evolcore 0.0.22 → 0.0.24

package/dist/core/permission/tool-policy.js

@@ -91,15 +91,179 @@ export function maskManagedTempShellPaths(command, options = {}) {
         return `__managed_tmp_${index}__`;
     });
 }
-// 绝对禁止命令（所有角色、所有权限模式下都禁止，不可授权）
-// 这些是系统级破坏操作，任何情况下都不应该允许
 const ABSOLUTE_FORBIDDEN = [
-    /\bshutdown\b/, // 关机
-    /\breboot\b/, // 重启
-    /\bmkfs\b/, // mkfs (格式化文件系统)
-    /\bformat\s+[a-zA-Z]:/i, // format C: (格式化磁盘)
-    /\bdd\s+if=.*of=\/dev/, // dd 写入磁盘设备（读取操作允许）
+    /\bshutdown\b/i,
+    /\breboot\b/i,
+    /\bmkfs(?:\.[A-Za-z0-9._-]+)?\b/i,
+    /\bformat\s+[a-zA-Z]:/i,
+    /\bdd\s+if=.*of=\/dev(?:\/|\b)/i,
 ];
+const SCRIPT_EXECUTION_RE = /(?:\bos\.system\s*\(|\bsubprocess\.(?:run|call|Popen)\s*\(|\bchild_process\.(?:exec|spawn|fork)\s*\(|\b(?:system|exec|spawn|popen)\s*\()/i;
+function hereDocDelimiter(line) {
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < line.length - 1; index++) {
+        const char = line[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\' && quote !== 'single') {
+            escaped = true;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = undefined;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"')
+                quote = undefined;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (char !== '<' || line[index + 1] !== '<' || line[index + 2] === '<')
+            continue;
+        let cursor = index + 2;
+        if (line[cursor] === '-')
+            cursor++;
+        while (cursor < line.length && /\s/.test(line[cursor]))
+            cursor++;
+        if (line[cursor] === "'" || line[cursor] === '"') {
+            const delimiterQuote = line[cursor++];
+            const start = cursor;
+            while (cursor < line.length && line[cursor] !== delimiterQuote)
+                cursor++;
+            return cursor > start && cursor < line.length ? line.slice(start, cursor) : undefined;
+        }
+        const match = line.slice(cursor).match(/^[A-Za-z_][A-Za-z0-9_-]*/);
+        return match?.[0];
+    }
+    return undefined;
+}
+function splitHereDocBodies(command) {
+    const lines = command.split(/\r?\n/);
+    let delimiter;
+    let body;
+    const bodies = [];
+    const retained = [];
+    for (const line of lines) {
+        if (delimiter) {
+            const candidate = line.replace(/^\t+/, '').trim();
+            if (candidate === delimiter) {
+                bodies.push((body ?? []).join('\n'));
+                delimiter = undefined;
+                body = undefined;
+            }
+            else {
+                body?.push(line);
+            }
+            continue;
+        }
+        retained.push(line);
+        delimiter = hereDocDelimiter(line);
+        if (delimiter)
+            body = [];
+    }
+    if (delimiter && body)
+        bodies.push(body.join('\n'));
+    return { command: retained.join('\n'), bodies };
+}
+function containsAbsoluteForbiddenText(value) {
+    return ABSOLUTE_FORBIDDEN.some(pattern => pattern.test(value));
+}
+function interpreterScript(args) {
+    const index = args.findIndex(argument => argument === '-c' || argument === '-e' || argument === '--eval');
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function scriptContainsAbsoluteForbidden(script) {
+    return SCRIPT_EXECUTION_RE.test(script) && containsAbsoluteForbiddenText(script);
+}
+/** Match only executable argv, never regex/search text or script literals. */
+function containsAbsoluteForbiddenCommand(command, depth = 0) {
+    const hereDocs = splitHereDocBodies(command);
+    if (containsShellSubstitution(hereDocs.command) && containsAbsoluteForbiddenText(hereDocs.command))
+        return true;
+    return splitShellCommandSegments(hereDocs.command).some(segment => {
+        const parsed = parseEffectiveCommand(segment);
+        if (!parsed)
