evolcore 0.0.22 → 0.0.24

package/dist/agents/codex-runner.js

@@ -1,20 +1,14 @@
-/**
- * Codex Agent Runner
- *
- * Integrates Codex app-server as an agent backend.
- * Implements the same interface surface as AgentRunner (claude-runner.ts)
- * so MessageProcessor and CommandHandler can work with it transparently.
- */
+import { getRunnerCatalog, catalogEfforts, assertCatalogSelectable } from '../core/model/model-catalog.js';
 import { hasTrustedFullAccessContext } from './runner-types.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/permission/protected-paths.js';
-import { CodexAppServerClient } from './codex-app-server-client.js';
-import { resolveOpenaiConfig } from './baseagent.js';
+import { CODEX_THREAD_ACTIVE_WRITER, CodexAppServerClient, } from './codex/app-server-client.js';
+import { resolveOpenaiConfig, resolveCodexCliPath } from './baseagent.js';
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
-import { auditCodexApprovalDecision, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
+import { auditCodexApprovalDecision, auditPermissionLifecycle, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../core/message/message-utils.js';
@@ -23,11 +17,12 @@ import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/au
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
 import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, hasPowerShellDelegationAssignment, normalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
-import { resolvePaths, resolveRoot } from '../paths.js';
+import { agentSessionsDir, resolvePaths, resolveRoot } from '../paths.js';
 import { ensureProcessManagedTempDir, getManagedTaskTempDir } from '../cli/task-context.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
+import { CodexSessionFileAdapter } from '../core/session/adapters/codex-session-file-adapter.js';
 import { execFileSync } from 'child_process';
-import { execCodexCliSync, resolveCodexCliPath } from '../utils/codex-cli.js';
+import { probeCli, probeCliSync } from '../utils/cross-platform.js';
 import { createHash, randomBytes } from 'crypto';
 import { buildModelRequestHeaders } from './request-identity.js';
 import fs from 'fs';
@@ -47,6 +42,14 @@ export function formatApprovalLogSummary(summary) {
         return singleLine;
     return singleLine.slice(0, APPROVAL_LOG_SUMMARY_MAX_LENGTH - 3).trimEnd() + '...';
 }
+/**
+ * 规范化模型 ID：去掉 Claude Code SDK 专有的上下文窗口后缀 [1m]/[200k]
+ * Codex/OpenAI API 不认识这些后缀，必须传入标准模型 ID
+ */
+function stripContextWindowSuffix(modelId) {
+    return modelId.replace(/\[(?:1m|200k)\]$/i, '');
+}
+// ── Codex 模型目录（动态获取，含 effort） ──
 class AsyncEventQueue {
     queue = [];
     done = false;
@@ -94,6 +97,12 @@ function errorCodeForToolDenial(decisionSource, policyCode) {
         return 'INVALID_ARGUMENT';
     return 'EXECUTION_FAILED';
 }
+function isCodexReasoningNotification(method) {
+    return method === 'item/reasoning/textDelta'
+        || method === 'item/reasoning/summaryTextDelta'
+        || method === 'item/reasoning/summaryPartAdded';
+}
+const CODEX_THREAD_HANDOFF_TIMEOUT_MS = 2_000;
 const managedTempDirsForExitCleanup = new Map();
 let managedTempExitCleanupRegistered = false;
 function isTrustedManagedTempDirectory(directory, parent) {
@@ -109,9 +118,9 @@ function isTrustedManagedTempDirectory(directory, parent) {
             const stat = fs.lstatSync(candidate);
             if (!stat.isDirectory() || stat.isSymbolicLink())
                 return false;
-            if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            if (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())
                 return false;
-            return (stat.mode & 0o077) === 0;
+            return process.platform === 'win32' || (stat.mode & 0o077) === 0;
         };
         if (!trustedDirectory(parentPath) || !trustedDirectory(directoryPath))
             return false;
@@ -218,20 +227,17 @@ function outputTextForManagedHook(value) {
     }
     return String(value);
 }
-const CODEX_CATALOG_FALLBACK = [
-    { slug: 'gpt-5.5', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.4', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.4-mini', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.3-codex', efforts: ['low', 'medium', 'high', 'xhigh'] },
-    { slug: 'gpt-5.2', efforts: ['low', 'medium', 'high', 'xhigh'] },
-];
 const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
 const CODEX_NO_ROLLOUT_RE = /no rollout found for thread id/i;
+const CODEX_ACTIVE_WRITER_RE = /already has an active writer/i;
 function isCodexNoRolloutError(error) {
     return error?.code === 'CODEX_ROLLOUT_NOT_FOUND'
         || CODEX_NO_ROLLOUT_RE.test(error instanceof Error ? error.message : String(error));
 }
-let codexCatalogCache = null;
+function isCodexActiveWriterError(error) {
+    return error?.code === CODEX_THREAD_ACTIVE_WRITER
+        || CODEX_ACTIVE_WRITER_RE.test(error instanceof Error ? error.message : String(error));
+}
 // The permission bridge is version-locked to the audited approval schema and
 // managed PreToolUse hook behavior used by proactive first-tool enforcement.
 export const MIN_CODEX_CLI_VERSION = '0.144.1';
@@ -242,21 +248,59 @@ export function parseCodexCliVersion(output) {
 export function isCodexCliVersionSupported(version) {
     return compareVersions(version, MIN_CODEX_CLI_VERSION) >= 0;
 }
+// Windows shim/process startup can exceed the quick probe deadline under load.
