evolcore 0.0.21 → 0.0.23

package/dist/agents/claude-runner.js

@@ -1,6 +1,7 @@
+import { getRunnerCatalog, peekRunnerCatalog, catalogEfforts, resolveCatalogModel, assertCatalogSelectable } from '../core/model/model-catalog.js';
 import { query, forkSession as sdkForkSession, getSessionMessages as sdkGetSessionMessages, resolveSettings as sdkResolveSettings, } from '@anthropic-ai/claude-agent-sdk';
 import { spawn } from 'child_process';
-import { atomicReadJson, atomicWriteJson, ensureDir } from '../utils/atomic-write.js';
+import { ensureDir } from '../utils/atomic-write.js';
 import { resolveAnthropicConfig } from './baseagent.js';
 import { buildModelRequestHeaders } from './request-identity.js';
 import { DEFAULT_PERMISSION_MODE } from '../types.js';
@@ -261,103 +262,6 @@ async function assertClaudeSettingSourcesHaveLiteralSandboxPaths(cwd, settingSou
         }
     }
 }
-// ── 模型别名解析 ──
-// SDK 内置的别名表可能落后于代理实际可用的最新模型，
-// 因此优先从 {baseUrl}/models 动态获取各系列最新版本，失败则使用持久化的最近成功值。
-// 已验证可用但尚未出现在 /models 列表中的模型 ID 会被注入候选列表，
-// 等列表更新后注入自动变为 no-op。
-const MODEL_FAMILIES = ['opus', 'sonnet', 'haiku'];
-/** 已验证可用但可能尚未出现在 /models 列表中的模型 ID（注入候选） */
-const INJECTED_MODELS = [];
-/** 启动默认值：某网关尚无任何成功刷新记录时使用。 */
-const BOOTSTRAP_MODEL_ALIASES = {
-    'opus': 'claude-opus-4-8',
-    'sonnet': 'claude-sonnet-4-6',
-    'haiku': 'claude-haiku-4-5-20251001',
-};
-const MODEL_ALIAS_TTL_MS = 5 * 60 * 1000; // 5min
-const MODEL_ALIAS_STORE_VERSION = 1;
-const modelAliasCache = new Map(); // key: baseUrl
-const modelAliasFallbacks = new Map(); // key: baseUrl，最近一次成功解析值
-const modelAliasInFlight = new Set(); // 去重并发刷新
-const loadedModelAliasFallbacks = new Set(); // key: store path + gateway hash
-function normalizeModelGatewayUrl(baseUrl) {
-    return baseUrl.trim().replace(/\/+$/, '');
-}
-function modelGatewayKey(baseUrl) {
-    return crypto.createHash('sha256').update(normalizeModelGatewayUrl(baseUrl)).digest('hex');
-}
-function modelAliasStorePath() {
-    return resolvePaths().claudeModelCache;
-}
-function sanitizeModelAliases(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return {};
-    const aliases = {};
-    for (const family of MODEL_FAMILIES) {
-        const model = value[family];
-        if (typeof model !== 'string')
-            continue;
-        const pattern = new RegExp(`^claude-${family}-[A-Za-z0-9._-]+$`);
-        if (pattern.test(model))
-            aliases[family] = model;
-    }
-    return aliases;
-}
-function readPersistedAliasStore() {
-    try {
-        const value = atomicReadJson(modelAliasStorePath());
-        if (!value || typeof value !== 'object' || Array.isArray(value)) {
-            return { $schema_version: MODEL_ALIAS_STORE_VERSION, gateways: {} };
-        }
-        const raw = value;
-        if (raw.$schema_version !== MODEL_ALIAS_STORE_VERSION || !raw.gateways || typeof raw.gateways !== 'object' || Array.isArray(raw.gateways)) {
-            return { $schema_version: MODEL_ALIAS_STORE_VERSION, gateways: {} };
-        }
-        const gateways = {};
-        for (const [key, entry] of Object.entries(raw.gateways)) {
-            if (!/^[a-f0-9]{64}$/.test(key) || !entry || typeof entry !== 'object' || Array.isArray(entry))
-                continue;
-            const record = entry;
-            const aliases = sanitizeModelAliases(record.aliases);