+            return false;
+        const { executable, args } = parsed;
+        if (executable === 'shutdown' || executable === 'reboot')
+            return true;
+        if (/^mkfs(?:\..*)?$/.test(executable))
+            return true;
+        if (executable === 'format' && args.some(argument => /^[A-Za-z]:$/.test(argument)))
+            return true;
+        if (executable === 'dd'
+            && args.some(argument => /^if=/.test(argument))
+            && args.some(argument => /^of=\/dev(?:\/|$)/.test(argument)))
+            return true;
+        if (executable === 'eval' && containsAbsoluteForbiddenText(args.join(' ')))
+            return true;
+        if (['node', 'nodejs', 'python', 'python3', 'perl'].includes(executable)) {
+            const script = interpreterScript(args);
+            if (script && scriptContainsAbsoluteForbidden(script))
+                return true;
+            if (hereDocs.bodies.some(scriptContainsAbsoluteForbidden))
+                return true;
+        }
+        if (['bash', 'sh', 'zsh', 'dash'].includes(executable)
+            && hereDocs.bodies.some(body => containsAbsoluteForbiddenCommand(body, depth + 1)))
+            return true;
+        if (depth >= 2 || !['bash', 'sh', 'zsh', 'dash', 'cmd', 'cmd.exe'].includes(executable))
+            return false;
+        const commandFlag = executable.startsWith('cmd') ? '/c' : '-c';
+        const commandIndex = args.findIndex(argument => argument.toLowerCase() === commandFlag);
+        return commandIndex >= 0
+            && !!args[commandIndex + 1]
+            && containsAbsoluteForbiddenCommand(args.slice(commandIndex + 1).join(' '), depth + 1);
+    });
+}
+function containsShellSubstitution(command) {
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < command.length; index++) {
+        const char = command[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\' && quote !== 'single') {
+            escaped = true;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = undefined;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"')
+                quote = undefined;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (char === '`' || (char === '$' && command[index + 1] === '('))
+            return true;
+    }
+    return false;
+}
 // 危险操作（需要用户审批才能执行）
 // 这些操作有合理使用场景，但需要用户明确授权
 const DANGEROUS_PATTERNS = [
@@ -386,7 +550,8 @@ function classifyStructuredCommand(command, depth = 0) {
     return matches.find(match => match.approvalScope === 'all') ?? matches[0];
 }
 function containsNetStopCommand(command, depth = 0) {
-    return splitShellCommandSegments(command).some(segment => {
+    const hereDocs = splitHereDocBodies(command);
+    return splitShellCommandSegments(hereDocs.command).some(segment => {
         const parsed = parseEffectiveCommand(segment);
         if (!parsed)
             return false;
@@ -394,6 +559,9 @@ function containsNetStopCommand(command, depth = 0) {
             && parsed.args[0]?.toLowerCase() === 'stop') {
             return true;
         }
+        if (['bash', 'sh', 'zsh', 'dash'].includes(parsed.executable)
+            && hereDocs.bodies.some(body => containsNetStopCommand(body, depth + 1)))
+            return true;
         if (depth >= 2 || !['bash', 'sh', 'zsh', 'dash', 'cmd', 'cmd.exe'].includes(parsed.executable)) {
             return false;
         }
@@ -1192,6 +1360,54 @@ function readonlySourceDiagnosticAllowed(analysis, projectPath) {
             && !isLClassPath(candidate, { root: resolveRoot() });
     });
 }
+/**
+ * A narrow exception for the common repository source inventory query. The
+ * general recursive H-class rule remains fail-closed; only an opt-in,
+ * single-find query whose output is limited to TypeScript/JavaScript files at
+ * the project root can use this path.
