evolcore 0.0.22 → 0.0.23

package/dist/agents/codex-runner.js

@@ -1,16 +1,10 @@
-/**
- * Codex Agent Runner
- *
- * Integrates Codex app-server as an agent backend.
- * Implements the same interface surface as AgentRunner (claude-runner.ts)
- * so MessageProcessor and CommandHandler can work with it transparently.
- */
+import { getRunnerCatalog, catalogEfforts, assertCatalogSelectable } from '../core/model/model-catalog.js';
 import { hasTrustedFullAccessContext } from './runner-types.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/permission/protected-paths.js';
-import { CodexAppServerClient } from './codex-app-server-client.js';
+import { CODEX_THREAD_ACTIVE_WRITER, CodexAppServerClient, } from './codex/app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
@@ -47,6 +41,7 @@ export function formatApprovalLogSummary(summary) {
         return singleLine;
     return singleLine.slice(0, APPROVAL_LOG_SUMMARY_MAX_LENGTH - 3).trimEnd() + '...';
 }
+// ── Codex 模型目录（动态获取，含 effort） ──
 class AsyncEventQueue {
     queue = [];
     done = false;
@@ -94,6 +89,7 @@ function errorCodeForToolDenial(decisionSource, policyCode) {
         return 'INVALID_ARGUMENT';
     return 'EXECUTION_FAILED';
 }
+const CODEX_THREAD_HANDOFF_TIMEOUT_MS = 2_000;
 const managedTempDirsForExitCleanup = new Map();
 let managedTempExitCleanupRegistered = false;
 function isTrustedManagedTempDirectory(directory, parent) {
@@ -109,9 +105,9 @@ function isTrustedManagedTempDirectory(directory, parent) {
             const stat = fs.lstatSync(candidate);
             if (!stat.isDirectory() || stat.isSymbolicLink())
                 return false;
-            if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            if (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())
                 return false;
-            return (stat.mode & 0o077) === 0;
+            return process.platform === 'win32' || (stat.mode & 0o077) === 0;
         };
         if (!trustedDirectory(parentPath) || !trustedDirectory(directoryPath))
             return false;
@@ -218,20 +214,17 @@ function outputTextForManagedHook(value) {
     }
     return String(value);
 }
-const CODEX_CATALOG_FALLBACK = [
-    { slug: 'gpt-5.5', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.4', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.4-mini', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.3-codex', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.2', efforts: ['low', 'medium', 'high', 'xhigh'] },
-];
 const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
 const CODEX_NO_ROLLOUT_RE = /no rollout found for thread id/i;
+const CODEX_ACTIVE_WRITER_RE = /already has an active writer/i;
 function isCodexNoRolloutError(error) {
     return error?.code === 'CODEX_ROLLOUT_NOT_FOUND'
         || CODEX_NO_ROLLOUT_RE.test(error instanceof Error ? error.message : String(error));
 }
-let codexCatalogCache = null;
+function isCodexActiveWriterError(error) {
+    return error?.code === CODEX_THREAD_ACTIVE_WRITER
+        || CODEX_ACTIVE_WRITER_RE.test(error instanceof Error ? error.message : String(error));
+}
 // The permission bridge is version-locked to the audited approval schema and
 // managed PreToolUse hook behavior used by proactive first-tool enforcement.
 export const MIN_CODEX_CLI_VERSION = '0.144.1';
@@ -286,37 +279,6 @@ export function getCodexAppServerAvailability() {
 export function isCodexAppServerAvailable() {
     return getCodexAppServerAvailability().available;
 }
-function fetchCodexCatalog() {
-    if (codexCatalogCache)
-        return codexCatalogCache;
-    try {
-        const output = execCodexCliSync(['debug', 'models'], {
-            encoding: 'utf-8',
-            timeout: 5000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        const catalog = JSON.parse(output);
-        const models = catalog.models
-            .filter(m => m.visibility === 'list')
-            .map(m => ({
-            slug: m.slug,
-            efforts: (m.supported_reasoning_levels || []).map(l => l.effort),
-        }));
-        if (models.length > 0) {
-            codexCatalogCache = models;
-            return models;
-        }
-    }
-    catch (e) {
-        logger.debug(`[CodexRunner] Failed to fetch model catalog, using fallback: ${e}`);
-    }
-    return CODEX_CATALOG_FALLBACK;
-}
-export function getCodexEfforts(model) {
-    const catalog = fetchCodexCatalog();
-    const entry = catalog.find(m => m.slug === model);
-    return entry?.efforts ?? catalog[0]?.efforts ?? ['low', 'medium', 'high'];
-}
 // ── Codex Runner ──
 export class CodexRunner {
     name = 'codex';
@@ -347,7 +309,12 @@ export class CodexRunner {
     steeringTails = new Map();
     threadOperationLocks = new Map();
     activeOperationReleases = new Map();
+    /** Last app-server client that loaded each thread, including unsubscribed threads. */
+    threadSubscriptions = new Map();
+    /** Ordinary sessions stay behind the EvolCore H/L filesystem guard. */
     appServerClient = null;
+    /** Trusted fullaccess calls use a separate unmasked app-server process. */
+    fullAccessAppServerClient = null;
     onSessionIdUpdate;
     onCompactStart;
     permissionGateway;
@@ -388,24 +355,203 @@ export class CodexRunner {
             this.effort = this.resolvedConfig.effort;
         this.onSessionIdUpdate = callbacks.onSessionIdUpdate;
     }
-    getAppServerClient() {
-        if (!this.appServerClient) {
-            const client = new CodexAppServerClient({
-                apiKey: this.resolvedConfig.apiKey,
-                baseUrl: this.resolvedConfig.baseUrl,
-                provider: this.resolvedConfig.provider,
-                headers: this.resolvedConfig.headers,
-                queryParams: this.resolvedConfig.queryParams,
-                model: this.model,
-                effort: this.effort,
-                enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,
-                approvalsReviewer: 'user',
-                onServerRequest: request => this.handleAppServerRequest(request),
-            });
-            client.onNotification(notification => this.trackApprovalItemNotification(notification));
+    getAppServerClient(fullAccess = false) {
+        const existing = fullAccess ? this.fullAccessAppServerClient : this.appServerClient;
+        if (existing)
+            return existing;
+        const client = new CodexAppServerClient({
+            apiKey: this.resolvedConfig.apiKey,
+            baseUrl: this.resolvedConfig.baseUrl,
+            provider: this.resolvedConfig.provider,
+            headers: this.resolvedConfig.headers,
+            queryParams: this.resolvedConfig.queryParams,
+            model: this.model,
+            effort: this.effort,
+            enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,
+            approvalsReviewer: 'user',
+            protectEvolcoreFilesystem: !fullAccess,
+            // A completed turn is explicitly unsubscribed below. This is only an
+            // optimization on newer Codex versions; old versions retain the thread
+            // until the cross-client archive fallback runs.