-            if (Object.keys(aliases).length === 0)
-                continue;
-            gateways[key] = {
-                aliases,
-                updatedAt: typeof record.updatedAt === 'number' && Number.isFinite(record.updatedAt) ? record.updatedAt : 0,
-            };
-        }
-        return { $schema_version: MODEL_ALIAS_STORE_VERSION, gateways };
-    }
-    catch (error) {
-        logger.warn(`[AgentRunner] Failed to load persisted model aliases: ${error instanceof Error ? error.message : String(error)}`);
-        return { $schema_version: MODEL_ALIAS_STORE_VERSION, gateways: {} };
-    }
-}
-function loadPersistedModelAliases(baseUrl) {
-    const cacheKey = normalizeModelGatewayUrl(baseUrl);
-    const storePath = modelAliasStorePath();
-    const gatewayKey = modelGatewayKey(cacheKey);
-    const loadKey = `${storePath}\0${gatewayKey}`;
-    if (loadedModelAliasFallbacks.has(loadKey))
-        return;
-    loadedModelAliasFallbacks.add(loadKey);
-    const persisted = readPersistedAliasStore().gateways[gatewayKey];
-    if (!persisted)
-        return;
-    modelAliasFallbacks.set(cacheKey, persisted.aliases);
-    logger.info(`[AgentRunner] Loaded persisted model aliases: ${JSON.stringify(persisted.aliases)}`);
-}
-function persistModelAliases(baseUrl, aliases, updatedAt) {
-    try {
-        const store = readPersistedAliasStore();
-        store.gateways[modelGatewayKey(baseUrl)] = { aliases, updatedAt };
-        atomicWriteJson(modelAliasStorePath(), store);
-    }
-    catch (error) {
-        logger.warn(`[AgentRunner] Failed to persist model aliases: ${error instanceof Error ? error.message : String(error)}`);
-    }
-}
 // ── 网关价格缓存（从 /v1/models 的 pricing/effective_pricing 提取）─────────────
 // 与别名刷新同范式：按 baseUrl 缓存，1h TTL，stale-while-revalidate（缺失/过期时
 // fire-and-forget 触发刷新，本轮先用旧值或回退，不阻塞查询）。
@@ -432,94 +336,6 @@ async function refreshGatewayPricing(baseUrl, apiKey, requestHeaders) {
         gatewayPricingInFlight.delete(baseUrl);
     }
 }
-/** 从模型 ID 列表中提取各 claude 系列的最新版本（按 major.minor 取最高，minor 可省略） */
-function deriveAliasesFromModelIds(ids) {
-    // 注入已验证可用的模型（如果列表中已有则去重无影响）
-    const allIds = [...new Set([...ids, ...INJECTED_MODELS])];
-    const best = {};
-    for (const id of allIds) {
-        const m = id.match(/^claude-(opus|sonnet|haiku)-(\d+)(?:-(\d+))?/);
-        if (!m)
-            continue;
-        const [, family, majorStr, minorStr] = m;
-        const major = parseInt(majorStr, 10);
-        const minor = minorStr ? parseInt(minorStr, 10) : 0;
-        const cur = best[family];
-        if (!cur || major > cur.major || (major === cur.major && minor > cur.minor)) {
-            best[family] = { id, major, minor };
-        }
-    }
-    const aliases = {};
-    for (const family of MODEL_FAMILIES) {
-        const info = best[family];
-        if (info)
-            aliases[family] = info.id;
-    }
-    return aliases;
-}
-/** 异步刷新某 baseUrl 的别名缓存（失败静默，不抛出） */
-async function refreshModelAliases(baseUrl, apiKey, requestHeaders) {
-    const cacheKey = normalizeModelGatewayUrl(baseUrl);
-    if (modelAliasInFlight.has(cacheKey))
-        return;
-    modelAliasInFlight.add(cacheKey);
-    loadPersistedModelAliases(cacheKey);
-    try {
-        const url = `${cacheKey}/models`;
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), 5000);