+const CODEX_CLI_PROBE_TIMEOUT_MS = 3000;
+const CODEX_CLI_PROBE_RETRY_TIMEOUT_MS = 15_000;
+function compactCodexProbeText(value, maxLength = 600) {
+    if (Buffer.isBuffer(value))
+        value = value.toString('utf-8');
+    if (typeof value !== 'string')
+        return undefined;
+    const text = value.replace(/\s+/gu, ' ').trim();
+    return text.length <= maxLength ? text : `${text.slice(0, maxLength - 3).trimEnd()}...`;
+}
+function logCodexProbeFailure(args, startedAt, error, timeoutMs) {
+    const detail = error;
+    logger.warn(`[CodexProbe] CLI probe failed: ${JSON.stringify({
+        command: ['codex', ...args],
+        path: detail?.path ?? null,
+        spawnargs: detail?.spawnargs ?? null,
+        elapsedMs: Date.now() - startedAt,
+        timeoutMs,
+        code: detail?.code ?? null,
+        status: detail?.status ?? null,
+        signal: detail?.signal ?? null,
+        timedOut: detail?.code === 'ETIMEDOUT',
+        message: compactCodexProbeText(detail?.message ?? String(error)),
+        stdout: compactCodexProbeText(detail?.stdout),
+        stderr: compactCodexProbeText(detail?.stderr),
+    })}`);
+}
+function probeCodexCli(args) {
+    return probeCliSync('codex', args, { onFailure: logCodexProbeFailure });
+}
 export function getCodexCliVersion() {
+    const startedAt = Date.now();
     try {
-        const output = execCodexCliSync(['--version'], {
-            encoding: 'utf-8',
-            timeout: 3000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        return parseCodexCliVersion(output);
+        const output = probeCodexCli(['--version']);
+        const version = parseCodexCliVersion(output);
+        if (!version) {
+            logCodexProbeFailure(['--version'], startedAt, {
+                code: 'INVALID_VERSION_OUTPUT',
+                message: 'Codex CLI version output could not be parsed',
+                status: 0,
+                stdout: output,
+            }, CODEX_CLI_PROBE_TIMEOUT_MS);
+        }
+        return version;
     }
     catch {
         return null;
     }
 }
 export function getCodexAppServerAvailability() {
-    if (!resolveCodexCliPath()) {
+    const cliPath = resolveCodexCliPath();
+    if (!cliPath) {
         return { available: false, reason: '未检测到 Codex CLI。' };
     }
     const version = getCodexCliVersion();
@@ -272,52 +316,45 @@ export function getCodexAppServerAvailability() {
         };
     }
     try {
-        execCodexCliSync(['app-server', '--help'], {
-            encoding: 'utf-8',
-            timeout: 3000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        probeCodexCli(['app-server', '--help']);
         return { available: true, version };
     }
-    catch {
-        return { available: false, version, reason: `Codex CLI ${version} 不支持 app-server。` };
+    catch (error) {
+        if (error?.code === 'ETIMEDOUT') {
+            return { available: false, version, reason: `Codex CLI ${version} 的 app-server 探测超时，请稍后重试。` };
+        }
+        return { available: false, version, reason: `Codex CLI ${version} 的 app-server 探测失败，请检查 CLI 启动日志。` };
     }
 }
 export function isCodexAppServerAvailable() {
     return getCodexAppServerAvailability().available;
 }
-function fetchCodexCatalog() {
-    if (codexCatalogCache)
-        return codexCatalogCache;
+/** Daemon startup/hot reload use asynchronous probes; sync CLI callers share the cache. */
+export async function getCodexAppServerAvailabilityAsync() {
+    const options = {
+        timeouts: [CODEX_CLI_PROBE_TIMEOUT_MS, CODEX_CLI_PROBE_RETRY_TIMEOUT_MS],
+        onFailure: logCodexProbeFailure,
+    };
+    let version;
     try {
-        const output = execCodexCliSync(['debug', 'models'], {
-            encoding: 'utf-8',
-            timeout: 5000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        const catalog = JSON.parse(output);
-        const models = catalog.models
-            .filter(m => m.visibility === 'list')
-            .map(m => ({
-            slug: m.slug,
-            efforts: (m.supported_reasoning_levels || []).map(l => l.effort),
-        }));
-        if (models.length > 0) {
-            codexCatalogCache = models;
-            return models;
-        }
+        version = parseCodexCliVersion(await probeCli('codex', ['--version'], options)) ?? undefined;
+        if (!version)
+            return { available: false, reason: '无法读取 Codex CLI 版本。' };
+        if (!isCodexCliVersionSupported(version)) {
+            return { available: false, version, requiresUpgrade: true,
+                reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。请升级 Codex CLI：npm install -g @openai/codex@latest` };
+        }
+        await probeCli('codex', ['app-server', '--help'], options);
+        return { available: true, version };
     }
-    catch (e) {
-        logger.debug(`[CodexRunner] Failed to fetch model catalog, using fallback: ${e}`);
+    catch (error) {
+        const detail = error;
+        return { available: false, version, reason: detail.code === 'ETIMEDOUT' || detail.killed
+                ? 'Codex CLI 探测超时，请稍后重试。'
+                : `Codex CLI 探测失败：${error instanceof Error ? error.message : String(error)}` };
     }
-    return CODEX_CATALOG_FALLBACK;
 }
-export function getCodexEfforts(model) {
-    const catalog = fetchCodexCatalog();
-    const entry = catalog.find(m => m.slug === model);
-    return entry?.efforts ?? catalog[0]?.efforts ?? ['low', 'medium', 'high'];
-}
-// ── Codex Runner ──
+export const CODEX_SESSION_TOKEN_ENV = 'EVOLCORE_CODEX_SESSION_TOKEN';
 export class CodexRunner {
     name = 'codex';
     // turn/start persists a new user turn before runQuery resolves. App-server
@@ -329,7 +366,7 @@ export class CodexRunner {
     activeAbortControllers = new Map();
     activeStreams = new Map();
     activeSessions = new Map(); // sessionId → threadId
-    /** Threads created/resumed for a turn but not yet durably admitted by turn/start. */
+    /** New threads held in memory until the exact first turn is visible in the rollout. */
     provisionalSessions = new Map();
     activeTurns = new Map();
     activeSubagentTurns = new Map();
@@ -347,14 +384,25 @@ export class CodexRunner {
     steeringTails = new Map();
     threadOperationLocks = new Map();
     activeOperationReleases = new Map();
+    /** Last app-server client that loaded each thread, including unsubscribed threads. */
+    threadSubscriptions = new Map();
+    /** Ordinary sessions stay behind the EvolCore H/L filesystem guard. */
     appServerClient = null;
+    /** Trusted fullaccess calls use a separate unmasked app-server process. */
+    fullAccessAppServerClient = null;
     onSessionIdUpdate;
     onCompactStart;
     permissionGateway;
     sendPromptFn;
     permissionContexts = new Map();
+    /** Fallback authorization lifecycle ids for app-server requests without an RPC id. */
+    approvalLifecycleIds = new WeakMap();
     resolvedConfig;
     pendingInterruptTtlMs = 30_000;
+    /** Fallback for direct runner callers that do not inject SessionManager. */
+    codexSessionFileAdapter = new CodexSessionFileAdapter();
+    /** threadId → managed-hook credential, issued by this runner's agent only. */
+    threadCredentials = new Map();
     constructor(config, callbacks, runtime) {
         // Compatibility for legacy direct callers that still pass the removed
         // internal fields in a synthetic config. AgentLoader uses runtime binding.
@@ -383,29 +431,208 @@ export class CodexRunner {
             fileRewind: 'git-head',
             fullaccess: true,
         };
-        this.model = this.resolvedConfig.model;
+        this.model = stripContextWindowSuffix(this.resolvedConfig.model);
         if (this.resolvedConfig.effort)
             this.effort = this.resolvedConfig.effort;
         this.onSessionIdUpdate = callbacks.onSessionIdUpdate;
     }
-    getAppServerClient() {
-        if (!this.appServerClient) {
-            const client = new CodexAppServerClient({
-                apiKey: this.resolvedConfig.apiKey,
-                baseUrl: this.resolvedConfig.baseUrl,
-                provider: this.resolvedConfig.provider,
-                headers: this.resolvedConfig.headers,
-                queryParams: this.resolvedConfig.queryParams,
-                model: this.model,
-                effort: this.effort,
-                enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,
-                approvalsReviewer: 'user',
-                onServerRequest: request => this.handleAppServerRequest(request),
-            });
-            client.onNotification(notification => this.trackApprovalItemNotification(notification));
+    getAppServerClient(fullAccess = false) {
+        const existing = fullAccess ? this.fullAccessAppServerClient : this.appServerClient;
+        if (existing)
+            return existing;
+        const client = new CodexAppServerClient({
+            apiKey: this.resolvedConfig.apiKey,
+            baseUrl: this.resolvedConfig.baseUrl,
+            provider: this.resolvedConfig.provider,
+            headers: this.resolvedConfig.headers,
+            queryParams: this.resolvedConfig.queryParams,
+            model: this.model,
+            effort: this.effort,
+            enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,
+            approvalsReviewer: 'user',
+            protectEvolcoreFilesystem: !fullAccess,
+            // A completed turn is explicitly unsubscribed below. This is only an
+            // optimization on newer Codex versions; old versions retain the thread
+            // until the cross-client archive fallback runs.
