evolcore 0.0.21 → 0.0.22

package/dist/agents/codex-runner.js

@@ -21,7 +21,7 @@ import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, parseCodexToolCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, hasPowerShellDelegationAssignment, normalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
 import { ensureProcessManagedTempDir, getManagedTaskTempDir } from '../cli/task-context.js';
@@ -83,6 +83,17 @@ class AsyncEventQueue {
         }
     }
 }
+function errorCodeForToolDenial(decisionSource, policyCode) {
+    if (decisionSource === 'policy')
+        return 'POLICY_DENIED';
+    if (decisionSource === 'approval')
+        return 'USER_DENIED';
+    if (policyCode && /delegation|carrier/i.test(policyCode))
+        return 'DELEGATION_FAILED';
+    if (policyCode && /argument|canonical|quote|shell/i.test(policyCode))
+        return 'INVALID_ARGUMENT';
+    return 'EXECUTION_FAILED';
+}
 const managedTempDirsForExitCleanup = new Map();
 let managedTempExitCleanupRegistered = false;
 function isTrustedManagedTempDirectory(directory, parent) {
@@ -150,6 +161,63 @@ function stableSecurityValue(value) {
 function externalToolConfigFingerprint(config) {
     return createHash('sha256').update(stableSecurityValue(config)).digest('hex');
 }
+/**
+ * Codex can surface a managed hook rejection as item output instead of an
+ * app-server approval request. Preserve the policy boundary in that path too
+ * so downstream audit/event consumers never infer a successful execution.
+ */
+function parseManagedPreToolUseDenial(value) {
+    let text;
+    if (typeof value === 'string')
+        text = value;
+    else if (value == null)
+        return undefined;
+    else {
+        try {
+            text = JSON.stringify(value) ?? '';
+        }
+        catch {
+            text = String(value);
+        }
+    }
+    const marker = /(?:Command|Tool call) blocked by PreToolUse hook\s*:\s*/i.exec(text);
+    if (!marker)
+        return undefined;
+    let reason = text.slice((marker.index ?? 0) + marker[0].length)
+        .replace(/\s*\.\s*(?:Command|Tool):[\s\S]*$/i, '')
+        .replace(/(?:^|\s)(?:Command|Tool):[\s\S]*$/i, '')
+        .trim();
+    if (!reason)
+        reason = 'EvolCore PreToolUse policy denied this tool call';
+    const policyCode = /工具调用已达到\s*\d+\s*次/.test(reason)
+        ? 'proactive_tool_report_required'
+        : /请先用\s+ec\s+(?:group\s+send|msg\s+send)/.test(reason)
+            ? 'proactive_first_send_required'
+            : 'managed_pre_tool_use_denied';
+    return { policyCode, reason };
+}
+function outputTextForManagedHook(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value == null)
+        return '';
+    if (Array.isArray(value))
+        return value.map(outputTextForManagedHook).filter(Boolean).join('\n');
+    if (typeof value === 'object') {
+        const record = value;
+        if (typeof record.text === 'string')
+            return record.text;
+        if (typeof record.message === 'string')
+            return record.message;
+        try {
+            return JSON.stringify(value) ?? '';
+        }
+        catch {
+            return String(value);
+        }
+    }
+    return String(value);
+}
 const CODEX_CATALOG_FALLBACK = [
     { slug: 'gpt-5.5', efforts: ['low', 'medium', 'high', 'xhigh'] },
     { slug: 'gpt-5.4', efforts: ['low', 'medium', 'high', 'xhigh'] },
@@ -158,6 +226,11 @@ const CODEX_CATALOG_FALLBACK = [
     { slug: 'gpt-5.2', efforts: ['low', 'medium', 'high', 'xhigh'] },
 ];
 const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
+const CODEX_NO_ROLLOUT_RE = /no rollout found for thread id/i;
+function isCodexNoRolloutError(error) {
+    return error?.code === 'CODEX_ROLLOUT_NOT_FOUND'
+        || CODEX_NO_ROLLOUT_RE.test(error instanceof Error ? error.message : String(error));
+}
 let codexCatalogCache = null;
 // The permission bridge is version-locked to the audited approval schema and
 // managed PreToolUse hook behavior used by proactive first-tool enforcement.
@@ -256,15 +329,22 @@ export class CodexRunner {
     activeAbortControllers = new Map();
     activeStreams = new Map();
     activeSessions = new Map(); // sessionId → threadId
+    /** Threads created/resumed for a turn but not yet durably admitted by turn/start. */
+    provisionalSessions = new Map();
     activeTurns = new Map();
+    activeSubagentTurns = new Map();
     threadProjectPaths = new Map();
+    /** Child Codex threads inherit the EvolCore session that started them. */
+    childThreadSessions = new Map();
     sessionTempDirs = new Map();
     managedTempNonce = randomBytes(16).toString('hex');
     threadExternalToolFingerprints = new Map();
     threadExternalToolBoundaries = new Map();
     trackedApprovalItems = new Map();
+    pendingToolDenials = new Map();
     threadDelegationCarriers = new Map();
     pendingInterrupts = new Map();
+    steeringTails = new Map();
     threadOperationLocks = new Map();
     activeOperationReleases = new Map();
     appServerClient = null;
@@ -330,21 +410,27 @@ export class CodexRunner {
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommand(command, managedTempDir, dialect = 'posix') {
+    approvedLiteralEvolcoreCommand(command, managedTempDir, dialect = 'posix', expectedDelegationToken, executable) {
         const parseOptions = {
             allowManagedTmpDir: true,
             dialect,
+            verifyShellExecutable: process.platform === 'win32',
             ...(managedTempDir ? { managedTempDir } : {}),
+            ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
         };
         const classification = classifyEvolcoreShellCommand(command, parseOptions);
         if (classification.kind === 'bounded-output')
             return { argv: classification.command.argv };
         // Keep the approval/delegation parser aligned with the preflight parser:
         // the session-managed `$TMPDIR` token is a permitted EC path reference.
-        const parsed = parseLiteralShellCommand(command, parseOptions);
+        const parsed = executable
+            ? parseCodexCarrierCommand({ command, dialect, executable }, parseOptions)
+            : dialect === 'powershell'
+                ? parseCodexCarrierCommand({ command, dialect }, parseOptions)
+                : parseLiteralShellCommand(command, parseOptions);
         if (!parsed.ok)
             return { parseFailure: parsed };
-        if (parsed.argv[0] !== 'ec')
+        if (normalizeEvolcoreCommandArgv(parsed.argv)[0] !== 'ec')
             return {};
         if (containsLiteralManagedTmpDirOutsideSendContent(parsed.argv)) {
             return { parseFailure: {
@@ -355,14 +441,17 @@ export class CodexRunner {
                     inputLength: command.length,
                 } };
         }
-        return { argv: parsed.argv };
+        return {
+            argv: normalizeEvolcoreCommandArgv(parsed.argv),
+            ...(parsed.delegationToken ? { delegationToken: parsed.delegationToken } : {}),
+        };
     }
-    resolveCanonicalEcApproval(toolInput, managedTempDir) {
+    resolveCanonicalEcApproval(toolInput, managedTempDir, expectedDelegationToken) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
             : undefined;
-        if (explicitArgv?.[0] === 'ec') {
+        if (explicitArgv && normalizeEvolcoreCommandArgv(explicitArgv)[0] === 'ec') {
             if (explicitArgv.some(value => value.includes('\0'))) {
                 return { parseFailure: {
                         issue: 'invalid-control-char', offset: 0,
@@ -372,16 +461,19 @@ export class CodexRunner {
             }
             return containsLiteralManagedTmpDirOutsideSendContent(explicitArgv)
                 ? { parseFailure: { issue: 'unsafe-expansion', offset: 0, tokenIndex: 0, dialect: 'posix', inputLength: 0 } }
-                : { argv: explicitArgv };
+                : { argv: normalizeEvolcoreCommandArgv(explicitArgv) };
         }
         const explicitCarrier = explicitArgv
             ? resolveCodexShellCarrierArgv(explicitArgv)
             : undefined;
         if (explicitCarrier !== undefined) {
-            return this.approvedLiteralEvolcoreCommand(explicitCarrier.command, managedTempDir, explicitCarrier.dialect);
+            return this.approvedLiteralEvolcoreCommand(explicitCarrier.command, managedTempDir, explicitCarrier.dialect, expectedDelegationToken, explicitCarrier.executable);