-        const resp = await fetch(url, {
-            signal: controller.signal,
-            headers: {
-                ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
-                ...requestHeaders,
-            },
-        });
-        clearTimeout(timer);
-        if (!resp.ok)
-            return;
-        const json = await resp.json();
-        const ids = Array.isArray(json?.data)
-            ? json.data.map((m) => m?.id).filter((x) => typeof x === 'string')
-            : [];
-        const aliases = deriveAliasesFromModelIds(ids);
-        if (ids.length > 0 || Object.keys(aliases).length > 0) {
-            const updatedAt = Date.now();
-            modelAliasCache.set(cacheKey, { aliases, ids, fetchedAt: updatedAt });
-            if (Object.keys(aliases).length > 0) {
-                const previousAliases = modelAliasFallbacks.get(cacheKey) || {};
-                const latestAliases = { ...previousAliases, ...aliases };
-                modelAliasFallbacks.set(cacheKey, latestAliases);
-                persistModelAliases(cacheKey, latestAliases, updatedAt);
-            }
-            logger.info(`[AgentRunner] Refreshed models from ${url}: ${ids.length} ids, aliases ${JSON.stringify(aliases)}`);
-        }
-    }
-    catch {
-        // 网络/解析失败：保留该网关最近一次成功结果，不打断查询
-    }
-    finally {
-        modelAliasInFlight.delete(cacheKey);
-    }
-}
-/** 将短别名展开为完整 model ID，已是完整 ID 则原样返回 */
-function resolveModelAlias(model, baseUrl) {
-    // 非短别名（已经是完整 ID）直接返回
-    if (!MODEL_FAMILIES.includes(model))
-        return model;
-    const family = model;
-    // 优先使用动态缓存
-    if (baseUrl) {
-        const cacheKey = normalizeModelGatewayUrl(baseUrl);
-        loadPersistedModelAliases(cacheKey);
-        const cached = modelAliasCache.get(cacheKey);
-        if (cached && (Date.now() - cached.fetchedAt < MODEL_ALIAS_TTL_MS)) {
-            return cached.aliases[family] || modelAliasFallbacks.get(cacheKey)?.[family] || BOOTSTRAP_MODEL_ALIASES[family];
-        }
-        return modelAliasFallbacks.get(cacheKey)?.[family] || BOOTSTRAP_MODEL_ALIASES[family];
-    }
-    return BOOTSTRAP_MODEL_ALIASES[family];
-}
 /**
  * 为支持 1M 上下文的模型追加 `[1m]` 后缀——仅在交给 SDK query() 时调用。
  * 目录与校验层始终使用不带后缀的基础 ID，避免与网关 /models 返回值（无 `[1m]`）冲突。
@@ -531,10 +347,6 @@ function applyContextWindow(modelId) {
         return `${modelId}[1m]`;
     return modelId;
 }
-/** 解析别名 + 追加 1M 后缀，得到最终交给 SDK 的 model 串。 */
-function resolveSdkModel(model, baseUrl) {
-    return applyContextWindow(resolveModelAlias(model, baseUrl));
-}
 class MessageStream {
     queue = [];
     waiting = null;
@@ -719,6 +531,20 @@ export class AgentRunner {
             ...(evolcoreSessionId ? { EVOLCORE_SESSION_ID: evolcoreSessionId } : {}),
             ...(runtimeEnv ?? {}),
         }, { lockExecutableResolution: permissionMode === 'readonly' });
+        const trustedRootFullAccess = permissionMode === 'fullaccess'
+            && typeof process.getuid === 'function'
+            && process.getuid() === 0
+            && typeof evolcoreSessionId === 'string'
+            && hasTrustedFullAccessContext(this.permissionContexts.get(evolcoreSessionId));
+        // Claude Code refuses --dangerously-skip-permissions as root unless its
+        // caller asserts that the execution is intentionally sandbox-managed.
