evolcore 0.0.20 → 0.0.22

package/dist/agents/codex-runner.js

@@ -5,10 +5,11 @@
  * Implements the same interface surface as AgentRunner (claude-runner.ts)
  * so MessageProcessor and CommandHandler can work with it transparently.
  */
+import { hasTrustedFullAccessContext } from './runner-types.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
-import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
-import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/protected-paths.js';
+import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
+import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/permission/protected-paths.js';
 import { CodexAppServerClient } from './codex-app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
@@ -16,14 +17,14 @@ import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { auditCodexApprovalDecision, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
-import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
+import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, hasPowerShellDelegationAssignment, normalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
-import { ensureProcessManagedTempDir } from '../cli/task-context.js';
+import { ensureProcessManagedTempDir, getManagedTaskTempDir } from '../cli/task-context.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
 import { execFileSync } from 'child_process';
 import { execCodexCliSync, resolveCodexCliPath } from '../utils/codex-cli.js';
@@ -39,6 +40,13 @@ const MIME_EXT = {
     'image/gif': '.gif',
     'image/webp': '.webp',
 };
+const APPROVAL_LOG_SUMMARY_MAX_LENGTH = 256;
+export function formatApprovalLogSummary(summary) {
+    const singleLine = summary.replace(/\s+/gu, ' ').trim();
+    if (singleLine.length <= APPROVAL_LOG_SUMMARY_MAX_LENGTH)
+        return singleLine;
+    return singleLine.slice(0, APPROVAL_LOG_SUMMARY_MAX_LENGTH - 3).trimEnd() + '...';
+}
 class AsyncEventQueue {
     queue = [];
     done = false;
@@ -75,6 +83,17 @@ class AsyncEventQueue {
         }
     }
 }
+function errorCodeForToolDenial(decisionSource, policyCode) {
+    if (decisionSource === 'policy')
+        return 'POLICY_DENIED';
+    if (decisionSource === 'approval')
+        return 'USER_DENIED';
+    if (policyCode && /delegation|carrier/i.test(policyCode))
+        return 'DELEGATION_FAILED';
+    if (policyCode && /argument|canonical|quote|shell/i.test(policyCode))
+        return 'INVALID_ARGUMENT';
+    return 'EXECUTION_FAILED';
+}
 const managedTempDirsForExitCleanup = new Map();
 let managedTempExitCleanupRegistered = false;
 function isTrustedManagedTempDirectory(directory, parent) {
@@ -142,6 +161,63 @@ function stableSecurityValue(value) {
 function externalToolConfigFingerprint(config) {
     return createHash('sha256').update(stableSecurityValue(config)).digest('hex');
 }
+/**
+ * Codex can surface a managed hook rejection as item output instead of an
+ * app-server approval request. Preserve the policy boundary in that path too
+ * so downstream audit/event consumers never infer a successful execution.
+ */
+function parseManagedPreToolUseDenial(value) {
+    let text;
+    if (typeof value === 'string')
+        text = value;
+    else if (value == null)
+        return undefined;
+    else {
+        try {
+            text = JSON.stringify(value) ?? '';
+        }
+        catch {
+            text = String(value);
+        }
+    }
+    const marker = /(?:Command|Tool call) blocked by PreToolUse hook\s*:\s*/i.exec(text);
+    if (!marker)
+        return undefined;
+    let reason = text.slice((marker.index ?? 0) + marker[0].length)
+        .replace(/\s*\.\s*(?:Command|Tool):[\s\S]*$/i, '')
+        .replace(/(?:^|\s)(?:Command|Tool):[\s\S]*$/i, '')
+        .trim();
+    if (!reason)
+        reason = 'EvolCore PreToolUse policy denied this tool call';
+    const policyCode = /工具调用已达到\s*\d+\s*次/.test(reason)
+        ? 'proactive_tool_report_required'
+        : /请先用\s+ec\s+(?:group\s+send|msg\s+send)/.test(reason)
+            ? 'proactive_first_send_required'
+            : 'managed_pre_tool_use_denied';
+    return { policyCode, reason };
+}
+function outputTextForManagedHook(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value == null)
+        return '';
+    if (Array.isArray(value))
+        return value.map(outputTextForManagedHook).filter(Boolean).join('\n');
+    if (typeof value === 'object') {
+        const record = value;
+        if (typeof record.text === 'string')
+            return record.text;
+        if (typeof record.message === 'string')
+            return record.message;
+        try {
+            return JSON.stringify(value) ?? '';
+        }
+        catch {
+            return String(value);
+        }
+    }
+    return String(value);
+}
 const CODEX_CATALOG_FALLBACK = [
     { slug: 'gpt-5.5', efforts: ['low', 'medium', 'high', 'xhigh'] },
     { slug: 'gpt-5.4', efforts: ['low', 'medium', 'high', 'xhigh'] },
@@ -150,6 +226,11 @@ const CODEX_CATALOG_FALLBACK = [
     { slug: 'gpt-5.2', efforts: ['low', 'medium', 'high', 'xhigh'] },
 ];
 const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
+const CODEX_NO_ROLLOUT_RE = /no rollout found for thread id/i;
+function isCodexNoRolloutError(error) {
+    return error?.code === 'CODEX_ROLLOUT_NOT_FOUND'
+        || CODEX_NO_ROLLOUT_RE.test(error instanceof Error ? error.message : String(error));
+}
 let codexCatalogCache = null;
 // The permission bridge is version-locked to the audited approval schema and
 // managed PreToolUse hook behavior used by proactive first-tool enforcement.
@@ -248,15 +329,22 @@ export class CodexRunner {
     activeAbortControllers = new Map();
     activeStreams = new Map();
     activeSessions = new Map(); // sessionId → threadId
+    /** Threads created/resumed for a turn but not yet durably admitted by turn/start. */
+    provisionalSessions = new Map();
     activeTurns = new Map();
+    activeSubagentTurns = new Map();
     threadProjectPaths = new Map();
+    /** Child Codex threads inherit the EvolCore session that started them. */
+    childThreadSessions = new Map();
     sessionTempDirs = new Map();
     managedTempNonce = randomBytes(16).toString('hex');
     threadExternalToolFingerprints = new Map();
     threadExternalToolBoundaries = new Map();
     trackedApprovalItems = new Map();
+    pendingToolDenials = new Map();
     threadDelegationCarriers = new Map();
     pendingInterrupts = new Map();
+    steeringTails = new Map();
     threadOperationLocks = new Map();
     activeOperationReleases = new Map();
     appServerClient = null;
@@ -267,16 +355,21 @@ export class CodexRunner {
     permissionContexts = new Map();
     resolvedConfig;
     pendingInterruptTtlMs = 30_000;
-    constructor(config, callbacks) {
-        this.resolvedConfig = resolveOpenaiConfig(config);
+    constructor(config, callbacks, runtime) {
+        // Compatibility for legacy direct callers that still pass the removed
+        // internal fields in a synthetic config. AgentLoader uses runtime binding.
+        const legacy = config.agents?.codex;
+        const binding = {
+            agentAid: runtime?.agentAid ?? legacy?.['evolcoreAgentAid'],
+            agentConfig: runtime?.agentConfig ?? legacy?.['evolcoreAgentConfig'],
+        };
+        this.resolvedConfig = resolveOpenaiConfig(config, undefined, binding);
         this.resolvedConfig.headers = buildModelRequestHeaders({
             baseagent: 'codex',
             baseUrl: this.resolvedConfig.baseUrl,
-            agentAid: config.agents?.codex?.evolcoreAgentAid,
+            agentAid: this.resolvedConfig.agentAid,
             configuredHeaders: this.resolvedConfig.headers,
         });
-        this.resolvedConfig.evolcoreAgentAid = config.agents?.codex?.evolcoreAgentAid;
-        this.resolvedConfig.evolcoreAgentConfig = config.agents?.codex?.evolcoreAgentConfig;
         this.capabilities = {
             clear: false,
             compact: true,
@@ -288,6 +381,7 @@ export class CodexRunner {
             planApproval: false,
             // Current file rewind is intentionally degraded: it restores touched files from Git HEAD.
             fileRewind: 'git-head',
+            fullaccess: true,
         };
         this.model = this.resolvedConfig.model;
         if (this.resolvedConfig.effort)
@@ -316,74 +410,148 @@ export class CodexRunner {
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommandArgv(command, managedTempDir, dialect = 'posix') {
+    approvedLiteralEvolcoreCommand(command, managedTempDir, dialect = 'posix', expectedDelegationToken, executable) {
         const parseOptions = {
             allowManagedTmpDir: true,
             dialect,
+            verifyShellExecutable: process.platform === 'win32',
             ...(managedTempDir ? { managedTempDir } : {}),
+            ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
         };
         const classification = classifyEvolcoreShellCommand(command, parseOptions);
         if (classification.kind === 'bounded-output')
-            return classification.command.argv;
-        if (classification.kind !== 'literal')
-            return undefined;
+            return { argv: classification.command.argv };
         // Keep the approval/delegation parser aligned with the preflight parser:
         // the session-managed `$TMPDIR` token is a permitted EC path reference.