         }
         if (hasCodexCmdCarrierEcIntent(toolInput)) {
-            const parsed = parseCodexToolCommand(toolInput);
+            const parsed = parseCodexToolCommand(toolInput, {
+                verifyShellExecutable: process.platform === 'win32',
+                ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
+            });
             if (!parsed.ok)
                 return { parseFailure: parsed };
             if (parsed.argv[0] === 'ec') {
@@ -390,7 +482,10 @@ export class CodexRunner {
                             issue: 'unsafe-expansion', offset: 0, tokenIndex: 0,
                             dialect: 'cmd', inputLength: 0,
                         } }
-                    : { argv: parsed.argv };
+                    : {
+                        argv: normalizeEvolcoreCommandArgv(parsed.argv),
+                        ...(parsed.delegationToken ? { delegationToken: parsed.delegationToken } : {}),
+                    };
             }
             const command = typeof toolInput.command === 'string' ? toolInput.command : '';
             const classification = classifyEvolcoreShellCommand(command, { dialect: 'cmd' });
@@ -407,7 +502,9 @@ export class CodexRunner {
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         const canonicalCommand = parseCodexShellCommandArgv(command, {
             allowManagedTmpDir: true,
+            verifyShellExecutable: process.platform === 'win32',
             ...(managedTempDir ? { managedTempDir } : {}),
+            ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
         });
         if (canonicalCommand?.[0] === 'ec') {
             return containsLiteralManagedTmpDirOutsideSendContent(canonicalCommand)
@@ -436,11 +533,14 @@ export class CodexRunner {
     isManagedEvolcoreCommandIntent(toolInput) {
         if (Array.isArray(toolInput.commandArgv)) {
             const rawArgv = toolInput.commandArgv;
-            if (rawArgv[0] === 'ec')
-                return true;
             if (!rawArgv.every(value => typeof value === 'string'))
                 return false;
+            if (normalizeEvolcoreCommandArgv(rawArgv)[0] === 'ec')
+                return true;
             const shellCarrier = resolveCodexShellCarrierArgv(rawArgv);
+            if (shellCarrier?.dialect === 'powershell'
+                && hasPowerShellDelegationAssignment(shellCarrier.command))
+                return true;
             return hasCodexCmdCarrierEcIntent(toolInput)
                 || shellCarrier !== undefined
                     && classifyEvolcoreShellCommand(shellCarrier.command, {
@@ -451,7 +551,7 @@ export class CodexRunner {
         return classifyEvolcoreShellCommand(command).kind !== 'none';
     }
     armApprovedDelegationCommand(sessionId, argv) {
-        const threadId = this.activeSessions.get(sessionId);
+        const threadId = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
         const carrierToken = threadId ? this.threadDelegationCarriers.get(threadId) : undefined;
         const commandHash = hashDelegatedCommandArgv(argv);
         const arm = this.permissionContexts.get(sessionId)?.armApprovedDelegationCommand;
@@ -465,6 +565,21 @@ export class CodexRunner {
             return false;
         }
     }
+    delegationCarrierForSession(sessionId, threadId) {
+        const candidates = [
+            threadId,
+            this.activeSessions.get(sessionId),
+            this.provisionalSessions.get(sessionId),
+        ];
+        for (const candidate of candidates) {
+            if (!candidate)
+                continue;
+            const carrier = this.threadDelegationCarriers.get(candidate);
+            if (carrier)
+                return carrier;
+        }
+        return undefined;
+    }
     async readThreadDelegationCarrier(appServer, threadId) {
         try {
             const result = await appServer.threadShellCommand(threadId, `node -e "process.stdout.write(process.env.${AGENT_DELEGATION_TOKEN_ENV}||String())"`);
@@ -497,6 +612,49 @@ export class CodexRunner {
             return undefined;
         }
     }
+    async commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn) {
+        if (this.provisionalSessions.get(sessionId) !== threadId)
+            return false;
+        const bindingResult = this.onSessionIdUpdate
+            ? ((turn === undefined
+                ? await this.onSessionIdUpdate(sessionId, threadId)
+                : await this.onSessionIdUpdate(sessionId, threadId, { turn }))
+                ?? 'legacy_updated')
+            : 'legacy_updated';
+        const bindingAccepted = bindingResult === 'activated'
+            || bindingResult === 'already_active'
+            || bindingResult === 'legacy_updated';
+        if (!bindingAccepted) {
+            const error = new Error(`backend discovery rejected: ${bindingResult}`);
+            error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+            throw error;
+        }
+        this.provisionalSessions.delete(sessionId);
+        this.activeSessions.set(sessionId, threadId);
+        if (carrierToPublish) {
+            this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+            await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
+        }
+        this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
+        return true;
+    }
+    cleanupProvisionalThread(sessionId, threadId) {
+        if (this.provisionalSessions.get(sessionId) !== threadId)
+            return;
+        this.provisionalSessions.delete(sessionId);
+        this.threadProjectPaths.delete(threadId);
+        this.threadDelegationCarriers.delete(threadId);
+        this.unbindExternalToolBoundary(threadId);
+        this.clearTrackedApprovalItemsForThread(threadId);
+        // A stale provisional start can finish after a replacement run has
+        // already activated another parent thread for this session. Do not tear
+        // down the replacement run's child mappings in that race.
+        const activeParentThread = this.activeSessions.get(sessionId);
+        if (!activeParentThread || activeParentThread === threadId) {
+            this.cleanupChildThreadsForSession(sessionId);
+        }
+        this.pruneThreadOperationLocks();
+    }
     async persistDelegationCarrier(sessionManager, sessionId, threadId, carrier) {
         if (typeof sessionManager?.getSessionById !== 'function')
             return;
@@ -527,7 +685,15 @@ export class CodexRunner {
         this.appServerClient = null;
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
+        for (const childThreadId of this.childThreadSessions.keys())
+            this.threadProjectPaths.delete(childThreadId);
+        // Child turn ids belong to the discarded app-server connection. Keeping
+        // them would make a later session interrupt attempt target stale threads
+        // through the replacement client.
+        this.activeSubagentTurns.clear();
+        this.childThreadSessions.clear();
         this.trackedApprovalItems.clear();
+        this.pendingToolDenials.clear();
         this.threadDelegationCarriers.clear();
         client?.close().catch(error => {
             logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
@@ -900,9 +1066,9 @@ export class CodexRunner {
                         } : {}),
                         ...(mode !== 'readonly' && managedTempDir ? {
                             [managedTempDir]: 'write',
-                            [path.join(managedTempDir, '**')]: 'write',
+                            [managedTempDir + '/**']: 'write',
                             [path.join(path.dirname(managedTempDir), 'evolcore-locks')]: 'write',
-                            [path.join(path.dirname(managedTempDir), 'evolcore-locks', '**')]: 'write',
+                            [path.join(path.dirname(managedTempDir), 'evolcore-locks') + '/**']: 'write',
                         } : {}),
                     },
                     network,
@@ -949,55 +1115,145 @@ export class CodexRunner {
     }
     setSendPrompt(fn) { this.sendPromptFn = fn; }
     setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    injectUserMessage(sessionId, text) {
+        // Bind queued reminders to the turn that generated them. A completed
+        // turn may be replaced before the serialized steer reaches app-server;
+        // injecting the old reminder into the new turn would corrupt its context.