+        // EvolCore fullaccess is an explicit daemon-owner-authorized host run, so
+        // scope this assertion to that single trusted call. Never inherit a
+        // process-wide IS_SANDBOX into ordinary or untrusted Claude sessions.
+        if (trustedRootFullAccess)
+            env.IS_SANDBOX = '1';
+        else
+            delete env.IS_SANDBOX;
         const bubblewrapPath = resolveBubblewrapPath();
         return bubblewrapPath
             ? prependExecutableDirectory(env, bubblewrapPath)
@@ -766,31 +592,22 @@ export class AgentRunner {
             },
         };
     }
+    catalogConnection() {
+        return { baseUrl: this.baseUrl, apiKey: this.apiKey, headers: this.customHeaders, queryParams: this.customQueryParams };
+    }
+    getModelCatalog() {
+        return getRunnerCatalog('claude', this.agentAid, this.catalogConnection());
+    }
     async listModels() {
-        if (this.baseUrl) {
-            const cacheKey = normalizeModelGatewayUrl(this.baseUrl);
-            loadPersistedModelAliases(cacheKey);
-            let cached = modelAliasCache.get(cacheKey);
-            const stale = !cached || (Date.now() - cached.fetchedAt > MODEL_ALIAS_TTL_MS);
-            // 缓存为空（首次打开）→ 等待刷新；缓存仅过期 → 后台刷新不阻塞
-            if (!cached) {
-                await refreshModelAliases(this.baseUrl, this.apiKey, this.customHeaders);
-                cached = modelAliasCache.get(cacheKey);
-            }
-            else if (stale) {
-                refreshModelAliases(this.baseUrl, this.apiKey, this.customHeaders);
-            }
-            // 有缓存时返回网关 /models 的全量原始 ID
-            if (cached && cached.ids.length > 0)
-                return cached.ids;
-        }
-        // 无 baseUrl / 刷新超时或失败 → 回退短别名
-        const fallback = this.baseUrl ? modelAliasFallbacks.get(normalizeModelGatewayUrl(this.baseUrl)) : undefined;
-        return Object.values({ ...BOOTSTRAP_MODEL_ALIASES, ...fallback });
+        const catalog = await this.getModelCatalog();
+        assertCatalogSelectable(catalog);
+        return catalog.models.map(m => m.id);
     }
-    /** 将短别名解析为当前代理实际使用的完整 model ID（仅用于展示，不改变持久化值） */
     resolveModelId(model) {
-        return resolveModelAlias(model, this.baseUrl);
+        return resolveCatalogModel(peekRunnerCatalog('claude', this.agentAid, this.catalogConnection()), model);
+    }
+    async getAvailableEfforts(model) {
+        return catalogEfforts(await this.getModelCatalog(), model, 'claude');
     }
     setEffort(effort) {
         this.effort = effort;
@@ -1953,13 +1770,9 @@ export class AgentRunner {
         // 记录当前 evolcore session ID，用于 Agent ctl 环境变量注入
         // 同步用户级配置到内存
         this.syncFromUserSettings();
-        // 异步刷新模型别名缓存（fire-and-forget，不阻塞查询）
+        // Run preparation and model menus resolve aliases from the same snapshot.