+            onServerRequest: request => this.handleAppServerRequest(request),
+        });
+        client.onNotification(notification => {
+            this.trackApprovalItemNotification(notification);
+            if (notification.method !== 'thread/closed')
+                return;
+            const params = (notification.params || {});
+            const threadId = params.threadId ?? params.thread_id;
+            if (typeof threadId !== 'string')
+                return;
+            const subscription = this.threadSubscriptions.get(threadId);
+            if (subscription?.client === client) {
+                // Keep the last client identity so a later same-mode turn resumes on
+                // the same app-server even after the runtime has fully unloaded.
+                this.threadSubscriptions.set(threadId, { client, state: 'unsubscribed' });
+            }
+        });
+        if (fullAccess) {
+            this.fullAccessAppServerClient = client;
+        }
+        else {
             this.appServerClient = client;
         }
-        return this.appServerClient;
+        return client;
+    }
+    getAppServerClientForThread(threadId) {
+        const subscribed = this.threadSubscriptions.get(threadId);
+        if (subscribed)
+            return subscribed.client;
+        const sessionId = this.findSessionKeyByThread(threadId);
+        return this.getAppServerClient(sessionId ? this.chatModes.get(sessionId) === 'fullaccess' : false);
+    }
+    markThreadSubscribed(client, threadId) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (existing?.client === client && existing.state === 'subscribed' && !existing.release)
+            return;
+        this.threadSubscriptions.set(threadId, { client, state: 'subscribed' });
+    }
+    /**
+     * Release only one thread from one app-server connection. Unsubscribe is
+     * intentionally not treated as an immediate unload: current Codex builds can
+     * keep an unsubscribed thread loaded for a long grace period. The owner therefore
+     * remains in the map until a different client successfully resumes it.
+     */
+    async releaseThreadSubscription(client, threadId, reason, options = {}) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (existing && existing.client !== client)
+            return false;
+        if (existing?.release)
+            return await existing.release.catch(error => {
+                logger.warn(`[CodexRunner] Existing thread release failed: thread=${threadId} `
+                    + `error=${error instanceof Error ? error.message : String(error)}`);
+                return false;
+            });
+        if (existing?.state === 'unsubscribed')
+            return true;
+        let releasePromise;
+        releasePromise = Promise.resolve().then(async () => {
+            let released = false;
+            try {
+                const unsubscribe = client.threadUnsubscribe;
+                if (typeof unsubscribe === 'function') {
+                    if (options.waitForClose && typeof client.threadUnsubscribeAndWait === 'function') {
+                        try {
+                            await client.threadUnsubscribeAndWait.call(client, threadId, options.timeoutMs ?? CODEX_THREAD_HANDOFF_TIMEOUT_MS);
+                        }
+                        catch (error) {
+                            // The unsubscribe RPC has already succeeded when this is a
+                            // close-timeout. Keep the owner marked unsubscribed and let the
+                            // target resume decide whether the archive fallback is needed.