+        const requestedTurn = this.activeTurns.get(sessionId);
+        if (!requestedTurn) {
+            logger.warn(`[CodexRunner] turn steer skipped because no active turn is registered: session=${sessionId}`);
+            return;
+        }
+        const previous = this.steeringTails.get(sessionId) ?? Promise.resolve();
+        let current;
+        current = previous.catch(() => undefined).then(async () => {
+            const activeTurn = this.activeTurns.get(sessionId);
+            const sameTurn = !!activeTurn
+                && activeTurn.threadId === requestedTurn.threadId
+                && activeTurn.turnId === requestedTurn.turnId;
+            if (!sameTurn) {
+                logger.warn(`[CodexRunner] turn steer skipped because the originating turn is no longer active: `
+                    + `session=${sessionId} thread=${requestedTurn.threadId} turn=${requestedTurn.turnId}`);
+                return;
+            }
+            const input = [{ type: 'text', text, text_elements: [] }];
+            const client = this.getAppServerClient();
+            if (typeof client.turnSteer !== 'function') {
+                logger.warn(`[CodexRunner] turn steer unavailable in app-server client: session=${sessionId}`);
+                return;
+            }
+            try {
+                const response = await client.turnSteer(activeTurn.threadId, activeTurn.turnId, input);
+                logger.info(`[CodexRunner] turn steer delivered: session=${sessionId} thread=${activeTurn.threadId} ` +
+                    `turn=${response.turnId} chars=${text.length}`);
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] turn steer failed: session=${sessionId} thread=${activeTurn.threadId} ` +
+                    `turn=${activeTurn.turnId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        }).finally(() => {
+            if (this.steeringTails.get(sessionId) === current)
+                this.steeringTails.delete(sessionId);
+        });
+        this.steeringTails.set(sessionId, current);
+    }
     async assertProactiveHookAvailability(sessionId, appServer) {
         if (this.permissionContexts.get(sessionId)?.chatmode !== 'proactive')
             return;
-        if (process.platform === 'win32') {
-            await appServer.assertManagedHooksAvailable();
-            return;
-        }
-        if (process.platform !== 'linux') {
+        if (process.platform !== 'linux' && process.platform !== 'win32') {
             throw new Error('Codex proactive managed PreToolUse enforcement requires Linux or an installed Windows managed hook');
         }
+        await appServer.assertManagedHooksAvailable();
     }
-    async evaluatePreToolUse(threadId, toolName, toolInput, signal) {
+    async evaluatePreToolUse(threadId, toolName, toolInput, signal, callId) {
         const sessionKey = this.findSessionKeyByThread(threadId);
-        const activeThread = this.activeSessions.get(sessionKey);
+        const activeThread = this.activeSessions.get(sessionKey) ?? this.provisionalSessions.get(sessionKey);
         const context = this.permissionContexts.get(sessionKey);
-        if (!activeThread || activeThread !== threadId) {
+        const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
+            ? toolInput
+            : {};
+        const recordPreToolUseDenial = async (policyCode, reason) => {
+            const summary = summarizeToolInputForAudit(toolName, normalizedInput).slice(0, 512);
+            auditToolPreflightDenial({
+                toolName,
+                policyCode,
+                reason,
+                summary,
+                sessionId: sessionKey,
+                agentAid: context?.selfAid,
+                agentName: context?.agentName,
+                permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+                channel: context?.channel,
+                actorId: context?.userId,
+                role: context?.role,
+                selfAid: context?.selfAid,
+                callId,
+                correlationId: callId,
+                taskId: context?.taskId,
+            });
+            try {
+                await context?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    policyCode,
+                    decisionSource: 'policy',
+                    agentAid: context?.selfAid,
+                    agentName: context?.agentName,
+                    sessionId: sessionKey,
+                    permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+                    summary,
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record managed-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
+        if (!activeThread || !this.isThreadOwnedBySession(sessionKey, threadId)) {
             return { ok: true, applicable: false };
         }
         const proactiveSession = context?.chatmode === 'proactive';
         if (!context || (proactiveSession && !context.preToolUsePolicyHook)) {
-            return { ok: false, applicable: true, decision: 'deny', reason: 'EvolCore proactive session policy context is unavailable' };
+            const reason = 'EvolCore proactive session policy context is unavailable';
+            await recordPreToolUseDenial('pre_tool_use_context_unavailable', reason);
+            return { ok: false, applicable: true, decision: 'deny', reason };
         }
         if (context.pauseController) {
             const pauseResult = await context.pauseController.waitAtToolBoundary(signal);
             if (pauseResult === 'cancelled') {
-                return { ok: true, applicable: true, decision: 'deny', reason: '工具调用已取消' };
+                const reason = '工具调用已取消';
+                await recordPreToolUseDenial('tool_call_cancelled', reason);
+                return { ok: true, applicable: true, decision: 'deny', reason };
             }
         }
         if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
-            return this.isTrustedFullAccessSession(sessionKey)
-                ? { ok: true, applicable: true, decision: 'allow' }
-                : { ok: false, applicable: true, decision: 'deny', reason: 'Untrusted fullaccess execution context' };
+            if (this.isTrustedFullAccessSession(sessionKey))
+                return { ok: true, applicable: true, decision: 'allow' };
+            const reason = 'Untrusted fullaccess execution context';
+            await recordPreToolUseDenial('fullaccess_context_untrusted', reason);
+            return { ok: false, applicable: true, decision: 'deny', reason };
         }
         // A tracked interactive thread still needs an authenticated, explicit
         // allow so the managed hook can fail closed when no runner matches.
         if (!context.preToolUsePolicyHook)
             return { ok: true, applicable: true, decision: 'allow' };
-        const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
-            ? toolInput
-            : {};
         try {
             const result = context.preToolUsePolicyHook(toolName, normalizedInput);
             if (result?.block) {
-                return { ok: true, applicable: true, decision: 'deny', reason: result.reason };
+                const policyCode = result.policyCode ?? 'session_policy_hook';
+                const reason = result.reason ?? 'session policy denied this tool call';
+                await recordPreToolUseDenial(policyCode, reason);
+                return { ok: true, applicable: true, decision: 'deny', reason };
             }
             return { ok: true, applicable: true, decision: 'allow' };
         }
         catch (error) {
-            return { ok: false, applicable: true, decision: 'deny', reason: `policy hook failed: ${error instanceof Error ? error.message : String(error)}` };
+            const reason = `policy hook failed: ${error instanceof Error ? error.message : String(error)}`;
+            await recordPreToolUseDenial('pre_tool_use_hook_failed', reason);
+            return { ok: false, applicable: true, decision: 'deny', reason };
         }
     }
     setPermissionGateway(gw) { this.permissionGateway = gw; }
@@ -1006,9 +1262,18 @@ export class CodexRunner {
         this.activeStreams.set(key, stream);
     }
     cleanupStream(key) {
+        const hadController = this.activeAbortControllers.has(key);
+        const hadTurn = this.activeTurns.has(key);
+        const provisionalThread = this.provisionalSessions.get(key);
         this.activeStreams.delete(key);
         this.activeAbortControllers.delete(key);
         this.pendingInterrupts.delete(key);
+        // A stale runner-start path may dispose the stream without ever entering
+        // transformAppServerStream. Reclaim its provisional thread, but preserve
+        // a replacement run that has already installed a new controller/turn.
+        if (provisionalThread && !hadController && !hadTurn) {
+            this.cleanupProvisionalThread(key, provisionalThread);
+        }
         this.chatModes.delete(key);
         const release = this.activeOperationReleases.get(key);
         if (release) {
@@ -1064,14 +1329,20 @@ export class CodexRunner {
         }
     }
     isActiveThreadOperationAlias(key) {
-        if (key.startsWith('session:'))
-            return this.activeSessions.has(key.slice('session:'.length));
+        if (key.startsWith('session:')) {
+            const sessionId = key.slice('session:'.length);
+            return this.activeSessions.has(sessionId) || this.provisionalSessions.has(sessionId);
+        }
         if (key.startsWith('thread:')) {
             const threadId = key.slice('thread:'.length);
             for (const activeThreadId of this.activeSessions.values()) {
                 if (activeThreadId === threadId)
                     return true;
             }
+            for (const provisionalThreadId of this.provisionalSessions.values()) {
+                if (provisionalThreadId === threadId)
+                    return true;
+            }
             return false;
         }
         return true;
@@ -1157,7 +1428,18 @@ export class CodexRunner {
         let agentSessionId = topicBinding
             ? (topicAgentSessionId || undefined)
             : initialAgentSessionId || this.activeSessions.get(sessionId);
-        const resumingThread = !!agentSessionId;
+        if (!topicBinding && !initialAgentSessionId && typeof sessionManager?.getSessionById === 'function') {
+            try {
+                const persisted = await sessionManager.getSessionById(sessionId);
+                agentSessionId = typeof persisted?.agentSessionId === 'string' && persisted.agentSessionId.trim()
+                    ? persisted.agentSessionId.trim()
+                    : undefined;
+            }
+            catch (error) {
+                logger.debug(`[CodexRunner] persisted main backend lookup failed; using local cache: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        let resumingThread = !!agentSessionId;
         const callModel = modelOverride?.model || this.model;
         const callEffort = modelOverride?.effortMode === 'model_default'
             ? undefined
@@ -1190,13 +1472,13 @@ export class CodexRunner {
         if (agentSessionId && !knownDelegationCarrier) {
             knownDelegationCarrier = await this.loadPersistedDelegationCarrier(sessionManager, sessionId, agentSessionId);
         }
-        const delegationCarrierCandidate = knownDelegationCarrier ?? this.createDelegationCarrier();
+        let delegationCarrierCandidate = knownDelegationCarrier ?? this.createDelegationCarrier();
         // Keep newly discovered carrier state local until generation-aware
         // activation accepts the backend. A stale run must not publish a carrier
         // that a later generation could mistake for its own thread.
         let carrierToPublish;
         const hasTaskDelegation = typeof runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] === 'string';
-        const threadOptions = {
+        let threadOptions = {
             model: callModel,
             effort: callEffort,
             approvalPolicy: effectiveApprovalPolicy,
@@ -1207,9 +1489,47 @@ export class CodexRunner {
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
             `role=${executionSandbox.decision.role ?? 'none'} sandbox=${executionSandbox.decision.state}`);
-        const threadResponse = agentSessionId
-            ? await appServer.threadResume(agentSessionId, projectPath, threadOptions)
-            : await appServer.threadStart(projectPath, threadOptions);
+        let threadResponse;
+        if (agentSessionId) {
+            try {
+                threadResponse = await appServer.threadResume(agentSessionId, projectPath, threadOptions);
+            }
+            catch (error) {
+                // A legacy main session can retain a provider ID after its rollout was
+                // removed externally. It is safe to recover before input submission;
+                // topic bindings remain authoritative and fail closed.