+        const runCatalog = await this.getModelCatalog();
         if (this.baseUrl) {
-            const cacheKey = normalizeModelGatewayUrl(this.baseUrl);
-            const cached = modelAliasCache.get(cacheKey);
-            if (!cached || (Date.now() - cached.fetchedAt > MODEL_ALIAS_TTL_MS)) {
-                refreshModelAliases(this.baseUrl, this.apiKey, this.customHeaders);
-            }
             // 顺带预热网关价格缓存（1h TTL），让本轮结束写库时已就绪
             const pricing = gatewayPricingCache.get(this.baseUrl);
             if (!pricing || (Date.now() - pricing.fetchedAt > GATEWAY_PRICING_TTL_MS)) {
@@ -2525,7 +2338,7 @@ export class AgentRunner {
         else {
             logger.info(`[AgentRunner] systemPromptAppend: none`);
         }
-        const sdkModel = resolveSdkModel(callModel, this.baseUrl);
+        const sdkModel = applyContextWindow(resolveCatalogModel(runCatalog, callModel));
         const capabilityOptions = await this.resolveCapabilityRunOptions(projectPath);
         const managedSettings = callPermissionMode === 'fullaccess'
             ? undefined
@@ -2932,16 +2745,19 @@ export class AgentRunner {
             }
         });
     }
-    runSessionCommand(prompt, agentSessionId, projectPath, modelOverride) {
-        const callModel = modelOverride?.model || this.model;
+    async runSessionCommand(prompt, agentSessionId, projectPath, modelOverride, useModel = true) {
+        const callModel = modelOverride?.model || (useModel ? this.model : undefined);
         const callEffort = (modelOverride?.effortMode === 'model_default'
             ? undefined
-            : modelOverride?.effort ?? this.effort);
+            : modelOverride?.effort ?? (useModel ? this.effort : undefined));
+        const catalog = useModel ? await this.getModelCatalog() : undefined;
+        if (catalog)
+            assertCatalogSelectable(catalog);
         return query({
             prompt,
             options: {
                 cwd: projectPath,
-                model: resolveSdkModel(callModel, this.baseUrl),
+                ...(catalog && callModel ? { model: applyContextWindow(resolveCatalogModel(catalog, callModel)) } : {}),
                 resume: agentSessionId,
                 maxTurns: 1,
                 tools: [],
@@ -2950,7 +2766,7 @@ export class AgentRunner {
                 strictMcpConfig: true,
                 settingSources: [],
                 managedSettings: buildClaudeManagedLockdownSettings(),
-                ...(callEffort ? { effort: callEffort } : {}),
+                ...(catalog && callEffort ? { effort: callEffort } : {}),
                 permissionMode: this.toSdkPermissionMode(),
                 env: this.getAgentEnv()
             }
@@ -2965,7 +2781,7 @@ export class AgentRunner {
         let lastEvent;
         try {
             logger.info(`[AgentRunner] Compacting session: session=${sessionId} agent=${agentSessionId} project=${projectPath}`);
-            const stream = this.runSessionCommand('/compact', agentSessionId, projectPath, modelOverride);
+            const stream = await this.runSessionCommand('/compact', agentSessionId, projectPath, modelOverride);
             this.activeStreams.set(sessionId, stream);
             try {
                 let boundary;
@@ -3035,7 +2851,9 @@ export class AgentRunner {
     async clearSession(sessionId, agentSessionId, projectPath) {
         try {
             logger.info(`[AgentRunner] Clearing session via SDK: ${agentSessionId}`);
-            const stream = this.runSessionCommand('/clear', agentSessionId, projectPath);
+            // Clearing is a backend lifecycle operation. It does not depend on any
+            // Session model or model configuration/selection.