-        const argv = parseLiteralShellArgv(command, parseOptions);
-        if (argv && containsLiteralManagedTmpDirOutsideSendContent(argv))
-            return undefined;
-        return argv?.[0] === 'ec' ? argv : undefined;
+        const parsed = executable
+            ? parseCodexCarrierCommand({ command, dialect, executable }, parseOptions)
+            : dialect === 'powershell'
+                ? parseCodexCarrierCommand({ command, dialect }, parseOptions)
+                : parseLiteralShellCommand(command, parseOptions);
+        if (!parsed.ok)
+            return { parseFailure: parsed };
+        if (normalizeEvolcoreCommandArgv(parsed.argv)[0] !== 'ec')
+            return {};
+        if (containsLiteralManagedTmpDirOutsideSendContent(parsed.argv)) {
+            return { parseFailure: {
+                    issue: 'unsafe-expansion',
+                    offset: 0,
+                    tokenIndex: 0,
+                    dialect: dialect ?? 'posix',
+                    inputLength: command.length,
+                } };
+        }
+        return {
+            argv: normalizeEvolcoreCommandArgv(parsed.argv),
+            ...(parsed.delegationToken ? { delegationToken: parsed.delegationToken } : {}),
+        };
     }
-    approvedEvolcoreCommandArgv(toolInput, managedTempDir) {
+    resolveCanonicalEcApproval(toolInput, managedTempDir, expectedDelegationToken) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
             : undefined;
-        if (explicitArgv?.[0] === 'ec') {
-            return explicitArgv.some(value => value.includes('\0'))
-                || containsLiteralManagedTmpDirOutsideSendContent(explicitArgv)
-                ? undefined
-                : explicitArgv;
+        if (explicitArgv && normalizeEvolcoreCommandArgv(explicitArgv)[0] === 'ec') {
+            if (explicitArgv.some(value => value.includes('\0'))) {
+                return { parseFailure: {
+                        issue: 'invalid-control-char', offset: 0,
+                        tokenIndex: explicitArgv.findIndex(value => value.includes('\0')),
+                        dialect: 'posix', inputLength: 0,
+                    } };
+            }
+            return containsLiteralManagedTmpDirOutsideSendContent(explicitArgv)
+                ? { parseFailure: { issue: 'unsafe-expansion', offset: 0, tokenIndex: 0, dialect: 'posix', inputLength: 0 } }
+                : { argv: normalizeEvolcoreCommandArgv(explicitArgv) };
         }
         const explicitCarrier = explicitArgv
             ? resolveCodexShellCarrierArgv(explicitArgv)
             : undefined;
         if (explicitCarrier !== undefined) {
-            return this.approvedLiteralEvolcoreCommandArgv(explicitCarrier.command, managedTempDir, explicitCarrier.dialect);
+            return this.approvedLiteralEvolcoreCommand(explicitCarrier.command, managedTempDir, explicitCarrier.dialect, expectedDelegationToken, explicitCarrier.executable);
+        }
+        if (hasCodexCmdCarrierEcIntent(toolInput)) {
+            const parsed = parseCodexToolCommand(toolInput, {
+                verifyShellExecutable: process.platform === 'win32',
+                ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
+            });
+            if (!parsed.ok)
+                return { parseFailure: parsed };
+            if (parsed.argv[0] === 'ec') {
+                return containsLiteralManagedTmpDirOutsideSendContent(parsed.argv)
+                    ? { parseFailure: {
+                            issue: 'unsafe-expansion', offset: 0, tokenIndex: 0,
+                            dialect: 'cmd', inputLength: 0,
+                        } }
+                    : {
+                        argv: normalizeEvolcoreCommandArgv(parsed.argv),
+                        ...(parsed.delegationToken ? { delegationToken: parsed.delegationToken } : {}),
+                    };
+            }
+            const command = typeof toolInput.command === 'string' ? toolInput.command : '';
+            const classification = classifyEvolcoreShellCommand(command, { dialect: 'cmd' });
+            return {
+                parseFailure: {
+                    issue: classification.kind === 'composite' ? classification.issue : 'shell-composition',
+                    offset: 0,
+                    tokenIndex: 0,
+                    dialect: 'cmd',
+                    inputLength: command.length,
+                },
+            };
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
-        const directArgv = this.approvedLiteralEvolcoreCommandArgv(command, managedTempDir);
-        if (directArgv)
-            return directArgv;
-        const wrappedArgv = parseLiteralShellArgv(command, {
+        const canonicalCommand = parseCodexShellCommandArgv(command, {
             allowManagedTmpDir: true,
+            verifyShellExecutable: process.platform === 'win32',
             ...(managedTempDir ? { managedTempDir } : {}),
+            ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
         });
-        const shellCarrier = wrappedArgv
-            ? resolveCodexShellCarrierArgv(wrappedArgv)
-            : undefined;
-        return shellCarrier === undefined
-            ? undefined
-            : this.approvedLiteralEvolcoreCommandArgv(shellCarrier.command, managedTempDir, shellCarrier.dialect);
+        if (canonicalCommand?.[0] === 'ec') {
+            return containsLiteralManagedTmpDirOutsideSendContent(canonicalCommand)
+                ? { parseFailure: {
+                        issue: 'unsafe-expansion',
+                        offset: 0,
+                        tokenIndex: 0,
+                        dialect: 'posix',
+                        inputLength: command.length,
+                    } }
+                : { argv: canonicalCommand };
+        }
+        const outer = parseLiteralShellCommand(command, {
+            allowManagedTmpDir: true,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        });
+        if (!outer.ok) {
+            const classification = classifyEvolcoreShellCommand(command, {
+                allowManagedTmpDir: true,
+                ...(managedTempDir ? { managedTempDir } : {}),
+            });
+            return classification.kind === 'composite' ? { parseFailure: outer } : {};
+        }
+        return {};
     }
     isManagedEvolcoreCommandIntent(toolInput) {
         if (Array.isArray(toolInput.commandArgv)) {
             const rawArgv = toolInput.commandArgv;
-            if (rawArgv[0] === 'ec')
-                return true;
             if (!rawArgv.every(value => typeof value === 'string'))
                 return false;
+            if (normalizeEvolcoreCommandArgv(rawArgv)[0] === 'ec')
+                return true;
             const shellCarrier = resolveCodexShellCarrierArgv(rawArgv);
-            return shellCarrier !== undefined
-                && classifyEvolcoreShellCommand(shellCarrier.command, {
-                    dialect: shellCarrier.dialect,
-                }).kind !== 'none';
+            if (shellCarrier?.dialect === 'powershell'
+                && hasPowerShellDelegationAssignment(shellCarrier.command))
+                return true;
+            return hasCodexCmdCarrierEcIntent(toolInput)
+                || shellCarrier !== undefined
+                    && classifyEvolcoreShellCommand(shellCarrier.command, {
+                        dialect: shellCarrier.dialect,
+                    }).kind !== 'none';
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         return classifyEvolcoreShellCommand(command).kind !== 'none';
     }
     armApprovedDelegationCommand(sessionId, argv) {
-        const threadId = this.activeSessions.get(sessionId);
+        const threadId = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
         const carrierToken = threadId ? this.threadDelegationCarriers.get(threadId) : undefined;
         const commandHash = hashDelegatedCommandArgv(argv);
         const arm = this.permissionContexts.get(sessionId)?.armApprovedDelegationCommand;
@@ -397,6 +565,21 @@ export class CodexRunner {
             return false;
         }
     }
+    delegationCarrierForSession(sessionId, threadId) {
+        const candidates = [
+            threadId,
+            this.activeSessions.get(sessionId),
+            this.provisionalSessions.get(sessionId),
+        ];
+        for (const candidate of candidates) {
+            if (!candidate)
+                continue;
+            const carrier = this.threadDelegationCarriers.get(candidate);
+            if (carrier)
+                return carrier;
+        }
+        return undefined;
+    }
     async readThreadDelegationCarrier(appServer, threadId) {
         try {
             const result = await appServer.threadShellCommand(threadId, `node -e "process.stdout.write(process.env.${AGENT_DELEGATION_TOKEN_ENV}||String())"`);
@@ -429,9 +612,51 @@ export class CodexRunner {
             return undefined;
         }
     }
+    async commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn) {
+        if (this.provisionalSessions.get(sessionId) !== threadId)
+            return false;
+        const bindingResult = this.onSessionIdUpdate
+            ? ((turn === undefined
+                ? await this.onSessionIdUpdate(sessionId, threadId)
+                : await this.onSessionIdUpdate(sessionId, threadId, { turn }))
+                ?? 'legacy_updated')
+            : 'legacy_updated';
+        const bindingAccepted = bindingResult === 'activated'
+            || bindingResult === 'already_active'
+            || bindingResult === 'legacy_updated';
+        if (!bindingAccepted) {
+            const error = new Error(`backend discovery rejected: ${bindingResult}`);
+            error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+            throw error;
+        }
+        this.provisionalSessions.delete(sessionId);
+        this.activeSessions.set(sessionId, threadId);
+        if (carrierToPublish) {
+            this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+            await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
+        }
+        this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
+        return true;
+    }
+    cleanupProvisionalThread(sessionId, threadId) {
+        if (this.provisionalSessions.get(sessionId) !== threadId)
+            return;
+        this.provisionalSessions.delete(sessionId);
+        this.threadProjectPaths.delete(threadId);
+        this.threadDelegationCarriers.delete(threadId);
+        this.unbindExternalToolBoundary(threadId);
+        this.clearTrackedApprovalItemsForThread(threadId);
+        // A stale provisional start can finish after a replacement run has
+        // already activated another parent thread for this session. Do not tear
+        // down the replacement run's child mappings in that race.
+        const activeParentThread = this.activeSessions.get(sessionId);
+        if (!activeParentThread || activeParentThread === threadId) {
+            this.cleanupChildThreadsForSession(sessionId);
+        }
+        this.pruneThreadOperationLocks();
+    }
     async persistDelegationCarrier(sessionManager, sessionId, threadId, carrier) {
-        if (typeof sessionManager?.getSessionById !== 'function'
-            || typeof sessionManager?.updateSession !== 'function')
+        if (typeof sessionManager?.getSessionById !== 'function')
             return;
         try {
             const session = await sessionManager.getSessionById(sessionId);
@@ -440,12 +665,16 @@ export class CodexRunner {
             const current = session.metadata?.[CODEX_DELEGATION_CARRIER_METADATA_KEY];
             if (current?.threadId === threadId && current?.carrier === carrier)
                 return;
-            await sessionManager.updateSession(sessionId, {
-                metadata: {
-                    ...(session.metadata ?? {}),
+            if (typeof sessionManager.patchSessionMetadata === 'function') {
+                await sessionManager.patchSessionMetadata(sessionId, {
                     [CODEX_DELEGATION_CARRIER_METADATA_KEY]: { threadId, carrier },
-                },
-            });
+                });
+            }
+            else if (typeof sessionManager.updateSession === 'function') {
+                await sessionManager.updateSession(sessionId, {
+                    metadata: { [CODEX_DELEGATION_CARRIER_METADATA_KEY]: { threadId, carrier } },
+                });
+            }
         }
         catch (error) {
             logger.warn(`[CodexRunner] failed to persist delegation carrier: session=${sessionId} thread=${threadId} error=${error}`);
@@ -456,7 +685,15 @@ export class CodexRunner {
         this.appServerClient = null;
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
+        for (const childThreadId of this.childThreadSessions.keys())
+            this.threadProjectPaths.delete(childThreadId);
+        // Child turn ids belong to the discarded app-server connection. Keeping
+        // them would make a later session interrupt attempt target stale threads
+        // through the replacement client.
+        this.activeSubagentTurns.clear();
+        this.childThreadSessions.clear();
         this.trackedApprovalItems.clear();
+        this.pendingToolDenials.clear();
         this.threadDelegationCarriers.clear();
         client?.close().catch(error => {
             logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
@@ -485,7 +722,7 @@ export class CodexRunner {
         return Object.keys(merged).length > 0 ? merged : null;
     }
     async resolveCapabilityThreadConfig(projectPath) {
-        const agentConfig = this.resolvedConfig.evolcoreAgentConfig;
+        const agentConfig = this.resolvedConfig.agentConfig;
         if (!agentConfig) {
             return {
                 skills: { config: [{ name: 'eclink', enabled: false }] },
@@ -732,6 +969,8 @@ export class CodexRunner {
     chatModes = new Map();
     /** 将权限模式映射为 Codex app-server 的 approvalPolicy（纯函数，无副作用，供 per-call 派生用）。 */
     toApprovalPolicy(mode) {
+        if (mode === 'fullaccess')
+            return 'never';
         // `untrusted` guarantees that commands outside Codex's trusted read-only
         // set reach the EvolCore bridge for EvolCore's per-mode decision.
         void mode;
@@ -814,6 +1053,12 @@ export class CodexRunner {
                     filesystem: {
                         ...buildCodexProtectedFilesystemRules(resolveRoot(), {
                             denyLClassRead: mode === 'readonly',
+                            // The app-server itself is launched behind EvolCore's Linux
+                            // H-class guard, which already mounts every L-class directory
+                            // read-only. Avoid Codex's per-file glob expansion inside that
+                            // nested mount namespace; it can fail while creating a missing
+                            // target such as triggers/history.jsonl.
+                            expandLClassReadDeny: process.platform !== 'linux',
                         }),
                         ...this.resolveGitMetadataWriteRules(projectPath, mode),
                         ...(bootstrapAgentMdPath ? {
@@ -821,9 +1066,9 @@ export class CodexRunner {
                         } : {}),
                         ...(mode !== 'readonly' && managedTempDir ? {
                             [managedTempDir]: 'write',
-                            [path.join(managedTempDir, '**')]: 'write',
+                            [managedTempDir + '/**']: 'write',
                             [path.join(path.dirname(managedTempDir), 'evolcore-locks')]: 'write',
-                            [path.join(path.dirname(managedTempDir), 'evolcore-locks', '**')]: 'write',
+                            [path.join(path.dirname(managedTempDir), 'evolcore-locks') + '/**']: 'write',
                         } : {}),
                     },
                     network,
@@ -841,14 +1086,17 @@ export class CodexRunner {
             sandbox: decision.state === 'off' ? 'danger-full-access' : undefined,
         };
     }
-    buildLifecycleLockdownConfig() {
+    isTrustedFullAccessSession(sessionKey) {
+        return hasTrustedFullAccessContext(this.permissionContexts.get(sessionKey));
+    }
+    buildLifecycleLockdownConfig(permissionMode) {
         return {
             features: {
                 // The app-server is launched with allow_managed_hooks_only=true, so
                 // enabling the feature exposes only EvolCore's requirements-managed
                 // PreToolUse hook. Disabling it here suppresses that managed hook too
                 // and bypasses the pause/proactive policy boundary entirely.
-                hooks: true,
+                hooks: permissionMode !== 'fullaccess',
             },
         };
     }
@@ -867,50 +1115,145 @@ export class CodexRunner {
     }
     setSendPrompt(fn) { this.sendPromptFn = fn; }
     setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    injectUserMessage(sessionId, text) {
+        // Bind queued reminders to the turn that generated them. A completed
+        // turn may be replaced before the serialized steer reaches app-server;
+        // injecting the old reminder into the new turn would corrupt its context.