+            onServerRequest: request => this.handleAppServerRequest(request),
+        });
+        client.onNotification(notification => {
+            this.trackApprovalItemNotification(notification);
+            if (notification.method !== 'thread/closed')
+                return;
+            const params = (notification.params || {});
+            const threadId = params.threadId ?? params.thread_id;
+            if (typeof threadId !== 'string')
+                return;
+            const subscription = this.threadSubscriptions.get(threadId);
+            if (subscription?.client === client) {
+                // Keep the last client identity so a later same-mode turn resumes on
+                // the same app-server even after the runtime has fully unloaded.
+                this.threadSubscriptions.set(threadId, { client, state: 'unsubscribed' });
+            }
+        });
+        if (fullAccess) {
+            this.fullAccessAppServerClient = client;
+        }
+        else {
             this.appServerClient = client;
         }
-        return this.appServerClient;
+        return client;
+    }
+    getAppServerClientForThread(threadId) {
+        const subscribed = this.threadSubscriptions.get(threadId);
+        if (subscribed)
+            return subscribed.client;
+        const sessionId = this.findSessionKeyByThread(threadId);
+        return this.getAppServerClient(sessionId ? this.chatModes.get(sessionId) === 'fullaccess' : false);
+    }
+    markThreadSubscribed(client, threadId) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (existing?.client === client && existing.state === 'subscribed' && !existing.release)
+            return;
+        this.threadSubscriptions.set(threadId, { client, state: 'subscribed' });
+    }
+    /**
+     * Release only one thread from one app-server connection. Unsubscribe is
+     * intentionally not treated as an immediate unload: current Codex builds can
+     * keep an unsubscribed thread loaded for a long grace period. The owner therefore
+     * remains in the map until a different client successfully resumes it.
+     */
+    async releaseThreadSubscription(client, threadId, reason, options = {}) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (existing && existing.client !== client)
+            return false;
+        if (existing?.release)
+            return await existing.release.catch(error => {
+                logger.warn(`[CodexRunner] Existing thread release failed: thread=${threadId} `
+                    + `error=${error instanceof Error ? error.message : String(error)}`);
+                return false;
+            });
+        if (existing?.state === 'unsubscribed')
+            return true;
+        let releasePromise;
+        releasePromise = Promise.resolve().then(async () => {
+            let released = false;
+            try {
+                const unsubscribe = client.threadUnsubscribe;
+                if (typeof unsubscribe === 'function') {
+                    if (options.waitForClose && typeof client.threadUnsubscribeAndWait === 'function') {
+                        try {
+                            await client.threadUnsubscribeAndWait.call(client, threadId, options.timeoutMs ?? CODEX_THREAD_HANDOFF_TIMEOUT_MS);
+                        }
+                        catch (error) {
+                            // The unsubscribe RPC has already succeeded when this is a
+                            // close-timeout. Keep the owner marked unsubscribed and let the
+                            // target resume decide whether the archive fallback is needed.
+                            if (error?.code !== 'CODEX_THREAD_CLOSE_TIMEOUT')
+                                throw error;
+                            logger.debug(`[CodexRunner] thread/closed not observed before handoff timeout: `
+                                + `thread=${threadId} reason=${reason}`);
+                        }
+                    }
+                    else {
+                        await unsubscribe.call(client, threadId);
+                    }
+                }
+                logger.debug(`[CodexRunner] Released thread subscription: thread=${threadId} reason=${reason}`);
+                released = true;
+                return true;
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] Failed to release thread subscription: thread=${threadId} reason=${reason} `
+                    + `error=${error instanceof Error ? error.message : String(error)}`);
+                return false;
+            }
+            finally {
+                const current = this.threadSubscriptions.get(threadId);
+                if (current?.client === client && current.release === releasePromise) {
+                    if (released) {
+                        this.threadSubscriptions.set(threadId, { client, state: 'unsubscribed' });
+                    }
+                    else {
+                        this.threadSubscriptions.set(threadId, { client, state: current.state });
+                    }
+                }
+            }
+        });
+        this.threadSubscriptions.set(threadId, {
+            client,
+            state: existing?.state ?? 'subscribed',
+            release: releasePromise,
+        });
+        return await releasePromise;
+    }
+    async prepareThreadSubscription(client, threadId) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (!existing)
+            return undefined;
+        if (existing.client === client) {
+            if (existing.release)
+                await existing.release.catch(() => undefined);
+            return undefined;
+        }
+        if (existing.state === 'subscribed') {
+            const released = await this.releaseThreadSubscription(existing.client, threadId, 'mode-handoff', {
+                waitForClose: true,
+                timeoutMs: CODEX_THREAD_HANDOFF_TIMEOUT_MS,
+            });
+            if (!released) {
+                const error = new Error(`Codex thread ${threadId} is still owned by another app-server connection`);
+                error.code = CODEX_THREAD_ACTIVE_WRITER;
+                throw error;
+            }
+        }
+        return existing.client;
+    }
+    async archiveThreadForHandoff(sourceClient, targetClient, threadId) {
+        const existing = this.threadSubscriptions.get(threadId);
+        if (existing && existing.client !== sourceClient) {
+            const error = new Error(`Codex thread ${threadId} ownership changed during handoff`);
+            error.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw error;
+        }
+        const sessionId = this.findSessionKeyByThread(threadId);
+        if ([...this.activeSubagentTurns.values()].some(active => active.sessionId === sessionId && active.parentThreadId === threadId)) {
+            const error = new Error(`Codex thread ${threadId} has an active descendant turn`);
+            error.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw error;
+        }
+        // Old app-server versions can acknowledge unsubscribe while retaining the
+        // writer. Archive is the only per-thread operation that synchronously
+        // tears down that runtime; the target client restores it before resume.
+        const archive = sourceClient.threadArchive;
+        const unarchive = targetClient.threadUnarchive;
+        if (typeof archive !== 'function' || typeof unarchive !== 'function') {
+            const error = new Error(`Codex thread ${threadId} requires archive/unarchive handoff support`);
+            error.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw error;
+        }
+        let archived = false;
+        try {
+            await archive.call(sourceClient, threadId);
+            archived = true;
+            await unarchive.call(targetClient, threadId);
+        }
+        catch (error) {
+            if (archived) {
+                // Do not strand the user's rollout under archived_sessions when the
+                // target client fails midway through the compatibility handoff.
+                try {
+                    await unarchive.call(sourceClient, threadId);
+                    this.threadSubscriptions.set(threadId, { client: sourceClient, state: 'subscribed' });
+                }
+                catch (restoreError) {
+                    logger.error(`[CodexRunner] Failed to restore archived thread after handoff failure: thread=${threadId} `
+                        + `error=${restoreError instanceof Error ? restoreError.message : String(restoreError)}`);
+                }
+            }
+            logger.warn(`[CodexRunner] Archive handoff failed: thread=${threadId} `
+                + `error=${error instanceof Error ? error.message : String(error)}`);
+            const handoffError = new Error(`Codex thread ${threadId} is still owned by another app-server connection`);
+            handoffError.code = CODEX_THREAD_ACTIVE_WRITER;
+            throw handoffError;
+        }
+        this.threadSubscriptions.set(threadId, { client: targetClient, state: 'subscribed' });
     }
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
@@ -629,6 +856,11 @@ export class CodexRunner {
             error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
             throw error;
         }
+        // The binding callback can yield while a replacement run claims this
+        // session. Re-check the provisional owner before publishing any local
+        // indexes so a late first turn cannot overwrite the newer thread.
