds = this.globalSettings.idleMonitor?.retryAttemptTimeout
+        const configuredSeconds = this.globalSettings.idleMonitor?.apiRetryTimeout
             ?? this.globalSettings.idleMonitor?.timeout
             ?? 120;
         return typeof configuredSeconds === 'number'
@@ -1633,7 +1844,9 @@ export class ResponseEngine {
         // 二次拦截：如果命令消息绕过 MessageBridge 的 handleCommand 泄漏到这里，
         // 静默丢弃而不是发送给 Agent（命令已在 MessageBridge 层处理过）
         const rawContent = message.content.replace(/^(>[^\n]*\n)+\n?/, '').trim();
-        if (rawContent.startsWith('/') && this.isKnownCommand(rawContent)) {
+        if (!message.executionPermissionOverride
+            && rawContent.startsWith('/')
+            && this.isKnownCommand(rawContent)) {
             logger.warn(`[ResponseEngine] Command leaked past MessageBridge, dropped: "${rawContent.substring(0, 40)}"`);
             this.publishTriggerExecutionFailure(message, 'trigger_command_not_supported');
             return;
@@ -1870,7 +2083,7 @@ export class ResponseEngine {
             },
             modeConfig: resolvedMode.context.modeConfig,
             state: modeState,
-            isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, chatType, session.selfAID || message.selfAID),
+            isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, chatType, selfAid),
             logger,
         } : null;
         if (resolvedMode?.mode.beforeProcess && modeProcessCtx) {
@@ -1951,6 +2164,8 @@ export class ResponseEngine {
                 this.eventBus.publish({
                     type: 'task:error',
                     sessionId: session.id,
+                    taskId,
+                    generation: turnLease?.generation,
                     error: timeoutError.message,
                     errorType,
                     agentName: agentNameForStats,
@@ -1975,6 +2190,17 @@ export class ResponseEngine {
         let streamResult = { isError: false, lastReplyText: '', fullText: '', hasReceivedText: false };
         let startTime = runnerStartedAt;
         let protocolReplayAttempts = 0;
+        // These values span the outer task try/catch/finally so fullaccess audit
+        // completion and context cleanup also cover setup failures.
+        let fullAccessAuthorization;
+        let fullAccessAuditStartedAt;
+        let fullAccessAuditBaseagent;
+        let fullAccessAuditModel;
+        let fullAccessAuditProcessRole = 'none';
+        let fullAccessRunnerInvoked = false;
+        let fullAccessExecutionFailed = false;
+        let fullAccessExecutionFailureReason;
+        let activePermissionContext;
         try {
             const isBackground = this.isBackgroundSession(session, message.channel, message.channelId);
             // 记录收到消息
@@ -2062,9 +2288,13 @@ export class ResponseEngine {
             const imageInfo = message.images && message.images.length > 0 ? ` [${message.images.length} image(s)]` : '';
             const modeInfo = isBackground ? ' [\u540e\u53f0]' : '';
             const e2eeInfo = message.replyContext?.metadata?.encrypted != null ? ` encrypt=${message.replyContext.metadata.encrypted}` : '';
-            logger.info(`[${message.channel}] ${message.channelId}: ${message.content}${imageInfo}${modeInfo}${e2eeInfo}`);
+            const contentPreview = formatInboundMessageLogText(message.content);
+            logger.info(`[${message.channel}] ${message.channelId}: ${contentPreview}${imageInfo}${modeInfo}${e2eeInfo}`);
             // 构建 peer 标识（优先 peerName，退化到 peerId / channelId）
-            const peerName = session.metadata?.peerName ?? message.peerName;
+            // Group sessions are shared by multiple senders. The current inbound
+            // message is authoritative; session metadata is only a fallback for
+            // legacy paths that do not carry a per-message display name.
+            const peerName = message.peerName ?? session.metadata?.peerName;
             const peerId = session.metadata?.peerId ?? message.peerId ?? message.channelId;
             const peerShort = peerId ? peerId.split('.')[0].split(':')[0] : '?';
             const peerLabel = peerName && peerName !== peerShort ? `${peerShort}(${peerName})` : peerShort;
@@ -2075,7 +2305,16 @@ export class ResponseEngine {
             turnLease = await this.turnCoordinator.begin(session, taskId);
             // 记录开始处理
             const taskEncrypt = message.replyContext?.metadata?.encrypted != null ? !!(message.replyContext.metadata.encrypted) : undefined;
-            this.eventBus.publish({ type: 'task:started', sessionId: session.id, agentName: agentNameForStats, encrypt: taskEncrypt, chatmode, causation: taskCausation });
+            this.eventBus.publish({
+                type: 'task:started',
+                sessionId: session.id,
+                taskId,
+                generation: turnLease.generation,
+                agentName: agentNameForStats,
+                encrypt: taskEncrypt,
+                chatmode,
+                causation: taskCausation,
+            });
             this.touchAgentActivity(channelKey);
             // Upgrade the channel acknowledgement at task start, before compaction and
             // runner setup, so processing feedback remains visible for the whole run.
@@ -2101,12 +2340,12 @@ export class ResponseEngine {
                 adapter,
                 envelope,
                 agentAid: session.selfAID,
+                permissionMode: () => effectivePermissionMode,
                 flushDelay: (options?.flushDelay ?? this.agentRegistry?.resolveByChannel(channelKey)?.config?.flush_delay ?? 3) * 1000,
                 suppressActivityItems: isProactive ? false : middleOutputMode !== 'all',
                 suppressIntermediateText: isProactive ? false : middleOutputMode === 'none',
                 operationalNoticesAsText: !isProactive && middleOutputMode !== 'none',
                 fileMarkerPattern: options?.fileMarkerPattern,
-                diagEnabled: this.globalSettings.debug?.flusherDiag,
                 send: async (payload) => {
                     if (turnLease && !this.turnCoordinator.canPublish(turnLease)) {
                         snapshot.pushOutbound(session.id, taskId, { kind: payload.kind, decision: 'suppressed-stale-turn' });
@@ -2145,7 +2384,7 @@ export class ResponseEngine {
                         this.touchAgentActivity(channelKey);
                     const enrichedEnvelope = withEnvelopeReplyContext(envelope, opts);
                     snapshot.pushOutbound(session.id, taskId, { kind: payload.kind, decision: 'sent' });
-                    await adapter.send(enrichedEnvelope, payload);
+                    return await adapter.send(enrichedEnvelope, payload);
                 },
             });
             this.activeRenderers.set(session.id, {
@@ -2154,11 +2393,6 @@ export class ResponseEngine {
                 suppressActivities: shouldSuppress(),
             });
             renderer.addLifecycle('started');
-            // 预压缩与任务过程中的自动压缩共用同一投影规则：interactive 的 text/all
-            // 均以普通非最终文本显示运行提示；none 不显示。其它 activity 在 all 下仍保持结构化。
-            // 它仍发生在真正的 prompt 执行之前。
-            await this.runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, renderer);
-            startTime = Date.now();
             if (isProactive) {
                 logger.info(`[ResponseEngine] proactive mode: outputs via thought.put task=${taskId}`);
             }
@@ -2275,12 +2509,21 @@ export class ResponseEngine {
                 };
             })();
             let effectivePermissionMode = 'readonly';
+            // Allocate/register the session-owned root before any runner preflight
+            // context is installed. Codex may already own a stronger directory;
+            // other runners receive a private child of the process TMPDIR.