+        const requestedTurn = this.activeTurns.get(sessionId);
+        if (!requestedTurn) {
+            logger.warn(`[CodexRunner] turn steer skipped because no active turn is registered: session=${sessionId}`);
+            return;
+        }
+        const previous = this.steeringTails.get(sessionId) ?? Promise.resolve();
+        let current;
+        current = previous.catch(() => undefined).then(async () => {
+            const activeTurn = this.activeTurns.get(sessionId);
+            const sameTurn = !!activeTurn
+                && activeTurn.threadId === requestedTurn.threadId
+                && activeTurn.turnId === requestedTurn.turnId;
+            if (!sameTurn) {
+                logger.warn(`[CodexRunner] turn steer skipped because the originating turn is no longer active: `
+                    + `session=${sessionId} thread=${requestedTurn.threadId} turn=${requestedTurn.turnId}`);
+                return;
+            }
+            const input = [{ type: 'text', text, text_elements: [] }];
+            const client = this.getAppServerClient();
+            if (typeof client.turnSteer !== 'function') {
+                logger.warn(`[CodexRunner] turn steer unavailable in app-server client: session=${sessionId}`);
+                return;
+            }
+            try {
+                const response = await client.turnSteer(activeTurn.threadId, activeTurn.turnId, input);
+                logger.info(`[CodexRunner] turn steer delivered: session=${sessionId} thread=${activeTurn.threadId} ` +
+                    `turn=${response.turnId} chars=${text.length}`);
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] turn steer failed: session=${sessionId} thread=${activeTurn.threadId} ` +
+                    `turn=${activeTurn.turnId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        }).finally(() => {
+            if (this.steeringTails.get(sessionId) === current)
+                this.steeringTails.delete(sessionId);
+        });
+        this.steeringTails.set(sessionId, current);
+    }
     async assertProactiveHookAvailability(sessionId, appServer) {
         if (this.permissionContexts.get(sessionId)?.chatmode !== 'proactive')
             return;
-        if (process.platform === 'win32') {
-            await appServer.assertManagedHooksAvailable();
-            return;
-        }
-        if (process.platform !== 'linux') {
+        if (process.platform !== 'linux' && process.platform !== 'win32') {
             throw new Error('Codex proactive managed PreToolUse enforcement requires Linux or an installed Windows managed hook');
         }
+        await appServer.assertManagedHooksAvailable();
     }
-    async evaluatePreToolUse(threadId, toolName, toolInput, signal) {
+    async evaluatePreToolUse(threadId, toolName, toolInput, signal, callId) {
         const sessionKey = this.findSessionKeyByThread(threadId);
-        const activeThread = this.activeSessions.get(sessionKey);
+        const activeThread = this.activeSessions.get(sessionKey) ?? this.provisionalSessions.get(sessionKey);
         const context = this.permissionContexts.get(sessionKey);
-        if (!activeThread || activeThread !== threadId) {
+        const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
+            ? toolInput
+            : {};
+        const recordPreToolUseDenial = async (policyCode, reason) => {
+            const summary = summarizeToolInputForAudit(toolName, normalizedInput).slice(0, 512);
+            auditToolPreflightDenial({
+                toolName,
+                policyCode,
+                reason,
+                summary,
+                sessionId: sessionKey,
+                agentAid: context?.selfAid,
+                agentName: context?.agentName,
+                permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+                channel: context?.channel,
+                actorId: context?.userId,
+                role: context?.role,
+                selfAid: context?.selfAid,
+                callId,
+                correlationId: callId,
+                taskId: context?.taskId,
+            });
+            try {
+                await context?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    policyCode,
+                    decisionSource: 'policy',
+                    agentAid: context?.selfAid,
+                    agentName: context?.agentName,
+                    sessionId: sessionKey,
+                    permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+                    summary,
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record managed-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
+        if (!activeThread || !this.isThreadOwnedBySession(sessionKey, threadId)) {
             return { ok: true, applicable: false };
         }
         const proactiveSession = context?.chatmode === 'proactive';
         if (!context || (proactiveSession && !context.preToolUsePolicyHook)) {
-            return { ok: false, applicable: true, decision: 'deny', reason: 'EvolCore proactive session policy context is unavailable' };
+            const reason = 'EvolCore proactive session policy context is unavailable';
+            await recordPreToolUseDenial('pre_tool_use_context_unavailable', reason);
+            return { ok: false, applicable: true, decision: 'deny', reason };
         }
         if (context.pauseController) {
             const pauseResult = await context.pauseController.waitAtToolBoundary(signal);
             if (pauseResult === 'cancelled') {
-                return { ok: true, applicable: true, decision: 'deny', reason: '工具调用已取消' };
+                const reason = '工具调用已取消';
+                await recordPreToolUseDenial('tool_call_cancelled', reason);
+                return { ok: true, applicable: true, decision: 'deny', reason };
             }
         }
+        if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
+            if (this.isTrustedFullAccessSession(sessionKey))
+                return { ok: true, applicable: true, decision: 'allow' };
+            const reason = 'Untrusted fullaccess execution context';
+            await recordPreToolUseDenial('fullaccess_context_untrusted', reason);
+            return { ok: false, applicable: true, decision: 'deny', reason };
+        }
         // A tracked interactive thread still needs an authenticated, explicit
         // allow so the managed hook can fail closed when no runner matches.
         if (!context.preToolUsePolicyHook)
             return { ok: true, applicable: true, decision: 'allow' };
-        const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
-            ? toolInput
-            : {};
         try {
             const result = context.preToolUsePolicyHook(toolName, normalizedInput);
             if (result?.block) {
-                return { ok: true, applicable: true, decision: 'deny', reason: result.reason };
+                const policyCode = result.policyCode ?? 'session_policy_hook';
+                const reason = result.reason ?? 'session policy denied this tool call';
+                await recordPreToolUseDenial(policyCode, reason);
+                return { ok: true, applicable: true, decision: 'deny', reason };
             }
             return { ok: true, applicable: true, decision: 'allow' };
         }
         catch (error) {
-            return { ok: false, applicable: true, decision: 'deny', reason: `policy hook failed: ${error instanceof Error ? error.message : String(error)}` };
+            const reason = `policy hook failed: ${error instanceof Error ? error.message : String(error)}`;
+            await recordPreToolUseDenial('pre_tool_use_hook_failed', reason);
+            return { ok: false, applicable: true, decision: 'deny', reason };
         }
     }
     setPermissionGateway(gw) { this.permissionGateway = gw; }
@@ -919,9 +1262,19 @@ export class CodexRunner {
         this.activeStreams.set(key, stream);
     }
     cleanupStream(key) {
+        const hadController = this.activeAbortControllers.has(key);
+        const hadTurn = this.activeTurns.has(key);
+        const provisionalThread = this.provisionalSessions.get(key);
         this.activeStreams.delete(key);
         this.activeAbortControllers.delete(key);
         this.pendingInterrupts.delete(key);
+        // A stale runner-start path may dispose the stream without ever entering
+        // transformAppServerStream. Reclaim its provisional thread, but preserve
+        // a replacement run that has already installed a new controller/turn.
+        if (provisionalThread && !hadController && !hadTurn) {
+            this.cleanupProvisionalThread(key, provisionalThread);
+        }
+        this.chatModes.delete(key);
         const release = this.activeOperationReleases.get(key);
         if (release) {
             this.activeOperationReleases.delete(key);
@@ -976,14 +1329,20 @@ export class CodexRunner {
         }
     }
     isActiveThreadOperationAlias(key) {
-        if (key.startsWith('session:'))
-            return this.activeSessions.has(key.slice('session:'.length));
+        if (key.startsWith('session:')) {
+            const sessionId = key.slice('session:'.length);
+            return this.activeSessions.has(sessionId) || this.provisionalSessions.has(sessionId);
+        }
         if (key.startsWith('thread:')) {
             const threadId = key.slice('thread:'.length);
             for (const activeThreadId of this.activeSessions.values()) {
                 if (activeThreadId === threadId)
                     return true;
             }
+            for (const provisionalThreadId of this.provisionalSessions.values()) {
+                if (provisionalThreadId === threadId)
+                    return true;
+            }
             return false;
         }
         return true;
@@ -1032,8 +1391,22 @@ export class CodexRunner {
         }
     }
     // ── Core: runQuery ──
+    cachedThreadForTopic(sessionId, agentSessionId) {
+        if (!agentSessionId)
+            return undefined;
+        return this.activeSessions.get(sessionId) === agentSessionId ? agentSessionId : undefined;
+    }
     async runQuery(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
-        const knownThreadId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        const topicBinding = modelOverride?.backend?.kind === 'topic';
+        if (topicBinding && (!modelOverride?.turn || modelOverride.turn.sessionId !== sessionId || !this.onSessionIdUpdate)) {
+            const error = new Error('topic backend run requires an active TurnLease and binding callback');
+            error.code = 'TOPIC_TURN_LEASE_REQUIRED';
+            throw error;
+        }
+        const topicAgentSessionId = topicBinding ? modelOverride?.backend?.agentSessionId ?? null : undefined;
+        const knownThreadId = topicBinding
+            ? this.cachedThreadForTopic(sessionId, topicAgentSessionId)
+            : initialAgentSessionId || this.activeSessions.get(sessionId);
         const operationKey = this.threadOperationKey(knownThreadId, sessionId);
         const release = await this.acquireThreadOperation(operationKey, 'thread/resume+turn/start');
         try {
@@ -1047,8 +1420,26 @@ export class CodexRunner {
         }
     }
     async runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
-        let agentSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
-        const resumingThread = !!agentSessionId;
+        // A daemon-managed task must never fall back to the app-server's
+        // process-wide TMPDIR if its session namespace disappeared.
+        getManagedTaskTempDir(runtimeEnv);
+        const topicBinding = modelOverride?.backend?.kind === 'topic';
+        const topicAgentSessionId = topicBinding ? modelOverride?.backend?.agentSessionId ?? null : undefined;
+        let agentSessionId = topicBinding
+            ? (topicAgentSessionId || undefined)
+            : initialAgentSessionId || this.activeSessions.get(sessionId);
+        if (!topicBinding && !initialAgentSessionId && typeof sessionManager?.getSessionById === 'function') {
+            try {
+                const persisted = await sessionManager.getSessionById(sessionId);
+                agentSessionId = typeof persisted?.agentSessionId === 'string' && persisted.agentSessionId.trim()
+                    ? persisted.agentSessionId.trim()
+                    : undefined;
+            }
+            catch (error) {
+                logger.debug(`[CodexRunner] persisted main backend lookup failed; using local cache: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        let resumingThread = !!agentSessionId;
         const callModel = modelOverride?.model || this.model;
         const callEffort = modelOverride?.effortMode === 'model_default'
             ? undefined
@@ -1057,8 +1448,10 @@ export class CodexRunner {
         // 写入 chatModes 供异步审批回调按 sessionKey 读取，并据此派生本次 thread 的 approvalPolicy/sandbox，
         // 不依赖共享的 this.approvalPolicy/this.sandboxMode（多会话并发互不污染）。
         const requestedPermissionMode = modelOverride?.permissionMode || this.currentMode;
-        const normalizedPermission = normalizePermissionMode(requestedPermissionMode);
-        const callMode = normalizedPermission.mode;
+        const callMode = normalizeExecutionPermissionMode(requestedPermissionMode);
+        if (callMode === 'fullaccess' && !hasTrustedFullAccessContext(this.permissionContexts.get(sessionId))) {
+            throw new Error('Codex fullaccess requires a trusted per-call execution authorization');
+        }
         this.chatModes.set(sessionId, callMode);
         const callApprovalPolicy = this.toApprovalPolicy(callMode);
         const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath);
@@ -1066,8 +1459,11 @@ export class CodexRunner {
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
-        const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, callMode);
-        await this.assertProactiveHookAvailability(sessionId, appServer);
+        const externalToolConfig = callMode === 'fullaccess'
+            ? {}
+            : await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, callMode);
+        if (callMode !== 'fullaccess')
+            await this.assertProactiveHookAvailability(sessionId, appServer);
         const managedTempInstruction = this.managedTempInstruction(sessionId);
         const developerInstructions = [systemPromptAppend, managedTempInstruction].filter(Boolean).join('\n\n') || undefined;
         let knownDelegationCarrier = agentSessionId
@@ -1075,35 +1471,80 @@ export class CodexRunner {
             : undefined;
         if (agentSessionId && !knownDelegationCarrier) {
             knownDelegationCarrier = await this.loadPersistedDelegationCarrier(sessionManager, sessionId, agentSessionId);
-            if (knownDelegationCarrier) {
-                this.threadDelegationCarriers.set(agentSessionId, knownDelegationCarrier);
-            }
         }
-        const delegationCarrierCandidate = knownDelegationCarrier ?? this.createDelegationCarrier();
+        let delegationCarrierCandidate = knownDelegationCarrier ?? this.createDelegationCarrier();
+        // Keep newly discovered carrier state local until generation-aware
+        // activation accepts the backend. A stale run must not publish a carrier
+        // that a later generation could mistake for its own thread.
+        let carrierToPublish;
         const hasTaskDelegation = typeof runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] === 'string';
-        const threadOptions = {
+        let threadOptions = {
             model: callModel,
             effort: callEffort,
             approvalPolicy: effectiveApprovalPolicy,
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig()), callMode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig(callMode)), callMode),
             ...(developerInstructions ? { developerInstructions } : {}),
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
             `role=${executionSandbox.decision.role ?? 'none'} sandbox=${executionSandbox.decision.state}`);
-        const threadResponse = agentSessionId
-            ? await appServer.threadResume(agentSessionId, projectPath, threadOptions)
-            : await appServer.threadStart(projectPath, threadOptions);
+        let threadResponse;
+        if (agentSessionId) {
+            try {
+                threadResponse = await appServer.threadResume(agentSessionId, projectPath, threadOptions);
+            }
+            catch (error) {
+                // A legacy main session can retain a provider ID after its rollout was
+                // removed externally. It is safe to recover before input submission;
+                // topic bindings remain authoritative and fail closed.