+        if (this.provisionalSessions.get(sessionId) !== threadId)
+            return false;
         this.provisionalSessions.delete(sessionId);
         this.activeSessions.set(sessionId, threadId);
         if (carrierToPublish) {
@@ -638,6 +870,30 @@ export class CodexRunner {
         this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         return true;
     }
+    async waitForCodexTurnPersistence(sessionManager, projectPath, threadId, turnId, timeoutMs = 0) {
+        const check = () => {
+            try {
+                if (typeof sessionManager?.checkSessionTurnPersisted === 'function') {
+                    return sessionManager.checkSessionTurnPersisted(projectPath, threadId, 'codex', turnId, this.resolvedConfig.agentAid) === true;
+                }
+                return this.codexSessionFileAdapter.checkTurnPersisted(projectPath, threadId, turnId, this.resolvedConfig.agentAid);
+            }
+            catch (error) {
+                logger.debug(`[CodexRunner] rollout persistence check failed: session=${threadId} turn=${turnId} `
+                    + `error=${error instanceof Error ? error.message : String(error)}`);
+                return false;
+            }
+        };
+        const deadline = Date.now() + Math.max(0, timeoutMs);
+        while (true) {
+            if (check())
+                return true;
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                return false;
+            await new Promise(resolve => setTimeout(resolve, Math.min(10, remaining)));
+        }
+    }
     cleanupProvisionalThread(sessionId, threadId) {
         if (this.provisionalSessions.get(sessionId) !== threadId)
             return;
@@ -681,8 +937,11 @@ export class CodexRunner {
         }
     }
     resetAppServerClient() {
-        const client = this.appServerClient;
+        const clients = [this.appServerClient, this.fullAccessAppServerClient]
+            .filter((client) => !!client);
         this.appServerClient = null;
+        this.fullAccessAppServerClient = null;
+        this.threadSubscriptions.clear();
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
         for (const childThreadId of this.childThreadSessions.keys())
@@ -695,9 +954,11 @@ export class CodexRunner {
         this.trackedApprovalItems.clear();
         this.pendingToolDenials.clear();
         this.threadDelegationCarriers.clear();
-        client?.close().catch(error => {
-            logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
-        });
+        for (const client of clients) {
+            client.close().catch(error => {
+                logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
+            });
+        }
     }
     mergeThreadConfig(...configs) {
         const merged = {};
@@ -943,21 +1204,18 @@ export class CodexRunner {
         }
     }
     // ── ModelSwitcher ──
-    setModel(model) { this.model = model; this.resetAppServerClient(); }
+    setModel(model) { this.model = stripContextWindowSuffix(model); this.resetAppServerClient(); }
     getModel() { return this.model; }
+    getModelCatalog() {
+        return getRunnerCatalog('codex', this.resolvedConfig.agentAid, this.resolvedConfig);
+    }
     async listModels() {
-        try {
-            const response = await this.getAppServerClient().modelList(false);
-            const ids = (response.data ?? [])
-                .map(model => model.id || model.slug || model.name || model.model)
-                .filter((id) => typeof id === 'string' && id.length > 0);
-            if (ids.length > 0)
-                return ids;
-        }
-        catch (error) {
-            logger.debug(`[CodexRunner] app-server model/list failed, using catalog fallback: ${error}`);
-        }
-        return fetchCodexCatalog().map(m => m.slug);
+        const catalog = await this.getModelCatalog();
+        assertCatalogSelectable(catalog);
+        return catalog.models.map(m => m.id);
+    }
+    async getAvailableEfforts(model) {
+        return catalogEfforts(await this.getModelCatalog(), model, 'codex');
     }
     // ── Effort ──
     setEffort(effort) { this.effort = effort; this.resetAppServerClient(); }
@@ -1014,7 +1272,9 @@ export class CodexRunner {
             if (!looksLikeGitMetadataDirectory(resolved))
                 return;
             paths.add(resolved);
-            paths.add(path.join(resolved, '**'));
+            // Keep exact paths native, but Codex requires POSIX separators for
+            // recursive filesystem globs even on Windows.
+            paths.add(`${resolved}/**`);
         };
         try {
             const stat = fs.statSync(marker);
@@ -1028,7 +1288,7 @@ export class CodexRunner {
             }
         }
         catch { }
-        for (const gitDirectory of [...paths].filter(candidate => !candidate.endsWith(`${path.sep}**`))) {
+        for (const gitDirectory of [...paths].filter(candidate => !candidate.endsWith('/**'))) {
             try {
                 const commonDirectory = fs.readFileSync(path.join(gitDirectory, 'commondir'), 'utf8').trim();
                 if (commonDirectory)
@@ -1137,7 +1397,7 @@ export class CodexRunner {
                 return;
             }
             const input = [{ type: 'text', text, text_elements: [] }];
-            const client = this.getAppServerClient();
+            const client = this.getAppServerClientForThread(activeTurn.threadId);
             if (typeof client.turnSteer !== 'function') {
                 logger.warn(`[CodexRunner] turn steer unavailable in app-server client: session=${sessionId}`);
                 return;
@@ -1165,7 +1425,28 @@ export class CodexRunner {
         }
         await appServer.assertManagedHooksAvailable();
     }
-    async evaluatePreToolUse(threadId, toolName, toolInput, signal, callId) {
+    /**
+     * Decide whether the managed hook may proceed with a tool call.
+     *
+     * Credential contract (see CODEX_SESSION_TOKEN_ENV):
+     * - sessionToken present and issued by this runner for this thread → the
+     *   call belongs to an EvolCore-managed thread; full policy evaluation.
+     * - sessionToken present but unknown/mismatched → forgery or stale state;
+     *   fail closed with applicable=true so no other outcome allows it.
+     * - sessionToken absent → unmanaged process; not this runner's concern
+     *   (applicable=false; the IPC layer allows such calls outright).
+     */
+    async evaluatePreToolUse(threadId, toolName, toolInput, signal, callId, sessionToken) {
+        if (typeof sessionToken === 'string' && sessionToken) {
+            if (!this.validateThreadCredential(threadId, sessionToken)) {
+                return {
+                    ok: false,
+                    applicable: true,
+                    decision: 'deny',
+                    reason: 'Codex session credential was not recognized',
+                };
+            }
+        }
         const sessionKey = this.findSessionKeyByThread(threadId);
         const activeThread = this.activeSessions.get(sessionKey) ?? this.provisionalSessions.get(sessionKey);
         const context = this.permissionContexts.get(sessionKey);
@@ -1213,6 +1494,16 @@ export class CodexRunner {
             }
         };
         if (!activeThread || !this.isThreadOwnedBySession(sessionKey, threadId)) {
+            if (typeof sessionToken === 'string' && sessionToken) {
+                // A credentialed thread this runner cannot place (e.g. resumed state
+                // lost across a runner reload) must never fall through to allow.