+            const sessionRuntimeDir = agent.getManagedTempDir?.(session.id) ?? ensureSessionRuntimeDir(session.id);
             const recordExecutionAnomaly = triggerRunId
                 ? (anomaly) => {
                     recordTriggerExecutionAnomaly(triggerRunId, {
                         ...anomaly,
                         correlationId: anomaly.correlationId ?? anomaly.requestId,
                         agentAid: anomaly.agentAid ?? session.selfAID ?? message.selfAID,
+                        agentName: anomaly.agentName
+                            ?? (agentNameForStats !== '<unknown>' ? agentNameForStats : undefined)
+                            ?? anomaly.agentAid
+                            ?? session.selfAID
+                            ?? message.selfAID,
                         sessionId: anomaly.sessionId ?? session.id,
                         permissionMode: anomaly.permissionMode ?? effectivePermissionMode,
                     });
@@ -2291,7 +2534,7 @@ export class ResponseEngine {
                 : undefined;
             const pureSessionPolicyHook = runModeConfig?.policyHook;
             // 设置权限审批的交互上下文（支持交互卡片）
-            agent.setPermissionContext?.(session.id, {
+            const permissionContext = {
                 sendPrompt: permissionPromptForOrigin,
                 adapter: permissionAdapter,
                 channelId: permissionChannelId,
@@ -2305,12 +2548,14 @@ export class ResponseEngine {
                 chatmode: isProactive ? 'proactive' : 'interactive',
                 role: peerRole,
                 chatType: authChatType,
-                selfAid: session.selfAID || message.selfAID,
+                selfAid,
+                managedTempDir: sessionRuntimeDir,
                 allowReadonlySourceDiagnostics: effectiveAgentConfig?.readonlySourceDiagnostics === true,
                 peerKey: authPeerKey,
                 causation: taskCausation,
                 approvalRouting,
                 approvalInteractionPolicy: authorizationIdentity ? 'deny' : 'interactive',
+                permissionMode: effectivePermissionMode,
                 recordExecutionAnomaly,
                 pauseController: taskPauseController,
                 preToolUsePolicyHook: pureSessionPolicyHook,
@@ -2323,6 +2568,7 @@ export class ResponseEngine {
                     })
                     : undefined,
                 turn: {
+                    sessionId: turnLease.sessionId,
                     taskId,
                     turnId: turnLease.turnId,
                     generation: turnLease.generation,
@@ -2424,7 +2670,9 @@ export class ResponseEngine {
                         return undefined;
                     };
                 })(),
-            });
+            };
+            activePermissionContext = permissionContext;
+            agent.setPermissionContext?.(session.id, permissionContext);
             // per-session 权限模式在 try 内、peerKey 解析后设置（见 resolvePermissionMode 调用）
             // 标记会话为处理中（实时持久化，重启后可恢复）
             this.sessionManager.markProcessing(session.id, taskId);
@@ -2474,21 +2722,68 @@ export class ResponseEngine {
                 // 这样单条和积压合并批次不会因队列状态不同而切换关系级配置。
                 const normalizedBaseagent = normalizeBaseagent(agent.name);
                 // 设置 per-call 权限模式：只按当前角色定义解析（不读物理配置层或 session.metadata）。
-                // Trigger 只能降低本次调用权限，不能突破当前角色的权限上限。
+                // 普通 Trigger override 只能降低权限；可信 /fa 或 scheduler fullaccess
+                // 使用独立授权路径，不进入角色 authority ceiling。
                 // 作为 per-call 入参随 modelOverride 传入 runQuery —— 与 model/effort 同构，
                 // 不写 AgentRunner 实例字段，多对端/多会话并发共享同一 runner 实例时互不污染。
                 const triggerPermissionModeOverride = message.triggerMeta?.permissionModeOverride;
-                try {
-                    effectivePermissionMode = constrainRuntimePermissionMode({
-                        selfAid: selfAid || undefined,
-                        role: peerRole,
-                        requestedValue: triggerPermissionModeOverride,
-                    }).effectiveValue;
+                const commandFullAccess = message.executionPermissionOverride;
+                const triggerFullAccess = triggerPermissionModeOverride === 'fullaccess';
+                if (commandFullAccess || triggerFullAccess) {
+                    if (commandFullAccess) {
+                        if (commandFullAccess.permissionMode !== 'fullaccess'
+                            || commandFullAccess.processRole !== 'fullaccess-run'
+                            || commandFullAccess.dataScope !== 'daemon'
+                            || commandFullAccess.source !== 'fullaccess-command'
+                            || !commandFullAccess.authorizedBy) {
+                            throw new Error('fullaccess command authorization is missing or malformed');
+                        }
+                        fullAccessAuthorization = commandFullAccess;
+                    }
+                    else {
+                        if (message.source !== 'trigger'
+                            || !message.triggerMeta?.triggerId
+                            || !message.triggerMeta.runId
+                            || !message.triggerMeta.attemptId
+                            || !message.triggerMeta.authorizedBy) {
+                            throw new Error('fullaccess Trigger override lacks trusted scheduler identity or approval provenance');
+                        }
+                        const currentOwners = new Set(loadDaemonConfig().owners ?? []);
+                        if (!currentOwners.has(message.triggerMeta.authorizedBy)) {
+                            throw new Error('fullaccess Trigger approval is no longer owned');
+                        }
+                        fullAccessAuthorization = {
+                            permissionMode: 'fullaccess',
+                            processRole: 'fullaccess-run',
+                            dataScope: 'daemon',
+                            source: 'trigger',
+                            triggerId: message.triggerMeta.triggerId,
+                            runId: message.triggerMeta.runId,
+                            attemptId: message.triggerMeta.attemptId,
+                            authorizedBy: message.triggerMeta.authorizedBy,
+                        };
+                    }
+                    this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent);
+                    effectivePermissionMode = 'fullaccess';
                 }
-                catch (e) {
-                    logger.warn(`[ResponseEngine] permission mode resolution failed, using fallback: ${e instanceof Error ? e.message : String(e)}`);
-                    effectivePermissionMode = 'readonly';
+                else {
+                    try {
+                        effectivePermissionMode = constrainRuntimePermissionMode({
+                            selfAid: selfAid || undefined,
+                            role: peerRole,
+                            requestedValue: triggerPermissionModeOverride,
+                        }).effectiveValue;
+                    }
+                    catch (e) {
+                        logger.warn(`[ResponseEngine] permission mode resolution failed, using fallback: ${e instanceof Error ? e.message : String(e)}`);
+                        effectivePermissionMode = 'readonly';
+                    }
                 }
+                // The mode is resolved after the initial context is assembled. Keep
+                // the runner-held object live so preflight, approvals, and audit
+                // records all observe the same normalized value.