+ */
+function boundedRootSourceEnumeration(analysis, projectPath) {
+    if (analysis.kind !== 'proven-readonly' || analysis.ir.pipelines.length !== 1)
+        return false;
+    const pipeline = analysis.ir.pipelines[0];
+    const find = pipeline[0];
+    if (!find || find.executable !== 'find' || find.pathOperands.length !== 1 || find.pathOperands[0].access !== 'recursive') {
+        return false;
+    }
+    const workspace = resolveProtectedCandidate(projectPath);
+    if (workspace === path.parse(workspace).root)
+        return false;
+    const scope = resolveProtectedCandidate(find.pathOperands[0].value, projectPath);
+    if (scope !== workspace)
+        return false;
+    const allowedPredicates = new Set(['-o', '-or', '-a', '-and', '-print', '-print0']);
+    let sawSourceSuffix = false;
+    const scopeIndex = find.argv.indexOf(find.pathOperands[0].value);
+    if (scopeIndex < 1)
+        return false;
+    const args = find.argv.slice(scopeIndex + 1);
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (argument === '-name' || argument === '-iname') {
+            const pattern = args[++index];
+            if (!pattern || !/^\*\.(?:ts|js)$/i.test(pattern))
+                return false;
+            sawSourceSuffix = true;
+            continue;
+        }
+        if (argument === '-type') {
+            if (args[++index] !== 'f')
+                return false;
+            continue;
+        }
+        if (!allowedPredicates.has(argument))
+            return false;
+    }
+    if (!sawSourceSuffix)
+        return false;
+    return pipeline.slice(1).every(command => ['head', 'sort', 'grep', 'wc'].includes(command.executable)
+        && command.pathOperands.length === 0);
+}
 /** A lock filename used as a query pattern is safe; an operand naming the
  * actual lock path is still protected. */
 function containsLockPathReference(value) {
@@ -1246,10 +1462,13 @@ export function checkReadonly(toolName, input, projectPath, context) {
             managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
         });
+        const sourceQueryAllowed = readonlySourceDiagnosticAllowed(protectedOperands.analysis, projectPath);
+        const boundedSourceQueryAllowed = boundedRootSourceEnumeration(protectedOperands.analysis, projectPath);
         const sourceDiagnosticAllowed = context?.allowReadonlySourceDiagnostics
-            && readonlySourceDiagnosticAllowed(protectedOperands.analysis, projectPath)
-            && !protectedOperands.lClass
-            && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass));
+            && (!protectedOperands.lClass || boundedSourceQueryAllowed)
+            && ((sourceQueryAllowed
+                && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass)))
+                || boundedSourceQueryAllowed);
         if (sourceDiagnosticAllowed) {
             return { behavior: 'allow' };
         }
@@ -1556,11 +1775,15 @@ export function checkHClassWrite(toolName, input, context) {
             managedTempDir: context?.managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
         });
+        const sourceDiagnosticProjectPath = context?.projectPath ?? process.cwd();
+        const sourceQueryAllowed = readonlySourceDiagnosticAllowed(protectedOperands.analysis, sourceDiagnosticProjectPath);
+        const boundedSourceQueryAllowed = boundedRootSourceEnumeration(protectedOperands.analysis, sourceDiagnosticProjectPath);
         const sourceDiagnosticAllowed = context?.permissionMode === 'readonly'
             && context.allowReadonlySourceDiagnostics === true
-            && readonlySourceDiagnosticAllowed(protectedOperands.analysis, context.projectPath ?? process.cwd())
-            && !protectedOperands.lClass
-            && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass));
+            && (!protectedOperands.lClass || boundedSourceQueryAllowed)
+            && ((sourceQueryAllowed
+                && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass)))
+                || boundedSourceQueryAllowed);
         if (protectedOperands.hClass && !sourceDiagnosticAllowed) {
             logger.warn(`[H-Class Protection] 🔒 Protected filesystem operand in shell command: tool=${toolName} ` +
                 `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
@@ -1721,7 +1944,10 @@ export function checkLClassWrite(toolName, input, context) {
             ...pathOptions,
             managedTempDir: context?.managedTempDir,
         });
+        const boundedSourceQueryAllowed = context?.allowReadonlySourceDiagnostics === true
