evolcore 0.0.21 → 0.0.23

package/dist/agents/codex-runner.js

@@ -1,16 +1,10 @@
-/**
- * Codex Agent Runner
- *
- * Integrates Codex app-server as an agent backend.
- * Implements the same interface surface as AgentRunner (claude-runner.ts)
- * so MessageProcessor and CommandHandler can work with it transparently.
- */
+import { getRunnerCatalog, catalogEfforts, assertCatalogSelectable } from '../core/model/model-catalog.js';
 import { hasTrustedFullAccessContext } from './runner-types.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/permission/protected-paths.js';
-import { CodexAppServerClient } from './codex-app-server-client.js';
+import { CODEX_THREAD_ACTIVE_WRITER, CodexAppServerClient, } from './codex/app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
@@ -21,7 +15,7 @@ import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, parseCodexToolCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, hasPowerShellDelegationAssignment, normalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
 import { ensureProcessManagedTempDir, getManagedTaskTempDir } from '../cli/task-context.js';
@@ -47,6 +41,7 @@ export function formatApprovalLogSummary(summary) {
         return singleLine;
     return singleLine.slice(0, APPROVAL_LOG_SUMMARY_MAX_LENGTH - 3).trimEnd() + '...';
 }
+// ── Codex 模型目录（动态获取，含 effort） ──
 class AsyncEventQueue {
     queue = [];
     done = false;
@@ -83,6 +78,18 @@ class AsyncEventQueue {
         }
     }
 }
+function errorCodeForToolDenial(decisionSource, policyCode) {
+    if (decisionSource === 'policy')
+        return 'POLICY_DENIED';
+    if (decisionSource === 'approval')
+        return 'USER_DENIED';
+    if (policyCode && /delegation|carrier/i.test(policyCode))
+        return 'DELEGATION_FAILED';
+    if (policyCode && /argument|canonical|quote|shell/i.test(policyCode))
+        return 'INVALID_ARGUMENT';
+    return 'EXECUTION_FAILED';
+}
+const CODEX_THREAD_HANDOFF_TIMEOUT_MS = 2_000;
 const managedTempDirsForExitCleanup = new Map();
 let managedTempExitCleanupRegistered = false;
 function isTrustedManagedTempDirectory(directory, parent) {
@@ -98,9 +105,9 @@ function isTrustedManagedTempDirectory(directory, parent) {
             const stat = fs.lstatSync(candidate);
             if (!stat.isDirectory() || stat.isSymbolicLink())
                 return false;
-            if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            if (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())
                 return false;
-            return (stat.mode & 0o077) === 0;
+            return process.platform === 'win32' || (stat.mode & 0o077) === 0;
         };
         if (!trustedDirectory(parentPath) || !trustedDirectory(directoryPath))
             return false;
@@ -150,15 +157,74 @@ function stableSecurityValue(value) {
 function externalToolConfigFingerprint(config) {
     return createHash('sha256').update(stableSecurityValue(config)).digest('hex');
 }
-const CODEX_CATALOG_FALLBACK = [
-    { slug: 'gpt-5.5', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.4', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.4-mini', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.3-codex', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.2', efforts: ['low', 'medium', 'high', 'xhigh'] },
-];
+/**
+ * Codex can surface a managed hook rejection as item output instead of an
+ * app-server approval request. Preserve the policy boundary in that path too
+ * so downstream audit/event consumers never infer a successful execution.
+ */
+function parseManagedPreToolUseDenial(value) {
+    let text;
+    if (typeof value === 'string')
+        text = value;
+    else if (value == null)
+        return undefined;
+    else {
+        try {
+            text = JSON.stringify(value) ?? '';
+        }
+        catch {
+            text = String(value);
+        }
+    }
+    const marker = /(?:Command|Tool call) blocked by PreToolUse hook\s*:\s*/i.exec(text);
+    if (!marker)
+        return undefined;
+    let reason = text.slice((marker.index ?? 0) + marker[0].length)
+        .replace(/\s*\.\s*(?:Command|Tool):[\s\S]*$/i, '')
+        .replace(/(?:^|\s)(?:Command|Tool):[\s\S]*$/i, '')
+        .trim();
+    if (!reason)
+        reason = 'EvolCore PreToolUse policy denied this tool call';
+    const policyCode = /工具调用已达到\s*\d+\s*次/.test(reason)
+        ? 'proactive_tool_report_required'
+        : /请先用\s+ec\s+(?:group\s+send|msg\s+send)/.test(reason)
+            ? 'proactive_first_send_required'
+            : 'managed_pre_tool_use_denied';
+    return { policyCode, reason };
+}
+function outputTextForManagedHook(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value == null)
+        return '';
+    if (Array.isArray(value))
+        return value.map(outputTextForManagedHook).filter(Boolean).join('\n');
+    if (typeof value === 'object') {
+        const record = value;
+        if (typeof record.text === 'string')
+            return record.text;
+        if (typeof record.message === 'string')
+            return record.message;
+        try {
+            return JSON.stringify(value) ?? '';
+        }
+        catch {
+            return String(value);
+        }
+    }
+    return String(value);
+}
 const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
-let codexCatalogCache = null;
+const CODEX_NO_ROLLOUT_RE = /no rollout found for thread id/i;
+const CODEX_ACTIVE_WRITER_RE = /already has an active writer/i;
+function isCodexNoRolloutError(error) {
+    return error?.code === 'CODEX_ROLLOUT_NOT_FOUND'
+        || CODEX_NO_ROLLOUT_RE.test(error instanceof Error ? error.message : String(error));
+}
+function isCodexActiveWriterError(error) {
+    return error?.code === CODEX_THREAD_ACTIVE_WRITER
+        || CODEX_ACTIVE_WRITER_RE.test(error instanceof Error ? error.message : String(error));
+}
 // The permission bridge is version-locked to the audited approval schema and
 // managed PreToolUse hook behavior used by proactive first-tool enforcement.
 export const MIN_CODEX_CLI_VERSION = '0.144.1';
@@ -213,37 +279,6 @@ export function getCodexAppServerAvailability() {
 export function isCodexAppServerAvailable() {
     return getCodexAppServerAvailability().available;
 }
-function fetchCodexCatalog() {
-    if (codexCatalogCache)
-        return codexCatalogCache;
-    try {
-        const output = execCodexCliSync(['debug', 'models'], {
-            encoding: 'utf-8',
-            timeout: 5000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        const catalog = JSON.parse(output);
-        const models = catalog.models
-            .filter(m => m.visibility === 'list')
-            .map(m => ({
-            slug: m.slug,
-            efforts: (m.supported_reasoning_levels || []).map(l => l.effort),
-        }));
-        if (models.length > 0) {
-            codexCatalogCache = models;
-            return models;
-        }
-    }
-    catch (e) {
-        logger.debug(`[CodexRunner] Failed to fetch model catalog, using fallback: ${e}`);
-    }
-    return CODEX_CATALOG_FALLBACK;
-}
-export function getCodexEfforts(model) {
-    const catalog = fetchCodexCatalog();
-    const entry = catalog.find(m => m.slug === model);
-    return entry?.efforts ?? catalog[0]?.efforts ?? ['low', 'medium', 'high'];
-}
 // ── Codex Runner ──
 export class CodexRunner {
     name = 'codex';
@@ -256,18 +291,30 @@ export class CodexRunner {
     activeAbortControllers = new Map();
     activeStreams = new Map();
     activeSessions = new Map(); // sessionId → threadId
+    /** Threads created/resumed for a turn but not yet durably admitted by turn/start. */
+    provisionalSessions = new Map();
     activeTurns = new Map();
+    activeSubagentTurns = new Map();
     threadProjectPaths = new Map();
+    /** Child Codex threads inherit the EvolCore session that started them. */
+    childThreadSessions = new Map();
     sessionTempDirs = new Map();
     managedTempNonce = randomBytes(16).toString('hex');
     threadExternalToolFingerprints = new Map();
     threadExternalToolBoundaries = new Map();
     trackedApprovalItems = new Map();
+    pendingToolDenials = new Map();
     threadDelegationCarriers = new Map();
     pendingInterrupts = new Map();
+    steeringTails = new Map();
     threadOperationLocks = new Map();
     activeOperationReleases = new Map();
+    /** Last app-server client that loaded each thread, including unsubscribed threads. */
+    threadSubscriptions = new Map();
+    /** Ordinary sessions stay behind the EvolCore H/L filesystem guard. */
     appServerClient = null;
+    /** Trusted fullaccess calls use a separate unmasked app-server process. */
+    fullAccessAppServerClient = null;
     onSessionIdUpdate;
     onCompactStart;
     permissionGateway;
@@ -308,43 +355,228 @@ export class CodexRunner {
             this.effort = this.resolvedConfig.effort;
         this.onSessionIdUpdate = callbacks.onSessionIdUpdate;
     }
-    getAppServerClient() {
-        if (!this.appServerClient) {
-            const client = new CodexAppServerClient({
-                apiKey: this.resolvedConfig.apiKey,
-                baseUrl: this.resolvedConfig.baseUrl,
-                provider: this.resolvedConfig.provider,
-                headers: this.resolvedConfig.headers,
-                queryParams: this.resolvedConfig.queryParams,
-                model: this.model,
-                effort: this.effort,
-                enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,
-                approvalsReviewer: 'user',
-                onServerRequest: request => this.handleAppServerRequest(request),
-            });
-            client.onNotification(notification => this.trackApprovalItemNotification(notification));
+    getAppServerClient(fullAccess = false) {
+        const existing = fullAccess ? this.fullAccessAppServerClient : this.appServerClient;
+        if (existing)
+            return existing;
+        const client = new CodexAppServerClient({
+            apiKey: this.resolvedConfig.apiKey,
+            baseUrl: this.resolvedConfig.baseUrl,
+            provider: this.resolvedConfig.provider,
+            headers: this.resolvedConfig.headers,
+            queryParams: this.resolvedConfig.queryParams,
+            model: this.model,
+            effort: this.effort,
+            enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,
+            approvalsReviewer: 'user',
+            protectEvolcoreFilesystem: !fullAccess,
+            // A completed turn is explicitly unsubscribed below. This is only an
+            // optimization on newer Codex versions; old versions retain the thread
+            // until the cross-client archive fallback runs.
+            onServerRequest: request => this.handleAppServerRequest(request),
+        });
+        client.onNotification(notification => {
+            this.trackApprovalItemNotification(notification);
+            if (notification.method !== 'thread/closed')
+                return;
+            const params = (notification.params || {});
+            const threadId = params.threadId ?? params.thread_id;
+            if (typeof threadId !== 'string')
+                return;
+            const subscription = this.threadSubscriptions.get(threadId);
+            if (subscription?.client === client) {
+                // Keep the last client identity so a later same-mode turn resumes on
+                // the same app-server even after the runtime has fully unloaded.
+                this.threadSubscriptions.set(threadId, { client, state: 'unsubscribed' });
+            }
+        });
+        if (fullAccess) {
+            this.fullAccessAppServerClient = client;
+        }
+        else {
             this.appServerClient = client;
         }
-        return this.appServerClient;
+        return client;
+    }
+    getAppServerClientForThread(threadId) {
+        const subscribed = this.threadSubscriptions.get(threadId);
+        if (subscribed)
+            return subscribed.client;
+        const sessionId = this.findSessionKeyByThread(threadId);
+        return this.getAppServerClient(sessionId ? this.chatModes.get(sessionId) === 'fullaccess' : false);
+    }
+    markThreadSubscribed(client, threadId) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (existing?.client === client && existing.state === 'subscribed' && !existing.release)
+            return;
+        this.threadSubscriptions.set(threadId, { client, state: 'subscribed' });
+    }
+    /**
+     * Release only one thread from one app-server connection. Unsubscribe is
+     * intentionally not treated as an immediate unload: current Codex builds can
+     * keep an unsubscribed thread loaded for a long grace period. The owner therefore
+     * remains in the map until a different client successfully resumes it.
+     */
+    async releaseThreadSubscription(client, threadId, reason, options = {}) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (existing && existing.client !== client)
+            return false;
+        if (existing?.release)
+            return await existing.release.catch(error => {
+                logger.warn(`[CodexRunner] Existing thread release failed: thread=${threadId} `
+                    + `error=${error instanceof Error ? error.message : String(error)}`);
+                return false;
+            });
+        if (existing?.state === 'unsubscribed')
+            return true;
+        let releasePromise;
+        releasePromise = Promise.resolve().then(async () => {
+            let released = false;
+            try {
+                const unsubscribe = client.threadUnsubscribe;
+                if (typeof unsubscribe === 'function') {
+                    if (options.waitForClose && typeof client.threadUnsubscribeAndWait === 'function') {
+                        try {
+                            await client.threadUnsubscribeAndWait.call(client, threadId, options.timeoutMs ?? CODEX_THREAD_HANDOFF_TIMEOUT_MS);
+                        }
+                        catch (error) {
+                            // The unsubscribe RPC has already succeeded when this is a
+                            // close-timeout. Keep the owner marked unsubscribed and let the
+                            // target resume decide whether the archive fallback is needed.