+                            if (error?.code !== 'CODEX_THREAD_CLOSE_TIMEOUT')
+                                throw error;
+                            logger.debug(`[CodexRunner] thread/closed not observed before handoff timeout: `
+                                + `thread=${threadId} reason=${reason}`);
+                        }
+                    }
+                    else {
+                        await unsubscribe.call(client, threadId);
+                    }
+                }
+                logger.debug(`[CodexRunner] Released thread subscription: thread=${threadId} reason=${reason}`);
+                released = true;
+                return true;
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] Failed to release thread subscription: thread=${threadId} reason=${reason} `
+                    + `error=${error instanceof Error ? error.message : String(error)}`);
+                return false;
+            }
+            finally {
+                const current = this.threadSubscriptions.get(threadId);
+                if (current?.client === client && current.release === releasePromise) {
+                    if (released) {
+                        this.threadSubscriptions.set(threadId, { client, state: 'unsubscribed' });
+                    }
+                    else {
+                        this.threadSubscriptions.set(threadId, { client, state: current.state });
+                    }
+                }
+            }
+        });
+        this.threadSubscriptions.set(threadId, {
+            client,
+            state: existing?.state ?? 'subscribed',
+            release: releasePromise,
+        });
+        return await releasePromise;
+    }
+    async prepareThreadSubscription(client, threadId) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (!existing)
+            return undefined;
+        if (existing.client === client) {
+            if (existing.release)
+                await existing.release.catch(() => undefined);
+            return undefined;
+        }
+        if (existing.state === 'subscribed') {
+            const released = await this.releaseThreadSubscription(existing.client, threadId, 'mode-handoff', {
+                waitForClose: true,
+                timeoutMs: CODEX_THREAD_HANDOFF_TIMEOUT_MS,
+            });
+            if (!released) {
+                const error = new Error(`Codex thread ${threadId} is still owned by another app-server connection`);
+                error.code = CODEX_THREAD_ACTIVE_WRITER;
+                throw error;
+            }
+        }
+        return existing.client;
+    }
+    async archiveThreadForHandoff(sourceClient, targetClient, threadId) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (existing && existing.client !== sourceClient) {
+            const error = new Error(`Codex thread ${threadId} ownership changed during handoff`);
+            error.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw error;
+        }
+        const sessionId = this.findSessionKeyByThread(threadId);
+        if ([...this.activeSubagentTurns.values()].some(active => active.sessionId === sessionId && active.parentThreadId === threadId)) {
+            const error = new Error(`Codex thread ${threadId} has an active descendant turn`);
+            error.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw error;
+        }
+        // Old app-server versions can acknowledge unsubscribe while retaining the
+        // writer. Archive is the only per-thread operation that synchronously
+        // tears down that runtime; the target client restores it before resume.
+        const archive = sourceClient.threadArchive;
+        const unarchive = targetClient.threadUnarchive;
+        if (typeof archive !== 'function' || typeof unarchive !== 'function') {
+            const error = new Error(`Codex thread ${threadId} requires archive/unarchive handoff support`);
+            error.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw error;
+        }
+        let archived = false;
+        try {
+            await archive.call(sourceClient, threadId);
+            archived = true;
+            await unarchive.call(targetClient, threadId);
+        }
+        catch (error) {
+            if (archived) {
+                // Do not strand the user's rollout under archived_sessions when the
+                // target client fails midway through the compatibility handoff.
+                try {
+                    await unarchive.call(sourceClient, threadId);
+                    this.threadSubscriptions.set(threadId, { client: sourceClient, state: 'subscribed' });
+                }
+                catch (restoreError) {
+                    logger.error(`[CodexRunner] Failed to restore archived thread after handoff failure: thread=${threadId} `
+                        + `error=${restoreError instanceof Error ? restoreError.message : String(restoreError)}`);
+                }
+            }
+            logger.warn(`[CodexRunner] Archive handoff failed: thread=${threadId} `
+                + `error=${error instanceof Error ? error.message : String(error)}`);
+            const handoffError = new Error(`Codex thread ${threadId} is still owned by another app-server connection`);
+            handoffError.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw handoffError;
+        }
+        this.threadSubscriptions.set(threadId, { client: targetClient, state: 'subscribed' });
     }
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
@@ -681,8 +827,11 @@ export class CodexRunner {
         }
     }
     resetAppServerClient() {
-        const client = this.appServerClient;
+        const clients = [this.appServerClient, this.fullAccessAppServerClient]
+            .filter((client) => !!client);
         this.appServerClient = null;
+        this.fullAccessAppServerClient = null;
+        this.threadSubscriptions.clear();
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
         for (const childThreadId of this.childThreadSessions.keys())
@@ -695,9 +844,11 @@ export class CodexRunner {
         this.trackedApprovalItems.clear();
         this.pendingToolDenials.clear();
         this.threadDelegationCarriers.clear();
-        client?.close().catch(error => {
-            logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
-        });
+        for (const client of clients) {
+            client.close().catch(error => {
+                logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
+            });
+        }
     }
     mergeThreadConfig(...configs) {
         const merged = {};
@@ -945,19 +1096,16 @@ export class CodexRunner {
     // ── ModelSwitcher ──
     setModel(model) { this.model = model; this.resetAppServerClient(); }
     getModel() { return this.model; }
+    getModelCatalog() {
+        return getRunnerCatalog('codex', this.resolvedConfig.agentAid, this.resolvedConfig);
+    }
     async listModels() {
-        try {
-            const response = await this.getAppServerClient().modelList(false);
-            const ids = (response.data ?? [])
-                .map(model => model.id || model.slug || model.name || model.model)
-                .filter((id) => typeof id === 'string' && id.length > 0);
-            if (ids.length > 0)
-                return ids;
-        }
-        catch (error) {
-            logger.debug(`[CodexRunner] app-server model/list failed, using catalog fallback: ${error}`);
-        }
-        return fetchCodexCatalog().map(m => m.slug);
+        const catalog = await this.getModelCatalog();
+        assertCatalogSelectable(catalog);
+        return catalog.models.map(m => m.id);
+    }
+    async getAvailableEfforts(model) {
+        return catalogEfforts(await this.getModelCatalog(), model, 'codex');
     }
     // ── Effort ──
     setEffort(effort) { this.effort = effort; this.resetAppServerClient(); }
@@ -1014,7 +1162,9 @@ export class CodexRunner {
             if (!looksLikeGitMetadataDirectory(resolved))
                 return;
             paths.add(resolved);
-            paths.add(path.join(resolved, '**'));
+            // Keep exact paths native, but Codex requires POSIX separators for
+            // recursive filesystem globs even on Windows.