+                return {
+                    ok: false,
+                    applicable: true,
+                    decision: 'deny',
+                    reason: 'EvolCore-managed Codex thread is not tracked by an active session',
+                };
+            }
             return { ok: true, applicable: false };
         }
         const proactiveSession = context?.chatmode === 'proactive';
@@ -1265,6 +1556,10 @@ export class CodexRunner {
         const hadController = this.activeAbortControllers.has(key);
         const hadTurn = this.activeTurns.has(key);
         const provisionalThread = this.provisionalSessions.get(key);
+        const subscribedThreadId = this.activeTurns.get(key)?.threadId
+            ?? this.activeSessions.get(key)
+            ?? provisionalThread;
+        const subscription = subscribedThreadId ? this.threadSubscriptions.get(subscribedThreadId) : undefined;
         this.activeStreams.delete(key);
         this.activeAbortControllers.delete(key);
         this.pendingInterrupts.delete(key);
@@ -1276,9 +1571,18 @@ export class CodexRunner {
         }
         this.chatModes.delete(key);
         const release = this.activeOperationReleases.get(key);
+        let releaseAfterSubscription;
+        if (subscription) {
+            releaseAfterSubscription = this.releaseThreadSubscription(subscription.client, subscribedThreadId, 'stream-cleanup');
+        }
         if (release) {
             this.activeOperationReleases.delete(key);
-            release();
+            if (releaseAfterSubscription) {
+                void releaseAfterSubscription.then(release, release);
+            }
+            else {
+                release();
+            }
         }
     }
     hasActiveStream(key) {
@@ -1440,7 +1744,7 @@ export class CodexRunner {
             }
         }
         let resumingThread = !!agentSessionId;
-        const callModel = modelOverride?.model || this.model;
+        const callModel = stripContextWindowSuffix(modelOverride?.model || this.model);
         const callEffort = modelOverride?.effortMode === 'model_default'
             ? undefined
             : modelOverride?.effort ?? this.effort;
@@ -1455,7 +1759,7 @@ export class CodexRunner {
         this.chatModes.set(sessionId, callMode);
         const callApprovalPolicy = this.toApprovalPolicy(callMode);
         const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath);
-        const appServer = this.getAppServerClient();
+        const appServer = this.getAppServerClient(callMode === 'fullaccess');
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
@@ -1484,47 +1788,61 @@ export class CodexRunner {
             approvalPolicy: effectiveApprovalPolicy,
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig(callMode)), callMode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined, agentSessionId), this.buildLifecycleLockdownConfig(callMode)), callMode),
             ...(developerInstructions ? { developerInstructions } : {}),
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
             `role=${executionSandbox.decision.role ?? 'none'} sandbox=${executionSandbox.decision.state}`);
         let threadResponse;
+        let previousAppServer;
         if (agentSessionId) {
+            // A thread may have been loaded by the other permission-mode client.
+            // Release that one thread before asking this client to resume it.
+            previousAppServer = await this.prepareThreadSubscription(appServer, agentSessionId);
             try {
                 threadResponse = await appServer.threadResume(agentSessionId, projectPath, threadOptions);
             }
             catch (error) {
-                // A legacy main session can retain a provider ID after its rollout was
-                // removed externally. It is safe to recover before input submission;
-                // topic bindings remain authoritative and fail closed.
-                if (topicBinding || !isCodexNoRolloutError(error))
-                    throw error;
-                if (typeof sessionManager?.clearMainSessionBackendIfMatches !== 'function')
-                    throw error;
-                const missingThreadId = agentSessionId;
-                const cleared = await sessionManager.clearMainSessionBackendIfMatches(sessionId, missingThreadId, [CODEX_DELEGATION_CARRIER_METADATA_KEY]);
-                if (cleared !== 'cleared' && cleared !== 'already_clear') {
-                    const recoveryError = new Error(`Codex missing-rollout recovery rejected: ${cleared}`);
-                    recoveryError.code = 'CODEX_MISSING_ROLLOUT_RECOVERY_REJECTED';
-                    throw recoveryError;
+                if (isCodexActiveWriterError(error) && previousAppServer && previousAppServer !== appServer) {
+                    // Some Codex builds acknowledge unsubscribe before unloading the
+                    // runtime. Archive/unarchive is a synchronous per-thread teardown
+                    // and preserves the same persisted thread id for the retry.
+                    await this.archiveThreadForHandoff(previousAppServer, appServer, agentSessionId);
+                    threadResponse = await appServer.threadResume(agentSessionId, projectPath, threadOptions);
+                }
+                else {
+                    // A legacy main session can retain a provider ID after its rollout was
+                    // removed externally. It is safe to recover before input submission;
+                    // topic bindings remain authoritative and fail closed.
+                    if (topicBinding || !isCodexNoRolloutError(error))
+                        throw error;
+                    if (typeof sessionManager?.clearMainSessionBackendIfMatches !== 'function')
+                        throw error;
+                    const missingThreadId = agentSessionId;
+                    const cleared = await sessionManager.clearMainSessionBackendIfMatches(sessionId, missingThreadId, [CODEX_DELEGATION_CARRIER_METADATA_KEY]);
+                    if (cleared !== 'cleared' && cleared !== 'already_clear') {
+                        const recoveryError = new Error(`Codex missing-rollout recovery rejected: ${cleared}`);
+                        recoveryError.code = 'CODEX_MISSING_ROLLOUT_RECOVERY_REJECTED';
+                        throw recoveryError;
+                    }
+                    if (this.activeSessions.get(sessionId) === missingThreadId)
+                        this.activeSessions.delete(sessionId);
+                    this.threadProjectPaths.delete(missingThreadId);
+                    this.threadDelegationCarriers.delete(missingThreadId);
+                    this.unbindExternalToolBoundary(missingThreadId);
+                    this.clearTrackedApprovalItemsForThread(missingThreadId);
+                    this.dropThreadCredential(missingThreadId);
+                    agentSessionId = undefined;
+                    resumingThread = false;
+                    knownDelegationCarrier = undefined;
+                    delegationCarrierCandidate = this.createDelegationCarrier();
+                    threadOptions = {
+                        ...threadOptions,
+                        config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined), this.buildLifecycleLockdownConfig(callMode)), callMode),
+                    };
+                    logger.warn(`[CodexRunner] recovered missing rollout before input submission: session=${sessionId} thread=${missingThreadId}`);
+                    threadResponse = await appServer.threadStart(projectPath, threadOptions);
                 }
-                if (this.activeSessions.get(sessionId) === missingThreadId)
-                    this.activeSessions.delete(sessionId);
-                this.threadProjectPaths.delete(missingThreadId);
-                this.threadDelegationCarriers.delete(missingThreadId);
-                this.unbindExternalToolBoundary(missingThreadId);
-                this.clearTrackedApprovalItemsForThread(missingThreadId);
-                agentSessionId = undefined;
-                resumingThread = false;
-                knownDelegationCarrier = undefined;
-                delegationCarrierCandidate = this.createDelegationCarrier();
-                threadOptions = {
-                    ...threadOptions,
-                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate), this.buildLifecycleLockdownConfig(callMode)), callMode),
-                };
-                logger.warn(`[CodexRunner] recovered missing rollout before input submission: session=${sessionId} thread=${missingThreadId}`);
-                threadResponse = await appServer.threadStart(projectPath, threadOptions);
             }
         }
         else {
@@ -1533,6 +1851,7 @@ export class CodexRunner {
         let threadId = threadResponse.thread?.id || agentSessionId;
         if (!threadId)
             throw new Error('Codex app-server did not return a thread id');
+        this.markThreadSubscribed(appServer, threadId);
         if (!resumingThread) {
             carrierToPublish = { threadId, carrier: delegationCarrierCandidate };
         }
@@ -1559,6 +1878,9 @@ export class CodexRunner {
                 const forkedThreadId = forked.thread?.id;
                 if (!forkedThreadId)
                     throw new Error('Codex delegation-carrier recovery fork did not return a thread id');
+                this.markThreadSubscribed(appServer, forkedThreadId);
+                await this.releaseThreadSubscription(appServer, staleThreadId, 'carrier-recovery-fork-source');
+                await this.releaseThreadSubscription(appServer, forkedThreadId, 'carrier-recovery-fork');
                 threadId = forkedThreadId;
                 recoveredCarrier = delegationCarrierCandidate;
             }
@@ -1591,6 +1913,7 @@ export class CodexRunner {
             if (!bindingAccepted) {
                 const error = new Error(`backend discovery rejected: ${bindingResult}`);
                 error.code = 'TOPIC_BACKEND_DISCOVERY_REJECTED';