+                            if (error?.code !== 'CODEX_THREAD_CLOSE_TIMEOUT')
+                                throw error;
+                            logger.debug(`[CodexRunner] thread/closed not observed before handoff timeout: `
+                                + `thread=${threadId} reason=${reason}`);
+                        }
+                    }
+                    else {
+                        await unsubscribe.call(client, threadId);
+                    }
+                }
+                logger.debug(`[CodexRunner] Released thread subscription: thread=${threadId} reason=${reason}`);
+                released = true;
+                return true;
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] Failed to release thread subscription: thread=${threadId} reason=${reason} `
+                    + `error=${error instanceof Error ? error.message : String(error)}`);
+                return false;
+            }
+            finally {
+                const current = this.threadSubscriptions.get(threadId);
+                if (current?.client === client && current.release === releasePromise) {
+                    if (released) {
+                        this.threadSubscriptions.set(threadId, { client, state: 'unsubscribed' });
+                    }
+                    else {
+                        this.threadSubscriptions.set(threadId, { client, state: current.state });
+                    }
+                }
+            }
+        });
+        this.threadSubscriptions.set(threadId, {
+            client,
+            state: existing?.state ?? 'subscribed',
+            release: releasePromise,
+        });
+        return await releasePromise;
+    }
+    async prepareThreadSubscription(client, threadId) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (!existing)
+            return undefined;
+        if (existing.client === client) {
+            if (existing.release)
+                await existing.release.catch(() => undefined);
+            return undefined;
+        }
+        if (existing.state === 'subscribed') {
+            const released = await this.releaseThreadSubscription(existing.client, threadId, 'mode-handoff', {
+                waitForClose: true,
+                timeoutMs: CODEX_THREAD_HANDOFF_TIMEOUT_MS,
+            });
+            if (!released) {
+                const error = new Error(`Codex thread ${threadId} is still owned by another app-server connection`);
+                error.code = CODEX_THREAD_ACTIVE_WRITER;
+                throw error;
+            }
+        }
+        return existing.client;
+    }
+    async archiveThreadForHandoff(sourceClient, targetClient, threadId) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (existing && existing.client !== sourceClient) {
+            const error = new Error(`Codex thread ${threadId} ownership changed during handoff`);
+            error.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw error;
+        }
+        const sessionId = this.findSessionKeyByThread(threadId);
+        if ([...this.activeSubagentTurns.values()].some(active => active.sessionId === sessionId && active.parentThreadId === threadId)) {
+            const error = new Error(`Codex thread ${threadId} has an active descendant turn`);
+            error.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw error;
+        }
+        // Old app-server versions can acknowledge unsubscribe while retaining the
+        // writer. Archive is the only per-thread operation that synchronously
+        // tears down that runtime; the target client restores it before resume.
+        const archive = sourceClient.threadArchive;
+        const unarchive = targetClient.threadUnarchive;
+        if (typeof archive !== 'function' || typeof unarchive !== 'function') {
+            const error = new Error(`Codex thread ${threadId} requires archive/unarchive handoff support`);
+            error.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw error;
+        }
+        let archived = false;
+        try {
+            await archive.call(sourceClient, threadId);
+            archived = true;
+            await unarchive.call(targetClient, threadId);
+        }
+        catch (error) {
+            if (archived) {
+                // Do not strand the user's rollout under archived_sessions when the
+                // target client fails midway through the compatibility handoff.
+                try {
+                    await unarchive.call(sourceClient, threadId);
+                    this.threadSubscriptions.set(threadId, { client: sourceClient, state: 'subscribed' });
+                }
+                catch (restoreError) {
+                    logger.error(`[CodexRunner] Failed to restore archived thread after handoff failure: thread=${threadId} `
+                        + `error=${restoreError instanceof Error ? restoreError.message : String(restoreError)}`);
+                }
+            }
+            logger.warn(`[CodexRunner] Archive handoff failed: thread=${threadId} `
+                + `error=${error instanceof Error ? error.message : String(error)}`);
+            const handoffError = new Error(`Codex thread ${threadId} is still owned by another app-server connection`);
+            handoffError.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw handoffError;
+        }
+        this.threadSubscriptions.set(threadId, { client: targetClient, state: 'subscribed' });
     }
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommand(command, managedTempDir, dialect = 'posix') {
+    approvedLiteralEvolcoreCommand(command, managedTempDir, dialect = 'posix', expectedDelegationToken, executable) {
         const parseOptions = {
             allowManagedTmpDir: true,
             dialect,
+            verifyShellExecutable: process.platform === 'win32',
             ...(managedTempDir ? { managedTempDir } : {}),
+            ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
         };
         const classification = classifyEvolcoreShellCommand(command, parseOptions);
         if (classification.kind === 'bounded-output')
             return { argv: classification.command.argv };
         // Keep the approval/delegation parser aligned with the preflight parser:
         // the session-managed `$TMPDIR` token is a permitted EC path reference.
-        const parsed = parseLiteralShellCommand(command, parseOptions);
+        const parsed = executable
+            ? parseCodexCarrierCommand({ command, dialect, executable }, parseOptions)
+            : dialect === 'powershell'
+                ? parseCodexCarrierCommand({ command, dialect }, parseOptions)
+                : parseLiteralShellCommand(command, parseOptions);
         if (!parsed.ok)
             return { parseFailure: parsed };
-        if (parsed.argv[0] !== 'ec')
+        if (normalizeEvolcoreCommandArgv(parsed.argv)[0] !== 'ec')
             return {};
         if (containsLiteralManagedTmpDirOutsideSendContent(parsed.argv)) {
             return { parseFailure: {
@@ -355,14 +587,17 @@ export class CodexRunner {
                     inputLength: command.length,
                 } };
         }
-        return { argv: parsed.argv };
+        return {
+            argv: normalizeEvolcoreCommandArgv(parsed.argv),
+            ...(parsed.delegationToken ? { delegationToken: parsed.delegationToken } : {}),
+        };
     }
-    resolveCanonicalEcApproval(toolInput, managedTempDir) {
+    resolveCanonicalEcApproval(toolInput, managedTempDir, expectedDelegationToken) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
             : undefined;
-        if (explicitArgv?.[0] === 'ec') {
+        if (explicitArgv && normalizeEvolcoreCommandArgv(explicitArgv)[0] === 'ec') {
             if (explicitArgv.some(value => value.includes('\0'))) {
                 return { parseFailure: {
                         issue: 'invalid-control-char', offset: 0,
@@ -372,16 +607,19 @@ export class CodexRunner {
             }
             return containsLiteralManagedTmpDirOutsideSendContent(explicitArgv)
                 ? { parseFailure: { issue: 'unsafe-expansion', offset: 0, tokenIndex: 0, dialect: 'posix', inputLength: 0 } }
-                : { argv: explicitArgv };
+                : { argv: normalizeEvolcoreCommandArgv(explicitArgv) };
         }
         const explicitCarrier = explicitArgv
             ? resolveCodexShellCarrierArgv(explicitArgv)
             : undefined;
         if (explicitCarrier !== undefined) {
-            return this.approvedLiteralEvolcoreCommand(explicitCarrier.command, managedTempDir, explicitCarrier.dialect);
+            return this.approvedLiteralEvolcoreCommand(explicitCarrier.command, managedTempDir, explicitCarrier.dialect, expectedDelegationToken, explicitCarrier.executable);
         }
         if (hasCodexCmdCarrierEcIntent(toolInput)) {
-            const parsed = parseCodexToolCommand(toolInput);
+            const parsed = parseCodexToolCommand(toolInput, {
+                verifyShellExecutable: process.platform === 'win32',
+                ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
+            });
             if (!parsed.ok)
                 return { parseFailure: parsed };
             if (parsed.argv[0] === 'ec') {
@@ -390,7 +628,10 @@ export class CodexRunner {
                             issue: 'unsafe-expansion', offset: 0, tokenIndex: 0,
                             dialect: 'cmd', inputLength: 0,
                         } }
-                    : { argv: parsed.argv };
+                    : {
+                        argv: normalizeEvolcoreCommandArgv(parsed.argv),
+                        ...(parsed.delegationToken ? { delegationToken: parsed.delegationToken } : {}),
+                    };
             }
             const command = typeof toolInput.command === 'string' ? toolInput.command : '';
             const classification = classifyEvolcoreShellCommand(command, { dialect: 'cmd' });
@@ -407,7 +648,9 @@ export class CodexRunner {
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         const canonicalCommand = parseCodexShellCommandArgv(command, {
             allowManagedTmpDir: true,
+            verifyShellExecutable: process.platform === 'win32',
             ...(managedTempDir ? { managedTempDir } : {}),
+            ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
         });
         if (canonicalCommand?.[0] === 'ec') {
             return containsLiteralManagedTmpDirOutsideSendContent(canonicalCommand)
@@ -436,11 +679,14 @@ export class CodexRunner {
     isManagedEvolcoreCommandIntent(toolInput) {
         if (Array.isArray(toolInput.commandArgv)) {
             const rawArgv = toolInput.commandArgv;
-            if (rawArgv[0] === 'ec')
-                return true;
             if (!rawArgv.every(value => typeof value === 'string'))
                 return false;
+            if (normalizeEvolcoreCommandArgv(rawArgv)[0] === 'ec')
+                return true;
             const shellCarrier = resolveCodexShellCarrierArgv(rawArgv);
+            if (shellCarrier?.dialect === 'powershell'
+                && hasPowerShellDelegationAssignment(shellCarrier.command))
+                return true;
             return hasCodexCmdCarrierEcIntent(toolInput)
                 || shellCarrier !== undefined
                     && classifyEvolcoreShellCommand(shellCarrier.command, {
@@ -451,7 +697,7 @@ export class CodexRunner {
         return classifyEvolcoreShellCommand(command).kind !== 'none';
     }
     armApprovedDelegationCommand(sessionId, argv) {
-        const threadId = this.activeSessions.get(sessionId);
+        const threadId = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
         const carrierToken = threadId ? this.threadDelegationCarriers.get(threadId) : undefined;
         const commandHash = hashDelegatedCommandArgv(argv);
         const arm = this.permissionContexts.get(sessionId)?.armApprovedDelegationCommand;
@@ -465,6 +711,21 @@ export class CodexRunner {
             return false;
         }
     }
+    delegationCarrierForSession(sessionId, threadId) {
+        const candidates = [
+            threadId,
+            this.activeSessions.get(sessionId),
+            this.provisionalSessions.get(sessionId),
+        ];
+        for (const candidate of candidates) {
+            if (!candidate)
+                continue;
+            const carrier = this.threadDelegationCarriers.get(candidate);
+            if (carrier)
+                return carrier;
+        }
+        return undefined;
+    }
     async readThreadDelegationCarrier(appServer, threadId) {
         try {
             const result = await appServer.threadShellCommand(threadId, `node -e "process.stdout.write(process.env.${AGENT_DELEGATION_TOKEN_ENV}||String())"`);
@@ -497,6 +758,49 @@ export class CodexRunner {
             return undefined;
         }
     }
+    async commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn) {
+        if (this.provisionalSessions.get(sessionId) !== threadId)
+            return false;
+        const bindingResult = this.onSessionIdUpdate
+            ? ((turn === undefined
+                ? await this.onSessionIdUpdate(sessionId, threadId)
+                : await this.onSessionIdUpdate(sessionId, threadId, { turn }))
+                ?? 'legacy_updated')
+            : 'legacy_updated';
+        const bindingAccepted = bindingResult === 'activated'
+            || bindingResult === 'already_active'
+            || bindingResult === 'legacy_updated';
+        if (!bindingAccepted) {
+            const error = new Error(`backend discovery rejected: ${bindingResult}`);
+            error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+            throw error;
+        }
+        this.provisionalSessions.delete(sessionId);
+        this.activeSessions.set(sessionId, threadId);
+        if (carrierToPublish) {
+            this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+            await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
+        }
+        this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
+        return true;
+    }
+    cleanupProvisionalThread(sessionId, threadId) {
+        if (this.provisionalSessions.get(sessionId) !== threadId)
+            return;
+        this.provisionalSessions.delete(sessionId);
+        this.threadProjectPaths.delete(threadId);
+        this.threadDelegationCarriers.delete(threadId);
+        this.unbindExternalToolBoundary(threadId);
+        this.clearTrackedApprovalItemsForThread(threadId);
+        // A stale provisional start can finish after a replacement run has
+        // already activated another parent thread for this session. Do not tear
+        // down the replacement run's child mappings in that race.