+            paths.add(`${resolved}/**`);
         };
         try {
             const stat = fs.statSync(marker);
@@ -1028,7 +1178,7 @@ export class CodexRunner {
             }
         }
         catch { }
-        for (const gitDirectory of [...paths].filter(candidate => !candidate.endsWith(`${path.sep}**`))) {
+        for (const gitDirectory of [...paths].filter(candidate => !candidate.endsWith('/**'))) {
             try {
                 const commonDirectory = fs.readFileSync(path.join(gitDirectory, 'commondir'), 'utf8').trim();
                 if (commonDirectory)
@@ -1137,7 +1287,7 @@ export class CodexRunner {
                 return;
             }
             const input = [{ type: 'text', text, text_elements: [] }];
-            const client = this.getAppServerClient();
+            const client = this.getAppServerClientForThread(activeTurn.threadId);
             if (typeof client.turnSteer !== 'function') {
                 logger.warn(`[CodexRunner] turn steer unavailable in app-server client: session=${sessionId}`);
                 return;
@@ -1265,6 +1415,10 @@ export class CodexRunner {
         const hadController = this.activeAbortControllers.has(key);
         const hadTurn = this.activeTurns.has(key);
         const provisionalThread = this.provisionalSessions.get(key);
+        const subscribedThreadId = this.activeTurns.get(key)?.threadId
+            ?? this.activeSessions.get(key)
+            ?? provisionalThread;
+        const subscription = subscribedThreadId ? this.threadSubscriptions.get(subscribedThreadId) : undefined;
         this.activeStreams.delete(key);
         this.activeAbortControllers.delete(key);
         this.pendingInterrupts.delete(key);
@@ -1276,9 +1430,18 @@ export class CodexRunner {
         }
         this.chatModes.delete(key);
         const release = this.activeOperationReleases.get(key);
+        let releaseAfterSubscription;
+        if (subscription) {
+            releaseAfterSubscription = this.releaseThreadSubscription(subscription.client, subscribedThreadId, 'stream-cleanup');
+        }
         if (release) {
             this.activeOperationReleases.delete(key);
-            release();
+            if (releaseAfterSubscription) {
+                void releaseAfterSubscription.then(release, release);
+            }
+            else {
+                release();
+            }
         }
     }
     hasActiveStream(key) {
@@ -1455,7 +1618,7 @@ export class CodexRunner {
         this.chatModes.set(sessionId, callMode);
         const callApprovalPolicy = this.toApprovalPolicy(callMode);
         const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath);
-        const appServer = this.getAppServerClient();
+        const appServer = this.getAppServerClient(callMode === 'fullaccess');
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
@@ -1484,47 +1647,60 @@ export class CodexRunner {
             approvalPolicy: effectiveApprovalPolicy,
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig(callMode)), callMode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined), this.buildLifecycleLockdownConfig(callMode)), callMode),
             ...(developerInstructions ? { developerInstructions } : {}),
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
             `role=${executionSandbox.decision.role ?? 'none'} sandbox=${executionSandbox.decision.state}`);
         let threadResponse;
+        let previousAppServer;
         if (agentSessionId) {
+            // A thread may have been loaded by the other permission-mode client.
+            // Release that one thread before asking this client to resume it.
+            previousAppServer = await this.prepareThreadSubscription(appServer, agentSessionId);
             try {
                 threadResponse = await appServer.threadResume(agentSessionId, projectPath, threadOptions);
             }
             catch (error) {
-                // A legacy main session can retain a provider ID after its rollout was
-                // removed externally. It is safe to recover before input submission;
-                // topic bindings remain authoritative and fail closed.
-                if (topicBinding || !isCodexNoRolloutError(error))
-                    throw error;
-                if (typeof sessionManager?.clearMainSessionBackendIfMatches !== 'function')
-                    throw error;
-                const missingThreadId = agentSessionId;
-                const cleared = await sessionManager.clearMainSessionBackendIfMatches(sessionId, missingThreadId, [CODEX_DELEGATION_CARRIER_METADATA_KEY]);
-                if (cleared !== 'cleared' && cleared !== 'already_clear') {
-                    const recoveryError = new Error(`Codex missing-rollout recovery rejected: ${cleared}`);
-                    recoveryError.code = 'CODEX_MISSING_ROLLOUT_RECOVERY_REJECTED';
-                    throw recoveryError;
+                if (isCodexActiveWriterError(error) && previousAppServer && previousAppServer !== appServer) {
+                    // Some Codex builds acknowledge unsubscribe before unloading the
+                    // runtime. Archive/unarchive is a synchronous per-thread teardown
+                    // and preserves the same persisted thread id for the retry.
+                    await this.archiveThreadForHandoff(previousAppServer, appServer, agentSessionId);
+                    threadResponse = await appServer.threadResume(agentSessionId, projectPath, threadOptions);
+                }
+                else {
+                    // A legacy main session can retain a provider ID after its rollout was
+                    // removed externally. It is safe to recover before input submission;
+                    // topic bindings remain authoritative and fail closed.