+                if (topicBinding || !isCodexNoRolloutError(error))
+                    throw error;
+                if (typeof sessionManager?.clearMainSessionBackendIfMatches !== 'function')
+                    throw error;
+                const missingThreadId = agentSessionId;
+                const cleared = await sessionManager.clearMainSessionBackendIfMatches(sessionId, missingThreadId, [CODEX_DELEGATION_CARRIER_METADATA_KEY]);
+                if (cleared !== 'cleared' && cleared !== 'already_clear') {
+                    const recoveryError = new Error(`Codex missing-rollout recovery rejected: ${cleared}`);
+                    recoveryError.code = 'CODEX_MISSING_ROLLOUT_RECOVERY_REJECTED';
+                    throw recoveryError;
+                }
+                if (this.activeSessions.get(sessionId) === missingThreadId)
+                    this.activeSessions.delete(sessionId);
+                this.threadProjectPaths.delete(missingThreadId);
+                this.threadDelegationCarriers.delete(missingThreadId);
+                this.unbindExternalToolBoundary(missingThreadId);
+                this.clearTrackedApprovalItemsForThread(missingThreadId);
+                agentSessionId = undefined;
+                resumingThread = false;
+                knownDelegationCarrier = undefined;
+                delegationCarrierCandidate = this.createDelegationCarrier();
+                threadOptions = {
+                    ...threadOptions,
+                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig(callMode)), callMode),
+                };
+                logger.warn(`[CodexRunner] recovered missing rollout before input submission: session=${sessionId} thread=${missingThreadId}`);
+                threadResponse = await appServer.threadStart(projectPath, threadOptions);
+            }
+        }
+        else {
+            threadResponse = await appServer.threadStart(projectPath, threadOptions);
+        }
         let threadId = threadResponse.thread?.id || agentSessionId;
         if (!threadId)
             throw new Error('Codex app-server did not return a thread id');
@@ -1247,28 +1567,39 @@ export class CodexRunner {
         else if (knownDelegationCarrier) {
             carrierToPublish = { threadId, carrier: knownDelegationCarrier };
         }
-        agentSessionId = threadId;
         const turn = modelOverride?.turn;
-        const bindingResult = this.onSessionIdUpdate
-            ? ((turn === undefined
-                ? await this.onSessionIdUpdate(sessionId, threadId)
-                : await this.onSessionIdUpdate(sessionId, threadId, { turn }))
-                ?? 'legacy_updated')
-            : 'legacy_updated';
-        const bindingAccepted = bindingResult === 'activated'
-            || bindingResult === 'already_active'
-            || bindingResult === 'legacy_updated';
-        if (!bindingAccepted) {
-            const error = new Error(`backend discovery rejected: ${bindingResult}`);
-            error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
-            throw error;
+        if (!resumingThread) {
+            // Keep a newly-created backend private to this runner until turn/start
+            // has been accepted. In particular, a pending interrupt must not leave
+            // a durable ID for a thread that never produced a rollout.
+            this.provisionalSessions.set(sessionId, threadId);
+            if (carrierToPublish) {
+                this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+            }
         }
-        this.activeSessions.set(sessionId, threadId);
-        if (carrierToPublish) {
-            this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
-            await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
+        else {
+            agentSessionId = threadId;
+            const bindingResult = this.onSessionIdUpdate
+                ? ((turn === undefined
+                    ? await this.onSessionIdUpdate(sessionId, threadId)
+                    : await this.onSessionIdUpdate(sessionId, threadId, { turn }))
+                    ?? 'legacy_updated')
+                : 'legacy_updated';
+            const bindingAccepted = bindingResult === 'activated'
+                || bindingResult === 'already_active'
+                || bindingResult === 'legacy_updated';
+            if (!bindingAccepted) {
+                const error = new Error(`backend discovery rejected: ${bindingResult}`);
+                error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+                throw error;
+            }
+            this.activeSessions.set(sessionId, threadId);
+            if (carrierToPublish) {
+                this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+                await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
+            }
+            this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         }
-        this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         this.threadProjectPaths.set(threadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(threadId, externalToolConfig);
         const controller = new AbortController();
@@ -1279,21 +1610,55 @@ export class CodexRunner {
         controller.signal.addEventListener('abort', () => queue.end(), { once: true });
         const state = {
             threadId,
+            sessionId,
+            projectPath,
             model: callModel,
+            committed: resumingThread,
             streamedAgentMessageIds: new Set(),
             agentMessageDeltaText: new Map(),
             completedItemIds: new Set(),
             emittedEditCallIds: new Set(),
             completedTurnIds: new Set(),
             openToolCalls: new Map(),
+            activeSubagentThreads: new Set(),
+            turnCompleted: false,
         };
         const unsubscribe = appServer.onNotification(notification => {
             // 仅从 turn/started 锁定权威 turnId — resume 时会有上一轮 turn 的残留通知
             // （如 thread/tokenUsage/updated）先于新 turn 到达，不能用它们 latch turnId
             const params = notification.params || {};
             const notifThreadId = params.threadId ?? params.thread_id;
-            if (notifThreadId !== undefined && notifThreadId !== threadId)
+            const item = params.item && typeof params.item === 'object' ? params.item : undefined;
+            const emittedByChild = typeof notifThreadId === 'string'
+                && this.childThreadSessions.get(notifThreadId) === sessionId;
+            if (notifThreadId !== undefined && notifThreadId !== threadId && !emittedByChild)
+                return;
+            this.trackSubagentLifecycle(notification, state);
+            if (emittedByChild && notifThreadId !== threadId) {
+                const childTurnId = this.extractTurnId(notification);
+                if (notification.method === 'turn/started' && childTurnId) {
+                    this.activeSubagentTurns.set(notifThreadId, {
+                        sessionId,
+                        parentThreadId: threadId,
+                        turnId: childTurnId,
+                    });
+                }
+                else if (notification.method === 'turn/completed') {
+                    const activeChildTurn = this.activeSubagentTurns.get(notifThreadId);
+                    if (!childTurnId || activeChildTurn?.turnId === childTurnId) {
+                        this.activeSubagentTurns.delete(notifThreadId);
+                    }
+                    state.activeSubagentThreads.delete(notifThreadId);
+                    this.unregisterChildThread(notifThreadId);
+                    this.endAppServerQueueWhenSubagentsDone(queue, state);
+                }
+                if (this.isSubagentActivityItem(item))
+                    queue.push(notification);
+                if (notification.method === 'item/completed' && state.turnCompleted) {
+                    this.endAppServerQueueWhenSubagentsDone(queue, state);
+                }
                 return;
+            }
             if (notification.method === 'turn/started') {
                 const startedTurnId = this.extractTurnId(notification);
                 if (startedTurnId && !state.turnId) {
@@ -1309,13 +1674,20 @@ export class CodexRunner {
                 return;
             queue.push(notification);
             // 仅在已锁定 turnId 后才允许 turn/completed 结束队列，避免残留的旧 turn/completed 误关
-            if (notification.method === 'turn/completed' && state.turnId)
-                queue.end();
+            if (notification.method === 'turn/completed' && state.turnId) {
+                state.turnCompleted = true;
+                this.endAppServerQueueWhenSubagentsDone(queue, state);
+            }
+            else if (notification.method === 'item/completed' && state.turnCompleted) {
+                this.endAppServerQueueWhenSubagentsDone(queue, state);
+            }
         });
         if (this.consumePendingInterrupt(sessionId)) {
             controller.abort('User interrupt');
             this.activeAbortControllers.delete(sessionId);
             this.activeStreams.delete(sessionId);
+            if (!resumingThread)
+                this.cleanupProvisionalThread(sessionId, threadId);
             logger.info(`[CodexRunner] Applied pending interrupt before turn start: ${sessionId}`);
             return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
         }
@@ -1327,6 +1699,14 @@ export class CodexRunner {
                 approvalPolicy: effectiveApprovalPolicy,
                 ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
             });
+            if (!resumingThread) {
+                state.commitProvisional = async () => {
+                    const committed = await this.commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn);
+                    if (committed)
+                        agentSessionId = threadId;
+                    return committed;
+                };
+            }
             const turnId = turnResponse.turn?.id;
             if (turnId && !state.turnId) {
                 state.turnId = turnId;
@@ -1341,8 +1721,10 @@ export class CodexRunner {
             }
             const status = turnResponse.turn?.status;
             if (status === 'completed' || status === 'failed') {
+                this.primeSubagentStateFromTurn(turnResponse.turn, state);
                 queue.push({ method: 'turn/completed', params: { threadId, turn: turnResponse.turn } });
-                queue.end();
+                state.turnCompleted = true;