+        const activeParentThread = this.activeSessions.get(sessionId);
+        if (!activeParentThread || activeParentThread === threadId) {
+            this.cleanupChildThreadsForSession(sessionId);
+        }
+        this.pruneThreadOperationLocks();
+    }
     async persistDelegationCarrier(sessionManager, sessionId, threadId, carrier) {
         if (typeof sessionManager?.getSessionById !== 'function')
             return;
@@ -523,15 +827,28 @@ export class CodexRunner {
         }
     }
     resetAppServerClient() {
-        const client = this.appServerClient;
+        const clients = [this.appServerClient, this.fullAccessAppServerClient]
+            .filter((client) => !!client);
         this.appServerClient = null;
+        this.fullAccessAppServerClient = null;
+        this.threadSubscriptions.clear();
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
+        for (const childThreadId of this.childThreadSessions.keys())
+            this.threadProjectPaths.delete(childThreadId);
+        // Child turn ids belong to the discarded app-server connection. Keeping
+        // them would make a later session interrupt attempt target stale threads
+        // through the replacement client.
+        this.activeSubagentTurns.clear();
+        this.childThreadSessions.clear();
         this.trackedApprovalItems.clear();
+        this.pendingToolDenials.clear();
         this.threadDelegationCarriers.clear();
-        client?.close().catch(error => {
-            logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
-        });
+        for (const client of clients) {
+            client.close().catch(error => {
+                logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
+            });
+        }
     }
     mergeThreadConfig(...configs) {
         const merged = {};
@@ -779,19 +1096,16 @@ export class CodexRunner {
     // ── ModelSwitcher ──
     setModel(model) { this.model = model; this.resetAppServerClient(); }
     getModel() { return this.model; }
+    getModelCatalog() {
+        return getRunnerCatalog('codex', this.resolvedConfig.agentAid, this.resolvedConfig);
+    }
     async listModels() {
-        try {
-            const response = await this.getAppServerClient().modelList(false);
-            const ids = (response.data ?? [])
-                .map(model => model.id || model.slug || model.name || model.model)
-                .filter((id) => typeof id === 'string' && id.length > 0);
-            if (ids.length > 0)
-                return ids;
-        }
-        catch (error) {
-            logger.debug(`[CodexRunner] app-server model/list failed, using catalog fallback: ${error}`);
-        }
-        return fetchCodexCatalog().map(m => m.slug);
+        const catalog = await this.getModelCatalog();
+        assertCatalogSelectable(catalog);
+        return catalog.models.map(m => m.id);
+    }
+    async getAvailableEfforts(model) {
+        return catalogEfforts(await this.getModelCatalog(), model, 'codex');
     }
     // ── Effort ──
     setEffort(effort) { this.effort = effort; this.resetAppServerClient(); }
@@ -848,7 +1162,9 @@ export class CodexRunner {
             if (!looksLikeGitMetadataDirectory(resolved))
                 return;
             paths.add(resolved);
-            paths.add(path.join(resolved, '**'));
+            // Keep exact paths native, but Codex requires POSIX separators for
+            // recursive filesystem globs even on Windows.
+            paths.add(`${resolved}/**`);
         };
         try {
             const stat = fs.statSync(marker);
@@ -862,7 +1178,7 @@ export class CodexRunner {
             }
         }
         catch { }
-        for (const gitDirectory of [...paths].filter(candidate => !candidate.endsWith(`${path.sep}**`))) {
+        for (const gitDirectory of [...paths].filter(candidate => !candidate.endsWith('/**'))) {
             try {
                 const commonDirectory = fs.readFileSync(path.join(gitDirectory, 'commondir'), 'utf8').trim();
                 if (commonDirectory)
@@ -900,9 +1216,9 @@ export class CodexRunner {
                         } : {}),
                         ...(mode !== 'readonly' && managedTempDir ? {
                             [managedTempDir]: 'write',
-                            [path.join(managedTempDir, '**')]: 'write',
+                            [managedTempDir + '/**']: 'write',
                             [path.join(path.dirname(managedTempDir), 'evolcore-locks')]: 'write',
-                            [path.join(path.dirname(managedTempDir), 'evolcore-locks', '**')]: 'write',
+                            [path.join(path.dirname(managedTempDir), 'evolcore-locks') + '/**']: 'write',
                         } : {}),
                     },
                     network,
@@ -949,55 +1265,145 @@ export class CodexRunner {
     }
     setSendPrompt(fn) { this.sendPromptFn = fn; }
     setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    injectUserMessage(sessionId, text) {
+        // Bind queued reminders to the turn that generated them. A completed
+        // turn may be replaced before the serialized steer reaches app-server;
+        // injecting the old reminder into the new turn would corrupt its context.
+        const requestedTurn = this.activeTurns.get(sessionId);
+        if (!requestedTurn) {
+            logger.warn(`[CodexRunner] turn steer skipped because no active turn is registered: session=${sessionId}`);
+            return;
+        }
+        const previous = this.steeringTails.get(sessionId) ?? Promise.resolve();
+        let current;
+        current = previous.catch(() => undefined).then(async () => {
+            const activeTurn = this.activeTurns.get(sessionId);
+            const sameTurn = !!activeTurn
+                && activeTurn.threadId === requestedTurn.threadId
+                && activeTurn.turnId === requestedTurn.turnId;
+            if (!sameTurn) {
+                logger.warn(`[CodexRunner] turn steer skipped because the originating turn is no longer active: `
+                    + `session=${sessionId} thread=${requestedTurn.threadId} turn=${requestedTurn.turnId}`);
+                return;
+            }
+            const input = [{ type: 'text', text, text_elements: [] }];
+            const client = this.getAppServerClientForThread(activeTurn.threadId);
+            if (typeof client.turnSteer !== 'function') {
+                logger.warn(`[CodexRunner] turn steer unavailable in app-server client: session=${sessionId}`);
+                return;
+            }
+            try {
+                const response = await client.turnSteer(activeTurn.threadId, activeTurn.turnId, input);
+                logger.info(`[CodexRunner] turn steer delivered: session=${sessionId} thread=${activeTurn.threadId} ` +
+                    `turn=${response.turnId} chars=${text.length}`);
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] turn steer failed: session=${sessionId} thread=${activeTurn.threadId} ` +
+                    `turn=${activeTurn.turnId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        }).finally(() => {
+            if (this.steeringTails.get(sessionId) === current)
+                this.steeringTails.delete(sessionId);
+        });
+        this.steeringTails.set(sessionId, current);
+    }
     async assertProactiveHookAvailability(sessionId, appServer) {
         if (this.permissionContexts.get(sessionId)?.chatmode !== 'proactive')
             return;
-        if (process.platform === 'win32') {
-            await appServer.assertManagedHooksAvailable();
-            return;
-        }
-        if (process.platform !== 'linux') {
+        if (process.platform !== 'linux' && process.platform !== 'win32') {
             throw new Error('Codex proactive managed PreToolUse enforcement requires Linux or an installed Windows managed hook');
         }
+        await appServer.assertManagedHooksAvailable();
     }
-    async evaluatePreToolUse(threadId, toolName, toolInput, signal) {
+    async evaluatePreToolUse(threadId, toolName, toolInput, signal, callId) {
         const sessionKey = this.findSessionKeyByThread(threadId);
-        const activeThread = this.activeSessions.get(sessionKey);
+        const activeThread = this.activeSessions.get(sessionKey) ?? this.provisionalSessions.get(sessionKey);
         const context = this.permissionContexts.get(sessionKey);
-        if (!activeThread || activeThread !== threadId) {
+        const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
+            ? toolInput
+            : {};
+        const recordPreToolUseDenial = async (policyCode, reason) => {
+            const summary = summarizeToolInputForAudit(toolName, normalizedInput).slice(0, 512);
+            auditToolPreflightDenial({
+                toolName,
+                policyCode,
+                reason,
+                summary,
+                sessionId: sessionKey,
+                agentAid: context?.selfAid,
+                agentName: context?.agentName,
+                permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+                channel: context?.channel,
+                actorId: context?.userId,
+                role: context?.role,
+                selfAid: context?.selfAid,
+                callId,
+                correlationId: callId,
+                taskId: context?.taskId,
+            });
+            try {
+                await context?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    policyCode,
+                    decisionSource: 'policy',
+                    agentAid: context?.selfAid,
+                    agentName: context?.agentName,
+                    sessionId: sessionKey,
+                    permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+                    summary,
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record managed-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        };
+        if (!activeThread || !this.isThreadOwnedBySession(sessionKey, threadId)) {
             return { ok: true, applicable: false };
         }
         const proactiveSession = context?.chatmode === 'proactive';
         if (!context || (proactiveSession && !context.preToolUsePolicyHook)) {
-            return { ok: false, applicable: true, decision: 'deny', reason: 'EvolCore proactive session policy context is unavailable' };
+            const reason = 'EvolCore proactive session policy context is unavailable';
+            await recordPreToolUseDenial('pre_tool_use_context_unavailable', reason);
+            return { ok: false, applicable: true, decision: 'deny', reason };
         }
         if (context.pauseController) {
             const pauseResult = await context.pauseController.waitAtToolBoundary(signal);
             if (pauseResult === 'cancelled') {
-                return { ok: true, applicable: true, decision: 'deny', reason: '工具调用已取消' };
+                const reason = '工具调用已取消';
+                await recordPreToolUseDenial('tool_call_cancelled', reason);
+                return { ok: true, applicable: true, decision: 'deny', reason };
             }
         }
         if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
-            return this.isTrustedFullAccessSession(sessionKey)
-                ? { ok: true, applicable: true, decision: 'allow' }
-                : { ok: false, applicable: true, decision: 'deny', reason: 'Untrusted fullaccess execution context' };
+            if (this.isTrustedFullAccessSession(sessionKey))
+                return { ok: true, applicable: true, decision: 'allow' };
+            const reason = 'Untrusted fullaccess execution context';
+            await recordPreToolUseDenial('fullaccess_context_untrusted', reason);
+            return { ok: false, applicable: true, decision: 'deny', reason };
         }
         // A tracked interactive thread still needs an authenticated, explicit
         // allow so the managed hook can fail closed when no runner matches.
         if (!context.preToolUsePolicyHook)
             return { ok: true, applicable: true, decision: 'allow' };
-        const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
-            ? toolInput
-            : {};
         try {
             const result = context.preToolUsePolicyHook(toolName, normalizedInput);
             if (result?.block) {
-                return { ok: true, applicable: true, decision: 'deny', reason: result.reason };
+                const policyCode = result.policyCode ?? 'session_policy_hook';
+                const reason = result.reason ?? 'session policy denied this tool call';
+                await recordPreToolUseDenial(policyCode, reason);
+                return { ok: true, applicable: true, decision: 'deny', reason };
             }
             return { ok: true, applicable: true, decision: 'allow' };
         }
         catch (error) {
-            return { ok: false, applicable: true, decision: 'deny', reason: `policy hook failed: ${error instanceof Error ? error.message : String(error)}` };
+            const reason = `policy hook failed: ${error instanceof Error ? error.message : String(error)}`;
+            await recordPreToolUseDenial('pre_tool_use_hook_failed', reason);
+            return { ok: false, applicable: true, decision: 'deny', reason };
         }
     }
     setPermissionGateway(gw) { this.permissionGateway = gw; }
@@ -1006,14 +1412,36 @@ export class CodexRunner {
         this.activeStreams.set(key, stream);
     }
     cleanupStream(key) {
+        const hadController = this.activeAbortControllers.has(key);
+        const hadTurn = this.activeTurns.has(key);
+        const provisionalThread = this.provisionalSessions.get(key);
+        const subscribedThreadId = this.activeTurns.get(key)?.threadId
+            ?? this.activeSessions.get(key)
+            ?? provisionalThread;
+        const subscription = subscribedThreadId ? this.threadSubscriptions.get(subscribedThreadId) : undefined;
         this.activeStreams.delete(key);
         this.activeAbortControllers.delete(key);
         this.pendingInterrupts.delete(key);
+        // A stale runner-start path may dispose the stream without ever entering
+        // transformAppServerStream. Reclaim its provisional thread, but preserve
+        // a replacement run that has already installed a new controller/turn.