+                if (topicBinding || !isCodexNoRolloutError(error))
+                    throw error;
+                if (typeof sessionManager?.clearMainSessionBackendIfMatches !== 'function')
+                    throw error;
+                const missingThreadId = agentSessionId;
+                const cleared = await sessionManager.clearMainSessionBackendIfMatches(sessionId, missingThreadId, [CODEX_DELEGATION_CARRIER_METADATA_KEY]);
+                if (cleared !== 'cleared' && cleared !== 'already_clear') {
+                    const recoveryError = new Error(`Codex missing-rollout recovery rejected: ${cleared}`);
+                    recoveryError.code = 'CODEX_MISSING_ROLLOUT_RECOVERY_REJECTED';
+                    throw recoveryError;
+                }
+                if (this.activeSessions.get(sessionId) === missingThreadId)
+                    this.activeSessions.delete(sessionId);
+                this.threadProjectPaths.delete(missingThreadId);
+                this.threadDelegationCarriers.delete(missingThreadId);
+                this.unbindExternalToolBoundary(missingThreadId);
+                this.clearTrackedApprovalItemsForThread(missingThreadId);
+                agentSessionId = undefined;
+                resumingThread = false;
+                knownDelegationCarrier = undefined;
+                delegationCarrierCandidate = this.createDelegationCarrier();
+                threadOptions = {
+                    ...threadOptions,
+                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig(callMode)), callMode),
+                };
+                logger.warn(`[CodexRunner] recovered missing rollout before input submission: session=${sessionId} thread=${missingThreadId}`);
+                threadResponse = await appServer.threadStart(projectPath, threadOptions);
+            }
+        }
+        else {
+            threadResponse = await appServer.threadStart(projectPath, threadOptions);
+        }
         let threadId = threadResponse.thread?.id || agentSessionId;
         if (!threadId)
             throw new Error('Codex app-server did not return a thread id');
         if (!resumingThread) {
-            this.threadDelegationCarriers.set(threadId, delegationCarrierCandidate);
-            await this.persistDelegationCarrier(sessionManager, sessionId, threadId, delegationCarrierCandidate);
+            carrierToPublish = { threadId, carrier: delegationCarrierCandidate };
         }
         else if (hasTaskDelegation && !knownDelegationCarrier) {
-            let recoveredCarrier = await this.readThreadDelegationCarrier(appServer, threadId);
+            // A BOUND topic cannot silently fork to migrate carrier metadata: its
+            // active-turn activation is allowed to confirm only the authoritative
+            // backend ID, so a fork would deterministically conflict. threadResume
+            // already received the candidate in this turn's environment config;
+            // publish it for the same thread after binding confirmation instead.
+            let recoveredCarrier = topicBinding
+                ? delegationCarrierCandidate
+                : await this.readThreadDelegationCarrier(appServer, threadId);
             if (!recoveredCarrier) {
                 const staleThreadId = threadId;
                 logger.warn(`[CodexRunner] loaded thread has no recoverable delegation carrier; forking once to preserve history: thread=${staleThreadId}`);
@@ -1121,19 +1562,46 @@ export class CodexRunner {
                 threadId = forkedThreadId;
                 recoveredCarrier = delegationCarrierCandidate;
             }
-            this.threadDelegationCarriers.set(threadId, recoveredCarrier);
-            await this.persistDelegationCarrier(sessionManager, sessionId, threadId, recoveredCarrier);
+            carrierToPublish = { threadId, carrier: recoveredCarrier };
         }
         else if (knownDelegationCarrier) {
-            this.threadDelegationCarriers.set(threadId, knownDelegationCarrier);
-            await this.persistDelegationCarrier(sessionManager, sessionId, threadId, knownDelegationCarrier);
+            carrierToPublish = { threadId, carrier: knownDelegationCarrier };
+        }
+        const turn = modelOverride?.turn;
+        if (!resumingThread) {
+            // Keep a newly-created backend private to this runner until turn/start
+            // has been accepted. In particular, a pending interrupt must not leave
+            // a durable ID for a thread that never produced a rollout.
+            this.provisionalSessions.set(sessionId, threadId);
+            if (carrierToPublish) {
+                this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+            }
+        }
+        else {
+            agentSessionId = threadId;
+            const bindingResult = this.onSessionIdUpdate
+                ? ((turn === undefined
+                    ? await this.onSessionIdUpdate(sessionId, threadId)
+                    : await this.onSessionIdUpdate(sessionId, threadId, { turn }))
+                    ?? 'legacy_updated')
+                : 'legacy_updated';
+            const bindingAccepted = bindingResult === 'activated'
+                || bindingResult === 'already_active'
+                || bindingResult === 'legacy_updated';
+            if (!bindingAccepted) {
+                const error = new Error(`backend discovery rejected: ${bindingResult}`);
+                error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+                throw error;
+            }
+            this.activeSessions.set(sessionId, threadId);
+            if (carrierToPublish) {
+                this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+                await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
+            }
+            this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         }
-        agentSessionId = threadId;
-        this.activeSessions.set(sessionId, threadId);
-        this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         this.threadProjectPaths.set(threadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(threadId, externalToolConfig);
-        this.onSessionIdUpdate?.(sessionId, threadId);
         const controller = new AbortController();
         this.activeAbortControllers.set(sessionId, controller);
         const tempFiles = [];
@@ -1142,21 +1610,55 @@ export class CodexRunner {
         controller.signal.addEventListener('abort', () => queue.end(), { once: true });
         const state = {
             threadId,
+            sessionId,
+            projectPath,
             model: callModel,
+            committed: resumingThread,
             streamedAgentMessageIds: new Set(),
             agentMessageDeltaText: new Map(),
             completedItemIds: new Set(),
             emittedEditCallIds: new Set(),
             completedTurnIds: new Set(),
             openToolCalls: new Map(),
+            activeSubagentThreads: new Set(),
+            turnCompleted: false,
         };
         const unsubscribe = appServer.onNotification(notification => {
             // 仅从 turn/started 锁定权威 turnId — resume 时会有上一轮 turn 的残留通知
             // （如 thread/tokenUsage/updated）先于新 turn 到达，不能用它们 latch turnId
             const params = notification.params || {};
             const notifThreadId = params.threadId ?? params.thread_id;
-            if (notifThreadId !== undefined && notifThreadId !== threadId)
+            const item = params.item && typeof params.item === 'object' ? params.item : undefined;
+            const emittedByChild = typeof notifThreadId === 'string'
+                && this.childThreadSessions.get(notifThreadId) === sessionId;
+            if (notifThreadId !== undefined && notifThreadId !== threadId && !emittedByChild)
                 return;
+            this.trackSubagentLifecycle(notification, state);
+            if (emittedByChild && notifThreadId !== threadId) {
+                const childTurnId = this.extractTurnId(notification);
+                if (notification.method === 'turn/started' && childTurnId) {
+                    this.activeSubagentTurns.set(notifThreadId, {
+                        sessionId,
+                        parentThreadId: threadId,
+                        turnId: childTurnId,
+                    });
+                }
+                else if (notification.method === 'turn/completed') {
+                    const activeChildTurn = this.activeSubagentTurns.get(notifThreadId);
+                    if (!childTurnId || activeChildTurn?.turnId === childTurnId) {
+                        this.activeSubagentTurns.delete(notifThreadId);
+                    }
+                    state.activeSubagentThreads.delete(notifThreadId);
+                    this.unregisterChildThread(notifThreadId);
+                    this.endAppServerQueueWhenSubagentsDone(queue, state);
+                }
+                if (this.isSubagentActivityItem(item))
+                    queue.push(notification);
+                if (notification.method === 'item/completed' && state.turnCompleted) {
+                    this.endAppServerQueueWhenSubagentsDone(queue, state);
+                }
+                return;
+            }
             if (notification.method === 'turn/started') {
                 const startedTurnId = this.extractTurnId(notification);
                 if (startedTurnId && !state.turnId) {
@@ -1172,15 +1674,22 @@ export class CodexRunner {
                 return;
             queue.push(notification);
             // 仅在已锁定 turnId 后才允许 turn/completed 结束队列，避免残留的旧 turn/completed 误关
-            if (notification.method === 'turn/completed' && state.turnId)
-                queue.end();
+            if (notification.method === 'turn/completed' && state.turnId) {
+                state.turnCompleted = true;
+                this.endAppServerQueueWhenSubagentsDone(queue, state);
+            }
+            else if (notification.method === 'item/completed' && state.turnCompleted) {
+                this.endAppServerQueueWhenSubagentsDone(queue, state);
+            }
         });
         if (this.consumePendingInterrupt(sessionId)) {
             controller.abort('User interrupt');
             this.activeAbortControllers.delete(sessionId);
             this.activeStreams.delete(sessionId);
+            if (!resumingThread)
+                this.cleanupProvisionalThread(sessionId, threadId);
             logger.info(`[CodexRunner] Applied pending interrupt before turn start: ${sessionId}`);
-            return this.transformAppServerStream(queue, sessionId, state, unsubscribe, tempFiles);
+            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
         }
         try {
             const turnResponse = await appServer.turnStart(threadId, input, {
@@ -1190,6 +1699,14 @@ export class CodexRunner {
                 approvalPolicy: effectiveApprovalPolicy,
                 ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
             });
+            if (!resumingThread) {
+                state.commitProvisional = async () => {
+                    const committed = await this.commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn);
+                    if (committed)
+                        agentSessionId = threadId;
+                    return committed;
+                };
+            }
             const turnId = turnResponse.turn?.id;
             if (turnId && !state.turnId) {
                 state.turnId = turnId;
@@ -1204,8 +1721,10 @@ export class CodexRunner {
             }
             const status = turnResponse.turn?.status;
             if (status === 'completed' || status === 'failed') {
+                this.primeSubagentStateFromTurn(turnResponse.turn, state);
                 queue.push({ method: 'turn/completed', params: { threadId, turn: turnResponse.turn } });
-                queue.end();
+                state.turnCompleted = true;
+                this.endAppServerQueueWhenSubagentsDone(queue, state);
             }
         }
         catch (error) {
@@ -1214,9 +1733,11 @@ export class CodexRunner {
             this.activeTurns.delete(sessionId);
             this.pendingInterrupts.delete(sessionId);
             this.cleanupTempFiles(tempFiles);
+            if (!resumingThread)
+                this.cleanupProvisionalThread(sessionId, threadId);
             throw error;
         }
-        return this.transformAppServerStream(queue, sessionId, state, unsubscribe, tempFiles);
+        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
     }
     // ── Interrupt ──
     async interrupt(sessionKey) {
@@ -1227,6 +1748,7 @@ export class CodexRunner {
         const interruptTurn = activeTurn
             ? this.interruptAppServerTurn(activeTurn.threadId, activeTurn.turnId)
             : Promise.resolve();
+        const interruptSubagents = this.interruptSubagentTurns(sessionKey);
         if (!activeTurn)
             this.rememberPendingInterrupt(sessionKey);
         if (controller)
@@ -1237,7 +1759,17 @@ export class CodexRunner {
             this.activeTurns.delete(sessionKey);
             logger.info(`[CodexRunner] Interrupted session: ${sessionKey}`);
         }
-        await interruptTurn;
+        await Promise.all([interruptTurn, interruptSubagents]);
+    }
+    async interruptSubagentTurns(sessionId, parentThreadId) {
+        const entries = [...this.activeSubagentTurns.entries()]
+            .filter(([, active]) => active.sessionId === sessionId && (!parentThreadId || active.parentThreadId === parentThreadId));
+        await Promise.all(entries.map(async ([childThreadId, active]) => {
+            await this.interruptAppServerTurn(childThreadId, active.turnId).catch(() => { });
+            const current = this.activeSubagentTurns.get(childThreadId);
+            if (current === active)
+                this.activeSubagentTurns.delete(childThreadId);
+        }));
     }
     rememberPendingInterrupt(sessionId) {
         this.pendingInterrupts.set(sessionId, Date.now());
@@ -1266,40 +1798,96 @@ export class CodexRunner {
     // ── Session commands ──
     updateSessionId(sessionId, agentSessionId) {
         const previousThreadId = this.activeSessions.get(sessionId);
-        if (previousThreadId && previousThreadId !== agentSessionId) {
-            this.threadProjectPaths.delete(previousThreadId);
-            this.threadDelegationCarriers.delete(previousThreadId);
-            this.unbindExternalToolBoundary(previousThreadId);
-            this.clearTrackedApprovalItemsForThread(previousThreadId);
-        }
-        if (agentSessionId) {
-            this.activeSessions.set(sessionId, agentSessionId);
-            this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${agentSessionId}`);
-        }
-        else {
-            this.activeSessions.delete(sessionId);
+        const applyLocal = () => {
+            const currentThreadId = this.activeSessions.get(sessionId);
+            if (currentThreadId !== previousThreadId && !(previousThreadId === undefined && currentThreadId === undefined))
+                return;
+            if (previousThreadId && previousThreadId !== agentSessionId) {
+                this.threadProjectPaths.delete(previousThreadId);
+                this.threadDelegationCarriers.delete(previousThreadId);
+                this.unbindExternalToolBoundary(previousThreadId);
+                this.clearTrackedApprovalItemsForThread(previousThreadId);
+            }
+            if (agentSessionId)
+                this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${agentSessionId}`);
+            this.pruneThreadOperationLocks();
+            if (agentSessionId)
+                this.activeSessions.set(sessionId, agentSessionId);
+            else
+                this.activeSessions.delete(sessionId);
+        };
+        if (!this.onSessionIdUpdate) {
+            applyLocal();
+            return;
         }
-        this.pruneThreadOperationLocks();
-        this.onSessionIdUpdate?.(sessionId, agentSessionId);
+        void this.onSessionIdUpdate(sessionId, agentSessionId).then(result => {
+            if (result === 'activated' || result === 'already_active' || result === 'legacy_updated' || !agentSessionId) {
+                applyLocal();
+            }
+        }).catch(error => {
+            logger.warn(`[CodexRunner] session binding callback failed: ${error instanceof Error ? error.message : String(error)}`);
+            if (!agentSessionId)
+                applyLocal();
+        });
     }
     async closeSession(sessionId) {
+        const capturedThreadId = this.activeSessions.get(sessionId);
+        const capturedProvisionalThreadId = this.provisionalSessions.get(sessionId);
+        const capturedPermissionContext = this.permissionContexts.get(sessionId);
+        const capturedStream = this.activeStreams.get(sessionId);
+        const capturedController = this.activeAbortControllers.get(sessionId);
+        const capturedTurn = this.activeTurns.get(sessionId);
+        const capturedSteeringTail = this.steeringTails.get(sessionId);
         this.permissionContexts.get(sessionId)?.pauseController?.cancel();
-        const threadId = this.activeSessions.get(sessionId);
-        this.activeSessions.delete(sessionId);
-        this.activeStreams.delete(sessionId);
-        this.activeAbortControllers.delete(sessionId);
-        this.activeTurns.delete(sessionId);
-        this.pendingInterrupts.delete(sessionId);
-        this.permissionContexts.delete(sessionId);
-        this.chatModes.delete(sessionId);
-        this.cleanupSessionTempDir(sessionId);
-        if (threadId) {
-            this.threadProjectPaths.delete(threadId);
-            this.threadDelegationCarriers.delete(threadId);
-            this.unbindExternalToolBoundary(threadId);
+        // Do not call interrupt(sessionId) here: a new run may have replaced the
+        // session-scoped maps while an older close was waiting. Interrupt and
+        // clean only the exact lifecycle captured at entry.