+                    if (topicBinding || !isCodexNoRolloutError(error))
+                        throw error;
+                    if (typeof sessionManager?.clearMainSessionBackendIfMatches !== 'function')
+                        throw error;
+                    const missingThreadId = agentSessionId;
+                    const cleared = await sessionManager.clearMainSessionBackendIfMatches(sessionId, missingThreadId, [CODEX_DELEGATION_CARRIER_METADATA_KEY]);
+                    if (cleared !== 'cleared' && cleared !== 'already_clear') {
+                        const recoveryError = new Error(`Codex missing-rollout recovery rejected: ${cleared}`);
+                        recoveryError.code = 'CODEX_MISSING_ROLLOUT_RECOVERY_REJECTED';
+                        throw recoveryError;
+                    }
+                    if (this.activeSessions.get(sessionId) === missingThreadId)
+                        this.activeSessions.delete(sessionId);
+                    this.threadProjectPaths.delete(missingThreadId);
+                    this.threadDelegationCarriers.delete(missingThreadId);
+                    this.unbindExternalToolBoundary(missingThreadId);
+                    this.clearTrackedApprovalItemsForThread(missingThreadId);
+                    agentSessionId = undefined;
+                    resumingThread = false;
+                    knownDelegationCarrier = undefined;
+                    delegationCarrierCandidate = this.createDelegationCarrier();
+                    threadOptions = {
+                        ...threadOptions,
+                        config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined), this.buildLifecycleLockdownConfig(callMode)), callMode),
+                    };
+                    logger.warn(`[CodexRunner] recovered missing rollout before input submission: session=${sessionId} thread=${missingThreadId}`);
+                    threadResponse = await appServer.threadStart(projectPath, threadOptions);
                 }
-                if (this.activeSessions.get(sessionId) === missingThreadId)
-                    this.activeSessions.delete(sessionId);
-                this.threadProjectPaths.delete(missingThreadId);
-                this.threadDelegationCarriers.delete(missingThreadId);
-                this.unbindExternalToolBoundary(missingThreadId);
-                this.clearTrackedApprovalItemsForThread(missingThreadId);
-                agentSessionId = undefined;
-                resumingThread = false;
-                knownDelegationCarrier = undefined;
-                delegationCarrierCandidate = this.createDelegationCarrier();
-                threadOptions = {
-                    ...threadOptions,
-                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig(callMode)), callMode),
-                };
-                logger.warn(`[CodexRunner] recovered missing rollout before input submission: session=${sessionId} thread=${missingThreadId}`);
-                threadResponse = await appServer.threadStart(projectPath, threadOptions);
             }
         }
         else {
@@ -1533,6 +1709,7 @@ export class CodexRunner {
         let threadId = threadResponse.thread?.id || agentSessionId;
         if (!threadId)
             throw new Error('Codex app-server did not return a thread id');
+        this.markThreadSubscribed(appServer, threadId);
         if (!resumingThread) {
             carrierToPublish = { threadId, carrier: delegationCarrierCandidate };
         }
@@ -1559,6 +1736,9 @@ export class CodexRunner {
                 const forkedThreadId = forked.thread?.id;
                 if (!forkedThreadId)
                     throw new Error('Codex delegation-carrier recovery fork did not return a thread id');
+                this.markThreadSubscribed(appServer, forkedThreadId);
+                await this.releaseThreadSubscription(appServer, staleThreadId, 'carrier-recovery-fork-source');
+                await this.releaseThreadSubscription(appServer, forkedThreadId, 'carrier-recovery-fork');
                 threadId = forkedThreadId;
                 recoveredCarrier = delegationCarrierCandidate;
             }
@@ -1591,6 +1771,7 @@ export class CodexRunner {
             if (!bindingAccepted) {
                 const error = new Error(`backend discovery rejected: ${bindingResult}`);
                 error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+                await this.releaseThreadSubscription(appServer, threadId, 'backend-binding-rejected');
                 throw error;
             }
             this.activeSessions.set(sessionId, threadId);
@@ -1633,7 +1814,7 @@ export class CodexRunner {
                 && this.childThreadSessions.get(notifThreadId) === sessionId;
             if (notifThreadId !== undefined && notifThreadId !== threadId && !emittedByChild)
                 return;
-            this.trackSubagentLifecycle(notification, state);
+            this.trackSubagentLifecycle(notification, state, appServer);
             if (emittedByChild && notifThreadId !== threadId) {
                 const childTurnId = this.extractTurnId(notification);
                 if (notification.method === 'turn/started' && childTurnId) {
@@ -1649,6 +1830,7 @@ export class CodexRunner {
                         this.activeSubagentTurns.delete(notifThreadId);
                     }
                     state.activeSubagentThreads.delete(notifThreadId);
+                    void this.releaseThreadSubscription(appServer, notifThreadId, 'subagent-turn-finished');
                     this.unregisterChildThread(notifThreadId);
                     this.endAppServerQueueWhenSubagentsDone(queue, state);
                 }
@@ -1689,7 +1871,7 @@ export class CodexRunner {
             if (!resumingThread)
                 this.cleanupProvisionalThread(sessionId, threadId);
             logger.info(`[CodexRunner] Applied pending interrupt before turn start: ${sessionId}`);
-            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
+            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer, tempFiles);
         }
         try {
             const turnResponse = await appServer.turnStart(threadId, input, {
@@ -1721,7 +1903,7 @@ export class CodexRunner {
             }
             const status = turnResponse.turn?.status;
             if (status === 'completed' || status === 'failed') {
-                this.primeSubagentStateFromTurn(turnResponse.turn, state);
+                this.primeSubagentStateFromTurn(turnResponse.turn, state, appServer);
                 queue.push({ method: 'turn/completed', params: { threadId, turn: turnResponse.turn } });