+            const stream = await this.runSessionCommand('/clear', agentSessionId, projectPath, undefined, false);
             this.activeStreams.set(sessionId, stream);
             try {
                 let cleared = false;

package/dist/agents/{codex-app-server-client.js → codex/app-server-client.js}

@@ -1,16 +1,18 @@
 import { spawn } from 'child_process';
 import readline from 'readline';
-import { logger } from '../utils/logger.js';
-import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, } from '../core/permission/sandbox-runtime.js';
-import { resolveCodexLaunchCommand } from '../utils/codex-cli.js';
+import { logger } from '../../utils/logger.js';
+import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, } from '../../core/permission/sandbox-runtime.js';
+import { resolveCodexLaunchCommand } from '../../utils/codex-cli.js';
 import { createHash } from 'crypto';
-import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
+import { sanitizeShellExecutionEnvironment } from '../../core/permission/shell-environment.js';
 import fs from 'fs';
 import path from 'path';
-import { ensureProcessManagedTempDir } from '../cli/task-context.js';
-import { getPackageRoot, resolvePaths } from '../paths.js';
-import { registerCodexAppServerProcess, unregisterCodexAppServerProcess, } from '../utils/codex-app-server-registry.js';
+import { ensureProcessManagedTempDir } from '../../cli/task-context.js';
+import { getPackageRoot, resolvePaths } from '../../paths.js';
+import { killProcess } from '../../utils/cross-platform.js';
+import { registerCodexAppServerProcess, unregisterCodexAppServerProcess, } from './app-server-registry.js';
 const BUILT_IN_CODEX_PROVIDER_IDS = new Set(['openai']);
+export const CODEX_THREAD_ACTIVE_WRITER = 'THREAD_ACTIVE_WRITER';
 function tomlProviderKey(value) {
     if (!value || /[\0\r\n]/.test(value)) {
         throw new Error(`Invalid Codex provider name: ${value}`);
@@ -114,6 +116,61 @@ export class CodexAppServerClient {
             ...(options?.selectedCapabilityRoots ? { selectedCapabilityRoots: options.selectedCapabilityRoots } : {}),
         });
     }
+    async threadArchive(threadId) {
+        await this.request('thread/archive', { threadId });
+        return true;
+    }
+    async threadUnarchive(threadId) {
+        return this.request('thread/unarchive', { threadId });
+    }
+    async threadUnsubscribe(threadId) {
+        return this.request('thread/unsubscribe', { threadId });
+    }
+    /**
+     * Drop this connection's subscription and wait until the server has released
+     * the in-memory thread. This is deliberately scoped to one thread; closing
+     * the app-server process would also disrupt unrelated concurrent sessions.
+     */
+    async threadUnsubscribeAndWait(threadId, timeoutMs = 2_000) {
+        let closed = false;
+        let resolveClosed;
+        const closedPromise = new Promise(resolve => {
+            resolveClosed = resolve;
+        });
+        const removeNotificationHandler = this.onNotification(notification => {
+            if (notification.method !== 'thread/closed')
+                return;
+            const params = (notification.params || {});
+            const closedThreadId = params.threadId ?? params.thread_id;
+            if (closedThreadId !== threadId || closed)
+                return;
+            closed = true;
+            resolveClosed();
+        });
+        let timer;
+        try {
+            const response = await this.threadUnsubscribe(threadId);
+            if (response.status !== 'unsubscribed')
+                return response;
+            const timeoutPromise = new Promise((_, reject) => {
+                timer = setTimeout(() => {
+                    if (closed)
+                        return;
+                    const error = new Error(`thread/closed timed out for thread ${threadId}`);
+                    error.code = 'CODEX_THREAD_CLOSE_TIMEOUT';
+                    reject(error);
+                }, timeoutMs);
+                timer.unref?.();
+            });
+            await Promise.race([closedPromise, timeoutPromise]);
+            return response;
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            removeNotificationHandler();
+        }
+    }
     async turnStart(threadId, input, options) {
         const sandboxPolicy = this.toTurnSandboxPolicy(options?.sandbox);
         return this.request('turn/start', {
@@ -126,6 +183,14 @@ export class CodexAppServerClient {
             ...(options?.effort ? { effort: options.effort } : {}),
         });
     }
+    async turnSteer(threadId, expectedTurnId, input, additionalContext) {
+        return this.request('turn/steer', {
+            threadId,
+            expectedTurnId,
+            input,
+            ...(additionalContext ? { additionalContext } : {}),