+        if (capturedTurn) {
+            await this.interruptAppServerTurn(capturedTurn.threadId, capturedTurn.turnId).catch(() => { });
+        }
+        const capturedParentThreadId = capturedThreadId ?? capturedProvisionalThreadId;
+        if (capturedParentThreadId) {
+            await this.interruptSubagentTurns(sessionId, capturedParentThreadId);
+        }
+        else if (!this.activeSessions.has(sessionId) && !this.provisionalSessions.has(sessionId)) {
+            await this.interruptSubagentTurns(sessionId);
+        }
+        capturedController?.abort('Session closed');
+        const lifecycleReplaced = (capturedStream !== undefined && this.activeStreams.get(sessionId) !== capturedStream)
+            || (capturedController !== undefined && this.activeAbortControllers.get(sessionId) !== capturedController)
+            || (capturedTurn !== undefined && this.activeTurns.get(sessionId) !== capturedTurn)
+            || (capturedPermissionContext !== undefined && this.permissionContexts.get(sessionId) !== capturedPermissionContext)
+            || (capturedThreadId !== undefined && this.activeSessions.get(sessionId) !== capturedThreadId);
+        if (capturedStream !== undefined && this.activeStreams.get(sessionId) === capturedStream)
+            this.activeStreams.delete(sessionId);
+        if (capturedController !== undefined && this.activeAbortControllers.get(sessionId) === capturedController)
+            this.activeAbortControllers.delete(sessionId);
+        if (capturedTurn !== undefined && this.activeTurns.get(sessionId) === capturedTurn)
+            this.activeTurns.delete(sessionId);
+        if (this.pendingInterrupts.has(sessionId) && !lifecycleReplaced)
+            this.pendingInterrupts.delete(sessionId);
+        if (this.permissionContexts.get(sessionId) === capturedPermissionContext)
+            this.permissionContexts.delete(sessionId);
+        if (this.steeringTails.get(sessionId) === capturedSteeringTail)
+            this.steeringTails.delete(sessionId);
+        if (capturedProvisionalThreadId)
+            this.cleanupProvisionalThread(sessionId, capturedProvisionalThreadId);
+        // Session-level configuration and thread indexes are shared by later
+        // runs. Only remove them when the captured lifecycle still owns the key.
+        if (!lifecycleReplaced) {
+            if (this.activeSessions.get(sessionId) === capturedThreadId)
+                this.activeSessions.delete(sessionId);
+            this.chatModes.delete(sessionId);
+            this.cleanupSessionTempDir(sessionId);
+            if (capturedThreadId) {
+                this.threadProjectPaths.delete(capturedThreadId);
+                this.threadDelegationCarriers.delete(capturedThreadId);
+                this.unbindExternalToolBoundary(capturedThreadId);
+            }
+            this.clearTrackedApprovalItemsForThread(capturedThreadId);
+            this.cleanupChildThreadsForSession(sessionId);
+            this.pruneThreadOperationLocks();
         }
-        this.clearTrackedApprovalItemsForThread(threadId);
-        this.pruneThreadOperationLocks();
     }
     resolveSessionFile(agentSessionId, _projectPath) {
         // Codex session 文件: ~/.codex/sessions/YYYY/MM/DD/rollout-*-{threadId}.jsonl
@@ -1326,6 +1914,8 @@ export class CodexRunner {
         // Codex: 清空会话 = 下次 runQuery 不传 resumeId，自动创建新 thread
         const threadId = this.activeSessions.get(sessionId) ?? _agentSessionId;
         this.activeSessions.delete(sessionId);
+        this.activeTurns.delete(sessionId);
+        this.steeringTails.delete(sessionId);
         this.chatModes.delete(sessionId);
         this.cleanupSessionTempDir(sessionId);
         this.threadProjectPaths.delete(threadId);
@@ -1333,54 +1923,67 @@ export class CodexRunner {
         this.unbindExternalToolBoundary(threadId);
         this.clearTrackedApprovalItemsForThread(threadId);
         this.pruneThreadOperationLocks();
-        this.onSessionIdUpdate?.(sessionId, '');
+        await this.onSessionIdUpdate?.(sessionId, '');
         return true;
     }
-    async compactSession(_sessionId, agentSessionId, _projectPath) {
+    async compactSession(_sessionId, agentSessionId, _projectPath, modelOverride) {
+        const startedAt = Date.now();
+        const finish = (result) => {
+            logger.info(`[CodexRunner] Compact result: thread=${agentSessionId} ok=${result.ok} code=${result.ok ? 'ok' : result.code} durationMs=${result.durationMs}`);
+            return result;
+        };
         const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId, _sessionId), 'compact');
         try {
             const appServer = this.getAppServerClient();
             this.onCompactStart?.(_sessionId);
             try {
-                return await this.startAndWaitForCompact(appServer, agentSessionId);
+                await this.startAndWaitForCompact(appServer, agentSessionId);
+                return finish({ ok: true, durationMs: Date.now() - startedAt });
             }
             catch (error) {
                 if (!this.isThreadNotFoundError(error))
                     throw error;
                 logger.info(`[CodexRunner] Compact thread not loaded, resuming before compact: ${agentSessionId}`);
-                // 优先用 per-session 模式派生（与 runQuery 一致），缺省回落实例级
-                const compactMode = this.chatModes.get(_sessionId) ?? this.currentMode;
+                const compactMode = normalizeExecutionPermissionMode(modelOverride?.permissionMode ?? this.chatModes.get(_sessionId) ?? this.currentMode);
+                const compactModel = modelOverride?.model || this.model;
+                const compactEffort = modelOverride?.effortMode === 'model_default'
+                    ? undefined
+                    : modelOverride?.effort ?? this.effort;
                 const compactPolicy = this.toApprovalPolicy(compactMode);
                 const executionSandbox = this.buildExecutionSandboxOptions(_sessionId, compactMode, _projectPath);
                 const capabilityConfig = await this.resolveCapabilityThreadConfig(_projectPath);
-                const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, _projectPath, capabilityConfig, compactMode);
-                await this.assertProactiveHookAvailability(_sessionId, appServer);
+                const externalToolConfig = compactMode === 'fullaccess'
+                    ? {}
+                    : await this.resolveExternalToolApprovalConfig(appServer, _projectPath, capabilityConfig, compactMode);
+                if (compactMode !== 'fullaccess')
+                    await this.assertProactiveHookAvailability(_sessionId, appServer);
                 const compactDelegationCarrier = this.threadDelegationCarriers.get(agentSessionId)
                     ?? this.createDelegationCarrier();
                 await appServer.threadResume(agentSessionId, _projectPath, {
-                    model: this.model,
-                    effort: this.effort,
+                    model: compactModel,
+                    effort: compactEffort,
                     approvalPolicy: compactPolicy,
                     approvalsReviewer: 'user',
                     ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig()), compactMode),
+                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
                 });
                 this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
                 this.threadDelegationCarriers.set(agentSessionId, compactDelegationCarrier);
                 this.bindExternalToolBoundary(agentSessionId, externalToolConfig);
-                return await this.startAndWaitForCompact(appServer, agentSessionId);
+                await this.startAndWaitForCompact(appServer, agentSessionId);
+                return finish({ ok: true, durationMs: Date.now() - startedAt });
             }
         }
         catch (error) {
-            logger.error('[CodexRunner] Compact failed:', error);
-            return false;
+            const message = error instanceof Error ? error.message : String(error);
+            return finish({ ok: false, code: 'sdk_error', message, durationMs: Date.now() - startedAt });
         }
         finally {
             release();
         }
     }
-    async compact(sessionId, agentSessionId, projectPath) {
-        return this.compactSession(sessionId, agentSessionId, projectPath);
+    async compact(sessionId, agentSessionId, projectPath, modelOverride) {
+        return this.compactSession(sessionId, agentSessionId, projectPath, modelOverride);
     }
     async startAndWaitForCompact(appServer, threadId) {
         const completion = this.waitForThreadCompacted(appServer, threadId, Date.now());
@@ -1527,7 +2130,7 @@ export class CodexRunner {
             approvalPolicy: this.toApprovalPolicy(mode),
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, delegationCarrier), this.buildLifecycleLockdownConfig()), mode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, delegationCarrier), this.buildLifecycleLockdownConfig(mode)), mode),
         });
         const forkedThreadId = response.thread?.id;
         if (!forkedThreadId)
@@ -1582,13 +2185,14 @@ export class CodexRunner {
     trackApprovalItemNotification(notification) {
         const params = (notification.params || {});
         const item = params.item && typeof params.item === 'object' ? params.item : undefined;
-        const itemId = item?.id ?? params.itemId;
+        const itemId = item?.id ?? params.itemId ?? params.item_id;
         const threadId = this.requestThreadId(params);
-        const key = this.approvalItemKey(threadId, params.turnId, itemId);
+        const turnId = params.turnId ?? params.turn_id;
+        const key = this.approvalItemKey(threadId, turnId, itemId);
         if (notification.method === 'item/started' && key && item && threadId) {
             this.trackedApprovalItems.set(key, {
                 threadId,
-                turnId: params.turnId,
+                turnId,
                 itemId,
                 item: { ...item },
             });
@@ -1598,7 +2202,7 @@ export class CodexRunner {
             const tracked = this.trackedApprovalItems.get(key);
             this.trackedApprovalItems.set(key, {
                 threadId,
-                turnId: params.turnId,
+                turnId,
                 itemId,
                 item: {
                     ...(tracked?.item ?? { id: itemId, type: 'fileChange' }),
@@ -1622,22 +2226,40 @@ export class CodexRunner {
                     this.trackedApprovalItems.delete(trackedKey);
                 }
             }
+            this.clearPendingToolDenialsForTurn(threadId, completedTurnId);
         }
     }
     findTrackedApprovalItem(params) {
-        const key = this.approvalItemKey(this.requestThreadId(params), params.turnId, params.itemId);
+        const key = this.approvalItemKey(this.requestThreadId(params), params.turnId ?? params.turn_id, params.itemId ?? params.item_id);
         return key ? this.trackedApprovalItems.get(key)?.item : undefined;
     }
     requestThreadId(params) {
-        const threadId = typeof params.threadId === 'string' && params.threadId.length > 0
-            ? params.threadId
+        const threadIdValue = params.threadId ?? params.thread_id;
+        const threadId = typeof threadIdValue === 'string' && threadIdValue.length > 0
+            ? threadIdValue
             : undefined;
         if (threadId)
             return threadId;
-        return typeof params.conversationId === 'string' && params.conversationId.length > 0
-            ? params.conversationId
+        const conversationIdValue = params.conversationId ?? params.conversation_id;
+        return typeof conversationIdValue === 'string' && conversationIdValue.length > 0
+            ? conversationIdValue
             : undefined;
     }
+    clearPendingToolDenialsForTurn(threadId, turnId) {
+        for (const key of this.pendingToolDenials.keys()) {
+            let parsed;
+            try {
+                parsed = JSON.parse(key);
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(parsed) || parsed[0] !== threadId)
+                continue;
+            if (!turnId || parsed[1] === turnId)
+                this.pendingToolDenials.delete(key);
+        }
+    }
     clearTrackedApprovalItemsForThread(threadId) {
         if (!threadId)
             return;
@@ -1645,6 +2267,73 @@ export class CodexRunner {
             if (tracked.threadId === threadId)
                 this.trackedApprovalItems.delete(key);
         }
+        for (const key of this.pendingToolDenials.keys()) {
+            let parsed;
+            try {
+                parsed = JSON.parse(key);
+            }
+            catch {
+                continue;
+            }
+            if (Array.isArray(parsed) && parsed[0] === threadId)
+                this.pendingToolDenials.delete(key);
+        }
+    }
+    rememberToolDenial(request, params, denial) {
+        const itemId = params.itemId ?? params.item_id ?? params.callId ?? params.call_id;
+        const threadId = this.requestThreadId(params);
+        const rawTurnId = params.turnId ?? params.turn_id;
+        const turnId = typeof rawTurnId === 'string' ? rawTurnId : this.findActiveTurnId(threadId);
+        const key = this.approvalItemKey(threadId, turnId, itemId);
+        if (!key)
+            return;
+        this.pendingToolDenials.set(key, {
+            ...denial,
+            ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+            method: request.method,
+        });
+    }
+    steerPolicyReason(sessionId, policyCode, reason) {
+        const prefix = policyCode ? `策略拒绝（${policyCode}）` : '策略拒绝';
+        this.injectUserMessage(sessionId, `⚠️ ${prefix}：${reason}。命令未执行，请按提示重新执行正确的命令。`);
+    }
+    findActiveTurnId(threadId) {
+        if (!threadId)
+            return undefined;
+        for (const active of this.activeTurns.values()) {
+            if (active.threadId === threadId)
+                return active.turnId;
+        }
+        return undefined;
+    }
+    takeToolDenial(state, itemId) {
+        const exactKey = this.approvalItemKey(state.threadId, state.turnId, itemId);
+        if (exactKey) {
+            const exact = this.pendingToolDenials.get(exactKey);
+            if (exact) {
+                this.pendingToolDenials.delete(exactKey);
+                return exact;
+            }
+        }
+        // Legacy approval callbacks may not carry turnId. Consume the unique
+        // matching item for this thread rather than losing the structured reason.