+                await this.releaseThreadSubscription(appServer, threadId, 'backend-binding-rejected');
                 throw error;
             }
             this.activeSessions.set(sessionId, threadId);
@@ -1614,6 +1937,7 @@ export class CodexRunner {
             projectPath,
             model: callModel,
             committed: resumingThread,
+            persistenceFinalized: resumingThread,
             streamedAgentMessageIds: new Set(),
             agentMessageDeltaText: new Map(),
             completedItemIds: new Set(),
@@ -1633,7 +1957,7 @@ export class CodexRunner {
                 && this.childThreadSessions.get(notifThreadId) === sessionId;
             if (notifThreadId !== undefined && notifThreadId !== threadId && !emittedByChild)
                 return;
-            this.trackSubagentLifecycle(notification, state);
+            this.trackSubagentLifecycle(notification, state, appServer);
             if (emittedByChild && notifThreadId !== threadId) {
                 const childTurnId = this.extractTurnId(notification);
                 if (notification.method === 'turn/started' && childTurnId) {
@@ -1649,11 +1973,13 @@ export class CodexRunner {
                         this.activeSubagentTurns.delete(notifThreadId);
                     }
                     state.activeSubagentThreads.delete(notifThreadId);
+                    void this.releaseThreadSubscription(appServer, notifThreadId, 'subagent-turn-finished');
                     this.unregisterChildThread(notifThreadId);
                     this.endAppServerQueueWhenSubagentsDone(queue, state);
                 }
-                if (this.isSubagentActivityItem(item))
+                if (this.isSubagentActivityItem(item) || isCodexReasoningNotification(notification.method)) {
                     queue.push(notification);
+                }
                 if (notification.method === 'item/completed' && state.turnCompleted) {
                     this.endAppServerQueueWhenSubagentsDone(queue, state);
                 }
@@ -1689,7 +2015,7 @@ export class CodexRunner {
             if (!resumingThread)
                 this.cleanupProvisionalThread(sessionId, threadId);
             logger.info(`[CodexRunner] Applied pending interrupt before turn start: ${sessionId}`);
-            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
+            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer, tempFiles);
         }
         try {
             const turnResponse = await appServer.turnStart(threadId, input, {
@@ -1700,11 +2026,43 @@ export class CodexRunner {
                 ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
             });
             if (!resumingThread) {
-                state.commitProvisional = async () => {
-                    const committed = await this.commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn);
-                    if (committed)
-                        agentSessionId = threadId;
-                    return committed;
+                let confirmationInFlight;
+                state.confirmProvisional = (waitMs = 0) => {
+                    if (state.committed)
+                        return Promise.resolve(true);
+                    if (state.persistenceFinalized)
+                        return Promise.resolve(false);
+                    if (confirmationInFlight)
+                        return confirmationInFlight;
+                    const providerTurnId = state.turnId;
+                    if (!providerTurnId)
+                        return Promise.resolve(false);
+                    const confirmation = (async () => {
+                        const persisted = await this.waitForCodexTurnPersistence(sessionManager, projectPath, threadId, providerTurnId, waitMs);
+                        if (!persisted)
+                            return false;
+                        try {
+                            const committed = await this.commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn);
+                            if (!committed) {
+                                const staleError = new Error('Codex provisional thread was superseded before persistence confirmation');
+                                staleError.code = 'RUNNER_START_SUPERSEDED';
+                                throw staleError;
+                            }
+                            agentSessionId = threadId;
+                            state.committed = true;
+                            return true;
+                        }
+                        catch (error) {
+                            state.persistenceFinalized = true;
+                            throw error;
+                        }
+                    })();
+                    confirmationInFlight = confirmation;
+                    void confirmation.finally(() => {
+                        if (confirmationInFlight === confirmation)
+                            confirmationInFlight = undefined;
+                    }).catch(() => undefined);
+                    return confirmation;
                 };
             }
             const turnId = turnResponse.turn?.id;
@@ -1712,6 +2070,12 @@ export class CodexRunner {
                 state.turnId = turnId;
                 this.activeTurns.set(sessionId, { threadId, turnId });
             }
+            if (!resumingThread && turnId) {
+                // Check immediately, but leave a just-created rollout as a candidate.
+                // Subsequent notifications recheck it and the terminal boundary gets
+                // the short settle window below.
+                await state.confirmProvisional?.(0);
+            }
             if (turnId && this.consumePendingInterrupt(sessionId)) {
                 await this.interruptAppServerTurn(threadId, turnId);
                 controller.abort('User interrupt');
@@ -1721,7 +2085,7 @@ export class CodexRunner {
             }
             const status = turnResponse.turn?.status;
             if (status === 'completed' || status === 'failed') {
-                this.primeSubagentStateFromTurn(turnResponse.turn, state);
+                this.primeSubagentStateFromTurn(turnResponse.turn, state, appServer);
                 queue.push({ method: 'turn/completed', params: { threadId, turn: turnResponse.turn } });
                 state.turnCompleted = true;
                 this.endAppServerQueueWhenSubagentsDone(queue, state);
@@ -1729,6 +2093,7 @@ export class CodexRunner {
         }
         catch (error) {
             unsubscribe();
+            await this.releaseThreadSubscription(appServer, threadId, 'turn-start-failed');
             this.activeAbortControllers.delete(sessionId);
             this.activeTurns.delete(sessionId);
             this.pendingInterrupts.delete(sessionId);
@@ -1737,7 +2102,7 @@ export class CodexRunner {
                 this.cleanupProvisionalThread(sessionId, threadId);
             throw error;
         }
-        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, tempFiles);
+        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer, tempFiles);
     }
     // ── Interrupt ──
     async interrupt(sessionKey) {
@@ -1789,7 +2154,12 @@ export class CodexRunner {
     }
     async interruptAppServerTurn(threadId, turnId) {
         try {
-            await this.getAppServerClient().turnInterrupt(threadId, turnId);
+            const sessionId = this.findSessionKeyByThread(threadId);
+            const subscribed = this.threadSubscriptions.get(threadId);
+            const client = subscribed
+                ? subscribed.client
+                : this.getAppServerClient(sessionId ? this.chatModes.get(sessionId) === 'fullaccess' : false);
+            await client.turnInterrupt(threadId, turnId);
         }
         catch (error) {
             logger.debug(`[CodexRunner] app-server turn interrupt failed: ${error}`);
@@ -1853,11 +2223,21 @@ export class CodexRunner {
             await this.interruptSubagentTurns(sessionId);
         }
         capturedController?.abort('Session closed');
+        const capturedSubscription = capturedThreadId ? this.threadSubscriptions.get(capturedThreadId) : undefined;
+        const currentActiveThreadId = this.activeSessions.get(sessionId);
+        const currentProvisionalThreadId = this.provisionalSessions.get(sessionId);
+        const capturedThreadIds = new Set([capturedThreadId, capturedProvisionalThreadId].filter((value) => value !== undefined));
+        const threadLifecycleReplaced = (currentActiveThreadId !== undefined && !capturedThreadIds.has(currentActiveThreadId))
+            || (currentProvisionalThreadId !== undefined && !capturedThreadIds.has(currentProvisionalThreadId));
         const lifecycleReplaced = (capturedStream !== undefined && this.activeStreams.get(sessionId) !== capturedStream)
             || (capturedController !== undefined && this.activeAbortControllers.get(sessionId) !== capturedController)
             || (capturedTurn !== undefined && this.activeTurns.get(sessionId) !== capturedTurn)
             || (capturedPermissionContext !== undefined && this.permissionContexts.get(sessionId) !== capturedPermissionContext)
-            || (capturedThreadId !== undefined && this.activeSessions.get(sessionId) !== capturedThreadId);
+            || threadLifecycleReplaced;
+        if (capturedSubscription && !lifecycleReplaced
+            && this.threadSubscriptions.get(capturedThreadId) === capturedSubscription) {
+            await this.releaseThreadSubscription(capturedSubscription.client, capturedThreadId, 'session-closed');
+        }
         if (capturedStream !== undefined && this.activeStreams.get(sessionId) === capturedStream)
             this.activeStreams.delete(sessionId);
         if (capturedController !== undefined && this.activeAbortControllers.get(sessionId) === capturedController)
@@ -1890,7 +2270,7 @@ export class CodexRunner {
         }
     }
     resolveSessionFile(agentSessionId, _projectPath) {
-        // Codex session 文件: ~/.codex/sessions/YYYY/MM/DD/rollout-*-{threadId}.jsonl
+        // Codex sessions are shared with the local Codex Desktop installation.