+                permissionContext.permissionMode = effectivePermissionMode;
+                permissionContext.executionPermission = fullAccessAuthorization;
                 // 按 关系级 > agent级 > 全局 解析本次调用的模型/强度，作为 per-call 入参传入 runQuery。
                 // 不缓存、不绑会话——改关系级/agent级后该范围所有会话的下条消息即时生效；
                 // 多对端并发各自独立解析、各自传参，无共享状态可被污染。
@@ -2622,7 +2917,9 @@ export class ResponseEngine {
                 }
                 // permissionMode 随角色策略或 trigger override 传入；单 runner
                 // 嵌入/测试路径没有 self/peer 作用域时，避免制造无配置来源的 override。
-                const shouldPassPermissionMode = !!message.triggerMeta?.permissionModeOverride || !!selfAid;
+                const shouldPassPermissionMode = !!fullAccessAuthorization
+                    || !!message.triggerMeta?.permissionModeOverride
+                    || !!selfAid;
                 if (shouldPassPermissionMode) {
                     modelOverride = { ...(modelOverride || {}), permissionMode: effectivePermissionMode };
                 }
@@ -2638,6 +2935,61 @@ export class ResponseEngine {
                         sessionTitle: deriveSessionTitle(session.name, message.content, session.threadId),
                     };
                 }
+                // Capture the authoritative topic binding after begin() has durably
+                // published this logical run's TurnLease. A topic UNBOUND value is
+                // explicit and must never fall back to runner-local cache. This must
+                // happen before task-start auto compact because compact is a backend
+                // management action just like the subsequent runQuery.
+                let runAgentSessionId = session.agentSessionId;
+                if (session.threadId
+                    && typeof this.sessionManager.getSessionById === 'function') {
+                    const latestBackendSession = await this.sessionManager.getSessionById(session.id);
+                    if (!latestBackendSession || latestBackendSession.threadId !== session.threadId) {
+                        throw new Error('topic session changed before backend run started');
+                    }
+                    runAgentSessionId = latestBackendSession.agentSessionId;
+                    session.agentSessionId = runAgentSessionId;
+                    session.metadata = latestBackendSession.metadata;
+                }
+                modelOverride = {
+                    ...(modelOverride || {}),
+                    ...(session.threadId
+                        ? { backend: { kind: 'topic', agentSessionId: runAgentSessionId ?? null } }
+                        : {}),
+                    turn: {
+                        sessionId: turnLease.sessionId,
+                        taskId,
+                        turnId: turnLease.turnId,
+                        generation: turnLease.generation,
+                        inputId: turnLease.inputId,
+                    },
+                };
+                const refreshTopicBindingForLogicalRetry = async () => {
+                    if (!session.threadId || typeof this.sessionManager.getSessionById !== 'function')
+                        return;
+                    const latest = await this.sessionManager.getSessionById(session.id);
+                    if (!latest || latest.threadId !== session.threadId) {
+                        throw new Error('topic session changed during backend run');
+                    }
+                    const latestAgentSessionId = latest.agentSessionId;
+                    session.agentSessionId = latestAgentSessionId;
+                    session.metadata = latest.metadata;
+                    if (latestAgentSessionId === runAgentSessionId)
+                        return;
+                    logger.info(`[ResponseEngine] Refreshing authoritative topic backend for logical retry: `
+                        + `session=${session.id} task=${taskId} backend=${latestAgentSessionId ?? 'none'}`);
+                    runAgentSessionId = latestAgentSessionId;
+                    modelOverride = {
+                        ...(modelOverride || {}),
+                        backend: { kind: 'topic', agentSessionId: runAgentSessionId ?? null },
+                    };
+                };
+                // 预压缩必须使用与本轮 runQuery 相同的有效模型/强度覆盖。
+                // 模型解析完成后再执行，避免关系级模型存在时回落到 runner 默认模型。
+                await this.runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, renderer, modelOverride, fullAccessAuthorization
+                    ? () => this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent)
+                    : undefined);
+                startTime = Date.now();
                 const causationPath = inputCausation.trigger?.path ?? [];
                 const originNode = causationPath[0];
                 logger.info(`[ResponseEngine] execution context session=${session.id}`
@@ -2805,7 +3157,7 @@ export class ResponseEngine {
                             }];
                     const peerItems = (() => {
                         if (message.handoffDelivery && this.handoffRuntime) {
-                            const items = this.handoffRuntime.buildPromptItems(message);
+                            const items = this.handoffRuntime.buildPromptItems(message, peerRole);
                             if (items.length > 0) {
                                 v2HandoffIds = Array.from(new Set(items.flatMap(item => (item.handoff?.handoffIds?.length
                                     ? item.handoff.handoffIds
@@ -2889,7 +3241,6 @@ export class ResponseEngine {
                 // private child of the process-provided TMPDIR. Both paths are passed
                 // explicitly so sandboxed helper commands never fall back to a shared
                 // agent or project directory for transient state.