+        });
+    }
     toTurnSandboxPolicy(sandbox) {
         if (!sandbox)
             return undefined;
@@ -286,8 +351,8 @@ export class CodexAppServerClient {
         await this.request('turn/interrupt', { threadId, turnId });
         return true;
     }
-    async modelList(includeHidden = false) {
-        return this.request('model/list', { includeHidden });
+    async modelList(includeHidden = false, cursor) {
+        return this.request('model/list', { includeHidden, ...(cursor ? { cursor } : {}) });
     }
     async modelProviderCapabilitiesRead() {
         return this.request('modelProvider/capabilities/read', {});
@@ -332,7 +397,10 @@ export class CodexAppServerClient {
         }
         // 优雅关闭：先关闭 stdin，然后发送 SIGTERM，等待进程退出
         proc.stdin.end();
-        proc.kill('SIGTERM');
+        if (process.platform === 'win32' && proc.pid)
+            killProcess(proc.pid, false);
+        else
+            proc.kill('SIGTERM');
         // 等待进程退出，最多等待 5 秒
         await new Promise((resolve) => {
             let exited = false;
@@ -341,7 +409,10 @@ export class CodexAppServerClient {
                     return;
                 logger.warn('[CodexAppServer] Process did not exit after SIGTERM, sending SIGKILL');
                 try {
-                    proc.kill('SIGKILL');
+                    if (process.platform === 'win32' && proc.pid)
+                        killProcess(proc.pid, true);
+                    else
+                        proc.kill('SIGKILL');
                 }
                 catch { }
                 resolve();
@@ -416,6 +487,7 @@ export class CodexAppServerClient {
                 const managedRequirements = this.ensureManagedHookRuntime();
                 const guardedCommand = buildHClassGuardCommand(command, commandArgs, guardRoot, {
                     managedCodexRequirements: managedRequirements,
+                    protectEvolcoreFilesystem: this.options.protectEvolcoreFilesystem !== false,
                 });
                 if (!guardedCommand) {
                     throw new Error('Codex 缺少 EvolCore managed-hook 隔离运行时，已拒绝启动 app-server');
@@ -561,8 +633,8 @@ export class CodexAppServerClient {
                 }
                 const stat = fs.lstatSync(runtimeLockDir);
                 if (!stat.isDirectory() || stat.isSymbolicLink()
-                    || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
-                    || (stat.mode & 0o077) !== 0) {
+                    || (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                    || (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
                     throw new Error('runtime lock directory is not private');
                 }
                 env.EVOLCORE_RUNTIME_LOCK_DIR = runtimeLockDir;
@@ -613,7 +685,10 @@ export class CodexAppServerClient {
             // second command or changing the hook's behavior.
             if (!command || !hook || /[\r\n;&|<>]/.test(command))
                 return false;
-            return command.replace(/["']+$/, '').endsWith(hook);
+            const commandWithoutSocket = command
+                .replace(/\s+%EVOLCORE_INSTANCE_SOCKET%\s*$/i, '')
+                .trim();
+            return commandWithoutSocket.replace(/["']+$/, '').endsWith(hook);
         };
         const managedHookLoaded = Array.isArray(preToolUse)
             && preToolUse.some(group => {
@@ -659,7 +734,7 @@ export class CodexAppServerClient {
         const headerEnvNames = Object.fromEntries(Object.keys(this.options.headers ?? {}).map(name => [name, codexHeaderEnvName(name)]));
         const hasHeaders = Object.keys(headerEnvNames).length > 0;
         const hasQueryParams = Object.keys(this.options.queryParams ?? {}).length > 0;
-        if (hasHeaders || hasQueryParams) {
+        if (hasHeaders || hasQueryParams || this.options.baseUrl || this.options.provider) {
             const configuredProvider = this.options.provider?.trim();
             const useRuntimeProvider = !configuredProvider || BUILT_IN_CODEX_PROVIDER_IDS.has(configuredProvider.toLowerCase());
             const providerName = !useRuntimeProvider
@@ -765,8 +840,19 @@ export class CodexAppServerClient {
         this.pending.delete(messageId);
         if (message.error) {
             const detail = typeof message.error?.message === 'string' ? message.error.message : JSON.stringify(message.error);
-            const stderr = this.stderrBuffer.length ? `\n${this.stderrBuffer.join('\n')}` : '';
-            pending.reject(new Error(`${pending.method} failed: ${detail}${stderr}`));
+            // The CLI's one-time bubblewrap configuration warning is process-wide
+            // startup noise, not evidence about this RPC. Do not append it to an
+            // unrelated request failure such as thread/resume.