                 state.turnCompleted = true;
                 this.endAppServerQueueWhenSubagentsDone(queue, state);
@@ -1729,6 +1911,7 @@ export class CodexRunner {
         }
         catch (error) {
             unsubscribe();
+            await this.releaseThreadSubscription(appServer, threadId, 'turn-start-failed');
             this.activeAbortControllers.delete(sessionId);
             this.activeTurns.delete(sessionId);
             this.pendingInterrupts.delete(sessionId);
@@ -1737,7 +1920,7 @@ export class CodexRunner {
                 this.cleanupProvisionalThread(sessionId, threadId);
             throw error;
         }
-        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
+        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer, tempFiles);
     }
     // ── Interrupt ──
     async interrupt(sessionKey) {
@@ -1789,7 +1972,12 @@ export class CodexRunner {
     }
     async interruptAppServerTurn(threadId, turnId) {
         try {
-            await this.getAppServerClient().turnInterrupt(threadId, turnId);
+            const sessionId = this.findSessionKeyByThread(threadId);
+            const subscribed = this.threadSubscriptions.get(threadId);
+            const client = subscribed
+                ? subscribed.client
+                : this.getAppServerClient(sessionId ? this.chatModes.get(sessionId) === 'fullaccess' : false);
+            await client.turnInterrupt(threadId, turnId);
         }
         catch (error) {
             logger.debug(`[CodexRunner] app-server turn interrupt failed: ${error}`);
@@ -1853,11 +2041,16 @@ export class CodexRunner {
             await this.interruptSubagentTurns(sessionId);
         }
         capturedController?.abort('Session closed');
+        const capturedSubscription = capturedThreadId ? this.threadSubscriptions.get(capturedThreadId) : undefined;
         const lifecycleReplaced = (capturedStream !== undefined && this.activeStreams.get(sessionId) !== capturedStream)
             || (capturedController !== undefined && this.activeAbortControllers.get(sessionId) !== capturedController)
             || (capturedTurn !== undefined && this.activeTurns.get(sessionId) !== capturedTurn)
             || (capturedPermissionContext !== undefined && this.permissionContexts.get(sessionId) !== capturedPermissionContext)
             || (capturedThreadId !== undefined && this.activeSessions.get(sessionId) !== capturedThreadId);
+        if (capturedSubscription && !lifecycleReplaced
+            && this.threadSubscriptions.get(capturedThreadId) === capturedSubscription) {
+            await this.releaseThreadSubscription(capturedSubscription.client, capturedThreadId, 'session-closed');
+        }
         if (capturedStream !== undefined && this.activeStreams.get(sessionId) === capturedStream)
             this.activeStreams.delete(sessionId);
         if (capturedController !== undefined && this.activeAbortControllers.get(sessionId) === capturedController)
@@ -1913,6 +2106,10 @@ export class CodexRunner {
     async clearSession(sessionId, _agentSessionId, _projectPath) {
         // Codex: 清空会话 = 下次 runQuery 不传 resumeId，自动创建新 thread
         const threadId = this.activeSessions.get(sessionId) ?? _agentSessionId;
+        const subscription = this.threadSubscriptions.get(threadId);
+        if (subscription) {
+            await this.releaseThreadSubscription(subscription.client, threadId, 'session-cleared');
+        }
         this.activeSessions.delete(sessionId);
         this.activeTurns.delete(sessionId);
         this.steeringTails.delete(sessionId);
@@ -1933,8 +2130,12 @@ export class CodexRunner {
             return result;
         };
         const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId, _sessionId), 'compact');
+        let compactAppServer;
         try {
-            const appServer = this.getAppServerClient();
+            const compactMode = normalizeExecutionPermissionMode(modelOverride?.permissionMode ?? this.chatModes.get(_sessionId) ?? this.currentMode);
+            const appServer = this.getAppServerClient(compactMode === 'fullaccess');
+            compactAppServer = appServer;
+            await this.prepareThreadSubscription(appServer, agentSessionId);
             this.onCompactStart?.(_sessionId);
             try {
                 await this.startAndWaitForCompact(appServer, agentSessionId);
@@ -1944,7 +2145,6 @@ export class CodexRunner {
                 if (!this.isThreadNotFoundError(error))
                     throw error;
                 logger.info(`[CodexRunner] Compact thread not loaded, resuming before compact: ${agentSessionId}`);
-                const compactMode = normalizeExecutionPermissionMode(modelOverride?.permissionMode ?? this.chatModes.get(_sessionId) ?? this.currentMode);
                 const compactModel = modelOverride?.model || this.model;
                 const compactEffort = modelOverride?.effortMode === 'model_default'
                     ? undefined
@@ -1967,6 +2167,7 @@ export class CodexRunner {
                     ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
                     config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
                 });
+                this.markThreadSubscribed(appServer, agentSessionId);
                 this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
                 this.threadDelegationCarriers.set(agentSessionId, compactDelegationCarrier);
                 this.bindExternalToolBoundary(agentSessionId, externalToolConfig);
@@ -1979,6 +2180,9 @@ export class CodexRunner {
             return finish({ ok: false, code: 'sdk_error', message, durationMs: Date.now() - startedAt });
         }
         finally {
+            if (compactAppServer) {
+                await this.releaseThreadSubscription(compactAppServer, agentSessionId, 'compact-finished');
+            }
             release();
         }
     }
@@ -2119,7 +2323,8 @@ export class CodexRunner {
         const mode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const executionSandbox = this.buildExecutionSandboxOptions(sessionKey, mode, projectPath);
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
-        const appServer = this.getAppServerClient();
+        const appServer = this.threadSubscriptions.get(agentSessionId)?.client
+            ?? this.getAppServerClient(mode === 'fullaccess');
         const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, mode);
         if (sessionKey)
             await this.assertProactiveHookAvailability(sessionKey, appServer);
@@ -2135,9 +2340,11 @@ export class CodexRunner {
         const forkedThreadId = response.thread?.id;