-                const sessionRuntimeDir = agent.getManagedTempDir?.(session.id) ?? ensureSessionRuntimeDir(session.id);
                 const taskRuntimeContext = {
                     taskId,
                     sessionId: session.id,
@@ -2903,6 +3254,14 @@ export class ResponseEngine {
                     peerName: peerName || undefined,
                     peerType: message.peerType || session.metadata?.peerType || undefined,
                     peerRole,
+                    permissionMode: effectivePermissionMode,
+                    ...(fullAccessAuthorization ? {
+                        processRole: fullAccessAuthorization.processRole,
+                        dataScope: fullAccessAuthorization.dataScope,
+                        authorizedBy: fullAccessAuthorization.authorizedBy,
+                        executionSource: fullAccessAuthorization.source,
+                    } : {}),
+                    daemonRuntimeEpoch: this.agentDelegationRegistry?.getRuntimeEpoch(),
                     threadId: session.threadId || undefined,
                     sessionRuntimeDir,
                     runtimeLockDir: ensureRuntimeLockDir(sessionRuntimeDir),
@@ -2911,15 +3270,6 @@ export class ResponseEngine {
                 };
                 this.activeTaskRuntimeContexts.set(session.id, taskRuntimeContext);
                 runtimeEnv = buildTaskRuntimeEnv(taskRuntimeContext);
-                modelOverride = {
-                    ...(modelOverride || {}),
-                    turn: {
-                        taskId,
-                        turnId: turnLease.turnId,
-                        generation: turnLease.generation,
-                        inputId: turnLease.inputId,
-                    },
-                };
                 if (this.agentDelegationRegistry && configActorId && selfAid && peerKey) {
                     const delegationToken = this.agentDelegationRegistry.issue({
                         sessionId: session.id,
@@ -2932,13 +3282,14 @@ export class ResponseEngine {
                         selfAid,
                         peerKey,
                         issuedRole: peerRole,
+                        ...(fullAccessAuthorization ? { executionIdentity: fullAccessAuthorization } : {}),
                     });
                     runtimeEnv[AGENT_DELEGATION_TOKEN_ENV] = delegationToken;
                 }
                 const retryScheduler = new RetryScheduler(fallbackCandidates, modelOverride?.model || agentModel, model => (typeof agent.resolveModelId === 'function'
                     ? (agent.resolveModelId(model) ?? model)
                     : model));
-                const retryAttemptTimeoutMs = this.retryAttemptTimeoutMs();
+                const apiRetryTimeoutMs = this.apiRetryTimeoutMs();
                 const retryInputIsAtMostOnce = agent.retryInputSemantics === 'at_most_once';
                 let runAttempt = 1;
                 const recordRetryHealthError = async (retryError) => {
@@ -2956,11 +3307,45 @@ export class ResponseEngine {
                 };
                 while (true) {
                     let streamRegistered = false;
-                    const shouldTimeoutRetryAttempt = retryScheduler.shouldTimeoutAttempt() && retryAttemptTimeoutMs !== undefined;
+                    const shouldTimeoutRetryAttempt = retryScheduler.shouldTimeoutAttempt() && apiRetryTimeoutMs !== undefined;
                     let attemptTimeout;
                     try {
-                        logger.info(`[ResponseEngine] agent.runQuery start: agent=${agent.name} session=${session.id} task=${taskId} attempt=${runAttempt} apiRetries=${retryScheduler.apiRetryAttemptsMade} agentSessionId=${session.agentSessionId ?? 'none'}`);
-                        const stream = await agent.runQuery(session.id, effectivePrompt, absoluteProjectPath, session.agentSessionId, renderResult?.images.length ? renderResult.images : message.images, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
+                        logger.info(`[ResponseEngine] agent.runQuery start: agent=${agent.name} session=${session.id} task=${taskId} attempt=${runAttempt} apiRetries=${retryScheduler.apiRetryAttemptsMade} agentSessionId=${runAgentSessionId ?? 'none'} topicBinding=${session.threadId ? 'authoritative' : 'legacy'}`);
+                        if (fullAccessAuthorization) {
+                            this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent);
+                            if (fullAccessAuditStartedAt === undefined) {
+                                fullAccessAuditProcessRole = 'fullaccess-run';
+                                fullAccessAuditStartedAt = Date.now();
+                                fullAccessAuditBaseagent = normalizedBaseagent.canonical;
+                                fullAccessAuditModel = modelOverride?.model || agentModel;
+                                auditFullAccessEvent({
+                                    event: fullAccessAuthorization.source === 'trigger'
+                                        ? 'fullaccess.trigger.execution.started'
+                                        : 'fullaccess.execution.started',
+                                    source: fullAccessAuthorization.source,
+                                    actorId: fullAccessAuthorization.authorizedBy,
+                                    processRole: fullAccessAuditProcessRole,
+                                    agentAid: selfAid,
+                                    agentName: agentNameForStats,
+                                    sessionId: session.id,
+                                    taskId,
+                                    messageId: message.messageId,
+                                    triggerId: fullAccessAuthorization.triggerId,
+                                    runId: fullAccessAuthorization.runId,
+                                    attemptId: fullAccessAuthorization.attemptId,
+                                    dataScope: fullAccessAuthorization.dataScope,
+                                    authorizedBy: fullAccessAuthorization.authorizedBy,
+                                    baseagent: fullAccessAuditBaseagent,
+                                    model: fullAccessAuditModel,
+                                });
+                                // Audit is synchronous today, but it is an observable boundary.
+                                // Revalidate once more so an administrative revocation observed
+                                // there cannot be followed by a privileged Runner call.
+                                this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent);
+                            }
+                            fullAccessRunnerInvoked = true;
+                        }
+                        const stream = await agent.runQuery(session.id, effectivePrompt, absoluteProjectPath, runAgentSessionId, renderResult?.images.length ? renderResult.images : message.images, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
                         // The turn may be superseded while the runner is still creating its
                         // backend query. Replay the interrupt after runQuery resolves, when
                         // every runner is required to have an addressable cancellation handle.