+                this.endAppServerQueueWhenSubagentsDone(queue, state);
             }
         }
         catch (error) {
@@ -1351,6 +1733,8 @@ export class CodexRunner {
             this.activeTurns.delete(sessionId);
             this.pendingInterrupts.delete(sessionId);
             this.cleanupTempFiles(tempFiles);
+            if (!resumingThread)
+                this.cleanupProvisionalThread(sessionId, threadId);
             throw error;
         }
         return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
@@ -1364,6 +1748,7 @@ export class CodexRunner {
         const interruptTurn = activeTurn
             ? this.interruptAppServerTurn(activeTurn.threadId, activeTurn.turnId)
             : Promise.resolve();
+        const interruptSubagents = this.interruptSubagentTurns(sessionKey);
         if (!activeTurn)
             this.rememberPendingInterrupt(sessionKey);
         if (controller)
@@ -1374,7 +1759,17 @@ export class CodexRunner {
             this.activeTurns.delete(sessionKey);
             logger.info(`[CodexRunner] Interrupted session: ${sessionKey}`);
         }
-        await interruptTurn;
+        await Promise.all([interruptTurn, interruptSubagents]);
+    }
+    async interruptSubagentTurns(sessionId, parentThreadId) {
+        const entries = [...this.activeSubagentTurns.entries()]
+            .filter(([, active]) => active.sessionId === sessionId && (!parentThreadId || active.parentThreadId === parentThreadId));
+        await Promise.all(entries.map(async ([childThreadId, active]) => {
+            await this.interruptAppServerTurn(childThreadId, active.turnId).catch(() => { });
+            const current = this.activeSubagentTurns.get(childThreadId);
+            if (current === active)
+                this.activeSubagentTurns.delete(childThreadId);
+        }));
     }
     rememberPendingInterrupt(sessionId) {
         this.pendingInterrupts.set(sessionId, Date.now());
@@ -1437,10 +1832,12 @@ export class CodexRunner {
     }
     async closeSession(sessionId) {
         const capturedThreadId = this.activeSessions.get(sessionId);
+        const capturedProvisionalThreadId = this.provisionalSessions.get(sessionId);
         const capturedPermissionContext = this.permissionContexts.get(sessionId);
         const capturedStream = this.activeStreams.get(sessionId);
         const capturedController = this.activeAbortControllers.get(sessionId);
         const capturedTurn = this.activeTurns.get(sessionId);
+        const capturedSteeringTail = this.steeringTails.get(sessionId);
         this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         // Do not call interrupt(sessionId) here: a new run may have replaced the
         // session-scoped maps while an older close was waiting. Interrupt and
@@ -1448,6 +1845,13 @@ export class CodexRunner {
         if (capturedTurn) {
             await this.interruptAppServerTurn(capturedTurn.threadId, capturedTurn.turnId).catch(() => { });
         }
+        const capturedParentThreadId = capturedThreadId ?? capturedProvisionalThreadId;
+        if (capturedParentThreadId) {
+            await this.interruptSubagentTurns(sessionId, capturedParentThreadId);
+        }
+        else if (!this.activeSessions.has(sessionId) && !this.provisionalSessions.has(sessionId)) {
+            await this.interruptSubagentTurns(sessionId);
+        }
         capturedController?.abort('Session closed');
         const lifecycleReplaced = (capturedStream !== undefined && this.activeStreams.get(sessionId) !== capturedStream)
             || (capturedController !== undefined && this.activeAbortControllers.get(sessionId) !== capturedController)
@@ -1464,6 +1868,10 @@ export class CodexRunner {
             this.pendingInterrupts.delete(sessionId);
         if (this.permissionContexts.get(sessionId) === capturedPermissionContext)
             this.permissionContexts.delete(sessionId);
+        if (this.steeringTails.get(sessionId) === capturedSteeringTail)
+            this.steeringTails.delete(sessionId);
+        if (capturedProvisionalThreadId)
+            this.cleanupProvisionalThread(sessionId, capturedProvisionalThreadId);
         // Session-level configuration and thread indexes are shared by later
         // runs. Only remove them when the captured lifecycle still owns the key.
         if (!lifecycleReplaced) {
@@ -1477,6 +1885,7 @@ export class CodexRunner {
                 this.unbindExternalToolBoundary(capturedThreadId);
             }
             this.clearTrackedApprovalItemsForThread(capturedThreadId);
+            this.cleanupChildThreadsForSession(sessionId);
             this.pruneThreadOperationLocks();
         }
     }
@@ -1505,6 +1914,8 @@ export class CodexRunner {
         // Codex: 清空会话 = 下次 runQuery 不传 resumeId，自动创建新 thread
         const threadId = this.activeSessions.get(sessionId) ?? _agentSessionId;
         this.activeSessions.delete(sessionId);
+        this.activeTurns.delete(sessionId);
+        this.steeringTails.delete(sessionId);
         this.chatModes.delete(sessionId);
         this.cleanupSessionTempDir(sessionId);
         this.threadProjectPaths.delete(threadId);
@@ -1774,13 +2185,14 @@ export class CodexRunner {
     trackApprovalItemNotification(notification) {
         const params = (notification.params || {});
         const item = params.item && typeof params.item === 'object' ? params.item : undefined;
-        const itemId = item?.id ?? params.itemId;
+        const itemId = item?.id ?? params.itemId ?? params.item_id;
         const threadId = this.requestThreadId(params);
-        const key = this.approvalItemKey(threadId, params.turnId, itemId);
+        const turnId = params.turnId ?? params.turn_id;
+        const key = this.approvalItemKey(threadId, turnId, itemId);
         if (notification.method === 'item/started' && key && item && threadId) {
             this.trackedApprovalItems.set(key, {
                 threadId,
-                turnId: params.turnId,
+                turnId,
                 itemId,
                 item: { ...item },
             });
@@ -1790,7 +2202,7 @@ export class CodexRunner {
             const tracked = this.trackedApprovalItems.get(key);
             this.trackedApprovalItems.set(key, {
                 threadId,
-                turnId: params.turnId,
+                turnId,
                 itemId,
                 item: {
                     ...(tracked?.item ?? { id: itemId, type: 'fileChange' }),
@@ -1814,22 +2226,40 @@ export class CodexRunner {
                     this.trackedApprovalItems.delete(trackedKey);
                 }
             }
+            this.clearPendingToolDenialsForTurn(threadId, completedTurnId);
         }
     }
     findTrackedApprovalItem(params) {
-        const key = this.approvalItemKey(this.requestThreadId(params), params.turnId, params.itemId);
+        const key = this.approvalItemKey(this.requestThreadId(params), params.turnId ?? params.turn_id, params.itemId ?? params.item_id);
         return key ? this.trackedApprovalItems.get(key)?.item : undefined;
     }
     requestThreadId(params) {
-        const threadId = typeof params.threadId === 'string' && params.threadId.length > 0
-            ? params.threadId
+        const threadIdValue = params.threadId ?? params.thread_id;
+        const threadId = typeof threadIdValue === 'string' && threadIdValue.length > 0
+            ? threadIdValue
             : undefined;
         if (threadId)
             return threadId;
-        return typeof params.conversationId === 'string' && params.conversationId.length > 0
-            ? params.conversationId
+        const conversationIdValue = params.conversationId ?? params.conversation_id;
+        return typeof conversationIdValue === 'string' && conversationIdValue.length > 0
+            ? conversationIdValue
             : undefined;
     }
+    clearPendingToolDenialsForTurn(threadId, turnId) {
+        for (const key of this.pendingToolDenials.keys()) {
+            let parsed;
+            try {
+                parsed = JSON.parse(key);
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(parsed) || parsed[0] !== threadId)
+                continue;
+            if (!turnId || parsed[1] === turnId)
+                this.pendingToolDenials.delete(key);
+        }
+    }
     clearTrackedApprovalItemsForThread(threadId) {
         if (!threadId)
             return;
@@ -1837,6 +2267,73 @@ export class CodexRunner {
             if (tracked.threadId === threadId)
                 this.trackedApprovalItems.delete(key);
         }
+        for (const key of this.pendingToolDenials.keys()) {
+            let parsed;
+            try {
+                parsed = JSON.parse(key);
+            }
+            catch {
+                continue;
+            }
+            if (Array.isArray(parsed) && parsed[0] === threadId)
+                this.pendingToolDenials.delete(key);
+        }
+    }
+    rememberToolDenial(request, params, denial) {
+        const itemId = params.itemId ?? params.item_id ?? params.callId ?? params.call_id;
+        const threadId = this.requestThreadId(params);
+        const rawTurnId = params.turnId ?? params.turn_id;
+        const turnId = typeof rawTurnId === 'string' ? rawTurnId : this.findActiveTurnId(threadId);
+        const key = this.approvalItemKey(threadId, turnId, itemId);
+        if (!key)
+            return;
+        this.pendingToolDenials.set(key, {
+            ...denial,
+            ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+            method: request.method,
+        });
+    }
+    steerPolicyReason(sessionId, policyCode, reason) {
+        const prefix = policyCode ? `策略拒绝（${policyCode}）` : '策略拒绝';
+        this.injectUserMessage(sessionId, `⚠️ ${prefix}：${reason}。命令未执行，请按提示重新执行正确的命令。`);
+    }
+    findActiveTurnId(threadId) {
+        if (!threadId)
+            return undefined;
+        for (const active of this.activeTurns.values()) {
+            if (active.threadId === threadId)
+                return active.turnId;
+        }
+        return undefined;
+    }
+    takeToolDenial(state, itemId) {
+        const exactKey = this.approvalItemKey(state.threadId, state.turnId, itemId);
+        if (exactKey) {
+            const exact = this.pendingToolDenials.get(exactKey);
+            if (exact) {
+                this.pendingToolDenials.delete(exactKey);
+                return exact;
+            }
+        }
+        // Legacy approval callbacks may not carry turnId. Consume the unique
+        // matching item for this thread rather than losing the structured reason.