+        const candidates = [];
+        for (const [key, denial] of this.pendingToolDenials) {
+            let parsed;
+            try {
+                parsed = JSON.parse(key);
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(parsed) || parsed[0] !== state.threadId || String(parsed[2]) !== String(itemId))
+                continue;
+            candidates.push([key, denial]);
+        }
+        if (candidates.length !== 1)
+            return undefined;
+        this.pendingToolDenials.delete(candidates[0][0]);
+        return candidates[0][1];
     }
     async handleAppServerRequest(request) {
         const params = (request.params || {});
@@ -1654,7 +2343,12 @@ export class CodexRunner {
         }
         if (request.method === 'item/tool/requestUserInput') {
             const trackedItem = this.findTrackedApprovalItem(params);
+            const requestSessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
+            const trustedFullAccess = (this.chatModes.get(requestSessionKey) ?? this.currentMode) === 'fullaccess'
+                && this.isTrustedFullAccessSession(requestSessionKey);
             if (trackedItem?.type === 'mcpToolCall') {
+                if (trustedFullAccess)
+                    return this.handleMcpToolApproval(params, trackedItem);
                 const unattendedDenial = await this.denyUnattendedExternalToolApproval(params, `MCP:${String(trackedItem.server || 'unknown')}/${String(trackedItem.tool || 'unknown')}`, request.id);
                 if (unattendedDenial)
                     return unattendedDenial;
@@ -1664,6 +2358,12 @@ export class CodexRunner {
                 return this.handleToolRequestUserInput(params);
             }
             if (this.looksLikeExternalToolApproval(params.questions)) {
+                // In trusted fullaccess, an untracked approval prompt is still an SDK
+                // permission surface, not ordinary model/user interaction. The
+                // fullaccess branch in handleMcpToolApproval deliberately does not
+                // require capability-bound metadata and selects a one-shot allow.
+                if (trustedFullAccess)
+                    return this.handleMcpToolApproval(params, {});
                 const unattendedDenial = await this.denyUnattendedExternalToolApproval(params, 'MCP:untracked', request.id);
                 if (unattendedDenial)
                     return unattendedDenial;
@@ -1690,30 +2390,51 @@ export class CodexRunner {
                 ? 'FileChange'
                 : 'Bash';
         const toolInput = this.buildPermissionInput(request.method, params);
-        // proactive 模式行为策略（首次工具调用必须是 ec msg send）
+        // A trusted fullaccess run has already been explicitly authorized by the
+        // daemon owner. Do not route its approvals through ordinary capability,
+        // workspace, or unattended-trigger policy checks.
+        if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
+            if (!this.isTrustedFullAccessSession(sessionKey)) {
+                const reason = 'Untrusted fullaccess execution context';
+                this.rememberToolDenial(request, params, {
+                    decision: 'deny',
+                    decisionSource: 'policy',
+                    policyCode: 'fullaccess_context_untrusted',
+                    reason,
+                });
+                this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', 'fullaccess_context_untrusted', reason);
+                setImmediate(() => this.steerPolicyReason(sessionKey, 'fullaccess_context_untrusted', reason));
+                return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            }
+            const response = this.toAppServerApprovalResponse(request.method, 'allow', toolInput, false);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'allow', 'approval', undefined, 'trusted fullaccess execution');
+            return response;
+        }
+        // Keep the policy check in the approval path as a fail-closed fallback.
+        // Some app-server tool routes can reach approval without invoking the
+        // command hook; allowing here would bypass the proactive gate.
         const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         if (policyResult?.block) {
             logger.info(`[CodexRunner] app-server approval declined by session policy: session=${sessionKey} ` +
                 `requestId=${request.id ?? '<missing>'} code=${policyResult.policyCode ?? 'session_policy_hook'} ` +
                 `reason=${policyResult.reason ?? 'policy denied'} executed=false`);
-            try {
-                await permissionContext?.recordExecutionAnomaly?.({
-                    code: 'operation_blocked',
-                    severity: 'warning',
-                    phase: 'execution',
-                    occurredAt: Date.now(),
-                    toolName,
-                    ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
-                    policyCode: policyResult.policyCode ?? 'session_policy_hook',
-                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
-                    effect: 'operation_skipped',
-                });
-            }
-            catch (error) {
-                logger.warn(`[CodexRunner] failed to record policy-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+            const policyCode = policyResult.policyCode ?? 'session_policy_hook';
+            const policyReason = policyResult.reason ?? 'session policy denied approval';
+            this.rememberToolDenial(request, params, {
+                decision: 'deny',
+                decisionSource: 'policy',
+                policyCode,
+                reason: policyReason,
+            });
+            // ResponseEngine's wrapped policy hook already steers Codex sessions
+            // that have the pure managed-hook policy installed. Standalone callers
+            // may only provide policyHook, so keep this fallback for them without
+            // duplicating the same user message in production.
+            if (!permissionContext?.preToolUsePolicyHook) {
+                setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, policyReason));
             }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyResult.policyCode ?? 'session_policy_hook', policyResult.reason ?? 'session policy denied approval');
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyCode, policyReason);
             return response;
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
@@ -1722,18 +2443,28 @@ export class CodexRunner {
         if (!workspacePath) {
             logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.rememberToolDenial(request, params, {
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode: 'approval_workspace_unknown',
+                reason: 'thread workspace is unknown',
+            });
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', 'approval_workspace_unknown', 'thread workspace is unknown');
+            setImmediate(() => this.steerPolicyReason(sessionKey, 'approval_workspace_unknown', 'thread workspace is unknown'));
             return response;
         }
         const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
         const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
-        logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${summary}`);
+        const logSummary = formatApprovalLogSummary(summary);
+        logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${logSummary}`);
         const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
             || request.method === 'execCommandApproval';
         const managedEcIntent = isCommandApproval && this.isManagedEvolcoreCommandIntent(toolInput);
-        const approvedCommand = isCommandApproval
-            ? this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionKey))
+        const delegationCarrier = this.delegationCarrierForSession(sessionKey, typeof params.threadId === 'string' ? params.threadId : undefined);
+        const canonicalEcApproval = isCommandApproval
+            ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey), delegationCarrier)
             : undefined;
+        const approvedCommand = canonicalEcApproval?.argv;
         const denyInfrastructure = async (policyCode, message) => {
             logger.warn(`[CodexRunner] ${message}: session=${sessionKey} requestId=${request.id ?? '<missing>'}`);
             try {
@@ -1747,8 +2478,9 @@ export class CodexRunner {
                     policyCode,
                     decisionSource: 'infrastructure',
                     agentAid: permissionContext?.selfAid,
+                    agentName: permissionContext?.agentName,
                     sessionId: sessionKey,
-                    permissionMode: normalizePermissionMode(sessionMode).mode,
+                    permissionMode: normalizeExecutionPermissionMode(sessionMode),
                     summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
                     effect: 'operation_skipped',
                 });
@@ -1757,17 +2489,32 @@ export class CodexRunner {
                 logger.warn(`[CodexRunner] failed to record infrastructure approval denial: session=${sessionKey} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
             }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode, message);
+            this.rememberToolDenial(request, params, {
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode,
+                reason: message,
+            });
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode, message, canonicalEcApproval?.parseFailure);
+            setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, message));
             return response;
         };
         if (managedEcIntent && !approvedCommand) {
-            return await denyInfrastructure('ec_command_not_canonical', 'EC command approval denied because no canonical argv could be derived');
+            if (canonicalEcApproval?.parseFailure?.issue === 'untrusted-shell') {
+                return await denyInfrastructure('ec_shell_untrusted_executable', 'EC command approval denied because the shell executable failed Windows Authenticode trust validation');
+            }
+            return await denyInfrastructure('ec_command_not_canonical', canonicalEcApproval?.parseFailure
+                ? `EC command approval denied because canonical argv parsing failed (${canonicalEcApproval.parseFailure.issue})`
+                : 'EC command approval denied because no canonical argv could be derived');
         }
         try {
-            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
+            const resolution = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id, typeof params.itemId === 'string' ? params.itemId : typeof params.item_id === 'string' ? params.item_id : undefined);
+            const decision = typeof resolution === 'string' ? resolution : resolution.decision;
+            const resolutionMeta = typeof resolution === 'string' ? undefined : resolution;
             if (decision !== 'deny' && managedEcIntent && approvedCommand) {
                 const carrierThreadIds = [
                     this.activeSessions.get(sessionKey),
+                    this.provisionalSessions.get(sessionKey),
                     typeof params.threadId === 'string' ? params.threadId : undefined,
                     typeof params.conversationId === 'string' ? params.conversationId : undefined,
                 ];
@@ -1776,18 +2523,35 @@ export class CodexRunner {
                 // A carrier-bearing thread is managed even if its permission context
                 // was not wired with an arm callback; it must fail closed here rather
                 // than reaching daemon IPC with an unarmed carrier.