+            const stderrLines = this.stderrBuffer.filter(line => !/could not find bubblewrap on PATH/i.test(line));
+            const stderr = stderrLines.length ? `\n${stderrLines.join('\n')}` : '';
+            const error = new Error(`${pending.method} failed: ${detail}${stderr}`);
+            if (/no rollout found for thread id/i.test(detail)) {
+                error.code = 'CODEX_ROLLOUT_NOT_FOUND';
+            }
+            else if (/already has an active writer/i.test(detail)) {
+                error.code = CODEX_THREAD_ACTIVE_WRITER;
+            }
+            pending.reject(error);
             return;
         }
         pending.resolve(message.result ?? null);

package/dist/{utils/codex-app-server-registry.js → agents/codex/app-server-registry.js}

@@ -1,7 +1,7 @@
 import fs from 'fs';
 import path from 'path';
-import { resolvePaths } from '../paths.js';
-import { getProcessStartTime } from './process-introspect.js';
+import { resolvePaths } from '../../paths.js';
+import { getProcessStartTime } from '../../utils/process-introspect.js';
 const CODEX_APP_SERVER_RECORD_PREFIX = 'codex-app-server-';
 const CODEX_APP_SERVER_RECORD_SUFFIX = '.json';
 function recordFilePath(pid) {

package/dist/agents/codex/catalog.js

@@ -0,0 +1,70 @@
+import { execFile } from 'node:child_process';
+import { CodexAppServerClient } from './app-server-client.js';
+import { resolveCodexLaunchCommand } from '../../utils/codex-cli.js';
+import { parseModelList } from '../../core/model/catalog-service.js';
+async function cliModels() {
+    const launch = resolveCodexLaunchCommand(['debug', 'models']);
+    if (!launch)
+        return null;
+    return new Promise(resolve => {
+        execFile(launch.command, launch.args, { timeout: 3000, windowsHide: true, maxBuffer: 16 * 1024 * 1024, encoding: 'utf8' }, (error, stdout) => {
+            try {
+                if (error)
+                    return resolve(null);
+                const json = JSON.parse(stdout);
+                if (!Array.isArray(json?.models))
+                    return resolve(null);
+                resolve(parseModelList(json.models.filter((m) => m.visibility === 'list'))
+                    .map(m => ({ ...m, verification: 'unverified' })));
+            }
+            catch {
+                resolve(null);
+            }
+        });
+    });
+}
+/** A catalog-only client uses the same transport configuration as inference. */
+export async function codexNativeCatalog(context) {
+    if (context.baseagent !== 'codex')
+        return null;
+    const client = new CodexAppServerClient({
+        apiKey: context.apiKey ?? '', baseUrl: context.baseUrl, provider: context.provider,
+        headers: context.headers, queryParams: context.queryParams,
+    });
+    let timer;
+    let expired = false;
+    try {
+        return await Promise.race([
+            (async () => {
+                const models = [];
+                const seen = new Set();
+                let cursor;
+                do {
+                    const page = await client.modelList(false, cursor);
+                    if (expired)
+                        throw new Error('Model catalog timeout');
+                    if (!Array.isArray(page.data))
+                        throw new Error('Invalid native model list');
+                    models.push(...parseModelList(page.data.filter(m => !m.hidden)));
+                    cursor = page.nextCursor || undefined;
+                    if (cursor && (seen.has(cursor) || seen.size >= 100))
+                        throw new Error('Invalid native model pagination');
+                    if (cursor)
+                        seen.add(cursor);
+                } while (cursor);
+                return [...new Map(models.map(m => [m.id, m])).values()];
+            })(),
+            new Promise((_, reject) => { timer = setTimeout(() => { expired = true; reject(new Error('Model catalog timeout')); }, 5000); }),
+        ]);
+    }
+    catch {
+        // The host CLI catalog has no guarantee of matching this Agent connection.
+        // It is useful metadata/suggestions and always remains unverified.
+        return await cliModels();
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        await client.close();
+    }
+}