+        const candidates = [];
+        for (const [key, denial] of this.pendingToolDenials) {
+            let parsed;
+            try {
+                parsed = JSON.parse(key);
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(parsed) || parsed[0] !== state.threadId || String(parsed[2]) !== String(itemId))
+                continue;
+            candidates.push([key, denial]);
+        }
+        if (candidates.length !== 1)
+            return undefined;
+        this.pendingToolDenials.delete(candidates[0][0]);
+        return candidates[0][1];
     }
     async handleAppServerRequest(request) {
         const params = (request.params || {});
@@ -1898,41 +2395,46 @@ export class CodexRunner {
         // workspace, or unattended-trigger policy checks.
         if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
             if (!this.isTrustedFullAccessSession(sessionKey)) {
+                const reason = 'Untrusted fullaccess execution context';
+                this.rememberToolDenial(request, params, {
+                    decision: 'deny',
+                    decisionSource: 'policy',
+                    policyCode: 'fullaccess_context_untrusted',
+                    reason,
+                });
+                this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', 'fullaccess_context_untrusted', reason);
+                setImmediate(() => this.steerPolicyReason(sessionKey, 'fullaccess_context_untrusted', reason));
                 return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
             }
             const response = this.toAppServerApprovalResponse(request.method, 'allow', toolInput, false);
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'allow', 'approval', undefined, 'trusted fullaccess execution');
             return response;
         }
-        // proactive 模式行为策略（首次工具调用必须是 ec msg send）
+        // Keep the policy check in the approval path as a fail-closed fallback.
+        // Some app-server tool routes can reach approval without invoking the
+        // command hook; allowing here would bypass the proactive gate.
         const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         if (policyResult?.block) {
             logger.info(`[CodexRunner] app-server approval declined by session policy: session=${sessionKey} ` +
                 `requestId=${request.id ?? '<missing>'} code=${policyResult.policyCode ?? 'session_policy_hook'} ` +
                 `reason=${policyResult.reason ?? 'policy denied'} executed=false`);
-            try {
-                await permissionContext?.recordExecutionAnomaly?.({
-                    code: 'operation_blocked',
-                    severity: 'warning',
-                    phase: 'execution',
-                    occurredAt: Date.now(),
-                    toolName,
-                    ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
-                    policyCode: policyResult.policyCode ?? 'session_policy_hook',
-                    decisionSource: 'policy',
-                    agentAid: permissionContext?.selfAid,
-                    agentName: permissionContext?.agentName,
-                    sessionId: sessionKey,
-                    permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
-                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
-                    effect: 'operation_skipped',
-                });
-            }
-            catch (error) {
-                logger.warn(`[CodexRunner] failed to record policy-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+            const policyCode = policyResult.policyCode ?? 'session_policy_hook';
+            const policyReason = policyResult.reason ?? 'session policy denied approval';
+            this.rememberToolDenial(request, params, {
+                decision: 'deny',
+                decisionSource: 'policy',
+                policyCode,
+                reason: policyReason,
+            });
+            // ResponseEngine's wrapped policy hook already steers Codex sessions
+            // that have the pure managed-hook policy installed. Standalone callers
+            // may only provide policyHook, so keep this fallback for them without
+            // duplicating the same user message in production.
+            if (!permissionContext?.preToolUsePolicyHook) {
+                setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, policyReason));
             }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyResult.policyCode ?? 'session_policy_hook', policyResult.reason ?? 'session policy denied approval');
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyCode, policyReason);
             return response;
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
@@ -1941,7 +2443,14 @@ export class CodexRunner {
         if (!workspacePath) {
             logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.rememberToolDenial(request, params, {
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode: 'approval_workspace_unknown',
+                reason: 'thread workspace is unknown',
+            });
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', 'approval_workspace_unknown', 'thread workspace is unknown');
+            setImmediate(() => this.steerPolicyReason(sessionKey, 'approval_workspace_unknown', 'thread workspace is unknown'));
             return response;
         }
         const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
@@ -1951,8 +2460,9 @@ export class CodexRunner {
         const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
             || request.method === 'execCommandApproval';
         const managedEcIntent = isCommandApproval && this.isManagedEvolcoreCommandIntent(toolInput);
+        const delegationCarrier = this.delegationCarrierForSession(sessionKey, typeof params.threadId === 'string' ? params.threadId : undefined);
         const canonicalEcApproval = isCommandApproval
-            ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey))
+            ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey), delegationCarrier)
             : undefined;
         const approvedCommand = canonicalEcApproval?.argv;
         const denyInfrastructure = async (policyCode, message) => {
@@ -1979,19 +2489,32 @@ export class CodexRunner {
                 logger.warn(`[CodexRunner] failed to record infrastructure approval denial: session=${sessionKey} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
             }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.rememberToolDenial(request, params, {
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode,
+                reason: message,
+            });
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode, message, canonicalEcApproval?.parseFailure);
+            setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, message));
             return response;
         };
         if (managedEcIntent && !approvedCommand) {
+            if (canonicalEcApproval?.parseFailure?.issue === 'untrusted-shell') {
+                return await denyInfrastructure('ec_shell_untrusted_executable', 'EC command approval denied because the shell executable failed Windows Authenticode trust validation');
+            }
             return await denyInfrastructure('ec_command_not_canonical', canonicalEcApproval?.parseFailure
                 ? `EC command approval denied because canonical argv parsing failed (${canonicalEcApproval.parseFailure.issue})`
                 : 'EC command approval denied because no canonical argv could be derived');
         }
         try {
-            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
+            const resolution = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id, typeof params.itemId === 'string' ? params.itemId : typeof params.item_id === 'string' ? params.item_id : undefined);
+            const decision = typeof resolution === 'string' ? resolution : resolution.decision;
+            const resolutionMeta = typeof resolution === 'string' ? undefined : resolution;
             if (decision !== 'deny' && managedEcIntent && approvedCommand) {
                 const carrierThreadIds = [
                     this.activeSessions.get(sessionKey),
+                    this.provisionalSessions.get(sessionKey),
                     typeof params.threadId === 'string' ? params.threadId : undefined,
                     typeof params.conversationId === 'string' ? params.conversationId : undefined,
                 ];
@@ -2000,18 +2523,35 @@ export class CodexRunner {
                 // A carrier-bearing thread is managed even if its permission context
                 // was not wired with an arm callback; it must fail closed here rather
                 // than reaching daemon IPC with an unarmed carrier.