         if (!forkedThreadId)
             throw new Error('Codex fork did not return a thread id');
+        this.markThreadSubscribed(appServer, forkedThreadId);
         this.threadDelegationCarriers.set(forkedThreadId, delegationCarrier);
         this.threadProjectPaths.set(forkedThreadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(forkedThreadId, externalToolConfig);
+        await this.releaseThreadSubscription(appServer, forkedThreadId, 'fork-finished');
         return forkedThreadId;
     }
     async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title) {
@@ -2167,14 +2374,14 @@ export class CodexRunner {
         }
     }
     async setSessionName(agentSessionId, name) {
-        return this.getAppServerClient().threadSetName(agentSessionId, name);
+        return this.getAppServerClientForThread(agentSessionId).threadSetName(agentSessionId, name);
     }
     async updateSessionMetadata(agentSessionId, metadata) {
         const gitInfo = metadata?.gitInfo && typeof metadata.gitInfo === 'object' ? metadata.gitInfo : undefined;
-        return this.getAppServerClient().threadMetadataUpdate(agentSessionId, gitInfo);
+        return this.getAppServerClientForThread(agentSessionId).threadMetadataUpdate(agentSessionId, gitInfo);
     }
     async getSessionMessages(agentSessionId, projectPath) {
-        const response = await this.getAppServerClient().threadRead(agentSessionId, true);
+        const response = await this.getAppServerClientForThread(agentSessionId).threadRead(agentSessionId, true);
         return this.mapThreadToSessionMessages(response, agentSessionId);
     }
     approvalItemKey(threadId, turnId, itemId) {
@@ -2406,6 +2613,10 @@ export class CodexRunner {
                 setImmediate(() => this.steerPolicyReason(sessionKey, 'fullaccess_context_untrusted', reason));
                 return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
             }
+            // Fullaccess uses the current task delegation token in its shell
+            // environment, so it must not enter the ordinary workspace/carrier
+            // approval path even if the app-server asks for an infrastructure
+            // approval despite approvalPolicy=never.
             const response = this.toAppServerApprovalResponse(request.method, 'allow', toolInput, false);
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'allow', 'approval', undefined, 'trusted fullaccess execution');
             return response;
@@ -2413,7 +2624,9 @@ export class CodexRunner {
         // Keep the policy check in the approval path as a fail-closed fallback.
         // Some app-server tool routes can reach approval without invoking the
         // command hook; allowing here would bypass the proactive gate.
-        const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
+        const policyResult = (this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess'
+            ? undefined
+            : this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         if (policyResult?.block) {
             logger.info(`[CodexRunner] app-server approval declined by session policy: session=${sessionKey} ` +
                 `requestId=${request.id ?? '<missing>'} code=${policyResult.policyCode ?? 'session_policy_hook'} ` +
@@ -2439,9 +2652,33 @@ export class CodexRunner {
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
         const reason = params.reason || params.decisionReason || undefined;
+        const auditSummary = (summarizeToolInputForAudit(toolName, toolInput)
+            || summarizeToolInputForAudit('Bash', { command: summary })).slice(0, 512);
+        const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const workspacePath = this.resolvePermissionWorkspacePath(params);
         if (!workspacePath) {
             logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+                    policyCode: 'approval_workspace_unknown',
+                    decisionSource: 'infrastructure',
+                    agentAid: permissionContext?.selfAid,
+                    agentName: permissionContext?.agentName,
+                    sessionId: sessionKey,
+                    permissionMode: normalizeExecutionPermissionMode(sessionMode),
+                    summary: auditSummary,
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record unknown-workspace approval denial: session=${sessionKey} error=${error instanceof Error ? error.message : String(error)}`);
+            }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
             this.rememberToolDenial(request, params, {
                 decision: 'deny',
@@ -2454,8 +2691,7 @@ export class CodexRunner {
             return response;
         }
         const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
-        const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
-        const logSummary = formatApprovalLogSummary(summary);
+        const logSummary = formatApprovalLogSummary(auditSummary || summary);
         logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${logSummary}`);
         const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
             || request.method === 'execCommandApproval';
@@ -2567,6 +2803,16 @@ export class CodexRunner {
         const params = (request.params || {});
         const rawCallId = params.itemId ?? params.item_id ?? params.callId ?? params.call_id;
         const callId = typeof rawCallId === 'string' && rawCallId ? rawCallId : undefined;
+        const toolInput = this.buildPermissionInput(request.method, params);
+        const rawSummary = summarizeToolInputForAudit(toolName, toolInput);
+        const auditSummary = (rawSummary
+            || summarizeToolInputForAudit('Bash', { command: this.summarizeAppServerRequest(request.method, params) })).slice(0, 512);
+        const threadId = this.requestThreadId(params);
+        const rawCwd = typeof toolInput.cwd === 'string' && toolInput.cwd
+            ? toolInput.cwd
+            : typeof params.cwd === 'string' && params.cwd
+                ? params.cwd
+                : undefined;
         auditCodexApprovalDecision({
             requestId: request.id !== undefined ? String(request.id) : undefined,
             callId,
@@ -2581,6 +2827,10 @@ export class CodexRunner {
             policyCode,
             permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
             role: context?.role,
+            taskId: context?.taskId,
+            summary: auditSummary,
+            threadId,
+            cwd: rawCwd,
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             parseFailure,
         });