+        if (provisionalThread && !hadController && !hadTurn) {
+            this.cleanupProvisionalThread(key, provisionalThread);
+        }
         this.chatModes.delete(key);
         const release = this.activeOperationReleases.get(key);
+        let releaseAfterSubscription;
+        if (subscription) {
+            releaseAfterSubscription = this.releaseThreadSubscription(subscription.client, subscribedThreadId, 'stream-cleanup');
+        }
         if (release) {
             this.activeOperationReleases.delete(key);
-            release();
+            if (releaseAfterSubscription) {
+                void releaseAfterSubscription.then(release, release);
+            }
+            else {
+                release();
+            }
         }
     }
     hasActiveStream(key) {
@@ -1064,14 +1492,20 @@ export class CodexRunner {
         }
     }
     isActiveThreadOperationAlias(key) {
-        if (key.startsWith('session:'))
-            return this.activeSessions.has(key.slice('session:'.length));
+        if (key.startsWith('session:')) {
+            const sessionId = key.slice('session:'.length);
+            return this.activeSessions.has(sessionId) || this.provisionalSessions.has(sessionId);
+        }
         if (key.startsWith('thread:')) {
             const threadId = key.slice('thread:'.length);
             for (const activeThreadId of this.activeSessions.values()) {
                 if (activeThreadId === threadId)
                     return true;
             }
+            for (const provisionalThreadId of this.provisionalSessions.values()) {
+                if (provisionalThreadId === threadId)
+                    return true;
+            }
             return false;
         }
         return true;
@@ -1157,7 +1591,18 @@ export class CodexRunner {
         let agentSessionId = topicBinding
             ? (topicAgentSessionId || undefined)
             : initialAgentSessionId || this.activeSessions.get(sessionId);
-        const resumingThread = !!agentSessionId;
+        if (!topicBinding && !initialAgentSessionId && typeof sessionManager?.getSessionById === 'function') {
+            try {
+                const persisted = await sessionManager.getSessionById(sessionId);
+                agentSessionId = typeof persisted?.agentSessionId === 'string' && persisted.agentSessionId.trim()
+                    ? persisted.agentSessionId.trim()
+                    : undefined;
+            }
+            catch (error) {
+                logger.debug(`[CodexRunner] persisted main backend lookup failed; using local cache: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        let resumingThread = !!agentSessionId;
         const callModel = modelOverride?.model || this.model;
         const callEffort = modelOverride?.effortMode === 'model_default'
             ? undefined
@@ -1173,7 +1618,7 @@ export class CodexRunner {
         this.chatModes.set(sessionId, callMode);
         const callApprovalPolicy = this.toApprovalPolicy(callMode);
         const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath);
-        const appServer = this.getAppServerClient();
+        const appServer = this.getAppServerClient(callMode === 'fullaccess');
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
@@ -1190,29 +1635,81 @@ export class CodexRunner {
         if (agentSessionId && !knownDelegationCarrier) {
             knownDelegationCarrier = await this.loadPersistedDelegationCarrier(sessionManager, sessionId, agentSessionId);
         }
-        const delegationCarrierCandidate = knownDelegationCarrier ?? this.createDelegationCarrier();
+        let delegationCarrierCandidate = knownDelegationCarrier ?? this.createDelegationCarrier();
         // Keep newly discovered carrier state local until generation-aware
         // activation accepts the backend. A stale run must not publish a carrier
         // that a later generation could mistake for its own thread.
         let carrierToPublish;
         const hasTaskDelegation = typeof runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] === 'string';
-        const threadOptions = {
+        let threadOptions = {
             model: callModel,
             effort: callEffort,
             approvalPolicy: effectiveApprovalPolicy,
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig(callMode)), callMode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined), this.buildLifecycleLockdownConfig(callMode)), callMode),
             ...(developerInstructions ? { developerInstructions } : {}),
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
             `role=${executionSandbox.decision.role ?? 'none'} sandbox=${executionSandbox.decision.state}`);
-        const threadResponse = agentSessionId
-            ? await appServer.threadResume(agentSessionId, projectPath, threadOptions)
-            : await appServer.threadStart(projectPath, threadOptions);
+        let threadResponse;
+        let previousAppServer;
+        if (agentSessionId) {
+            // A thread may have been loaded by the other permission-mode client.
+            // Release that one thread before asking this client to resume it.
+            previousAppServer = await this.prepareThreadSubscription(appServer, agentSessionId);
+            try {
+                threadResponse = await appServer.threadResume(agentSessionId, projectPath, threadOptions);
+            }
+            catch (error) {
+                if (isCodexActiveWriterError(error) && previousAppServer && previousAppServer !== appServer) {
+                    // Some Codex builds acknowledge unsubscribe before unloading the
+                    // runtime. Archive/unarchive is a synchronous per-thread teardown
+                    // and preserves the same persisted thread id for the retry.
+                    await this.archiveThreadForHandoff(previousAppServer, appServer, agentSessionId);
+                    threadResponse = await appServer.threadResume(agentSessionId, projectPath, threadOptions);
+                }
+                else {
+                    // A legacy main session can retain a provider ID after its rollout was
+                    // removed externally. It is safe to recover before input submission;
+                    // topic bindings remain authoritative and fail closed.
+                    if (topicBinding || !isCodexNoRolloutError(error))
+                        throw error;
+                    if (typeof sessionManager?.clearMainSessionBackendIfMatches !== 'function')
+                        throw error;
+                    const missingThreadId = agentSessionId;
+                    const cleared = await sessionManager.clearMainSessionBackendIfMatches(sessionId, missingThreadId, [CODEX_DELEGATION_CARRIER_METADATA_KEY]);
+                    if (cleared !== 'cleared' && cleared !== 'already_clear') {
+                        const recoveryError = new Error(`Codex missing-rollout recovery rejected: ${cleared}`);
+                        recoveryError.code = 'CODEX_MISSING_ROLLOUT_RECOVERY_REJECTED';
+                        throw recoveryError;
+                    }
+                    if (this.activeSessions.get(sessionId) === missingThreadId)
+                        this.activeSessions.delete(sessionId);
+                    this.threadProjectPaths.delete(missingThreadId);
+                    this.threadDelegationCarriers.delete(missingThreadId);
+                    this.unbindExternalToolBoundary(missingThreadId);
+                    this.clearTrackedApprovalItemsForThread(missingThreadId);
+                    agentSessionId = undefined;
+                    resumingThread = false;
+                    knownDelegationCarrier = undefined;
+                    delegationCarrierCandidate = this.createDelegationCarrier();
+                    threadOptions = {
+                        ...threadOptions,
+                        config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined), this.buildLifecycleLockdownConfig(callMode)), callMode),
+                    };
+                    logger.warn(`[CodexRunner] recovered missing rollout before input submission: session=${sessionId} thread=${missingThreadId}`);
+                    threadResponse = await appServer.threadStart(projectPath, threadOptions);
+                }
+            }
+        }
+        else {
+            threadResponse = await appServer.threadStart(projectPath, threadOptions);
+        }
         let threadId = threadResponse.thread?.id || agentSessionId;
         if (!threadId)
             throw new Error('Codex app-server did not return a thread id');
+        this.markThreadSubscribed(appServer, threadId);
         if (!resumingThread) {
             carrierToPublish = { threadId, carrier: delegationCarrierCandidate };
         }
@@ -1239,6 +1736,9 @@ export class CodexRunner {
                 const forkedThreadId = forked.thread?.id;
                 if (!forkedThreadId)
                     throw new Error('Codex delegation-carrier recovery fork did not return a thread id');
+                this.markThreadSubscribed(appServer, forkedThreadId);
+                await this.releaseThreadSubscription(appServer, staleThreadId, 'carrier-recovery-fork-source');
+                await this.releaseThreadSubscription(appServer, forkedThreadId, 'carrier-recovery-fork');
                 threadId = forkedThreadId;
                 recoveredCarrier = delegationCarrierCandidate;
             }
@@ -1247,28 +1747,40 @@ export class CodexRunner {
         else if (knownDelegationCarrier) {
             carrierToPublish = { threadId, carrier: knownDelegationCarrier };
         }
-        agentSessionId = threadId;
         const turn = modelOverride?.turn;
-        const bindingResult = this.onSessionIdUpdate
-            ? ((turn === undefined
-                ? await this.onSessionIdUpdate(sessionId, threadId)
-                : await this.onSessionIdUpdate(sessionId, threadId, { turn }))
-                ?? 'legacy_updated')
-            : 'legacy_updated';
-        const bindingAccepted = bindingResult === 'activated'
-            || bindingResult === 'already_active'
-            || bindingResult === 'legacy_updated';
-        if (!bindingAccepted) {
-            const error = new Error(`backend discovery rejected: ${bindingResult}`);
-            error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
-            throw error;
+        if (!resumingThread) {
+            // Keep a newly-created backend private to this runner until turn/start
+            // has been accepted. In particular, a pending interrupt must not leave
+            // a durable ID for a thread that never produced a rollout.