+                if ((hasDelegationCarrier || canArmDelegation)
+                    && canonicalEcApproval?.delegationToken
+                    && canonicalEcApproval.delegationToken !== delegationCarrier) {
+                    return await denyInfrastructure('delegation_token_mismatch', 'EC command approval contains a delegation token different from the active thread carrier');
+                }
                 if ((hasDelegationCarrier || canArmDelegation)
                     && !this.armApprovedDelegationCommand(sessionKey, approvedCommand)) {
                     return await denyInfrastructure('delegation_not_armed', 'EC command approval failed to arm delegation');
                 }
             }
             const response = this.toAppServerApprovalResponse(request.method, decision, toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval') : 'approval', decision === 'deny' && (sessionMode === 'auto' || sessionMode === 'readonly')
-                ? 'permission_mode_denied'
-                : undefined, decision === 'deny'
-                ? (reason || (sessionMode === 'auto' || sessionMode === 'readonly'
-                    ? `permission mode ${sessionMode} denied approval`
-                    : 'user approval denied'))
+            const decisionSource = resolutionMeta?.decisionSource
+                ?? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval');
+            const policyCode = resolutionMeta?.policyCode
+                ?? (decisionSource === 'policy' ? 'permission_mode_denied' : undefined);
+            const denialReason = resolutionMeta?.reason || reason || (policyCode
+                ? `permission mode ${sessionMode} denied approval`
+                : 'user approval denied');
+            if (decision === 'deny') {
+                this.rememberToolDenial(request, params, {
+                    decision: 'deny',
+                    decisionSource,
+                    ...(policyCode ? { policyCode } : {}),
+                    reason: denialReason,
+                });
+                setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, denialReason));
+            }
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? decisionSource : 'approval', decision === 'deny' ? policyCode : undefined, decision === 'deny'
+                ? denialReason
                 : 'approval accepted');
             logger.info(`[CodexRunner] app-server approval response id=${request.id} method=${request.method} decision=${decision} response=${JSON.stringify(response)}`);
             return response;
@@ -1798,29 +2562,38 @@ export class CodexRunner {
             throw error;
         }
     }
-    logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode, reason) {
+    logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode, reason, parseFailure) {
         const context = this.permissionContexts.get(sessionKey);
+        const params = (request.params || {});
+        const rawCallId = params.itemId ?? params.item_id ?? params.callId ?? params.call_id;
+        const callId = typeof rawCallId === 'string' && rawCallId ? rawCallId : undefined;
         auditCodexApprovalDecision({
             requestId: request.id !== undefined ? String(request.id) : undefined,
+            callId,
+            correlationId: callId,
             method: request.method,
             sessionId: sessionKey,
             agentAid: context?.selfAid,
+            agentName: context?.agentName,
             toolName,
             decision,
             decisionSource,
             policyCode,
-            permissionMode: normalizePermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode).mode,
+            permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
             role: context?.role,
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
+            parseFailure,
         });
         logger.info(`[CodexRunner] app-server approval audit ${JSON.stringify({
             requestId: request.id !== undefined ? String(request.id) : undefined,
+            ...(callId ? { callId, correlationId: callId } : {}),
             method: request.method,
             sessionId: sessionKey,
             toolName,
             decision,
             decisionSource,
             ...(policyCode ? { policyCode } : {}),
+            ...(parseFailure ? { parseFailure } : {}),
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             executed: false,
         })}`);
@@ -1910,6 +2683,12 @@ export class CodexRunner {
                     ? { requestId: String(requestId) }
                     : {}),
                 policy: context.approvalRouting?.approverPolicy ?? 'requester',
+                policyCode: 'permission_mode_denied',
+                decisionSource: 'policy',
+                agentAid: context.selfAid,
+                agentName: context.agentName,
+                sessionId: sessionKey,
+                permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
                 summary: `${toolName} runtime authorization denied by unattended Trigger policy`,
                 effect: 'operation_skipped',
             });
@@ -1924,6 +2703,27 @@ export class CodexRunner {
         const questions = Array.isArray(params.questions) ? params.questions : [];
         if (questions.length === 0)
             throw new Error('Codex MCP 审批未包含问题，已拒绝');
+        const sessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
+        if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
+            if (!this.isTrustedFullAccessSession(sessionKey))
+                return this.denyUntrackedExternalToolApproval(params);
+            const answers = {};
+            for (const question of questions) {
+                const questionId = typeof question.id === 'string' ? question.id : `q-${Object.keys(answers).length + 1}`;
+                const labels = Array.isArray(question.options)
+                    ? question.options.map((option) => typeof option?.label === 'string' ? option.label.trim() : '').filter(Boolean)
+                    : [];
+                let answer = '';
+                try {
+                    answer = this.selectMcpApprovalAnswer(question, true);
+                }
+                catch {
+                    answer = labels[0] ?? 'allow';
+                }
+                answers[questionId] = { answers: [answer] };
+            }
+            return { answers };
+        }
         const hasExactIdentity = typeof trackedItem.server === 'string'
             && trackedItem.server.length > 0
             && typeof trackedItem.tool === 'string'
@@ -1940,7 +2740,6 @@ export class CodexRunner {
             logger.warn(`[CodexRunner] MCP approval denied because the hardened external-tool config is unbound: thread=${threadId ?? '<missing>'}`);
             return this.denyUntrackedExternalToolApproval(params);
         }
-        const sessionKey = this.findSessionKeyByThread(params.threadId, params.conversationId);
         const server = trackedItem.server;
         const tool = trackedItem.tool;
         const isAppCall = typeof trackedItem.mcpAppResourceUri === 'string'
@@ -1964,7 +2763,7 @@ export class CodexRunner {
         };
         const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         const workspacePath = this.resolvePermissionWorkspacePath(params);
-        const mode = normalizePermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode).mode;
+        const mode = normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode);
         // MCP servers are inherited unless capability config explicitly disables
         // them. Apps retain their separate request/bypass lifecycle policy.
         let allow = !policyResult?.block
@@ -2084,7 +2883,8 @@ export class CodexRunner {
                     chatmode: context.chatmode,
                     replyContext: context.replyContext,
                 });
-                sent = !!await sendInteractionPayload(context.adapter, envelope, interaction, undefined, context.replyContext);
+                const receipt = await sendInteractionPayload(context.adapter, envelope, interaction, undefined, context.replyContext);
+                sent = isInteractionSendAccepted(receipt);
             }
             if (!sent) {
                 await sendPrompt(renderActionAsText(interaction));
@@ -2147,9 +2947,20 @@ export class CodexRunner {
                 if (activeThreadId === candidate)
                     return sessionKey;
             }
+            for (const [sessionKey, provisionalThreadId] of this.provisionalSessions.entries()) {
+                if (provisionalThreadId === candidate)
+                    return sessionKey;
+            }
+            const childSessionKey = this.childThreadSessions.get(candidate);
+            if (childSessionKey)
+                return childSessionKey;
         }
         return candidates[0] || 'codex-app-server';
     }
+    isThreadOwnedBySession(sessionId, threadId) {
+        const activeThread = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
+        return activeThread === threadId || this.childThreadSessions.get(threadId) === sessionId;
+    }
     buildPermissionInput(method, params) {
         if (method === 'item/permissions/requestApproval') {
             return { permissions: params.permissions, cwd: params.cwd, reason: params.reason };
@@ -2211,6 +3022,12 @@ export class CodexRunner {
             const threadProjectPath = this.threadProjectPaths.get(threadId);
             if (threadProjectPath)
                 return threadProjectPath;
+            const parentSession = this.childThreadSessions.get(threadId);
+            const parentThread = parentSession
+                ? this.activeSessions.get(parentSession) ?? this.provisionalSessions.get(parentSession)
+                : undefined;
+            if (parentThread)
+                return this.threadProjectPaths.get(parentThread);
         }
         return undefined;
     }
@@ -2239,7 +3056,7 @@ export class CodexRunner {
             // Revalidate ownership, mode, and parent containment at the final
             // readonly decision. The map entry alone is stale if the directory was
             // replaced between preflight and the approval callback.
-            managedTempDir: this.getManagedTempDir(sessionKey),
+            managedTempDir: permCtx?.managedTempDir ?? this.getManagedTempDir(sessionKey),
             allowReadonlySourceDiagnostics: permCtx?.allowReadonlySourceDiagnostics === true,
         } : undefined;
         if (toolName === 'Bash')
@@ -2341,7 +3158,7 @@ export class CodexRunner {
             return true;
         });
     }
-    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId) {
+    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId, callId) {
         const permissionContext = this.permissionContexts.get(sessionKey);
         const permissionPrompt = permissionContext?.sendPrompt ?? this.sendPromptFn;
         const hasFilesystemPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
@@ -2355,7 +3172,13 @@ export class CodexRunner {
             && this.fileChangeRequiresExpansion(toolInput, workspacePath, sessionKey);
         // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
-        const mode = normalizePermissionMode(rawMode).mode;
+        const mode = normalizeExecutionPermissionMode(rawMode);
+        if (rawMode === 'fullaccess') {
+            if (!this.isTrustedFullAccessSession(sessionKey)) {
+                return 'deny';
+            }
+            return 'allow';
+        }
         const recordBlockedOperation = async (policyCode, operationInput = toolInput, denialReason = 'policy denied', matchedPath) => {
             const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
             auditToolPreflightDenial({
@@ -2365,12 +3188,15 @@ export class CodexRunner {
                 summary,
                 sessionId: sessionKey,
                 agentAid: permissionContext?.selfAid,
+                agentName: permissionContext?.agentName,
                 permissionMode: mode,
                 channel: permissionContext?.channel,
                 actorId: permissionContext?.userId,
                 role: permissionContext?.role,
                 selfAid: permissionContext?.selfAid,
                 requestId: typeof requestId === 'string' || typeof requestId === 'number' ? String(requestId) : undefined,
+                callId,
+                correlationId: callId,
                 taskId: permissionContext?.taskId,
                 matchedPath,
             });
@@ -2385,6 +3211,7 @@ export class CodexRunner {
                     policyCode,
                     decisionSource: 'policy',
                     agentAid: permissionContext?.selfAid,
+                    agentName: permissionContext?.agentName,
                     permissionMode: mode,
                     summary,
                     effect: 'operation_skipped',
@@ -2399,7 +3226,8 @@ export class CodexRunner {
             // An unavailable registered root must fail closed; the policy helper
             // distinguishes this explicit empty value from runners without a
             // session-temp capability.
-            managedTempDir: this.getManagedTempDir(sessionKey) ?? '',
+            managedTempDir: permissionContext?.managedTempDir ?? this.getManagedTempDir(sessionKey) ?? '',
+            delegationCarrier: this.delegationCarrierForSession(sessionKey),
             allowProtectedMetadata: false,
             selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
@@ -2416,7 +3244,12 @@ export class CodexRunner {
             if (preflight.policyCode) {
                 await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied', preflight.matchedPath);
             }
-            return 'deny';
+            return {
+                decision: 'deny',
+                decisionSource: 'policy',
+                policyCode: preflight.policyCode ?? 'tool_preflight_denied',
+                reason: preflight.message ?? 'tool preflight denied',
+            };
         }
         if (preflight.behavior === 'allow')
             return 'allow';
@@ -2686,7 +3519,8 @@ export class CodexRunner {
         const input = [{ type: 'text', text: prompt, text_elements: [] }];
         if (!images?.length)
             return input;
-        const tmpDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR
+        const tmpDir = getManagedTaskTempDir(runtimeEnv)
+            ?? runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR
             ?? (sessionId ? this.getManagedTempDir(sessionId) : undefined)
             ?? process.env.TMPDIR;
         if (!tmpDir || !path.isAbsolute(tmpDir))
@@ -2729,19 +3563,142 @@ export class CodexRunner {
         }
         return !state.turnId || !turnId || turnId === state.turnId;
     }
-    async *transformAppServerStream(notifications, sessionId, state, unsubscribe, tempFiles) {
+    isSubagentActivityItem(item) {
+        return typeof item?.type === 'string' && item.type.toLowerCase() === 'subagentactivity';
+    }
+    subagentThreadId(item) {
+        const value = item?.agentThreadId ?? item?.agent_thread_id;
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    subagentPath(item) {
+        const value = item?.agentPath ?? item?.agent_path;
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    subagentType(item) {
+        const value = item?.agentType ?? item?.agent_type;
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    registerChildThread(sessionId, childThreadId, projectPath) {
+        const parentThreadId = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
+        if (childThreadId === parentThreadId)
+            return;
+        this.childThreadSessions.set(childThreadId, sessionId);
+        this.threadProjectPaths.set(childThreadId, path.resolve(projectPath));
+        // Child approvals use the parent's capability boundary and delegation
+        // carrier. This is inheritance, not a second permission decision.