@@ -2970,16 +3355,20 @@ export class ResponseEngine {
                         agent.registerStream(streamKey, stream);
                         streamRegistered = true;
                         if (shouldTimeoutRetryAttempt) {
-                            attemptTimeout = createRetryAttemptTimeout(retryAttemptTimeoutMs);
+                            attemptTimeout = createRetryAttemptTimeout(apiRetryTimeoutMs);
                             resetTimer('retry_attempt');
                         }
                         const processAttempt = this.processEventStream(stream, session, agent, renderer, (eventType, toolName) => {
                             resetTimer(eventType, toolName);
                             attemptTimeout?.reset();
-                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode, session.selfAID || message.selfAID);
+                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode, selfAid);
                         streamResult = attemptTimeout
                             ? await Promise.race([processAttempt, attemptTimeout.promise])
                             : await processAttempt;
+                        // Activation can complete either before runQuery returns (Codex)
+                        // or while its event stream is consumed (Claude/Gemini/Ecagent).
+                        // Always reconcile from strict latest before any logical retry.
+                        await refreshTopicBindingForLogicalRetry();
                         if (!streamResult.isError) {
                             const protocolDecision = this.turnCoordinator.evaluateCommit(turnLease, this.buildTurnCommitEvidence(session, streamResult));
                             const protocolReason = protocolDecision.ok ? undefined : protocolDecision.reason;
@@ -3015,6 +3404,7 @@ export class ResponseEngine {
                         break; // 成功，跳出重试循环
                     }
                     catch (retryError) {
+                        await refreshTopicBindingForLogicalRetry();
                         const retryAttemptTimedOut = retryError instanceof RetryAttemptTimeoutError;
                         if (retryAttemptTimedOut) {
                             logger.warn(`[ResponseEngine] Retry attempt ${runAttempt} timed out after ${retryError.timeoutMs}ms without agent events; interrupting current stream`);
@@ -3134,9 +3524,12 @@ export class ResponseEngine {
                         resetTimer,
                         shouldSuppress,
                         proactive,
-                        proactiveSelfAid: session.selfAID || message.selfAID,
+                        proactiveSelfAid: selfAid,
                         permissionMode: effectivePermissionMode,
                         turnLease,
+                        beforeRunQuery: fullAccessAuthorization
+                            ? () => this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent)
+                            : undefined,
                     });
                 }
                 else {
@@ -3177,9 +3570,12 @@ export class ResponseEngine {
                     resetTimer,
                     shouldSuppress,
                     proactive,
-                    proactiveSelfAid: session.selfAID || message.selfAID,
+                    proactiveSelfAid: selfAid,
                     permissionMode: effectivePermissionMode,
                     turnLease,
+                    beforeRunQuery: fullAccessAuthorization
+                        ? () => this.assertCurrentFullAccessExecutionAuthorization(fullAccessAuthorization, agent)
+                        : undefined,
                 });
                 // 重试后仍然 prompt_too_long：显示友好提示
                 const retryStillTooLong = streamResult.isError && streamHitContextLimit(streamResult);
@@ -3202,7 +3598,10 @@ export class ResponseEngine {
                     }
                     this.agentDelegationRegistry?.revokeTask(session.id, taskId);
                     logger.info(`[ResponseEngine] Stale turn stopped before publish: session=${session.id} task=${taskId}`);
-                    await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_generation', taskCausation);
+                    await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_generation', taskCausation, {
+                        expected: turnLease?.generation,
+                        current: this.turnCoordinator.current(session).generation,
+                    });
                     return;
                 }
                 if (!commitDecision.ok) {
@@ -3214,7 +3613,10 @@ export class ResponseEngine {
                         }
                         this.agentDelegationRegistry?.revokeTask(session.id, taskId);
                         logger.info(`[ResponseEngine] Stale turn stopped before protocol rejection: session=${session.id} task=${taskId}`);
-                        await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_generation', taskCausation);
+                        await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_generation', taskCausation, {
+                            expected: turnLease?.generation,
+                            current: this.turnCoordinator.current(session).generation,
+                        });
                         return;
                     }
                     const reason = streamResult.protocolIncompleteReason || commitDecision.reason;
@@ -3416,7 +3818,10 @@ export class ResponseEngine {
                 if (!commitDecision.ok) {
                     logger.info(`[ResponseEngine] Turn commit rejected after flush: session=${session.id} task=${taskId} reason=${commitDecision.reason}`);
                     if (commitDecision.reason === 'stale_generation') {
-                        await this.publishTriggerExecutionInterrupted(message, adapter, envelope, commitDecision.reason, taskCausation);
+                        await this.publishTriggerExecutionInterrupted(message, adapter, envelope, commitDecision.reason, taskCausation, {
+                            expected: turnLease?.generation,
+                            current: this.turnCoordinator.current(session).generation,
+                        });
                     }
                     else {
                         this.publishTriggerExecutionFailure(message, `turn_commit_rejected:${commitDecision.reason}`, {
@@ -3503,6 +3908,8 @@ export class ResponseEngine {
                     this.eventBus.publish({
                         type: 'task:error',
                         sessionId: session.id,
+                        taskId,
+                        generation: turnLease?.generation,
                         error: errorSummary,
                         errorType,
                         agentName: agentNameForStats,
@@ -3620,12 +4027,18 @@ export class ResponseEngine {
                             cache_read_tokens: sum.cache_read_tokens,
                             cache_creation_tokens: sum.cache_creation_tokens,
                             // 顶层 cost_usd/cost_cny 保持向后兼容 = 网关实际价
-                            cost_usd: sum.cost_gateway_usd,
-                            cost_cny: sum.cost_gateway_cny,
+                            cost_usd: roundCostForOutput(sum.cost_gateway_usd),
+                            cost_cny: roundCostForOutput(sum.cost_gateway_cny),
                             call_count: sum.calls,
                             cost: {
-                                official: { usd: sum.cost_official_usd, cny: sum.cost_official_cny },
-                                gateway: { usd: sum.cost_gateway_usd, cny: sum.cost_gateway_cny },
+                                official: {
+                                    usd: roundCostForOutput(sum.cost_official_usd),