+                if ((hasDelegationCarrier || canArmDelegation)
+                    && canonicalEcApproval?.delegationToken
+                    && canonicalEcApproval.delegationToken !== delegationCarrier) {
+                    return await denyInfrastructure('delegation_token_mismatch', 'EC command approval contains a delegation token different from the active thread carrier');
+                }
                 if ((hasDelegationCarrier || canArmDelegation)
                     && !this.armApprovedDelegationCommand(sessionKey, approvedCommand)) {
                     return await denyInfrastructure('delegation_not_armed', 'EC command approval failed to arm delegation');
                 }
             }
             const response = this.toAppServerApprovalResponse(request.method, decision, toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval') : 'approval', decision === 'deny' && (sessionMode === 'auto' || sessionMode === 'readonly')
-                ? 'permission_mode_denied'
-                : undefined, decision === 'deny'
-                ? (reason || (sessionMode === 'auto' || sessionMode === 'readonly'
-                    ? `permission mode ${sessionMode} denied approval`
-                    : 'user approval denied'))
+            const decisionSource = resolutionMeta?.decisionSource
+                ?? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval');
+            const policyCode = resolutionMeta?.policyCode
+                ?? (decisionSource === 'policy' ? 'permission_mode_denied' : undefined);
+            const denialReason = resolutionMeta?.reason || reason || (policyCode
+                ? `permission mode ${sessionMode} denied approval`
+                : 'user approval denied');
+            if (decision === 'deny') {
+                this.rememberToolDenial(request, params, {
+                    decision: 'deny',
+                    decisionSource,
+                    ...(policyCode ? { policyCode } : {}),
+                    reason: denialReason,
+                });
+                setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, denialReason));
+            }
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? decisionSource : 'approval', decision === 'deny' ? policyCode : undefined, decision === 'deny'
+                ? denialReason
                 : 'approval accepted');
             logger.info(`[CodexRunner] app-server approval response id=${request.id} method=${request.method} decision=${decision} response=${JSON.stringify(response)}`);
             return response;
@@ -2024,8 +2564,13 @@ export class CodexRunner {
     }
     logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode, reason, parseFailure) {
         const context = this.permissionContexts.get(sessionKey);
+        const params = (request.params || {});
+        const rawCallId = params.itemId ?? params.item_id ?? params.callId ?? params.call_id;
+        const callId = typeof rawCallId === 'string' && rawCallId ? rawCallId : undefined;
         auditCodexApprovalDecision({
             requestId: request.id !== undefined ? String(request.id) : undefined,
+            callId,
+            correlationId: callId,
             method: request.method,
             sessionId: sessionKey,
             agentAid: context?.selfAid,
@@ -2041,6 +2586,7 @@ export class CodexRunner {
         });
         logger.info(`[CodexRunner] app-server approval audit ${JSON.stringify({
             requestId: request.id !== undefined ? String(request.id) : undefined,
+            ...(callId ? { callId, correlationId: callId } : {}),
             method: request.method,
             sessionId: sessionKey,
             toolName,
@@ -2401,9 +2947,20 @@ export class CodexRunner {
                 if (activeThreadId === candidate)
                     return sessionKey;
             }
+            for (const [sessionKey, provisionalThreadId] of this.provisionalSessions.entries()) {
+                if (provisionalThreadId === candidate)
+                    return sessionKey;
+            }
+            const childSessionKey = this.childThreadSessions.get(candidate);
+            if (childSessionKey)
+                return childSessionKey;
         }
         return candidates[0] || 'codex-app-server';
     }
+    isThreadOwnedBySession(sessionId, threadId) {
+        const activeThread = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
+        return activeThread === threadId || this.childThreadSessions.get(threadId) === sessionId;
+    }
     buildPermissionInput(method, params) {
         if (method === 'item/permissions/requestApproval') {
             return { permissions: params.permissions, cwd: params.cwd, reason: params.reason };
@@ -2465,6 +3022,12 @@ export class CodexRunner {
             const threadProjectPath = this.threadProjectPaths.get(threadId);
             if (threadProjectPath)
                 return threadProjectPath;
+            const parentSession = this.childThreadSessions.get(threadId);
+            const parentThread = parentSession
+                ? this.activeSessions.get(parentSession) ?? this.provisionalSessions.get(parentSession)
+                : undefined;
+            if (parentThread)
+                return this.threadProjectPaths.get(parentThread);
         }
         return undefined;
     }
@@ -2595,7 +3158,7 @@ export class CodexRunner {
             return true;
         });
     }
-    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId) {
+    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId, callId) {
         const permissionContext = this.permissionContexts.get(sessionKey);
         const permissionPrompt = permissionContext?.sendPrompt ?? this.sendPromptFn;
         const hasFilesystemPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
@@ -2632,6 +3195,8 @@ export class CodexRunner {
                 role: permissionContext?.role,
                 selfAid: permissionContext?.selfAid,
                 requestId: typeof requestId === 'string' || typeof requestId === 'number' ? String(requestId) : undefined,
+                callId,
+                correlationId: callId,
                 taskId: permissionContext?.taskId,
                 matchedPath,
             });
@@ -2662,6 +3227,7 @@ export class CodexRunner {
             // distinguishes this explicit empty value from runners without a
             // session-temp capability.
             managedTempDir: permissionContext?.managedTempDir ?? this.getManagedTempDir(sessionKey) ?? '',
+            delegationCarrier: this.delegationCarrierForSession(sessionKey),
             allowProtectedMetadata: false,
             selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
@@ -2678,7 +3244,12 @@ export class CodexRunner {
             if (preflight.policyCode) {
                 await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied', preflight.matchedPath);
             }
-            return 'deny';
+            return {
+                decision: 'deny',
+                decisionSource: 'policy',
+                policyCode: preflight.policyCode ?? 'tool_preflight_denied',
+                reason: preflight.message ?? 'tool preflight denied',
+            };
         }
         if (preflight.behavior === 'allow')
             return 'allow';
@@ -2992,12 +3563,124 @@ export class CodexRunner {
         }
         return !state.turnId || !turnId || turnId === state.turnId;
     }
+    isSubagentActivityItem(item) {
+        return typeof item?.type === 'string' && item.type.toLowerCase() === 'subagentactivity';
+    }
+    subagentThreadId(item) {
+        const value = item?.agentThreadId ?? item?.agent_thread_id;
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    subagentPath(item) {
+        const value = item?.agentPath ?? item?.agent_path;
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    subagentType(item) {
+        const value = item?.agentType ?? item?.agent_type;
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    registerChildThread(sessionId, childThreadId, projectPath) {
+        const parentThreadId = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
+        if (childThreadId === parentThreadId)
+            return;
+        this.childThreadSessions.set(childThreadId, sessionId);
+        this.threadProjectPaths.set(childThreadId, path.resolve(projectPath));
+        // Child approvals use the parent's capability boundary and delegation
+        // carrier. This is inheritance, not a second permission decision.
+        const parentBoundary = parentThreadId ? this.threadExternalToolBoundaries.get(parentThreadId) : undefined;
+        const parentFingerprint = parentThreadId ? this.threadExternalToolFingerprints.get(parentThreadId) : undefined;
+        if (parentBoundary)
+            this.threadExternalToolBoundaries.set(childThreadId, parentBoundary);
+        if (parentFingerprint)
+            this.threadExternalToolFingerprints.set(childThreadId, parentFingerprint);
+        const parentCarrier = parentThreadId ? this.threadDelegationCarriers.get(parentThreadId) : undefined;
+        if (parentCarrier)
+            this.threadDelegationCarriers.set(childThreadId, parentCarrier);
+    }
+    unregisterChildThread(childThreadId) {
+        this.childThreadSessions.delete(childThreadId);
+        this.activeSubagentTurns.delete(childThreadId);
+        this.threadProjectPaths.delete(childThreadId);
+        this.threadExternalToolBoundaries.delete(childThreadId);
+        this.threadExternalToolFingerprints.delete(childThreadId);
+        this.threadDelegationCarriers.delete(childThreadId);
+        this.clearTrackedApprovalItemsForThread(childThreadId);
+    }
+    cleanupChildThreadsForSession(sessionId) {
+        for (const [childThreadId, ownerSessionId] of this.childThreadSessions) {
+            if (ownerSessionId === sessionId)
+                this.unregisterChildThread(childThreadId);
+        }
+    }
+    trackSubagentLifecycle(notification, state) {
+        const params = (notification.params || {});
+        const item = params.item && typeof params.item === 'object' ? params.item : undefined;
+        if (!this.isSubagentActivityItem(item))
+            return;
+        const childThreadId = this.subagentThreadId(item);
+        if (!childThreadId)
+            return;
+        const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+        if (kind === 'started') {
+            state.activeSubagentThreads.add(childThreadId);
+            this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+        }
+        if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+            state.activeSubagentThreads.delete(childThreadId);
+            this.unregisterChildThread(childThreadId);
+        }
+    }
+    primeSubagentStateFromTurn(turn, state) {
+        for (const item of this.getTurnItems(turn)) {
+            if (!this.isSubagentActivityItem(item))
+                continue;
+            const childThreadId = this.subagentThreadId(item);
+            const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+            if (!childThreadId)
+                continue;
+            if (kind === 'started') {
+                state.activeSubagentThreads.add(childThreadId);
+                this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+            }
+            else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+                state.activeSubagentThreads.delete(childThreadId);
+                this.unregisterChildThread(childThreadId);
+            }
+        }
+    }
+    endAppServerQueueWhenSubagentsDone(queue, state) {
+        if (!state.turnCompleted)
+            return;
+        if (state.activeSubagentThreads.size > 0) {
+            logger.info(`[CodexRunner] parent turn completed; waiting for subagent thread(s): `
+                + `${[...state.activeSubagentThreads].join(',')}`);
+            return;
+        }
+        queue.end();
+    }
     async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, tempFiles) {
         try {
-            yield { type: 'session_id', sessionId: state.threadId };
+            let sessionIdEmitted = state.committed;
+            if (sessionIdEmitted)
+                yield { type: 'session_id', sessionId: state.threadId };