         const sessionsDir = path.join(os.homedir(), '.codex', 'sessions');
         if (!fs.existsSync(sessionsDir))
             return null;
@@ -1913,6 +2293,10 @@ export class CodexRunner {
     async clearSession(sessionId, _agentSessionId, _projectPath) {
         // Codex: 清空会话 = 下次 runQuery 不传 resumeId，自动创建新 thread
         const threadId = this.activeSessions.get(sessionId) ?? _agentSessionId;
+        const subscription = this.threadSubscriptions.get(threadId);
+        if (subscription) {
+            await this.releaseThreadSubscription(subscription.client, threadId, 'session-cleared');
+        }
         this.activeSessions.delete(sessionId);
         this.activeTurns.delete(sessionId);
         this.steeringTails.delete(sessionId);
@@ -1933,8 +2317,12 @@ export class CodexRunner {
             return result;
         };
         const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId, _sessionId), 'compact');
+        let compactAppServer;
         try {
-            const appServer = this.getAppServerClient();
+            const compactMode = normalizeExecutionPermissionMode(modelOverride?.permissionMode ?? this.chatModes.get(_sessionId) ?? this.currentMode);
+            const appServer = this.getAppServerClient(compactMode === 'fullaccess');
+            compactAppServer = appServer;
+            await this.prepareThreadSubscription(appServer, agentSessionId);
             this.onCompactStart?.(_sessionId);
             try {
                 await this.startAndWaitForCompact(appServer, agentSessionId);
@@ -1944,8 +2332,7 @@ export class CodexRunner {
                 if (!this.isThreadNotFoundError(error))
                     throw error;
                 logger.info(`[CodexRunner] Compact thread not loaded, resuming before compact: ${agentSessionId}`);
-                const compactMode = normalizeExecutionPermissionMode(modelOverride?.permissionMode ?? this.chatModes.get(_sessionId) ?? this.currentMode);
-                const compactModel = modelOverride?.model || this.model;
+                const compactModel = stripContextWindowSuffix(modelOverride?.model || this.model);
                 const compactEffort = modelOverride?.effortMode === 'model_default'
                     ? undefined
                     : modelOverride?.effort ?? this.effort;
@@ -1965,8 +2352,9 @@ export class CodexRunner {
                     approvalPolicy: compactPolicy,
                     approvalsReviewer: 'user',
                     ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
+                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier, undefined, agentSessionId), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
                 });
+                this.markThreadSubscribed(appServer, agentSessionId);
                 this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
                 this.threadDelegationCarriers.set(agentSessionId, compactDelegationCarrier);
                 this.bindExternalToolBoundary(agentSessionId, externalToolConfig);
@@ -1979,6 +2367,9 @@ export class CodexRunner {
             return finish({ ok: false, code: 'sdk_error', message, durationMs: Date.now() - startedAt });
         }
         finally {
+            if (compactAppServer) {
+                await this.releaseThreadSubscription(compactAppServer, agentSessionId, 'compact-finished');
+            }
             release();
         }
     }
@@ -2070,10 +2461,14 @@ export class CodexRunner {
         }
         return false;
     }
+    codexHomeDir() {
+        return process.env.CODEX_HOME || path.join(process.env.HOME || os.homedir(), '.codex');
+    }
     findCodexSessionFile(threadId) {
-        const root = process.env.CODEX_HOME
-            ? path.join(process.env.CODEX_HOME, 'sessions')
-            : path.join(process.env.HOME || os.homedir(), '.codex', 'sessions');
+        return this.findRolloutFile(path.join(this.codexHomeDir(), 'sessions'), threadId)
+            ?? this.findRolloutFile(path.join(this.codexHomeDir(), 'archived_sessions'), threadId);
+    }
+    findRolloutFile(root, threadId) {
         const stack = [root];
         let newest;
         while (stack.length > 0) {
@@ -2105,6 +2500,101 @@ export class CodexRunner {
         }
         return newest?.path;
     }
+    // ── Managed-hook thread credentials ─────────────────────────────────
+    // The Windows managed hook is machine-wide, so unmanaged Codex processes
+    // also reach it. Credentials let the hook tell EvolCore-owned threads
+    // (policy enforced) apart from unmanaged ones (allowed unconditionally).
+    // They follow the thread (not the daemon process) so a daemon restart does
+    // not strand a resumable thread: the token file is re-read on resume, and
+    // it is removed lazily once the rollout file itself disappears.
+    threadCredentialsDir() {
+        const aid = this.resolvedConfig.agentAid;
+        if (!aid)
+            return undefined;
+        return path.join(agentSessionsDir(aid), 'codex-tokens');
+    }
+    threadCredentialPath(threadId) {
+        const dir = this.threadCredentialsDir();
+        return dir ? path.join(dir, `${encodeURIComponent(threadId)}.json`) : undefined;
+    }
+    /** Issue or re-read this agent's credential for a thread. */
+    ensureThreadCredential(threadId) {
+        const cached = this.threadCredentials.get(threadId);
+        if (cached)
+            return cached;
+        const file = this.threadCredentialPath(threadId);
+        if (!file)
+            return undefined;
+        try {
+            const record = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (record && typeof record.token === 'string' && record.token && record.threadId === threadId) {
+                this.threadCredentials.set(threadId, record.token);
+                return record.token;
+            }
+        }
+        catch { /* missing or unreadable: fall through to issuance */ }
+        const token = randomBytes(32).toString('hex');
+        const record = {
+            token,
+            threadId,
+            createdAt: new Date().toISOString(),
+            rolloutPath: this.findCodexSessionFile(threadId),
+        };
+        try {
+            fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+            fs.writeFileSync(file, JSON.stringify(record, null, 2), { mode: 0o600 });
+            this.threadCredentials.set(threadId, token);
+            return token;
+        }
+        catch (error) {
+            logger.warn(`[CodexRunner] failed to persist thread credential: thread=${threadId} error=${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }
+    }
+    /**
+     * Validate a credential presented by the managed hook. Returns the matched
+     * threadId when this runner issued the token; undefined otherwise. Token
+     * records whose rollout file has disappeared are pruned lazily.
+     */
+    validateThreadCredential(threadId, token) {
+        const expected = this.ensureThreadCredentialLoaded(threadId);
+        if (!expected || expected !== token)
+            return false;
+        const rollout = this.findCodexSessionFile(threadId);
+        if (!rollout) {
+            // The thread's rollout is gone: nothing left to protect, drop the record.