+            && boundedRootSourceEnumeration(protectedOperands.analysis, context?.projectPath ?? process.cwd());
         const lClassDenied = protectedOperands.lClass
+            && !boundedSourceQueryAllowed
             && (context?.permissionMode === 'readonly' || protectedOperands.analysis.kind === 'unproven');
         if (lClassDenied) {
             logger.warn(`[L-Class Protection] L-class shell access denied: tool=${toolName} ` +
@@ -1789,23 +2015,15 @@ export function checkBlacklist(toolName, input) {
         if (!cmd || cmd.trim() === '') {
             return { behavior: 'allow', updatedInput: input };
         }
-        if (containsNetStopCommand(cmd)) {
+        // 只根据解析后的 executable 和 argv 判断，避免把搜索词、正则和
+        // heredoc/script 正文当成实际命令。
+        if (containsNetStopCommand(cmd) || containsAbsoluteForbiddenCommand(cmd)) {
             const cmdPreview = cmd.length > 60 ? cmd.substring(0, 60) + '...' : cmd;
             return {
                 behavior: 'deny',
                 message: `🚫 系统级危险操作已拦截\n命令：${cmdPreview}\n\n此类操作可能导致系统损坏，任何权限模式下都不允许执行。`,
             };
         }
-        // 检查绝对禁止命令（系统级破坏操作）
-        for (const pattern of ABSOLUTE_FORBIDDEN) {
-            if (pattern.test(cmd)) {
-                const cmdPreview = cmd.length > 60 ? cmd.substring(0, 60) + '...' : cmd;
-                return {
-                    behavior: 'deny',
-                    message: `🚫 系统级危险操作已拦截\n命令：${cmdPreview}\n\n此类操作可能导致系统损坏，任何权限模式下都不允许执行。`
-                };
-            }
-        }
     }
     // 默认允许
     return { behavior: 'allow', updatedInput: input };
@@ -1943,10 +2161,11 @@ export function evaluateToolPreflight(toolName, input, context) {
             : command;
         const tempCheck = checkManagedTempShellCommand(commandForPolicy, managedTempOptions(context));
         if (tempCheck.kind === 'deny') {
+            const currentTmpDir = resolveManagedTempDir(managedTempOptions(context).env);
             return {
                 behavior: 'deny',
                 input,
-                message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内：${tempCheck.reason}`,
+                message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内（当前值：${currentTmpDir ?? '<不可用>'}）：${tempCheck.reason}`,
                 policyCode: 'temporary_path_outside_tmpdir',
             };
         }
@@ -1997,14 +2216,20 @@ export function evaluateToolPreflight(toolName, input, context) {
         const ownAid = !!managedAidArgv
             && !!context.selfAid
             && managedAidArgv.at(-1)?.replace(/^@/, '') === context.selfAid.replace(/^@/, '');
-        const isSelfManagedAidRead = !!managedAidArgv
+        const isManagedAidPublicRead = !!context.selfAid
+            && !!managedAidArgv
             && managedAidArgv[0] === 'ec'
             && managedAidArgv[1] === 'aid'
-            && ownAid
-            && ((managedAidArgv.length === 4 && ['show', 'lookup'].includes(managedAidArgv[2]))
+            && ((managedAidArgv.length === 4 && managedAidArgv[2] === 'lookup')
                 || (managedAidArgv.length === 5
                     && managedAidArgv[2] === 'agentmd'
                     && managedAidArgv[3] === 'get'));
+        const isSelfManagedAidShow = !!managedAidArgv
+            && managedAidArgv.length === 4
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && managedAidArgv[2] === 'show'
+            && ownAid;
         const isSelfAgentMdPublish = !!managedAidArgv
             && managedAidArgv.length === 5
             && managedAidArgv[0] === 'ec'
@@ -2014,14 +2239,14 @@ export function evaluateToolPreflight(toolName, input, context) {
             && ownAid;
         const canPublishSelfAgentMd = isSelfAgentMdPublish
             && ['request', 'bypass'].includes(context.permissionMode ?? '');
-        const isAllowedManagedAidCommand = isSelfManagedAidRead || canPublishSelfAgentMd;
+        const isAllowedManagedAidCommand = isManagedAidPublicRead || isSelfManagedAidShow || canPublishSelfAgentMd;
         if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(policyCommand) && !isAllowedManagedAidCommand) {
             return {
                 behavior: 'deny',
                 input,
                 message: isSelfAgentMdPublish && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
                     ? `🔒 ${context.permissionMode} 模式禁止发布 agent.md；请切换到 request 或 bypass 后再执行 \`ec aid agentmd put <当前 self AID>\`。`
-                    : '🔒 EvolCore 托管会话仅允许针对当前 self AID 精确调用 `ec aid show`、`ec aid lookup` 或 `ec aid agentmd get`；`ec aid agentmd put` 还要求 request 或 bypass。可选后缀仅限 `--format json`。禁止枚举、切换或操作其他身份。',