@@ -2594,6 +2844,7 @@ export class CodexRunner {
             decisionSource,
             ...(policyCode ? { policyCode } : {}),
             ...(parseFailure ? { parseFailure } : {}),
+            ...(auditSummary ? { summary: auditSummary } : {}),
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             executed: false,
         })}`);
@@ -3364,7 +3615,7 @@ export class CodexRunner {
     async rollbackSessionTurnsLocked(agentSessionId, numTurns) {
         if (numTurns < 1)
             return true;
-        const response = await this.getAppServerClient().threadRollback(agentSessionId, numTurns);
+        const response = await this.getAppServerClientForThread(agentSessionId).threadRollback(agentSessionId, numTurns);
         return !!response.thread;
     }
     async rewindFiles(agentSessionId, projectPath, userMessageId) {
@@ -3611,7 +3862,7 @@ export class CodexRunner {
                 this.unregisterChildThread(childThreadId);
         }
     }
-    trackSubagentLifecycle(notification, state) {
+    trackSubagentLifecycle(notification, state, appServer) {
         const params = (notification.params || {});
         const item = params.item && typeof params.item === 'object' ? params.item : undefined;
         if (!this.isSubagentActivityItem(item))
@@ -3623,13 +3874,17 @@ export class CodexRunner {
         if (kind === 'started') {
             state.activeSubagentThreads.add(childThreadId);
             this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+            if (appServer)
+                this.markThreadSubscribed(appServer, childThreadId);
         }
         if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
             state.activeSubagentThreads.delete(childThreadId);
+            if (appServer)
+                void this.releaseThreadSubscription(appServer, childThreadId, 'subagent-finished');
             this.unregisterChildThread(childThreadId);
         }
     }
-    primeSubagentStateFromTurn(turn, state) {
+    primeSubagentStateFromTurn(turn, state, appServer) {
         for (const item of this.getTurnItems(turn)) {
             if (!this.isSubagentActivityItem(item))
                 continue;
@@ -3640,9 +3895,13 @@ export class CodexRunner {
             if (kind === 'started') {
                 state.activeSubagentThreads.add(childThreadId);
                 this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+                if (appServer)
+                    this.markThreadSubscribed(appServer, childThreadId);
             }
             else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
                 state.activeSubagentThreads.delete(childThreadId);
+                if (appServer)
+                    void this.releaseThreadSubscription(appServer, childThreadId, 'subagent-finished');
                 this.unregisterChildThread(childThreadId);
             }
         }
@@ -3657,7 +3916,7 @@ export class CodexRunner {
         }
         queue.end();
     }
-    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, tempFiles) {
+    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, appServer, tempFiles) {
         try {
             let sessionIdEmitted = state.committed;
             if (sessionIdEmitted)
@@ -3686,6 +3945,7 @@ export class CodexRunner {
         }
         finally {
             unsubscribe();
+            await this.releaseThreadSubscription(appServer, state.threadId, 'turn-finished');
             if (this.activeAbortControllers.get(sessionId) === controller) {
                 this.activeAbortControllers.delete(sessionId);
             }
@@ -4266,10 +4526,10 @@ export class CodexRunner {
         if (!stat.isDirectory() || stat.isSymbolicLink()) {
             throw new Error(`managed temp path is not a real directory: ${directory}`);
         }
-        if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+        if (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
             throw new Error(`managed temp path is owned by another uid: ${directory}`);
         }
-        if ((stat.mode & 0o077) !== 0)
+        if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)
             fs.chmodSync(directory, 0o700);
     }
     ensureSessionTempDir(sessionId) {
@@ -4345,7 +4605,7 @@ export class CodexRunner {
             return undefined;
         return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 `/tmp/evolcore-codex-*` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 `$TMPDIR` 重新创建，再继续执行后续 `ec` 命令。';
     }
-    buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier) {
+    buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier, taskDelegationToken) {
         const managedTempDir = this.ensureSessionTempDir(sessionId);
         return {
             shell_environment_policy: {
@@ -4354,7 +4614,9 @@ export class CodexRunner {
                     EVOLCORE_HOME: resolveRoot(),
                     ...(managedTempDir ? { EVOLCORE_SESSION_RUNTIME_DIR: managedTempDir } : {}),
                     ...(managedTempDir ? { EVOLCORE_RUNTIME_LOCK_DIR: path.join(path.dirname(managedTempDir), 'evolcore-locks') } : {}),
-                    ...(delegationCarrier ? { [AGENT_DELEGATION_TOKEN_ENV]: delegationCarrier } : {}),
+                    ...(taskDelegationToken || delegationCarrier
+                        ? { [AGENT_DELEGATION_TOKEN_ENV]: taskDelegationToken ?? delegationCarrier }
+                        : {}),
                     ...(managedTempDir ? { TMPDIR: managedTempDir } : {}),
                 },
             },
@@ -4384,6 +4646,8 @@ export class CodexRunner {
             controller.abort('dispose');
         }
         await Promise.all([...this.activeSubagentTurns.entries()].map(([threadId, active]) => this.interruptAppServerTurn(threadId, active.turnId).catch(() => { })));
+        await Promise.all([...this.threadSubscriptions.entries()].map(([threadId, subscription]) => this.releaseThreadSubscription(subscription.client, threadId, 'runner-dispose')));
+        this.threadSubscriptions.clear();
         this.activeAbortControllers.clear();
         this.activeStreams.clear();
         this.activeSessions.clear();
@@ -4404,8 +4668,12 @@ export class CodexRunner {
         this.threadOperationLocks.clear();
         for (const sessionId of [...this.sessionTempDirs.keys()])
             this.cleanupSessionTempDir(sessionId);
-        await this.appServerClient?.close();
+        await Promise.all([
+            this.appServerClient?.close(),
+            this.fullAccessAppServerClient?.close(),
+        ]);
         this.appServerClient = null;
+        this.fullAccessAppServerClient = null;
     }
 }
 // ── Plugin ──