+            this.provisionalSessions.set(sessionId, threadId);
+            if (carrierToPublish) {
+                this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+            }
         }
-        this.activeSessions.set(sessionId, threadId);
-        if (carrierToPublish) {
-            this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
-            await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
+        else {
+            agentSessionId = threadId;
+            const bindingResult = this.onSessionIdUpdate
+                ? ((turn === undefined
+                    ? await this.onSessionIdUpdate(sessionId, threadId)
+                    : await this.onSessionIdUpdate(sessionId, threadId, { turn }))
+                    ?? 'legacy_updated')
+                : 'legacy_updated';
+            const bindingAccepted = bindingResult === 'activated'
+                || bindingResult === 'already_active'
+                || bindingResult === 'legacy_updated';
+            if (!bindingAccepted) {
+                const error = new Error(`backend discovery rejected: ${bindingResult}`);
+                error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+                await this.releaseThreadSubscription(appServer, threadId, 'backend-binding-rejected');
+                throw error;
+            }
+            this.activeSessions.set(sessionId, threadId);
+            if (carrierToPublish) {
+                this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
+                await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
+            }
+            this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         }
-        this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         this.threadProjectPaths.set(threadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(threadId, externalToolConfig);
         const controller = new AbortController();
@@ -1279,21 +1791,56 @@ export class CodexRunner {
         controller.signal.addEventListener('abort', () => queue.end(), { once: true });
         const state = {
             threadId,
+            sessionId,
+            projectPath,
             model: callModel,
+            committed: resumingThread,
             streamedAgentMessageIds: new Set(),
             agentMessageDeltaText: new Map(),
             completedItemIds: new Set(),
             emittedEditCallIds: new Set(),
             completedTurnIds: new Set(),
             openToolCalls: new Map(),
+            activeSubagentThreads: new Set(),
+            turnCompleted: false,
         };
         const unsubscribe = appServer.onNotification(notification => {
             // 仅从 turn/started 锁定权威 turnId — resume 时会有上一轮 turn 的残留通知
             // （如 thread/tokenUsage/updated）先于新 turn 到达，不能用它们 latch turnId
             const params = notification.params || {};
             const notifThreadId = params.threadId ?? params.thread_id;
-            if (notifThreadId !== undefined && notifThreadId !== threadId)
+            const item = params.item && typeof params.item === 'object' ? params.item : undefined;
+            const emittedByChild = typeof notifThreadId === 'string'
+                && this.childThreadSessions.get(notifThreadId) === sessionId;
+            if (notifThreadId !== undefined && notifThreadId !== threadId && !emittedByChild)
+                return;
+            this.trackSubagentLifecycle(notification, state, appServer);
+            if (emittedByChild && notifThreadId !== threadId) {
+                const childTurnId = this.extractTurnId(notification);
+                if (notification.method === 'turn/started' && childTurnId) {
+                    this.activeSubagentTurns.set(notifThreadId, {
+                        sessionId,
+                        parentThreadId: threadId,
+                        turnId: childTurnId,
+                    });
+                }
+                else if (notification.method === 'turn/completed') {
+                    const activeChildTurn = this.activeSubagentTurns.get(notifThreadId);
+                    if (!childTurnId || activeChildTurn?.turnId === childTurnId) {
+                        this.activeSubagentTurns.delete(notifThreadId);
+                    }
+                    state.activeSubagentThreads.delete(notifThreadId);
+                    void this.releaseThreadSubscription(appServer, notifThreadId, 'subagent-turn-finished');
+                    this.unregisterChildThread(notifThreadId);
+                    this.endAppServerQueueWhenSubagentsDone(queue, state);
+                }
+                if (this.isSubagentActivityItem(item))
+                    queue.push(notification);
+                if (notification.method === 'item/completed' && state.turnCompleted) {
+                    this.endAppServerQueueWhenSubagentsDone(queue, state);
+                }
                 return;
+            }
             if (notification.method === 'turn/started') {
                 const startedTurnId = this.extractTurnId(notification);
                 if (startedTurnId && !state.turnId) {
@@ -1309,15 +1856,22 @@ export class CodexRunner {
                 return;
             queue.push(notification);
             // 仅在已锁定 turnId 后才允许 turn/completed 结束队列，避免残留的旧 turn/completed 误关
-            if (notification.method === 'turn/completed' && state.turnId)
-                queue.end();
+            if (notification.method === 'turn/completed' && state.turnId) {
+                state.turnCompleted = true;
+                this.endAppServerQueueWhenSubagentsDone(queue, state);
+            }
+            else if (notification.method === 'item/completed' && state.turnCompleted) {
+                this.endAppServerQueueWhenSubagentsDone(queue, state);
+            }
         });
         if (this.consumePendingInterrupt(sessionId)) {
             controller.abort('User interrupt');
             this.activeAbortControllers.delete(sessionId);
             this.activeStreams.delete(sessionId);
+            if (!resumingThread)
+                this.cleanupProvisionalThread(sessionId, threadId);
             logger.info(`[CodexRunner] Applied pending interrupt before turn start: ${sessionId}`);
-            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
+            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer, tempFiles);
         }
         try {
             const turnResponse = await appServer.turnStart(threadId, input, {
@@ -1327,6 +1881,14 @@ export class CodexRunner {
                 approvalPolicy: effectiveApprovalPolicy,
                 ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
             });
+            if (!resumingThread) {
+                state.commitProvisional = async () => {
+                    const committed = await this.commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn);
+                    if (committed)
+                        agentSessionId = threadId;
+                    return committed;
+                };
+            }
             const turnId = turnResponse.turn?.id;
             if (turnId && !state.turnId) {
                 state.turnId = turnId;
@@ -1341,19 +1903,24 @@ export class CodexRunner {
             }
             const status = turnResponse.turn?.status;
             if (status === 'completed' || status === 'failed') {
+                this.primeSubagentStateFromTurn(turnResponse.turn, state, appServer);
                 queue.push({ method: 'turn/completed', params: { threadId, turn: turnResponse.turn } });
-                queue.end();
+                state.turnCompleted = true;
+                this.endAppServerQueueWhenSubagentsDone(queue, state);
             }
         }
         catch (error) {
             unsubscribe();
+            await this.releaseThreadSubscription(appServer, threadId, 'turn-start-failed');
             this.activeAbortControllers.delete(sessionId);
             this.activeTurns.delete(sessionId);
             this.pendingInterrupts.delete(sessionId);
             this.cleanupTempFiles(tempFiles);
+            if (!resumingThread)
+                this.cleanupProvisionalThread(sessionId, threadId);
             throw error;
         }
-        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
+        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer, tempFiles);
     }
     // ── Interrupt ──
     async interrupt(sessionKey) {
@@ -1364,6 +1931,7 @@ export class CodexRunner {
         const interruptTurn = activeTurn
             ? this.interruptAppServerTurn(activeTurn.threadId, activeTurn.turnId)
             : Promise.resolve();
+        const interruptSubagents = this.interruptSubagentTurns(sessionKey);
         if (!activeTurn)
             this.rememberPendingInterrupt(sessionKey);
         if (controller)
@@ -1374,7 +1942,17 @@ export class CodexRunner {
             this.activeTurns.delete(sessionKey);
             logger.info(`[CodexRunner] Interrupted session: ${sessionKey}`);
         }
-        await interruptTurn;
+        await Promise.all([interruptTurn, interruptSubagents]);
+    }
+    async interruptSubagentTurns(sessionId, parentThreadId) {
+        const entries = [...this.activeSubagentTurns.entries()]
+            .filter(([, active]) => active.sessionId === sessionId && (!parentThreadId || active.parentThreadId === parentThreadId));
+        await Promise.all(entries.map(async ([childThreadId, active]) => {
+            await this.interruptAppServerTurn(childThreadId, active.turnId).catch(() => { });
+            const current = this.activeSubagentTurns.get(childThreadId);
+            if (current === active)
+                this.activeSubagentTurns.delete(childThreadId);
+        }));
     }
     rememberPendingInterrupt(sessionId) {
         this.pendingInterrupts.set(sessionId, Date.now());
@@ -1394,7 +1972,12 @@ export class CodexRunner {
     }
     async interruptAppServerTurn(threadId, turnId) {
         try {
-            await this.getAppServerClient().turnInterrupt(threadId, turnId);
+            const sessionId = this.findSessionKeyByThread(threadId);
+            const subscribed = this.threadSubscriptions.get(threadId);
+            const client = subscribed
+                ? subscribed.client
+                : this.getAppServerClient(sessionId ? this.chatModes.get(sessionId) === 'fullaccess' : false);
+            await client.turnInterrupt(threadId, turnId);
         }
         catch (error) {
             logger.debug(`[CodexRunner] app-server turn interrupt failed: ${error}`);
@@ -1437,10 +2020,12 @@ export class CodexRunner {
     }
     async closeSession(sessionId) {
         const capturedThreadId = this.activeSessions.get(sessionId);
+        const capturedProvisionalThreadId = this.provisionalSessions.get(sessionId);
         const capturedPermissionContext = this.permissionContexts.get(sessionId);
         const capturedStream = this.activeStreams.get(sessionId);
         const capturedController = this.activeAbortControllers.get(sessionId);
         const capturedTurn = this.activeTurns.get(sessionId);
+        const capturedSteeringTail = this.steeringTails.get(sessionId);
         this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         // Do not call interrupt(sessionId) here: a new run may have replaced the
         // session-scoped maps while an older close was waiting. Interrupt and
@@ -1448,12 +2033,24 @@ export class CodexRunner {
         if (capturedTurn) {
             await this.interruptAppServerTurn(capturedTurn.threadId, capturedTurn.turnId).catch(() => { });
         }
+        const capturedParentThreadId = capturedThreadId ?? capturedProvisionalThreadId;
+        if (capturedParentThreadId) {
+            await this.interruptSubagentTurns(sessionId, capturedParentThreadId);
+        }
+        else if (!this.activeSessions.has(sessionId) && !this.provisionalSessions.has(sessionId)) {
+            await this.interruptSubagentTurns(sessionId);
+        }
         capturedController?.abort('Session closed');
+        const capturedSubscription = capturedThreadId ? this.threadSubscriptions.get(capturedThreadId) : undefined;
         const lifecycleReplaced = (capturedStream !== undefined && this.activeStreams.get(sessionId) !== capturedStream)
             || (capturedController !== undefined && this.activeAbortControllers.get(sessionId) !== capturedController)
             || (capturedTurn !== undefined && this.activeTurns.get(sessionId) !== capturedTurn)
             || (capturedPermissionContext !== undefined && this.permissionContexts.get(sessionId) !== capturedPermissionContext)
             || (capturedThreadId !== undefined && this.activeSessions.get(sessionId) !== capturedThreadId);
+        if (capturedSubscription && !lifecycleReplaced
+            && this.threadSubscriptions.get(capturedThreadId) === capturedSubscription) {
+            await this.releaseThreadSubscription(capturedSubscription.client, capturedThreadId, 'session-closed');
+        }
         if (capturedStream !== undefined && this.activeStreams.get(sessionId) === capturedStream)
             this.activeStreams.delete(sessionId);
         if (capturedController !== undefined && this.activeAbortControllers.get(sessionId) === capturedController)
@@ -1464,6 +2061,10 @@ export class CodexRunner {
             this.pendingInterrupts.delete(sessionId);
         if (this.permissionContexts.get(sessionId) === capturedPermissionContext)
             this.permissionContexts.delete(sessionId);
+        if (this.steeringTails.get(sessionId) === capturedSteeringTail)
+            this.steeringTails.delete(sessionId);
+        if (capturedProvisionalThreadId)
+            this.cleanupProvisionalThread(sessionId, capturedProvisionalThreadId);
         // Session-level configuration and thread indexes are shared by later
         // runs. Only remove them when the captured lifecycle still owns the key.
         if (!lifecycleReplaced) {
@@ -1477,6 +2078,7 @@ export class CodexRunner {
                 this.unbindExternalToolBoundary(capturedThreadId);
             }
             this.clearTrackedApprovalItemsForThread(capturedThreadId);
+            this.cleanupChildThreadsForSession(sessionId);
             this.pruneThreadOperationLocks();
         }
     }
@@ -1504,7 +2106,13 @@ export class CodexRunner {
     async clearSession(sessionId, _agentSessionId, _projectPath) {
         // Codex: 清空会话 = 下次 runQuery 不传 resumeId，自动创建新 thread
         const threadId = this.activeSessions.get(sessionId) ?? _agentSessionId;
+        const subscription = this.threadSubscriptions.get(threadId);
+        if (subscription) {
+            await this.releaseThreadSubscription(subscription.client, threadId, 'session-cleared');
+        }
         this.activeSessions.delete(sessionId);
+        this.activeTurns.delete(sessionId);
+        this.steeringTails.delete(sessionId);
         this.chatModes.delete(sessionId);
         this.cleanupSessionTempDir(sessionId);
         this.threadProjectPaths.delete(threadId);
@@ -1522,8 +2130,12 @@ export class CodexRunner {
             return result;
         };
         const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId, _sessionId), 'compact');
+        let compactAppServer;
         try {
-            const appServer = this.getAppServerClient();
+            const compactMode = normalizeExecutionPermissionMode(modelOverride?.permissionMode ?? this.chatModes.get(_sessionId) ?? this.currentMode);
+            const appServer = this.getAppServerClient(compactMode === 'fullaccess');
+            compactAppServer = appServer;
+            await this.prepareThreadSubscription(appServer, agentSessionId);
             this.onCompactStart?.(_sessionId);
             try {
                 await this.startAndWaitForCompact(appServer, agentSessionId);
@@ -1533,7 +2145,6 @@ export class CodexRunner {
                 if (!this.isThreadNotFoundError(error))
                     throw error;
                 logger.info(`[CodexRunner] Compact thread not loaded, resuming before compact: ${agentSessionId}`);
-                const compactMode = normalizeExecutionPermissionMode(modelOverride?.permissionMode ?? this.chatModes.get(_sessionId) ?? this.currentMode);
                 const compactModel = modelOverride?.model || this.model;
                 const compactEffort = modelOverride?.effortMode === 'model_default'
                     ? undefined
@@ -1556,6 +2167,7 @@ export class CodexRunner {
                     ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
                     config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
                 });
+                this.markThreadSubscribed(appServer, agentSessionId);
                 this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
                 this.threadDelegationCarriers.set(agentSessionId, compactDelegationCarrier);
                 this.bindExternalToolBoundary(agentSessionId, externalToolConfig);
@@ -1568,6 +2180,9 @@ export class CodexRunner {
             return finish({ ok: false, code: 'sdk_error', message, durationMs: Date.now() - startedAt });
         }
         finally {
+            if (compactAppServer) {
+                await this.releaseThreadSubscription(compactAppServer, agentSessionId, 'compact-finished');
+            }
             release();
         }
     }
@@ -1708,7 +2323,8 @@ export class CodexRunner {
         const mode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const executionSandbox = this.buildExecutionSandboxOptions(sessionKey, mode, projectPath);
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
-        const appServer = this.getAppServerClient();
+        const appServer = this.threadSubscriptions.get(agentSessionId)?.client
+            ?? this.getAppServerClient(mode === 'fullaccess');
         const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, mode);
         if (sessionKey)