+                                    cny: roundCostForOutput(sum.cost_official_cny),
+                                },
+                                gateway: {
+                                    usd: roundCostForOutput(sum.cost_gateway_usd),
+                                    cny: roundCostForOutput(sum.cost_gateway_cny),
+                                },
                             },
                         };
                     }
@@ -3643,10 +4056,13 @@ export class ResponseEngine {
                     }
                     else {
                         // cost 同时给原价(official)与网关实际价(gateway)；顶层 cost_usd/cost_cny 保持向后兼容 = 网关价。
-                        const gatewayUsd = turnCost.gateway?.usd ?? turnCost.official?.usd ?? 0;
-                        const gatewayCny = turnCost.gateway?.cny ?? turnCost.official?.cny ?? 0;
+                        const gatewayUsd = roundCostForOutput(turnCost.gateway?.usd ?? turnCost.official?.usd ?? 0);
+                        const gatewayCny = roundCostForOutput(turnCost.gateway?.cny ?? turnCost.official?.cny ?? 0);
                         const turnCostBlock = {
-                            official: { usd: turnCost.official?.usd ?? 0, cny: turnCost.official?.cny ?? 0 },
+                            official: {
+                                usd: roundCostForOutput(turnCost.official?.usd ?? 0),
+                                cny: roundCostForOutput(turnCost.official?.cny ?? 0),
+                            },
                             gateway: { usd: gatewayUsd, cny: gatewayCny },
                         };
                         // 最后一次访问：本轮可能有多次大模型调用（numTurns>1），整轮的 turnCostBlock 不等于
@@ -3661,10 +4077,13 @@ export class ResponseEngine {
                                     model: lastModel, turns: 1,
                                 });
                                 const lp = resolvePrices(resolveRoot(), lastEvent, agent.getGatewayPricing?.());
-                                const lpGwUsd = lp.gateway?.usd ?? lp.official?.usd ?? 0;
-                                const lpGwCny = lp.gateway?.cny ?? lp.official?.cny ?? 0;
+                                const lpGwUsd = roundCostForOutput(lp.gateway?.usd ?? lp.official?.usd ?? 0);
+                                const lpGwCny = roundCostForOutput(lp.gateway?.cny ?? lp.official?.cny ?? 0);
                                 lastModelCall = { ...lastModelCall, cost: {
-                                        official: { usd: lp.official?.usd ?? 0, cny: lp.official?.cny ?? 0 },
+                                        official: {
+                                            usd: roundCostForOutput(lp.official?.usd ?? 0),
+                                            cny: roundCostForOutput(lp.official?.cny ?? 0),
+                                        },
                                         gateway: { usd: lpGwUsd, cny: lpGwCny },
                                     } };
                             }
@@ -3712,6 +4131,8 @@ export class ResponseEngine {
                 this.eventBus.publish({
                     type: 'task:completed',
                     sessionId: session.id,
+                    taskId,
+                    generation: turnLease.generation,
                     channel: message.channel,
                     channelId: message.channelId,
                     terminalReason: streamResult.terminalReason,
@@ -3757,6 +4178,8 @@ export class ResponseEngine {
             });
         }
         catch (error) {
+            fullAccessExecutionFailed = true;
+            fullAccessExecutionFailureReason = error instanceof Error ? error.message : String(error);
             const authoritativeTimeoutError = timeoutControl?.claim();
             if (authoritativeTimeoutError) {
                 error = authoritativeTimeoutError;
@@ -3841,6 +4264,8 @@ export class ResponseEngine {
                 this.eventBus.publish({
                     type: 'task:error',
                     sessionId: session.id,
+                    taskId,
+                    generation: turnLease?.generation,
                     error: errorMsg,
                     errorType,
                     agentName: agentNameForStats,
@@ -3861,14 +4286,15 @@ export class ResponseEngine {
             }
             // 发送用户友好的错误消息
             // 用户主动中断（新消息打断 或 /stop 命令）时静默，不发送错误提示
-            // processEventStream 已通过 renderer 发过错误时也跳过
+            // 普通渠道可跳过 renderer 已发送的重复错误；daemon trigger 仍必须
+            // 发送结构化终态，否则 DaemonChannel 会一直等到 watchdog。
             const retryExhaustedCount = getRetryExhaustedCount(error);
             const modelFallbackExhaustedMessage = getModelFallbackExhaustedMessage(error);
             const retryInputAlreadySubmitted = wasRetryInputAlreadySubmitted(error);
             if (isUserInterrupt) {
                 logger.info(`[ResponseEngine] User interrupt by new_message, skip sending error message`);
             }
-            else if (error?._errorAlreadySent && !retryExhaustedCount && !isTimeout && !isTotalExecutionTimeout) {
+            else if (error?._errorAlreadySent && !daemonTrigger && !retryExhaustedCount && !isTimeout && !isTotalExecutionTimeout) {
                 logger.info(`[ResponseEngine] Error already sent via renderer, skip sending duplicate message`);
             }
             else {
@@ -3949,6 +4375,47 @@ export class ResponseEngine {
             }
         }
         finally {
+            if (fullAccessAuthorization) {
+                const startedAt = fullAccessAuditStartedAt;
+                const executed = fullAccessRunnerInvoked;
+                const interrupted = isExpectedTerminalInterrupt(streamResult.terminalReason);
+                const failed = fullAccessExecutionFailed || streamResult.isError;
+                auditFullAccessEvent({
+                    event: fullAccessAuthorization.source === 'trigger'
+                        ? 'fullaccess.trigger.execution.ended'
+                        : 'fullaccess.execution.ended',
+                    source: fullAccessAuthorization.source,
+                    actorId: fullAccessAuthorization.authorizedBy,
+                    processRole: fullAccessAuditProcessRole,
+                    agentAid: selfAid,
+                    agentName: agentNameForStats,
+                    sessionId: session.id,
+                    taskId,
+                    messageId: message.messageId,
+                    triggerId: fullAccessAuthorization.triggerId,
+                    runId: fullAccessAuthorization.runId,
+                    attemptId: fullAccessAuthorization.attemptId,
+                    dataScope: fullAccessAuthorization.dataScope,
+                    authorizedBy: fullAccessAuthorization.authorizedBy,
+                    baseagent: fullAccessAuditBaseagent,
+                    model: fullAccessAuditModel,
+                    result: !executed ? 'blocked' : failed ? 'failed' : interrupted ? 'interrupted' : 'completed',
+                    reason: fullAccessExecutionFailureReason
+                        ?? streamResult.errors?.join('; ')
+                        ?? (!executed ? 'fullaccess execution stopped before Runner invocation' : undefined),
+                    executed,
+                    executionState: !executed ? 'blocked' : failed ? 'failed' : 'completed',
+                    durationMs: executed && startedAt !== undefined ? Date.now() - startedAt : undefined,
+                });
+                this.fullAccessTerminalMessages.add(message);
+            }
+            // The authorization belongs to this logical run only. Clear the live
+            // runner context as well as relying on the Message object to be dropped,
+            // so late callbacks cannot observe a completed fullaccess grant.