+                    : '🔒 EvolCore 托管会话允许 `ec aid show <当前 self AID>`、`ec aid lookup <任意合法 AID>` 或 `ec aid agentmd get <任意合法 AID>`；`ec aid agentmd put` 还要求针对当前 self AID 且处于 request 或 bypass。可选后缀仅限 `--format json`。禁止列举本地身份、切换身份或对其它 AID 执行 show/put。',
                 policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }
@@ -2136,6 +2361,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         workspacePath: context.workspacePath,
         root: context.root,
         managedTempDir: context.managedTempDir,
+        allowReadonlySourceDiagnostics: context.allowReadonlySourceDiagnostics,
     });
     if (lClass.behavior === 'deny') {
         return { behavior: 'deny', input: checkedInput, message: lClass.message, policyCode: 'l_class_protection', matchedPath: lClass.matchedPath };

package/dist/core/runtime-lock.js

@@ -41,28 +41,33 @@ function isTrustedRuntimeLockDir(candidate) {
     if (!isWithinTmp && !isManagedSessionSibling)
         return false;
     try {
+        // Windows Stats.mode does not describe ACL privacy. The managed runtime
+        // roots are protected by Windows ACL inheritance, so apply POSIX
+        // ownership and permission-bit checks only where those fields are
+        // meaningful.
+        const isWindows = process.platform === 'win32';
         const tmpStat = fs.lstatSync(resolvedTmpRoot);
         if (!tmpStat.isDirectory() || tmpStat.isSymbolicLink())
             return false;
-        if (typeof process.getuid === 'function' && tmpStat.uid !== process.getuid())
+        if (!isWindows && typeof process.getuid === 'function' && tmpStat.uid !== process.getuid())
             return false;
-        if ((tmpStat.mode & 0o077) !== 0)
+        if (!isWindows && (tmpStat.mode & 0o077) !== 0)
             return false;
         if (isManagedSessionSibling) {
             const parentStat = fs.lstatSync(tmpParent);
             if (!parentStat.isDirectory() || parentStat.isSymbolicLink())
                 return false;
-            if (typeof process.getuid === 'function' && parentStat.uid !== process.getuid())
+            if (!isWindows && typeof process.getuid === 'function' && parentStat.uid !== process.getuid())
                 return false;
-            if ((parentStat.mode & 0o077) !== 0)
+            if (!isWindows && (parentStat.mode & 0o077) !== 0)
                 return false;
         }
         const stat = fs.lstatSync(resolved);
         if (!stat.isDirectory() || stat.isSymbolicLink())
             return false;
-        if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+        if (!isWindows && typeof process.getuid === 'function' && stat.uid !== process.getuid())
             return false;
-        return (stat.mode & 0o077) === 0;
+        return isWindows || (stat.mode & 0o077) === 0;
     }
     catch {
         return false;
@@ -93,8 +98,8 @@ export function ensureManagedLockParent(lockPath) {
         }
         const stat = fs.lstatSync(current);
         if (!stat.isDirectory() || stat.isSymbolicLink()
-            || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
-            || (stat.mode & 0o077) !== 0) {
+            || (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            || (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
             throw new Error(`managed runtime lock path is not a private real directory: ${current}`);
         }
     }

package/dist/core/session/adapters/codex-session-file-adapter.js

@@ -32,15 +32,20 @@ function loadSqlite() {
     return sqliteModule;
 }
 export class CodexSessionFileAdapter {
+    codexHome;
     baseagent = 'codex';
     db = null;
     dbInitialized = false;
+    rolloutPathCache = new Map();
+    constructor(codexHome = path.join(os.homedir(), '.codex')) {
+        this.codexHome = codexHome;
+    }
     /**
      * 动态发现最新的 state_*.sqlite 文件
      * Codex 使用 sqlx 迁移，DB 文件名含版本号（state_5, state_6, ...）
      */
     resolveStateDbPath() {
-        const codexHome = path.join(os.homedir(), '.codex');
+        const codexHome = this.codexHome;
         if (!fs.existsSync(codexHome))
             return null;
         try {
@@ -94,11 +99,71 @@ export class CodexSessionFileAdapter {
         //    SDK 创建的 thread 不写 state_*.sqlite，但会持久化到 sessions 目录
         return !!this.findRolloutFile(agentSessionId);
     }
+    /**
+     * A row in state_*.sqlite is created before the first turn is necessarily
+     * recoverable. Require the rollout to contain both its own session metadata
+     * and the exact turn_context before EvolCore publishes a new binding.