             await this.assertProactiveHookAvailability(sessionKey, appServer);
@@ -1724,9 +2340,11 @@ export class CodexRunner {
         const forkedThreadId = response.thread?.id;
         if (!forkedThreadId)
             throw new Error('Codex fork did not return a thread id');
+        this.markThreadSubscribed(appServer, forkedThreadId);
         this.threadDelegationCarriers.set(forkedThreadId, delegationCarrier);
         this.threadProjectPaths.set(forkedThreadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(forkedThreadId, externalToolConfig);
+        await this.releaseThreadSubscription(appServer, forkedThreadId, 'fork-finished');
         return forkedThreadId;
     }
     async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title) {
@@ -1756,14 +2374,14 @@ export class CodexRunner {
         }
     }
     async setSessionName(agentSessionId, name) {
-        return this.getAppServerClient().threadSetName(agentSessionId, name);
+        return this.getAppServerClientForThread(agentSessionId).threadSetName(agentSessionId, name);
     }
     async updateSessionMetadata(agentSessionId, metadata) {
         const gitInfo = metadata?.gitInfo && typeof metadata.gitInfo === 'object' ? metadata.gitInfo : undefined;
-        return this.getAppServerClient().threadMetadataUpdate(agentSessionId, gitInfo);
+        return this.getAppServerClientForThread(agentSessionId).threadMetadataUpdate(agentSessionId, gitInfo);
     }
     async getSessionMessages(agentSessionId, projectPath) {
-        const response = await this.getAppServerClient().threadRead(agentSessionId, true);
+        const response = await this.getAppServerClientForThread(agentSessionId).threadRead(agentSessionId, true);
         return this.mapThreadToSessionMessages(response, agentSessionId);
     }
     approvalItemKey(threadId, turnId, itemId) {
@@ -1774,13 +2392,14 @@ export class CodexRunner {
     trackApprovalItemNotification(notification) {
         const params = (notification.params || {});
         const item = params.item && typeof params.item === 'object' ? params.item : undefined;
-        const itemId = item?.id ?? params.itemId;
+        const itemId = item?.id ?? params.itemId ?? params.item_id;
         const threadId = this.requestThreadId(params);
-        const key = this.approvalItemKey(threadId, params.turnId, itemId);
+        const turnId = params.turnId ?? params.turn_id;
+        const key = this.approvalItemKey(threadId, turnId, itemId);
         if (notification.method === 'item/started' && key && item && threadId) {
             this.trackedApprovalItems.set(key, {
                 threadId,
-                turnId: params.turnId,
+                turnId,
                 itemId,
                 item: { ...item },
             });
@@ -1790,7 +2409,7 @@ export class CodexRunner {
             const tracked = this.trackedApprovalItems.get(key);
             this.trackedApprovalItems.set(key, {
                 threadId,
-                turnId: params.turnId,
+                turnId,
                 itemId,
                 item: {
                     ...(tracked?.item ?? { id: itemId, type: 'fileChange' }),
@@ -1814,22 +2433,40 @@ export class CodexRunner {
                     this.trackedApprovalItems.delete(trackedKey);
                 }
             }
+            this.clearPendingToolDenialsForTurn(threadId, completedTurnId);
         }
     }
     findTrackedApprovalItem(params) {
-        const key = this.approvalItemKey(this.requestThreadId(params), params.turnId, params.itemId);
+        const key = this.approvalItemKey(this.requestThreadId(params), params.turnId ?? params.turn_id, params.itemId ?? params.item_id);
         return key ? this.trackedApprovalItems.get(key)?.item : undefined;
     }
     requestThreadId(params) {
-        const threadId = typeof params.threadId === 'string' && params.threadId.length > 0
-            ? params.threadId
+        const threadIdValue = params.threadId ?? params.thread_id;
+        const threadId = typeof threadIdValue === 'string' && threadIdValue.length > 0
+            ? threadIdValue
             : undefined;
         if (threadId)
             return threadId;
-        return typeof params.conversationId === 'string' && params.conversationId.length > 0
-            ? params.conversationId
+        const conversationIdValue = params.conversationId ?? params.conversation_id;
+        return typeof conversationIdValue === 'string' && conversationIdValue.length > 0
+            ? conversationIdValue
             : undefined;
     }
+    clearPendingToolDenialsForTurn(threadId, turnId) {
+        for (const key of this.pendingToolDenials.keys()) {
+            let parsed;
+            try {
+                parsed = JSON.parse(key);
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(parsed) || parsed[0] !== threadId)
+                continue;
+            if (!turnId || parsed[1] === turnId)
+                this.pendingToolDenials.delete(key);
+        }
+    }
     clearTrackedApprovalItemsForThread(threadId) {
         if (!threadId)
             return;
@@ -1837,6 +2474,73 @@ export class CodexRunner {
             if (tracked.threadId === threadId)
                 this.trackedApprovalItems.delete(key);
         }
+        for (const key of this.pendingToolDenials.keys()) {
+            let parsed;
+            try {
+                parsed = JSON.parse(key);
+            }
+            catch {
+                continue;
+            }
+            if (Array.isArray(parsed) && parsed[0] === threadId)
+                this.pendingToolDenials.delete(key);
+        }
+    }
+    rememberToolDenial(request, params, denial) {
+        const itemId = params.itemId ?? params.item_id ?? params.callId ?? params.call_id;
+        const threadId = this.requestThreadId(params);
+        const rawTurnId = params.turnId ?? params.turn_id;
+        const turnId = typeof rawTurnId === 'string' ? rawTurnId : this.findActiveTurnId(threadId);
+        const key = this.approvalItemKey(threadId, turnId, itemId);
+        if (!key)
+            return;
+        this.pendingToolDenials.set(key, {
+            ...denial,
+            ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+            method: request.method,
+        });
+    }
+    steerPolicyReason(sessionId, policyCode, reason) {
+        const prefix = policyCode ? `策略拒绝（${policyCode}）` : '策略拒绝';
+        this.injectUserMessage(sessionId, `⚠️ ${prefix}：${reason}。命令未执行，请按提示重新执行正确的命令。`);
+    }
+    findActiveTurnId(threadId) {
+        if (!threadId)
+            return undefined;
+        for (const active of this.activeTurns.values()) {
+            if (active.threadId === threadId)
+                return active.turnId;
+        }
+        return undefined;
+    }
+    takeToolDenial(state, itemId) {
+        const exactKey = this.approvalItemKey(state.threadId, state.turnId, itemId);
+        if (exactKey) {
+            const exact = this.pendingToolDenials.get(exactKey);
+            if (exact) {
+                this.pendingToolDenials.delete(exactKey);
+                return exact;
+            }
+        }
+        // Legacy approval callbacks may not carry turnId. Consume the unique
+        // matching item for this thread rather than losing the structured reason.
+        const candidates = [];
+        for (const [key, denial] of this.pendingToolDenials) {
+            let parsed;
+            try {
+                parsed = JSON.parse(key);
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(parsed) || parsed[0] !== state.threadId || String(parsed[2]) !== String(itemId))
+                continue;
+            candidates.push([key, denial]);
+        }
+        if (candidates.length !== 1)
+            return undefined;
+        this.pendingToolDenials.delete(candidates[0][0]);
+        return candidates[0][1];
     }
     async handleAppServerRequest(request) {
         const params = (request.params || {});
@@ -1898,18 +2602,62 @@ export class CodexRunner {
         // workspace, or unattended-trigger policy checks.
         if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
             if (!this.isTrustedFullAccessSession(sessionKey)) {
+                const reason = 'Untrusted fullaccess execution context';
+                this.rememberToolDenial(request, params, {
+                    decision: 'deny',
+                    decisionSource: 'policy',
+                    policyCode: 'fullaccess_context_untrusted',
+                    reason,
+                });
+                this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', 'fullaccess_context_untrusted', reason);
+                setImmediate(() => this.steerPolicyReason(sessionKey, 'fullaccess_context_untrusted', reason));
                 return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
             }
+            // Fullaccess uses the current task delegation token in its shell
+            // environment, so it must not enter the ordinary workspace/carrier
+            // approval path even if the app-server asks for an infrastructure
+            // approval despite approvalPolicy=never.
             const response = this.toAppServerApprovalResponse(request.method, 'allow', toolInput, false);
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'allow', 'approval', undefined, 'trusted fullaccess execution');
             return response;
         }
-        // proactive 模式行为策略（首次工具调用必须是 ec msg send）
-        const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
+        // Keep the policy check in the approval path as a fail-closed fallback.
+        // Some app-server tool routes can reach approval without invoking the
+        // command hook; allowing here would bypass the proactive gate.
+        const policyResult = (this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess'
+            ? undefined
+            : this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         if (policyResult?.block) {
             logger.info(`[CodexRunner] app-server approval declined by session policy: session=${sessionKey} ` +
                 `requestId=${request.id ?? '<missing>'} code=${policyResult.policyCode ?? 'session_policy_hook'} ` +
                 `reason=${policyResult.reason ?? 'policy denied'} executed=false`);
+            const policyCode = policyResult.policyCode ?? 'session_policy_hook';
+            const policyReason = policyResult.reason ?? 'session policy denied approval';
+            this.rememberToolDenial(request, params, {
+                decision: 'deny',
+                decisionSource: 'policy',
+                policyCode,
+                reason: policyReason,
+            });
+            // ResponseEngine's wrapped policy hook already steers Codex sessions
+            // that have the pure managed-hook policy installed. Standalone callers
+            // may only provide policyHook, so keep this fallback for them without
+            // duplicating the same user message in production.
+            if (!permissionContext?.preToolUsePolicyHook) {
+                setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, policyReason));
+            }
+            const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyCode, policyReason);
+            return response;
+        }
+        const summary = this.summarizeAppServerRequest(request.method, params);
+        const reason = params.reason || params.decisionReason || undefined;
+        const auditSummary = (summarizeToolInputForAudit(toolName, toolInput)
+            || summarizeToolInputForAudit('Bash', { command: summary })).slice(0, 512);
+        const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
+        const workspacePath = this.resolvePermissionWorkspacePath(params);
+        if (!workspacePath) {
+            logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
                     code: 'operation_blocked',
@@ -1918,41 +2666,39 @@ export class CodexRunner {
                     occurredAt: Date.now(),
                     toolName,
                     ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
-                    policyCode: policyResult.policyCode ?? 'session_policy_hook',
-                    decisionSource: 'policy',
+                    policyCode: 'approval_workspace_unknown',
+                    decisionSource: 'infrastructure',
                     agentAid: permissionContext?.selfAid,
                     agentName: permissionContext?.agentName,
                     sessionId: sessionKey,
-                    permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
-                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    permissionMode: normalizeExecutionPermissionMode(sessionMode),
+                    summary: auditSummary,
                     effect: 'operation_skipped',
                 });
             }
             catch (error) {
-                logger.warn(`[CodexRunner] failed to record policy-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+                logger.warn(`[CodexRunner] failed to record unknown-workspace approval denial: session=${sessionKey} error=${error instanceof Error ? error.message : String(error)}`);
             }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyResult.policyCode ?? 'session_policy_hook', policyResult.reason ?? 'session policy denied approval');
-            return response;
-        }
-        const summary = this.summarizeAppServerRequest(request.method, params);
-        const reason = params.reason || params.decisionReason || undefined;
-        const workspacePath = this.resolvePermissionWorkspacePath(params);
-        if (!workspacePath) {
-            logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
-            const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.rememberToolDenial(request, params, {
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode: 'approval_workspace_unknown',
+                reason: 'thread workspace is unknown',
+            });
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', 'approval_workspace_unknown', 'thread workspace is unknown');
+            setImmediate(() => this.steerPolicyReason(sessionKey, 'approval_workspace_unknown', 'thread workspace is unknown'));
             return response;
         }
         const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
-        const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
-        const logSummary = formatApprovalLogSummary(summary);
+        const logSummary = formatApprovalLogSummary(auditSummary || summary);
         logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${logSummary}`);
         const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
             || request.method === 'execCommandApproval';
         const managedEcIntent = isCommandApproval && this.isManagedEvolcoreCommandIntent(toolInput);
+        const delegationCarrier = this.delegationCarrierForSession(sessionKey, typeof params.threadId === 'string' ? params.threadId : undefined);
         const canonicalEcApproval = isCommandApproval
-            ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey))
+            ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey), delegationCarrier)
             : undefined;
         const approvedCommand = canonicalEcApproval?.argv;
         const denyInfrastructure = async (policyCode, message) => {
@@ -1979,19 +2725,32 @@ export class CodexRunner {
                 logger.warn(`[CodexRunner] failed to record infrastructure approval denial: session=${sessionKey} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
             }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.rememberToolDenial(request, params, {
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode,
+                reason: message,
+            });
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode, message, canonicalEcApproval?.parseFailure);
+            setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, message));
             return response;
         };
         if (managedEcIntent && !approvedCommand) {
+            if (canonicalEcApproval?.parseFailure?.issue === 'untrusted-shell') {
+                return await denyInfrastructure('ec_shell_untrusted_executable', 'EC command approval denied because the shell executable failed Windows Authenticode trust validation');
+            }
             return await denyInfrastructure('ec_command_not_canonical', canonicalEcApproval?.parseFailure
                 ? `EC command approval denied because canonical argv parsing failed (${canonicalEcApproval.parseFailure.issue})`
                 : 'EC command approval denied because no canonical argv could be derived');
         }
         try {
-            const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
+            const resolution = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id, typeof params.itemId === 'string' ? params.itemId : typeof params.item_id === 'string' ? params.item_id : undefined);
+            const decision = typeof resolution === 'string' ? resolution : resolution.decision;
+            const resolutionMeta = typeof resolution === 'string' ? undefined : resolution;
             if (decision !== 'deny' && managedEcIntent && approvedCommand) {
                 const carrierThreadIds = [
                     this.activeSessions.get(sessionKey),
+                    this.provisionalSessions.get(sessionKey),
                     typeof params.threadId === 'string' ? params.threadId : undefined,
                     typeof params.conversationId === 'string' ? params.conversationId : undefined,
                 ];
@@ -2000,18 +2759,35 @@ export class CodexRunner {
                 // A carrier-bearing thread is managed even if its permission context
                 // was not wired with an arm callback; it must fail closed here rather
                 // than reaching daemon IPC with an unarmed carrier.