+            const completedPermissionContext = activePermissionContext;
+            if (completedPermissionContext && completedPermissionContext.executionPermission === fullAccessAuthorization) {
+                delete completedPermissionContext.executionPermission;
+            }
             // 同一 session 的新任务可能已替换登记；旧任务结束时不得删掉新任务的 renderer。
             if (this.activeRenderers.get(session.id)?.taskId === taskId) {
                 this.activeRenderers.delete(session.id);
@@ -3963,7 +4430,7 @@ export class ResponseEngine {
             snapshot.end(session.id, taskId);
         }
     }
-    async runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, renderer) {
+    async runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, renderer, modelOverride, beforeCompact) {
         if (!session.agentSessionId || !canCompactAgent(agent)) {
             logger.debug(`[ResponseEngine] Auto compact skipped: session=${session.id} agentSessionId=${session.agentSessionId || 'none'} canCompact=${canCompactAgent(agent)} agent=${agent.name}`);
             return;
@@ -3978,13 +4445,20 @@ export class ResponseEngine {
         await renderer.flush();
         this.announcedCompactStarts.add(session.id);
         try {
-            const compacted = await agent.compact(session.id, session.agentSessionId, absoluteProjectPath);
-            if (compacted) {
+            // Auto compact is a privileged backend-management operation for a
+            // fullaccess run. Revalidate immediately before invoking the runner so a
+            // daemon gate/owner revocation observed after task setup cannot still
+            // cause host-level runner activity.
+            beforeCompact?.();
+            const compacted = await agent.compact(session.id, session.agentSessionId, absoluteProjectPath, modelOverride);
+            const compactResult = compacted;
+            if (compactResult === true || compactResult?.ok === true) {
                 await this.emitOperationalNotice(renderer, '✅ 上下文压缩完成，继续处理...', 'info', 'auto-compact-complete');
                 await renderer.flush();
             }
             else {
-                logger.warn(`[ResponseEngine] Auto compact at task.start returned false (session=${session.id})`);
+                const compactFailure = compactResult;
+                logger.warn(`[ResponseEngine] Auto compact at task.start failed: session=${session.id} code=${compactFailure?.code ?? 'sdk_error'} durationMs=${compactFailure?.durationMs ?? 0} message=${compactFailure?.message ?? 'compact failed'}`);
             }
         }
         catch (err) {
@@ -4121,14 +4595,22 @@ export class ResponseEngine {
             const groupName = await adapter?.getGroupName?.(session.metadata.groupId).catch(() => undefined);
             if (groupName) {
                 session.metadata.groupName = groupName;
-                await this.sessionManager.updateSession(session.id, { metadata: session.metadata });
+                await this.sessionManager.patchSessionMetadata?.(session.id, { groupName });
+                if (typeof this.sessionManager.patchSessionMetadata !== 'function') {
+                    await this.sessionManager.updateSession(session.id, { metadata: { groupName } });
+                }
             }
         }
         // 同步服务端 mention_mode，供同一群会话的上下文和菜单展示使用。
         if (message.chatType === 'group' && message.mentionMode && session.metadata?.mentionMode !== message.mentionMode) {
             logger.info(`[ResponseEngine] mentionMode sync: sessionId=${session.id} ${session.metadata?.mentionMode ?? 'none'} -> ${message.mentionMode}`);
             session.metadata = { ...(session.metadata || {}), mentionMode: message.mentionMode };
-            await this.sessionManager.updateSession(session.id, { metadata: session.metadata });
+            if (typeof this.sessionManager.patchSessionMetadata === 'function') {
+                await this.sessionManager.patchSessionMetadata(session.id, { mentionMode: message.mentionMode });
+            }
+            else {
+                await this.sessionManager.updateSession(session.id, { metadata: { mentionMode: message.mentionMode } });
+            }
         }
         // chatMode 策略由 agent/relation behavior 配置在处理阶段解析；此处不再写 session 级参数。
         // replyContext 不再写入 session.metadata（跟着 message 走，避免群聊多人覆盖）
@@ -4166,6 +4648,11 @@ export class ResponseEngine {
         // Per-session agent name for stats bucketing
         const statsChannelKey = session.channel === 'daemon' ? session.channel : (session.metadata?.channelKey || session.channel);
         const agentNameForStats = this.agentRegistry?.resolveByChannel(statsChannelKey)?.name ?? '<unknown>';
+        const lifecycleAgentAid = proactiveSelfAid || session.selfAID;
+        const lifecycleAgentName = agentNameForStats !== '<unknown>'
+            ? agentNameForStats
+            : lifecycleAgentAid || '<unknown>';
+        const lifecyclePermissionMode = normalizeExecutionPermissionMode(permissionMode);
         let hasReceivedText = false;
         let hasProjectedCurrentReplyText = false;
         let hasErrorResult = false; // 是否已有 tool_result/error 事件输出过错误
@@ -4225,11 +4712,17 @@ export class ResponseEngine {
                 if (event.type === 'complete') {
                     event = normalizeCompleteAgentEvent(event);
                 }
-                if (event.type === 'tool_result' && event.isError && !event.errorCode) {
-                    event = {
-                        ...event,
-                        errorCode: classifyToolErrorCode({ error: event.error, result: event.result }),
-                    };
+                if (event.type === 'tool_result' && event.isError) {
+                    const classificationMissing = !normalizeToolErrorCode(event.errorCode)
+                        && event.decisionSource !== 'policy'
+                        && event.decisionSource !== 'approval';
+                    const errorCode = classifyToolErrorCode({
+                        errorCode: event.errorCode,
+                        decisionSource: event.decisionSource,
+                    });
+                    if (event.errorCode !== errorCode) {
+                        event = { ...event, errorCode, ...(classificationMissing ? { classificationMissing: true } : {}) };
+                    }
                 }
                 // 每收到事件重置空闲超时
                 const toolName = event.type === 'tool_use' ? event.name : undefined;
@@ -4332,7 +4825,13 @@ export class ResponseEngine {
                     eventDetail = ` tool=${event.name}${desc ? ` desc="${desc}"` : ''}`;
                 }
                 else if (event.type === 'tool_result') {
-                    eventDetail = ` tool=${event.name} ok=${!event.isError}`;
+                    const decision = event.decision ?? (event.isError ? 'error' : 'allow');
+                    const executed = event.executed ?? !event.isError;
+                    const executionState = event.executionState
+                        ?? (decision === 'deny' ? 'blocked' : event.isError ? 'failed' : 'completed');
+                    eventDetail = ` tool=${event.name} ok=${decision === 'allow' && executed}`
+                        + ` decision=${decision} executed=${executed} executionState=${executionState}`
+                        + (event.policyCode ? ` policy=${event.policyCode}` : '');
                 }
                 const frameworkEvents = new Set(['session_id', 'state_changed', 'status']);
                 if (frameworkEvents.has(event.type)) {
@@ -4554,8 +5053,9 @@ export class ResponseEngine {
                             input: event.input,
                             ...(event.callId ? { callId: event.callId } : {}),
                             ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
-                            agentAid: session.selfAID ?? 'unknown',
-                            permissionMode: permissionMode ?? 'unknown',