             for await (const notification of notifications) {
                 if (!this.activeAbortControllers.has(sessionId))
                     break;
+                if (!state.committed && notification.method === 'turn/completed') {
+                    const turn = notification.params?.turn ?? {};
+                    if (turn.status === 'completed') {
+                        const committed = await state.commitProvisional?.();
+                        if (!committed) {
+                            const staleError = new Error('Codex provisional thread was superseded before commit');
+                            staleError.code = 'RUNNER_START_SUPERSEDED';
+                            throw staleError;
+                        }
+                        state.committed = true;
+                        if (!sessionIdEmitted) {
+                            sessionIdEmitted = true;
+                            yield { type: 'session_id', sessionId: state.threadId };
+                        }
+                    }
+                }
                 yield* this.mapAppServerNotification(notification, sessionId, state);
             }
         }
@@ -3011,6 +3694,11 @@ export class CodexRunner {
                 && (!state.turnId || activeTurn.turnId === state.turnId)) {
                 this.activeTurns.delete(sessionId);
             }
+            if (!state.committed)
+                this.cleanupProvisionalThread(sessionId, state.threadId);
+            for (const childThreadId of state.activeSubagentThreads)
+                this.unregisterChildThread(childThreadId);
+            state.activeSubagentThreads.clear();
             this.cleanupTempFiles(tempFiles);
         }
     }
@@ -3078,12 +3766,16 @@ export class CodexRunner {
             }
             case 'turn/completed': {
                 const turn = params.turn || {};
-                const turnId = turn.id || params.turnId;
+                const turnId = turn.id || params.turnId || state.turnId;
                 if (turnId && state.completedTurnIds.has(turnId))
                     break;
                 if (turnId)
                     state.completedTurnIds.add(turnId);
-                this.activeTurns.delete(sessionId);
+                const activeTurn = this.activeTurns.get(sessionId);
+                if (activeTurn?.threadId === state.threadId && activeTurn.turnId === turnId) {
+                    this.activeTurns.delete(sessionId);
+                }
+                this.clearPendingToolDenialsForTurn(state.threadId, turnId);
                 yield* this.reconcileOpenAppServerToolCalls(state, turnId);
                 if (turn.status === 'failed' && turn.error?.message) {
                     if (isRetryableError(new Error(turn.error.message))) {
@@ -3204,11 +3896,36 @@ export class CodexRunner {
                 };
                 break;
             case 'subAgentActivity':
-                yield {
-                    type: 'task_progress',
-                    summary: `Subagent ${item.kind}: ${item.agentPath || item.agentThreadId}`,
-                };
+            case 'SubAgentActivity': {
+                const childThreadId = this.subagentThreadId(item);
+                if (!childThreadId)
+                    break;
+                const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+                const description = this.subagentPath(item) ?? childThreadId;
+                if (kind === 'started') {
+                    yield {
+                        type: 'task_started',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        subagentType: this.subagentType(item),
+                    };
+                }
+                else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+                    yield {
+                        type: 'task_notification',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        status: kind === 'completed' ? 'completed' : kind,
+                        summary: description,
+                    };
+                }
+                else {
+                    yield { type: 'task_progress', taskId: childThreadId, taskKind: 'agent', description, summary: `Subagent ${item.kind}: ${description}` };
+                }
                 break;
+            }
             case 'enteredReviewMode':
                 yield { type: 'task_progress', summary: item.review || 'Review mode entered' };
                 break;
@@ -3223,6 +3940,59 @@ export class CodexRunner {
     *mapAppServerItemCompleted(item, state) {
         if (!item)
             return;
+        const denial = this.takeToolDenial(state, item.id);
+        const denialFields = denial
+            ? {
+                isError: true,
+                error: denial.reason,
+                errorCode: errorCodeForToolDenial(denial.decisionSource, denial.policyCode),
+                decision: 'deny',
+                decisionSource: denial.decisionSource,
+                policyCode: denial.policyCode,
+                reason: denial.reason,
+                requestId: denial.requestId,
+                executed: false,
+                executionState: 'blocked',
+            }
+            : undefined;
+        const itemErrorText = outputTextForManagedHook(typeof item.error === 'string' ? item.error : item.error?.message);
+        const hookErrorText = /(?:Command|Tool call) blocked by PreToolUse hook\s*:/i.test(itemErrorText)
+            ? itemErrorText
+            : undefined;
+        const managedHookDenial = (item.status === 'failed' || item.status === 'declined' || hookErrorText)
+            ? parseManagedPreToolUseDenial([
+                item.aggregatedOutput,
+                item.output,
+                item.result,
+                hookErrorText,
+            ].filter(value => value !== undefined && value !== null).map(outputTextForManagedHook).join('\n'))
+            : undefined;
+        const managedHookFields = !denial && managedHookDenial
+            ? {
+                isError: true,
+                error: managedHookDenial.reason,
+                errorCode: 'POLICY_DENIED',
+                decision: 'deny',
+                decisionSource: 'policy',
+                policyCode: managedHookDenial.policyCode,
+                reason: managedHookDenial.reason,
+                executed: false,
+                executionState: 'blocked',
+            }
+            : undefined;
+        const genericDeclineFields = !denial && !managedHookFields && item.status === 'declined'
+            ? {
+                isError: true,
+                error: 'Approval declined',
+                errorCode: 'USER_DENIED',
+                decision: 'deny',
+                decisionSource: 'approval',
+                reason: 'Approval declined',
+                executed: false,
+                executionState: 'blocked',
+            }
+            : undefined;
+        const blockedFields = denialFields ?? managedHookFields ?? genericDeclineFields;
         switch (item.type) {
             case 'agentMessage':
                 {
@@ -3239,8 +4009,10 @@ export class CodexRunner {
                     type: 'tool_result',
                     name: 'Shell',
                     result: item.aggregatedOutput ?? '',
-                    isError: item.exitCode !== null && item.exitCode !== undefined ? item.exitCode !== 0 : item.status === 'failed',
-                    ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
+                    ...(blockedFields ?? {
+                        isError: item.exitCode !== null && item.exitCode !== undefined ? item.exitCode !== 0 : item.status === 'failed' || item.status === 'declined',
+                        ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
+                    }),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
                 };
@@ -3250,8 +4022,8 @@ export class CodexRunner {
                     type: 'tool_result',
                     name: `MCP:${item.server}/${item.tool}`,
                     result: item.result,
-                    isError: item.status === 'failed',
-                    error: item.error?.message,
+                    ...(blockedFields ?? { isError: item.status === 'failed' }),
+                    ...(blockedFields ? {} : { error: item.error?.message }),
                     ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
@@ -3262,7 +4034,7 @@ export class CodexRunner {
                     type: 'tool_result',
                     name: item.namespace ? `${item.namespace}:${item.tool}` : item.tool,
                     result: item.contentItems,
-                    isError: item.success === false || item.status === 'failed',
+                    ...(blockedFields ?? { isError: item.success === false || item.status === 'failed' }),
                     ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
@@ -3277,12 +4049,12 @@ export class CodexRunner {
                             yield editEvent;
                         }
                     }
-                    yield { type: 'tool_result', name: 'Edit', result: item.changes, isError: item.status === 'failed', callId: item.id };
+                    yield { type: 'tool_result', name: 'Edit', result: item.changes, ...(blockedFields ?? { isError: item.status === 'failed' }), callId: item.id };
                 }
                 else {
                     const desc = this.normalizeFileChanges(item.changes).map((change) => this.describeFileChange(change)).join(', ');
                     yield { type: 'tool_use', name: 'FileChange', input: { description: desc }, callId: item.id };
-                    yield { type: 'tool_result', name: 'FileChange', result: item.changes, isError: item.status === 'failed', callId: item.id };
+                    yield { type: 'tool_result', name: 'FileChange', result: item.changes, ...(blockedFields ?? { isError: item.status === 'failed' }), callId: item.id };
                 }
                 break;
             case 'webSearch':
@@ -3336,6 +4108,34 @@ export class CodexRunner {
                     callId: item.id,
                 };
                 break;
+            case 'subAgentActivity':
+            case 'SubAgentActivity': {
+                const childThreadId = this.subagentThreadId(item);
+                if (!childThreadId)
+                    break;
+                const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+                const description = this.subagentPath(item) ?? childThreadId;
+                if (kind === 'started') {
+                    yield {
+                        type: 'task_started',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        subagentType: this.subagentType(item),
+                    };
+                }
+                else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+                    yield {
+                        type: 'task_notification',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        status: kind === 'completed' ? 'completed' : kind,
+                        summary: description,
+                    };
+                }
+                break;
+            }
         }
     }
     *mapAppServerFileChangePatchUpdated(params, state) {
@@ -3583,16 +4383,21 @@ export class CodexRunner {
         for (const [key, controller] of this.activeAbortControllers) {
             controller.abort('dispose');
         }
+        await Promise.all([...this.activeSubagentTurns.entries()].map(([threadId, active]) => this.interruptAppServerTurn(threadId, active.turnId).catch(() => { })));
         this.activeAbortControllers.clear();
         this.activeStreams.clear();
         this.activeSessions.clear();
+        this.provisionalSessions.clear();
         this.activeTurns.clear();
+        this.activeSubagentTurns.clear();
+        this.childThreadSessions.clear();
         this.threadProjectPaths.clear();
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
         this.trackedApprovalItems.clear();
         this.threadDelegationCarriers.clear();
         this.pendingInterrupts.clear();
+        this.steeringTails.clear();
         this.permissionContexts.clear();
         this.chatModes.clear();
         this.pruneThreadOperationLocks();