+                if ((hasDelegationCarrier || canArmDelegation)
+                    && canonicalEcApproval?.delegationToken
+                    && canonicalEcApproval.delegationToken !== delegationCarrier) {
+                    return await denyInfrastructure('delegation_token_mismatch', 'EC command approval contains a delegation token different from the active thread carrier');
+                }
                 if ((hasDelegationCarrier || canArmDelegation)
                     && !this.armApprovedDelegationCommand(sessionKey, approvedCommand)) {
                     return await denyInfrastructure('delegation_not_armed', 'EC command approval failed to arm delegation');
                 }
             }
             const response = this.toAppServerApprovalResponse(request.method, decision, toolInput, unattended);
-            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval') : 'approval', decision === 'deny' && (sessionMode === 'auto' || sessionMode === 'readonly')
-                ? 'permission_mode_denied'
-                : undefined, decision === 'deny'
-                ? (reason || (sessionMode === 'auto' || sessionMode === 'readonly'
-                    ? `permission mode ${sessionMode} denied approval`
-                    : 'user approval denied'))
+            const decisionSource = resolutionMeta?.decisionSource
+                ?? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval');
+            const policyCode = resolutionMeta?.policyCode
+                ?? (decisionSource === 'policy' ? 'permission_mode_denied' : undefined);
+            const denialReason = resolutionMeta?.reason || reason || (policyCode
+                ? `permission mode ${sessionMode} denied approval`
+                : 'user approval denied');
+            if (decision === 'deny') {
+                this.rememberToolDenial(request, params, {
+                    decision: 'deny',
+                    decisionSource,
+                    ...(policyCode ? { policyCode } : {}),
+                    reason: denialReason,
+                });
+                setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, denialReason));
+            }
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? decisionSource : 'approval', decision === 'deny' ? policyCode : undefined, decision === 'deny'
+                ? denialReason
                 : 'approval accepted');
             logger.info(`[CodexRunner] app-server approval response id=${request.id} method=${request.method} decision=${decision} response=${JSON.stringify(response)}`);
             return response;
@@ -2024,8 +2800,23 @@ export class CodexRunner {
     }
     logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode, reason, parseFailure) {
         const context = this.permissionContexts.get(sessionKey);
+        const params = (request.params || {});
+        const rawCallId = params.itemId ?? params.item_id ?? params.callId ?? params.call_id;
+        const callId = typeof rawCallId === 'string' && rawCallId ? rawCallId : undefined;
+        const toolInput = this.buildPermissionInput(request.method, params);
+        const rawSummary = summarizeToolInputForAudit(toolName, toolInput);
+        const auditSummary = (rawSummary
+            || summarizeToolInputForAudit('Bash', { command: this.summarizeAppServerRequest(request.method, params) })).slice(0, 512);
+        const threadId = this.requestThreadId(params);
+        const rawCwd = typeof toolInput.cwd === 'string' && toolInput.cwd
+            ? toolInput.cwd
+            : typeof params.cwd === 'string' && params.cwd
+                ? params.cwd
+                : undefined;
         auditCodexApprovalDecision({
             requestId: request.id !== undefined ? String(request.id) : undefined,
+            callId,
+            correlationId: callId,
             method: request.method,
             sessionId: sessionKey,
             agentAid: context?.selfAid,
@@ -2036,11 +2827,16 @@ export class CodexRunner {
             policyCode,
             permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
             role: context?.role,
+            taskId: context?.taskId,
+            summary: auditSummary,
+            threadId,
+            cwd: rawCwd,
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             parseFailure,
         });
         logger.info(`[CodexRunner] app-server approval audit ${JSON.stringify({
             requestId: request.id !== undefined ? String(request.id) : undefined,
+            ...(callId ? { callId, correlationId: callId } : {}),
             method: request.method,
             sessionId: sessionKey,
             toolName,
@@ -2048,6 +2844,7 @@ export class CodexRunner {
             decisionSource,
             ...(policyCode ? { policyCode } : {}),
             ...(parseFailure ? { parseFailure } : {}),
+            ...(auditSummary ? { summary: auditSummary } : {}),
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             executed: false,
         })}`);
@@ -2401,9 +3198,20 @@ export class CodexRunner {
                 if (activeThreadId === candidate)
                     return sessionKey;
             }
+            for (const [sessionKey, provisionalThreadId] of this.provisionalSessions.entries()) {
+                if (provisionalThreadId === candidate)
+                    return sessionKey;
+            }
+            const childSessionKey = this.childThreadSessions.get(candidate);
+            if (childSessionKey)
+                return childSessionKey;
         }
         return candidates[0] || 'codex-app-server';
     }
+    isThreadOwnedBySession(sessionId, threadId) {
+        const activeThread = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
+        return activeThread === threadId || this.childThreadSessions.get(threadId) === sessionId;
+    }
     buildPermissionInput(method, params) {
         if (method === 'item/permissions/requestApproval') {
             return { permissions: params.permissions, cwd: params.cwd, reason: params.reason };
@@ -2465,6 +3273,12 @@ export class CodexRunner {
             const threadProjectPath = this.threadProjectPaths.get(threadId);
             if (threadProjectPath)
                 return threadProjectPath;
+            const parentSession = this.childThreadSessions.get(threadId);
+            const parentThread = parentSession
+                ? this.activeSessions.get(parentSession) ?? this.provisionalSessions.get(parentSession)
+                : undefined;
+            if (parentThread)
+                return this.threadProjectPaths.get(parentThread);
         }
         return undefined;
     }
@@ -2595,7 +3409,7 @@ export class CodexRunner {
             return true;
         });
     }
-    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId) {
+    async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId, callId) {
         const permissionContext = this.permissionContexts.get(sessionKey);
         const permissionPrompt = permissionContext?.sendPrompt ?? this.sendPromptFn;
         const hasFilesystemPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
@@ -2632,6 +3446,8 @@ export class CodexRunner {
                 role: permissionContext?.role,
                 selfAid: permissionContext?.selfAid,
                 requestId: typeof requestId === 'string' || typeof requestId === 'number' ? String(requestId) : undefined,
+                callId,
+                correlationId: callId,
                 taskId: permissionContext?.taskId,
                 matchedPath,
             });
@@ -2662,6 +3478,7 @@ export class CodexRunner {
             // distinguishes this explicit empty value from runners without a
             // session-temp capability.
             managedTempDir: permissionContext?.managedTempDir ?? this.getManagedTempDir(sessionKey) ?? '',
+            delegationCarrier: this.delegationCarrierForSession(sessionKey),
             allowProtectedMetadata: false,
             selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
@@ -2678,7 +3495,12 @@ export class CodexRunner {
             if (preflight.policyCode) {
                 await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied', preflight.matchedPath);
             }
-            return 'deny';
+            return {
+                decision: 'deny',
+                decisionSource: 'policy',
+                policyCode: preflight.policyCode ?? 'tool_preflight_denied',
+                reason: preflight.message ?? 'tool preflight denied',
+            };
         }
         if (preflight.behavior === 'allow')
             return 'allow';
@@ -2793,7 +3615,7 @@ export class CodexRunner {
     async rollbackSessionTurnsLocked(agentSessionId, numTurns) {
         if (numTurns < 1)
             return true;
-        const response = await this.getAppServerClient().threadRollback(agentSessionId, numTurns);
+        const response = await this.getAppServerClientForThread(agentSessionId).threadRollback(agentSessionId, numTurns);
         return !!response.thread;
     }
     async rewindFiles(agentSessionId, projectPath, userMessageId) {
@@ -2992,17 +3814,138 @@ export class CodexRunner {
         }
         return !state.turnId || !turnId || turnId === state.turnId;
     }
-    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, tempFiles) {
+    isSubagentActivityItem(item) {
+        return typeof item?.type === 'string' && item.type.toLowerCase() === 'subagentactivity';
+    }
+    subagentThreadId(item) {
+        const value = item?.agentThreadId ?? item?.agent_thread_id;
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    subagentPath(item) {
+        const value = item?.agentPath ?? item?.agent_path;
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    subagentType(item) {
+        const value = item?.agentType ?? item?.agent_type;
+        return typeof value === 'string' && value.length > 0 ? value : undefined;
+    }
+    registerChildThread(sessionId, childThreadId, projectPath) {
+        const parentThreadId = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
+        if (childThreadId === parentThreadId)
+            return;
+        this.childThreadSessions.set(childThreadId, sessionId);
+        this.threadProjectPaths.set(childThreadId, path.resolve(projectPath));
+        // Child approvals use the parent's capability boundary and delegation
+        // carrier. This is inheritance, not a second permission decision.