+        const parentBoundary = parentThreadId ? this.threadExternalToolBoundaries.get(parentThreadId) : undefined;
+        const parentFingerprint = parentThreadId ? this.threadExternalToolFingerprints.get(parentThreadId) : undefined;
+        if (parentBoundary)
+            this.threadExternalToolBoundaries.set(childThreadId, parentBoundary);
+        if (parentFingerprint)
+            this.threadExternalToolFingerprints.set(childThreadId, parentFingerprint);
+        const parentCarrier = parentThreadId ? this.threadDelegationCarriers.get(parentThreadId) : undefined;
+        if (parentCarrier)
+            this.threadDelegationCarriers.set(childThreadId, parentCarrier);
+    }
+    unregisterChildThread(childThreadId) {
+        this.childThreadSessions.delete(childThreadId);
+        this.activeSubagentTurns.delete(childThreadId);
+        this.threadProjectPaths.delete(childThreadId);
+        this.threadExternalToolBoundaries.delete(childThreadId);
+        this.threadExternalToolFingerprints.delete(childThreadId);
+        this.threadDelegationCarriers.delete(childThreadId);
+        this.clearTrackedApprovalItemsForThread(childThreadId);
+    }
+    cleanupChildThreadsForSession(sessionId) {
+        for (const [childThreadId, ownerSessionId] of this.childThreadSessions) {
+            if (ownerSessionId === sessionId)
+                this.unregisterChildThread(childThreadId);
+        }
+    }
+    trackSubagentLifecycle(notification, state) {
+        const params = (notification.params || {});
+        const item = params.item && typeof params.item === 'object' ? params.item : undefined;
+        if (!this.isSubagentActivityItem(item))
+            return;
+        const childThreadId = this.subagentThreadId(item);
+        if (!childThreadId)
+            return;
+        const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+        if (kind === 'started') {
+            state.activeSubagentThreads.add(childThreadId);
+            this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+        }
+        if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+            state.activeSubagentThreads.delete(childThreadId);
+            this.unregisterChildThread(childThreadId);
+        }
+    }
+    primeSubagentStateFromTurn(turn, state) {
+        for (const item of this.getTurnItems(turn)) {
+            if (!this.isSubagentActivityItem(item))
+                continue;
+            const childThreadId = this.subagentThreadId(item);
+            const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+            if (!childThreadId)
+                continue;
+            if (kind === 'started') {
+                state.activeSubagentThreads.add(childThreadId);
+                this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+            }
+            else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+                state.activeSubagentThreads.delete(childThreadId);
+                this.unregisterChildThread(childThreadId);
+            }
+        }
+    }
+    endAppServerQueueWhenSubagentsDone(queue, state) {
+        if (!state.turnCompleted)
+            return;
+        if (state.activeSubagentThreads.size > 0) {
+            logger.info(`[CodexRunner] parent turn completed; waiting for subagent thread(s): `
+                + `${[...state.activeSubagentThreads].join(',')}`);
+            return;
+        }
+        queue.end();
+    }
+    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, tempFiles) {
         try {
-            yield { type: 'session_id', sessionId: state.threadId };
+            let sessionIdEmitted = state.committed;
+            if (sessionIdEmitted)
+                yield { type: 'session_id', sessionId: state.threadId };
             for await (const notification of notifications) {
                 if (!this.activeAbortControllers.has(sessionId))
                     break;
+                if (!state.committed && notification.method === 'turn/completed') {
+                    const turn = notification.params?.turn ?? {};
+                    if (turn.status === 'completed') {
+                        const committed = await state.commitProvisional?.();
+                        if (!committed) {
+                            const staleError = new Error('Codex provisional thread was superseded before commit');
+                            staleError.code = 'RUNNER_START_SUPERSEDED';
+                            throw staleError;
+                        }
+                        state.committed = true;
+                        if (!sessionIdEmitted) {
+                            sessionIdEmitted = true;
+                            yield { type: 'session_id', sessionId: state.threadId };
+                        }
+                    }
+                }
                 yield* this.mapAppServerNotification(notification, sessionId, state);
             }
         }
         finally {
             unsubscribe();
-            this.activeAbortControllers.delete(sessionId);
-            this.activeTurns.delete(sessionId);
+            if (this.activeAbortControllers.get(sessionId) === controller) {
+                this.activeAbortControllers.delete(sessionId);
+            }
+            const activeTurn = this.activeTurns.get(sessionId);
+            if (activeTurn?.threadId === state.threadId
+                && (!state.turnId || activeTurn.turnId === state.turnId)) {
+                this.activeTurns.delete(sessionId);
+            }
+            if (!state.committed)
+                this.cleanupProvisionalThread(sessionId, state.threadId);
+            for (const childThreadId of state.activeSubagentThreads)
+                this.unregisterChildThread(childThreadId);
+            state.activeSubagentThreads.clear();
             this.cleanupTempFiles(tempFiles);
         }
     }
@@ -2809,12 +3766,16 @@ export class CodexRunner {
             }
             case 'turn/completed': {
                 const turn = params.turn || {};
-                const turnId = turn.id || params.turnId;
+                const turnId = turn.id || params.turnId || state.turnId;
                 if (turnId && state.completedTurnIds.has(turnId))
                     break;
                 if (turnId)
                     state.completedTurnIds.add(turnId);
-                this.activeTurns.delete(sessionId);
+                const activeTurn = this.activeTurns.get(sessionId);
+                if (activeTurn?.threadId === state.threadId && activeTurn.turnId === turnId) {
+                    this.activeTurns.delete(sessionId);
+                }
+                this.clearPendingToolDenialsForTurn(state.threadId, turnId);
                 yield* this.reconcileOpenAppServerToolCalls(state, turnId);
                 if (turn.status === 'failed' && turn.error?.message) {
                     if (isRetryableError(new Error(turn.error.message))) {
@@ -2935,11 +3896,36 @@ export class CodexRunner {
                 };
                 break;
             case 'subAgentActivity':
-                yield {
-                    type: 'task_progress',
-                    summary: `Subagent ${item.kind}: ${item.agentPath || item.agentThreadId}`,
-                };
+            case 'SubAgentActivity': {
+                const childThreadId = this.subagentThreadId(item);
+                if (!childThreadId)
+                    break;
+                const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+                const description = this.subagentPath(item) ?? childThreadId;
+                if (kind === 'started') {
+                    yield {
+                        type: 'task_started',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        subagentType: this.subagentType(item),
+                    };
+                }
+                else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+                    yield {
+                        type: 'task_notification',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        status: kind === 'completed' ? 'completed' : kind,
+                        summary: description,
+                    };
+                }
+                else {
+                    yield { type: 'task_progress', taskId: childThreadId, taskKind: 'agent', description, summary: `Subagent ${item.kind}: ${description}` };
+                }
                 break;
+            }
             case 'enteredReviewMode':
                 yield { type: 'task_progress', summary: item.review || 'Review mode entered' };
                 break;
@@ -2954,6 +3940,59 @@ export class CodexRunner {
     *mapAppServerItemCompleted(item, state) {
         if (!item)
             return;
+        const denial = this.takeToolDenial(state, item.id);
+        const denialFields = denial
+            ? {
+                isError: true,
+                error: denial.reason,
+                errorCode: errorCodeForToolDenial(denial.decisionSource, denial.policyCode),
+                decision: 'deny',
+                decisionSource: denial.decisionSource,
+                policyCode: denial.policyCode,
+                reason: denial.reason,
+                requestId: denial.requestId,
+                executed: false,
+                executionState: 'blocked',
+            }
+            : undefined;
+        const itemErrorText = outputTextForManagedHook(typeof item.error === 'string' ? item.error : item.error?.message);
+        const hookErrorText = /(?:Command|Tool call) blocked by PreToolUse hook\s*:/i.test(itemErrorText)
+            ? itemErrorText
+            : undefined;
+        const managedHookDenial = (item.status === 'failed' || item.status === 'declined' || hookErrorText)
+            ? parseManagedPreToolUseDenial([
+                item.aggregatedOutput,
+                item.output,
+                item.result,
+                hookErrorText,
+            ].filter(value => value !== undefined && value !== null).map(outputTextForManagedHook).join('\n'))
+            : undefined;
+        const managedHookFields = !denial && managedHookDenial
+            ? {
+                isError: true,
+                error: managedHookDenial.reason,
+                errorCode: 'POLICY_DENIED',
+                decision: 'deny',
+                decisionSource: 'policy',
+                policyCode: managedHookDenial.policyCode,
+                reason: managedHookDenial.reason,
+                executed: false,
+                executionState: 'blocked',
+            }
+            : undefined;
+        const genericDeclineFields = !denial && !managedHookFields && item.status === 'declined'
+            ? {
+                isError: true,
+                error: 'Approval declined',
+                errorCode: 'USER_DENIED',
+                decision: 'deny',
+                decisionSource: 'approval',
+                reason: 'Approval declined',
+                executed: false,
+                executionState: 'blocked',
+            }
+            : undefined;
+        const blockedFields = denialFields ?? managedHookFields ?? genericDeclineFields;
         switch (item.type) {
             case 'agentMessage':
                 {
@@ -2970,8 +4009,10 @@ export class CodexRunner {
                     type: 'tool_result',
                     name: 'Shell',
                     result: item.aggregatedOutput ?? '',
-                    isError: item.exitCode !== null && item.exitCode !== undefined ? item.exitCode !== 0 : item.status === 'failed',
-                    ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
+                    ...(blockedFields ?? {
+                        isError: item.exitCode !== null && item.exitCode !== undefined ? item.exitCode !== 0 : item.status === 'failed' || item.status === 'declined',
+                        ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
+                    }),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
                 };
@@ -2981,8 +4022,8 @@ export class CodexRunner {
                     type: 'tool_result',
                     name: `MCP:${item.server}/${item.tool}`,
                     result: item.result,
-                    isError: item.status === 'failed',
-                    error: item.error?.message,
+                    ...(blockedFields ?? { isError: item.status === 'failed' }),
+                    ...(blockedFields ? {} : { error: item.error?.message }),
                     ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
@@ -2993,7 +4034,7 @@ export class CodexRunner {
                     type: 'tool_result',
                     name: item.namespace ? `${item.namespace}:${item.tool}` : item.tool,
                     result: item.contentItems,
-                    isError: item.success === false || item.status === 'failed',
+                    ...(blockedFields ?? { isError: item.success === false || item.status === 'failed' }),
                     ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
@@ -3008,12 +4049,12 @@ export class CodexRunner {
                             yield editEvent;
                         }
                     }
-                    yield { type: 'tool_result', name: 'Edit', result: item.changes, isError: item.status === 'failed', callId: item.id };
+                    yield { type: 'tool_result', name: 'Edit', result: item.changes, ...(blockedFields ?? { isError: item.status === 'failed' }), callId: item.id };
                 }
                 else {
                     const desc = this.normalizeFileChanges(item.changes).map((change) => this.describeFileChange(change)).join(', ');
                     yield { type: 'tool_use', name: 'FileChange', input: { description: desc }, callId: item.id };
-                    yield { type: 'tool_result', name: 'FileChange', result: item.changes, isError: item.status === 'failed', callId: item.id };
+                    yield { type: 'tool_result', name: 'FileChange', result: item.changes, ...(blockedFields ?? { isError: item.status === 'failed' }), callId: item.id };
                 }
                 break;
             case 'webSearch':
@@ -3067,6 +4108,34 @@ export class CodexRunner {
                     callId: item.id,
                 };
                 break;
+            case 'subAgentActivity':
+            case 'SubAgentActivity': {
+                const childThreadId = this.subagentThreadId(item);
+                if (!childThreadId)
+                    break;
+                const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+                const description = this.subagentPath(item) ?? childThreadId;
+                if (kind === 'started') {
+                    yield {
+                        type: 'task_started',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        subagentType: this.subagentType(item),
+                    };
+                }
+                else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+                    yield {
+                        type: 'task_notification',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        status: kind === 'completed' ? 'completed' : kind,
+                        summary: description,
+                    };
+                }
+                break;
+            }
         }
     }
     *mapAppServerFileChangePatchUpdated(params, state) {
@@ -3314,16 +4383,21 @@ export class CodexRunner {
         for (const [key, controller] of this.activeAbortControllers) {
             controller.abort('dispose');
         }
+        await Promise.all([...this.activeSubagentTurns.entries()].map(([threadId, active]) => this.interruptAppServerTurn(threadId, active.turnId).catch(() => { })));
         this.activeAbortControllers.clear();
         this.activeStreams.clear();
         this.activeSessions.clear();
+        this.provisionalSessions.clear();
         this.activeTurns.clear();
+        this.activeSubagentTurns.clear();
+        this.childThreadSessions.clear();
         this.threadProjectPaths.clear();
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
         this.trackedApprovalItems.clear();
         this.threadDelegationCarriers.clear();
         this.pendingInterrupts.clear();
+        this.steeringTails.clear();
         this.permissionContexts.clear();
         this.chatModes.clear();
         this.pruneThreadOperationLocks();
@@ -3362,11 +4436,9 @@ export class CodexAgentPlugin {
             agents: {
                 codex: {
                     ...(override || {}),
-                    evolcoreAgentAid: agent.config.aid,
-                    evolcoreAgentConfig: agent.config,
                 },
             },
         };
-        return { evolagentName: agent.name, baseagent: 'codex', agent: new CodexRunner(merged, callbacks) };
+        return { evolagentName: agent.name, baseagent: 'codex', agent: new CodexRunner(merged, callbacks, { agentAid: agent.config.aid, agentConfig: agent.config }) };
     }
 }