+     */
+    checkTurnPersisted(_projectPath, agentSessionId, turnId, _agentAid) {
+        const normalizedSessionId = agentSessionId.trim();
+        const normalizedTurnId = turnId.trim();
+        if (!normalizedSessionId || !normalizedTurnId)
+            return false;
+        let rolloutPath = null;
+        const db = this.getDb();
+        if (db) {
+            try {
+                const row = db.prepare('SELECT rollout_path FROM threads WHERE id = ? AND archived = 0').get(normalizedSessionId);
+                rolloutPath = this.resolveRolloutPath(row?.rollout_path, normalizedSessionId);
+            }
+            catch (error) {
+                logger.warn('[CodexAdapter] checkTurnPersisted DB query failed:', error);
+            }
+        }
+        rolloutPath ??= this.findRolloutFile(normalizedSessionId);
+        if (!rolloutPath)
+            return false;
+        try {
+            let hasMatchingSession = false;
+            let hasMatchingTurn = false;
+            const lines = fs.readFileSync(rolloutPath, 'utf-8').split('\n');
+            for (const line of lines) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const event = JSON.parse(line);
+                    if (event?.type === 'session_meta') {
+                        const persistedSessionId = event.payload?.session_id ?? event.payload?.id;
+                        const version = event.payload?.version ?? event.payload?.cli_version;
+                        const hasVersion = version !== undefined && version !== null && String(version).trim().length > 0;
+                        if (persistedSessionId === normalizedSessionId && hasVersion)
+                            hasMatchingSession = true;
+                    }
+                    else if (event?.type === 'turn_context' && event.payload?.turn_id === normalizedTurnId) {
+                        hasMatchingTurn = true;
+                    }
+                    if (hasMatchingSession && hasMatchingTurn)
+                        return true;
+                }
+                catch {
+                    // The last JSONL line may still be in flight; a later poll retries it.
+                }
+            }
+            return false;
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * 在 ~/.codex/sessions/ 下递归查找含 agentSessionId 的 rollout JSONL 文件
      */
     findRolloutFile(agentSessionId) {
-        const sessionsDir = path.join(os.homedir(), '.codex', 'sessions');
+        const cached = this.rolloutPathCache.get(agentSessionId);
+        if (cached && fs.existsSync(cached))
+            return cached;
+        this.rolloutPathCache.delete(agentSessionId);
+        const sessionsDir = path.join(this.codexHome, 'sessions');
         if (!fs.existsSync(sessionsDir))
             return null;
         try {
@@ -110,7 +175,9 @@ export class CodexSessionFileAdapter {
                             return found;
                     }
                     else if (entry.name.endsWith('.jsonl') && entry.name.includes(agentSessionId)) {
-                        return path.join(dir, entry.name);
+                        const rolloutPath = path.join(dir, entry.name);
+                        this.rolloutPathCache.set(agentSessionId, rolloutPath);
+                        return rolloutPath;
                     }
                 }
                 return null;
@@ -251,6 +318,7 @@ export class CodexSessionFileAdapter {
             this.db = null;
         }
         this.dbInitialized = false;
+        this.rolloutPathCache.clear();
     }
     /**
      * 从 rollout JSONL 读取第一条或最后一条 user_message