+                            agentName: lifecycleAgentName,
+                            agentAid: lifecycleAgentAid ?? 'unknown',
+                            permissionMode: lifecyclePermissionMode,
                             decision: 'pending',
                             decisionSource: 'runner',
                             executed: false,
@@ -4597,6 +5097,16 @@ export class ResponseEngine {
                                 toolName: event.name,
                                 toolInput: event.input || {},
                                 injectToModel: (text) => { agent.injectUserMessage?.(session.id, text); },
+                                recordReminder: reminder => {
+                                    this.eventBus.publish({
+                                        type: 'runner:proactive-reminder',
+                                        sessionId: session.id,
+                                        ...reminder,
+                                        injection: 'requested',
+                                        timestamp: Date.now(),
+                                        causation,
+                                    });
+                                },
                                 getQueueLength: () => this.messageQueue?.getQueueLength(session.id) ?? 0,
                                 isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID),
                                 logger,
@@ -4622,6 +5132,7 @@ export class ResponseEngine {
                             sessionId: session.id,
                             callId: event.callId,
                             correlationId: event.correlationId,
+                            requestId: event.requestId,
                         });
                         this.eventBus.publish({
                             type: 'tool:result',
@@ -4630,16 +5141,29 @@ export class ResponseEngine {
                             sessionId: session.id,
                             toolName: event.name,
                             isError: event.isError,
-                            ...(event.isError ? { errorCode: classifyToolErrorCode({ errorCode: event.errorCode, error: event.error, result: event.result }) } : {}),
-                            agentName: agentNameForStats,
+                            ...(event.isError ? {
+                                errorCode: classifyToolErrorCode({
+                                    errorCode: event.errorCode,
+                                    decisionSource: event.decisionSource,
+                                }),
+                                ...((event.classificationMissing || (!normalizeToolErrorCode(event.errorCode)
+                                    && event.decisionSource !== 'policy'
+                                    && event.decisionSource !== 'approval')) ? { classificationMissing: true } : {}),
+                            } : {}),
                             ...(event.callId ? { callId: event.callId } : {}),
                             ...(event.correlationId || event.callId ? { correlationId: event.correlationId ?? event.callId } : {}),
-                            agentAid: session.selfAID ?? 'unknown',
-                            permissionMode: permissionMode ?? 'unknown',
-                            decision: event.isError ? 'error' : 'allow',
-                            decisionSource: 'runner',
-                            executed: true,
-                            executionState: event.isError ? 'failed' : 'completed',
+                            ...(event.requestId ? { requestId: event.requestId } : {}),
+                            agentName: lifecycleAgentName,
+                            agentAid: lifecycleAgentAid ?? 'unknown',
+                            permissionMode: lifecyclePermissionMode,
+                            decision: event.decision ?? (event.isError ? 'error' : 'allow'),
+                            decisionSource: event.decisionSource ?? 'runner',
+                            ...(event.policyCode ? { policyCode: event.policyCode } : {}),
+                            ...(event.reason ? { reason: event.reason } : {}),
+                            executed: event.executed ?? (event.decision === 'deny' ? false : true),
+                            executionState: event.executionState ?? (event.decision === 'deny'
+                                ? 'blocked'
+                                : event.isError ? 'failed' : 'completed'),
                             timestamp: Date.now(),
                             causation,
                         });
@@ -4686,7 +5210,23 @@ export class ResponseEngine {
                                 result: event.result,
                                 isError: event.isError,
                                 error: event.error,
+                                decision: event.decision,
+                                decisionSource: event.decisionSource,
+                                executed: event.executed,
+                                executionState: event.executionState,
+                                policyCode: event.policyCode,
+                                requestId: event.requestId,
                                 injectToModel: (text) => { agent.injectUserMessage?.(session.id, text); },
+                                recordReminder: reminder => {
+                                    this.eventBus.publish({
+                                        type: 'runner:proactive-reminder',
+                                        sessionId: session.id,
+                                        ...reminder,
+                                        injection: 'requested',
+                                        timestamp: Date.now(),
+                                        causation,
+                                    });
+                                },
                                 getQueueLength: () => this.messageQueue?.getQueueLength(session.id) ?? 0,
                                 isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID),
                                 logger,
@@ -4793,7 +5333,12 @@ export class ResponseEngine {
                                 lastReplyText,
                                 updateSessionMeta: async (patch) => {
                                     session.metadata = { ...(session.metadata || {}), ...patch };
-                                    await this.sessionManager.updateSession(session.id, { metadata: session.metadata });
+                                    if (typeof this.sessionManager.patchSessionMetadata === 'function') {
+                                        await this.sessionManager.patchSessionMetadata(session.id, patch);
+                                    }
+                                    else {
+                                        await this.sessionManager.updateSession(session.id, { metadata: patch });
+                                    }
                                 },
                                 logger,
                             });
@@ -4865,11 +5410,15 @@ export class ResponseEngine {
             // and mark the error so outer catch won't send a duplicate message
             const hasErrorSuppressingContent = hasErrorResult || renderer.hasNonLifecycleContent();
             if (hasErrorSuppressingContent) {
+                let errorOutputFlushed = false;
                 try {
                     await renderer.flush(true);
+                    errorOutputFlushed = true;
                 }
-                catch { }
-                if (error instanceof Error) {
+                catch (flushError) {
+                    logger.warn(`[ResponseEngine] Failed to flush error output: ${flushError instanceof Error ? flushError.message : String(flushError)}`);
+                }
+                if (errorOutputFlushed && error instanceof Error) {
                     error._errorAlreadySent = true;
                 }
             }