+        const parentBoundary = parentThreadId ? this.threadExternalToolBoundaries.get(parentThreadId) : undefined;
+        const parentFingerprint = parentThreadId ? this.threadExternalToolFingerprints.get(parentThreadId) : undefined;
+        if (parentBoundary)
+            this.threadExternalToolBoundaries.set(childThreadId, parentBoundary);
+        if (parentFingerprint)
+            this.threadExternalToolFingerprints.set(childThreadId, parentFingerprint);
+        const parentCarrier = parentThreadId ? this.threadDelegationCarriers.get(parentThreadId) : undefined;
+        if (parentCarrier)
+            this.threadDelegationCarriers.set(childThreadId, parentCarrier);
+    }
+    unregisterChildThread(childThreadId) {
+        this.childThreadSessions.delete(childThreadId);
+        this.activeSubagentTurns.delete(childThreadId);
+        this.threadProjectPaths.delete(childThreadId);
+        this.threadExternalToolBoundaries.delete(childThreadId);
+        this.threadExternalToolFingerprints.delete(childThreadId);
+        this.threadDelegationCarriers.delete(childThreadId);
+        this.clearTrackedApprovalItemsForThread(childThreadId);
+    }
+    cleanupChildThreadsForSession(sessionId) {
+        for (const [childThreadId, ownerSessionId] of this.childThreadSessions) {
+            if (ownerSessionId === sessionId)
+                this.unregisterChildThread(childThreadId);
+        }
+    }
+    trackSubagentLifecycle(notification, state, appServer) {
+        const params = (notification.params || {});
+        const item = params.item && typeof params.item === 'object' ? params.item : undefined;
+        if (!this.isSubagentActivityItem(item))
+            return;
+        const childThreadId = this.subagentThreadId(item);
+        if (!childThreadId)
+            return;
+        const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+        if (kind === 'started') {
+            state.activeSubagentThreads.add(childThreadId);
+            this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+            if (appServer)
+                this.markThreadSubscribed(appServer, childThreadId);
+        }
+        if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+            state.activeSubagentThreads.delete(childThreadId);
+            if (appServer)
+                void this.releaseThreadSubscription(appServer, childThreadId, 'subagent-finished');
+            this.unregisterChildThread(childThreadId);
+        }
+    }
+    primeSubagentStateFromTurn(turn, state, appServer) {
+        for (const item of this.getTurnItems(turn)) {
+            if (!this.isSubagentActivityItem(item))
+                continue;
+            const childThreadId = this.subagentThreadId(item);
+            const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+            if (!childThreadId)
+                continue;
+            if (kind === 'started') {
+                state.activeSubagentThreads.add(childThreadId);
+                this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+                if (appServer)
+                    this.markThreadSubscribed(appServer, childThreadId);
+            }
+            else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+                state.activeSubagentThreads.delete(childThreadId);
+                if (appServer)
+                    void this.releaseThreadSubscription(appServer, childThreadId, 'subagent-finished');
+                this.unregisterChildThread(childThreadId);
+            }
+        }
+    }
+    endAppServerQueueWhenSubagentsDone(queue, state) {
+        if (!state.turnCompleted)
+            return;
+        if (state.activeSubagentThreads.size > 0) {
+            logger.info(`[CodexRunner] parent turn completed; waiting for subagent thread(s): `
+                + `${[...state.activeSubagentThreads].join(',')}`);
+            return;
+        }
+        queue.end();
+    }
+    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, appServer, tempFiles) {
         try {
-            yield { type: 'session_id', sessionId: state.threadId };
+            let sessionIdEmitted = state.committed;
+            if (sessionIdEmitted)
+                yield { type: 'session_id', sessionId: state.threadId };
             for await (const notification of notifications) {
                 if (!this.activeAbortControllers.has(sessionId))
                     break;
+                if (!state.committed && notification.method === 'turn/completed') {
+                    const turn = notification.params?.turn ?? {};
+                    if (turn.status === 'completed') {
+                        const committed = await state.commitProvisional?.();
+                        if (!committed) {
+                            const staleError = new Error('Codex provisional thread was superseded before commit');
+                            staleError.code = 'RUNNER_START_SUPERSEDED';
+                            throw staleError;
+                        }
+                        state.committed = true;
+                        if (!sessionIdEmitted) {
+                            sessionIdEmitted = true;
+                            yield { type: 'session_id', sessionId: state.threadId };
+                        }
+                    }
+                }
                 yield* this.mapAppServerNotification(notification, sessionId, state);
             }
         }
         finally {
             unsubscribe();
+            await this.releaseThreadSubscription(appServer, state.threadId, 'turn-finished');
             if (this.activeAbortControllers.get(sessionId) === controller) {
                 this.activeAbortControllers.delete(sessionId);
             }
@@ -3011,6 +3954,11 @@ export class CodexRunner {
                 && (!state.turnId || activeTurn.turnId === state.turnId)) {
                 this.activeTurns.delete(sessionId);
             }
+            if (!state.committed)
+                this.cleanupProvisionalThread(sessionId, state.threadId);
+            for (const childThreadId of state.activeSubagentThreads)
+                this.unregisterChildThread(childThreadId);
+            state.activeSubagentThreads.clear();
             this.cleanupTempFiles(tempFiles);
         }
     }
@@ -3078,12 +4026,16 @@ export class CodexRunner {
             }
             case 'turn/completed': {
                 const turn = params.turn || {};
-                const turnId = turn.id || params.turnId;
+                const turnId = turn.id || params.turnId || state.turnId;
                 if (turnId && state.completedTurnIds.has(turnId))
                     break;
                 if (turnId)
                     state.completedTurnIds.add(turnId);
-                this.activeTurns.delete(sessionId);
+                const activeTurn = this.activeTurns.get(sessionId);
+                if (activeTurn?.threadId === state.threadId && activeTurn.turnId === turnId) {
+                    this.activeTurns.delete(sessionId);
+                }
+                this.clearPendingToolDenialsForTurn(state.threadId, turnId);
                 yield* this.reconcileOpenAppServerToolCalls(state, turnId);
                 if (turn.status === 'failed' && turn.error?.message) {
                     if (isRetryableError(new Error(turn.error.message))) {
@@ -3204,11 +4156,36 @@ export class CodexRunner {
                 };
                 break;
             case 'subAgentActivity':
-                yield {
-                    type: 'task_progress',
-                    summary: `Subagent ${item.kind}: ${item.agentPath || item.agentThreadId}`,
-                };
+            case 'SubAgentActivity': {
+                const childThreadId = this.subagentThreadId(item);
+                if (!childThreadId)
+                    break;
+                const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+                const description = this.subagentPath(item) ?? childThreadId;
+                if (kind === 'started') {
+                    yield {
+                        type: 'task_started',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        subagentType: this.subagentType(item),
+                    };
+                }
+                else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+                    yield {
+                        type: 'task_notification',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        status: kind === 'completed' ? 'completed' : kind,
+                        summary: description,
+                    };
+                }
+                else {
+                    yield { type: 'task_progress', taskId: childThreadId, taskKind: 'agent', description, summary: `Subagent ${item.kind}: ${description}` };
+                }
                 break;
+            }
             case 'enteredReviewMode':
                 yield { type: 'task_progress', summary: item.review || 'Review mode entered' };
                 break;
@@ -3223,6 +4200,59 @@ export class CodexRunner {
     *mapAppServerItemCompleted(item, state) {
         if (!item)
             return;
+        const denial = this.takeToolDenial(state, item.id);
+        const denialFields = denial
+            ? {
+                isError: true,
+                error: denial.reason,
+                errorCode: errorCodeForToolDenial(denial.decisionSource, denial.policyCode),
+                decision: 'deny',
+                decisionSource: denial.decisionSource,
+                policyCode: denial.policyCode,
+                reason: denial.reason,
+                requestId: denial.requestId,
+                executed: false,
+                executionState: 'blocked',
+            }
+            : undefined;
+        const itemErrorText = outputTextForManagedHook(typeof item.error === 'string' ? item.error : item.error?.message);
+        const hookErrorText = /(?:Command|Tool call) blocked by PreToolUse hook\s*:/i.test(itemErrorText)
+            ? itemErrorText
+            : undefined;
+        const managedHookDenial = (item.status === 'failed' || item.status === 'declined' || hookErrorText)
+            ? parseManagedPreToolUseDenial([
+                item.aggregatedOutput,
+                item.output,
+                item.result,
+                hookErrorText,
+            ].filter(value => value !== undefined && value !== null).map(outputTextForManagedHook).join('\n'))
+            : undefined;
+        const managedHookFields = !denial && managedHookDenial
+            ? {
+                isError: true,
+                error: managedHookDenial.reason,
+                errorCode: 'POLICY_DENIED',
+                decision: 'deny',
+                decisionSource: 'policy',
+                policyCode: managedHookDenial.policyCode,
+                reason: managedHookDenial.reason,
+                executed: false,
+                executionState: 'blocked',
+            }
+            : undefined;
+        const genericDeclineFields = !denial && !managedHookFields && item.status === 'declined'
+            ? {
+                isError: true,
+                error: 'Approval declined',
+                errorCode: 'USER_DENIED',
+                decision: 'deny',
+                decisionSource: 'approval',
+                reason: 'Approval declined',
+                executed: false,
+                executionState: 'blocked',
+            }
+            : undefined;
+        const blockedFields = denialFields ?? managedHookFields ?? genericDeclineFields;
         switch (item.type) {
             case 'agentMessage':
                 {
@@ -3239,8 +4269,10 @@ export class CodexRunner {
                     type: 'tool_result',
                     name: 'Shell',
                     result: item.aggregatedOutput ?? '',
-                    isError: item.exitCode !== null && item.exitCode !== undefined ? item.exitCode !== 0 : item.status === 'failed',
-                    ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
+                    ...(blockedFields ?? {
+                        isError: item.exitCode !== null && item.exitCode !== undefined ? item.exitCode !== 0 : item.status === 'failed' || item.status === 'declined',
+                        ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
+                    }),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
                 };
@@ -3250,8 +4282,8 @@ export class CodexRunner {
                     type: 'tool_result',
                     name: `MCP:${item.server}/${item.tool}`,
                     result: item.result,
-                    isError: item.status === 'failed',
-                    error: item.error?.message,
+                    ...(blockedFields ?? { isError: item.status === 'failed' }),
+                    ...(blockedFields ? {} : { error: item.error?.message }),
                     ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
@@ -3262,7 +4294,7 @@ export class CodexRunner {
                     type: 'tool_result',
                     name: item.namespace ? `${item.namespace}:${item.tool}` : item.tool,
                     result: item.contentItems,
-                    isError: item.success === false || item.status === 'failed',
+                    ...(blockedFields ?? { isError: item.success === false || item.status === 'failed' }),
                     ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
@@ -3277,12 +4309,12 @@ export class CodexRunner {
                             yield editEvent;
                         }
                     }
-                    yield { type: 'tool_result', name: 'Edit', result: item.changes, isError: item.status === 'failed', callId: item.id };
+                    yield { type: 'tool_result', name: 'Edit', result: item.changes, ...(blockedFields ?? { isError: item.status === 'failed' }), callId: item.id };
                 }
                 else {
                     const desc = this.normalizeFileChanges(item.changes).map((change) => this.describeFileChange(change)).join(', ');
                     yield { type: 'tool_use', name: 'FileChange', input: { description: desc }, callId: item.id };
-                    yield { type: 'tool_result', name: 'FileChange', result: item.changes, isError: item.status === 'failed', callId: item.id };
+                    yield { type: 'tool_result', name: 'FileChange', result: item.changes, ...(blockedFields ?? { isError: item.status === 'failed' }), callId: item.id };
                 }
                 break;
             case 'webSearch':
@@ -3336,6 +4368,34 @@ export class CodexRunner {
                     callId: item.id,
                 };
                 break;
+            case 'subAgentActivity':
+            case 'SubAgentActivity': {
+                const childThreadId = this.subagentThreadId(item);
+                if (!childThreadId)
+                    break;
+                const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
+                const description = this.subagentPath(item) ?? childThreadId;
+                if (kind === 'started') {
+                    yield {
+                        type: 'task_started',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        subagentType: this.subagentType(item),
+                    };
+                }
+                else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
+                    yield {
+                        type: 'task_notification',
+                        taskId: childThreadId,
+                        taskKind: 'agent',
+                        description,
+                        status: kind === 'completed' ? 'completed' : kind,
+                        summary: description,
+                    };
+                }
+                break;
+            }
         }
     }
     *mapAppServerFileChangePatchUpdated(params, state) {
@@ -3466,10 +4526,10 @@ export class CodexRunner {
         if (!stat.isDirectory() || stat.isSymbolicLink()) {
             throw new Error(`managed temp path is not a real directory: ${directory}`);
         }
-        if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+        if (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
             throw new Error(`managed temp path is owned by another uid: ${directory}`);
         }
-        if ((stat.mode & 0o077) !== 0)
+        if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)
             fs.chmodSync(directory, 0o700);
     }
     ensureSessionTempDir(sessionId) {
@@ -3545,7 +4605,7 @@ export class CodexRunner {
             return undefined;
         return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 `/tmp/evolcore-codex-*` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 `$TMPDIR` 重新创建，再继续执行后续 `ec` 命令。';
     }
-    buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier) {
+    buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier, taskDelegationToken) {
         const managedTempDir = this.ensureSessionTempDir(sessionId);
         return {
             shell_environment_policy: {
@@ -3554,7 +4614,9 @@ export class CodexRunner {
                     EVOLCORE_HOME: resolveRoot(),
                     ...(managedTempDir ? { EVOLCORE_SESSION_RUNTIME_DIR: managedTempDir } : {}),
                     ...(managedTempDir ? { EVOLCORE_RUNTIME_LOCK_DIR: path.join(path.dirname(managedTempDir), 'evolcore-locks') } : {}),
-                    ...(delegationCarrier ? { [AGENT_DELEGATION_TOKEN_ENV]: delegationCarrier } : {}),
+                    ...(taskDelegationToken || delegationCarrier
+                        ? { [AGENT_DELEGATION_TOKEN_ENV]: taskDelegationToken ?? delegationCarrier }
+                        : {}),
                     ...(managedTempDir ? { TMPDIR: managedTempDir } : {}),
                 },
             },
@@ -3583,24 +4645,35 @@ export class CodexRunner {
         for (const [key, controller] of this.activeAbortControllers) {
             controller.abort('dispose');
         }
+        await Promise.all([...this.activeSubagentTurns.entries()].map(([threadId, active]) => this.interruptAppServerTurn(threadId, active.turnId).catch(() => { })));
+        await Promise.all([...this.threadSubscriptions.entries()].map(([threadId, subscription]) => this.releaseThreadSubscription(subscription.client, threadId, 'runner-dispose')));
+        this.threadSubscriptions.clear();
         this.activeAbortControllers.clear();
         this.activeStreams.clear();
         this.activeSessions.clear();
+        this.provisionalSessions.clear();
         this.activeTurns.clear();
+        this.activeSubagentTurns.clear();
+        this.childThreadSessions.clear();
         this.threadProjectPaths.clear();
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
         this.trackedApprovalItems.clear();
         this.threadDelegationCarriers.clear();
         this.pendingInterrupts.clear();
+        this.steeringTails.clear();
         this.permissionContexts.clear();
         this.chatModes.clear();
         this.pruneThreadOperationLocks();
         this.threadOperationLocks.clear();
         for (const sessionId of [...this.sessionTempDirs.keys()])
             this.cleanupSessionTempDir(sessionId);
-        await this.appServerClient?.close();
+        await Promise.all([
+            this.appServerClient?.close(),
+            this.fullAccessAppServerClient?.close(),
+        ]);
         this.appServerClient = null;
+        this.fullAccessAppServerClient = null;
     }
 }
 // ── Plugin ──