+            this.dropThreadCredential(threadId);
+            return false;
+        }
+        return true;
+    }
+    ensureThreadCredentialLoaded(threadId) {
+        const cached = this.threadCredentials.get(threadId);
+        if (cached)
+            return cached;
+        const file = this.threadCredentialPath(threadId);
+        if (!file)
+            return undefined;
+        try {
+            const record = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (record && typeof record.token === 'string' && record.token && record.threadId === threadId) {
+                this.threadCredentials.set(threadId, record.token);
+                return record.token;
+            }
+        }
+        catch { /* absent or unreadable */ }
+        return undefined;
+    }
+    dropThreadCredential(threadId) {
+        this.threadCredentials.delete(threadId);
+        const file = this.threadCredentialPath(threadId);
+        if (!file)
+            return;
+        try {
+            fs.rmSync(file, { force: true });
+        }
+        catch { /* best effort */ }
+    }
     async forkSession(agentSessionId, projectPath, title) {
         const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'fork');
         try {
@@ -2119,7 +2609,8 @@ export class CodexRunner {
         const mode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const executionSandbox = this.buildExecutionSandboxOptions(sessionKey, mode, projectPath);
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
-        const appServer = this.getAppServerClient();
+        const appServer = this.threadSubscriptions.get(agentSessionId)?.client
+            ?? this.getAppServerClient(mode === 'fullaccess');
         const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, mode);
         if (sessionKey)
             await this.assertProactiveHookAvailability(sessionKey, appServer);
@@ -2135,9 +2626,11 @@ export class CodexRunner {
         const forkedThreadId = response.thread?.id;
         if (!forkedThreadId)
             throw new Error('Codex fork did not return a thread id');
+        this.markThreadSubscribed(appServer, forkedThreadId);
         this.threadDelegationCarriers.set(forkedThreadId, delegationCarrier);
         this.threadProjectPaths.set(forkedThreadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(forkedThreadId, externalToolConfig);
+        await this.releaseThreadSubscription(appServer, forkedThreadId, 'fork-finished');
         return forkedThreadId;
     }
     async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title) {
@@ -2167,14 +2660,14 @@ export class CodexRunner {
         }
     }
     async setSessionName(agentSessionId, name) {
-        return this.getAppServerClient().threadSetName(agentSessionId, name);
+        return this.getAppServerClientForThread(agentSessionId).threadSetName(agentSessionId, name);
     }
     async updateSessionMetadata(agentSessionId, metadata) {
         const gitInfo = metadata?.gitInfo && typeof metadata.gitInfo === 'object' ? metadata.gitInfo : undefined;
-        return this.getAppServerClient().threadMetadataUpdate(agentSessionId, gitInfo);
+        return this.getAppServerClientForThread(agentSessionId).threadMetadataUpdate(agentSessionId, gitInfo);
     }
     async getSessionMessages(agentSessionId, projectPath) {
-        const response = await this.getAppServerClient().threadRead(agentSessionId, true);
+        const response = await this.getAppServerClientForThread(agentSessionId).threadRead(agentSessionId, true);
         return this.mapThreadToSessionMessages(response, agentSessionId);
     }
     approvalItemKey(threadId, turnId, itemId) {
@@ -2390,6 +2883,31 @@ export class CodexRunner {
                 ? 'FileChange'
                 : 'Bash';
         const toolInput = this.buildPermissionInput(request.method, params);
+        const approvalCallId = typeof (params.itemId ?? params.item_id ?? params.callId ?? params.call_id) === 'string'
+            ? String(params.itemId ?? params.item_id ?? params.callId ?? params.call_id)
+            : undefined;
+        const approvalRequestId = request.id !== undefined
+            ? String(request.id)
+            : approvalCallId ?? `codex-approval-${crypto.randomUUID()}`;
+        this.approvalLifecycleIds.set(request, approvalRequestId);
+        const approvalContext = this.permissionContexts.get(sessionKey);
+        auditPermissionLifecycle({
+            phase: 'request',
+            requestId: approvalRequestId,
+            callId: approvalCallId,
+            correlationId: approvalCallId,
+            sessionId: sessionKey,
+            agentAid: approvalContext?.selfAid,
+            agentName: approvalContext?.agentName,
+            permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+            toolName,
+            decision: 'pending',
+            decisionSource: 'approval',
+            role: approvalContext?.role,
+            taskId: approvalContext?.taskId,
+            summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+            approvalMethod: request.method,
+        });
         // A trusted fullaccess run has already been explicitly authorized by the
         // daemon owner. Do not route its approvals through ordinary capability,
         // workspace, or unattended-trigger policy checks.
@@ -2406,6 +2924,10 @@ export class CodexRunner {
                 setImmediate(() => this.steerPolicyReason(sessionKey, 'fullaccess_context_untrusted', reason));
                 return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
             }
+            // Fullaccess uses the current task delegation token in its shell
+            // environment, so it must not enter the ordinary workspace/carrier
+            // approval path even if the app-server asks for an infrastructure
+            // approval despite approvalPolicy=never.
             const response = this.toAppServerApprovalResponse(request.method, 'allow', toolInput, false);
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'allow', 'approval', undefined, 'trusted fullaccess execution');
             return response;
@@ -2413,7 +2935,9 @@ export class CodexRunner {
         // Keep the policy check in the approval path as a fail-closed fallback.
         // Some app-server tool routes can reach approval without invoking the
         // command hook; allowing here would bypass the proactive gate.
-        const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
+        const policyResult = (this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess'
+            ? undefined
+            : this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
         if (policyResult?.block) {
             logger.info(`[CodexRunner] app-server approval declined by session policy: session=${sessionKey} ` +
                 `requestId=${request.id ?? '<missing>'} code=${policyResult.policyCode ?? 'session_policy_hook'} ` +
@@ -2439,9 +2963,33 @@ export class CodexRunner {
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
         const reason = params.reason || params.decisionReason || undefined;
+        const auditSummary = (summarizeToolInputForAudit(toolName, toolInput)
+            || summarizeToolInputForAudit('Bash', { command: summary })).slice(0, 512);
+        const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const workspacePath = this.resolvePermissionWorkspacePath(params);
         if (!workspacePath) {
             logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+                    policyCode: 'approval_workspace_unknown',
+                    decisionSource: 'infrastructure',
+                    agentAid: permissionContext?.selfAid,
+                    agentName: permissionContext?.agentName,
+                    sessionId: sessionKey,
+                    permissionMode: normalizeExecutionPermissionMode(sessionMode),
+                    summary: auditSummary,
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record unknown-workspace approval denial: session=${sessionKey} error=${error instanceof Error ? error.message : String(error)}`);
+            }
             const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
             this.rememberToolDenial(request, params, {
                 decision: 'deny',
@@ -2454,8 +3002,7 @@ export class CodexRunner {
             return response;
         }
         const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
-        const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
-        const logSummary = formatApprovalLogSummary(summary);
+        const logSummary = formatApprovalLogSummary(auditSummary || summary);
         logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${logSummary}`);
         const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
             || request.method === 'execCommandApproval';
@@ -2567,6 +3114,16 @@ export class CodexRunner {
         const params = (request.params || {});
         const rawCallId = params.itemId ?? params.item_id ?? params.callId ?? params.call_id;
         const callId = typeof rawCallId === 'string' && rawCallId ? rawCallId : undefined;
+        const toolInput = this.buildPermissionInput(request.method, params);
+        const rawSummary = summarizeToolInputForAudit(toolName, toolInput);
+        const auditSummary = (rawSummary
+            || summarizeToolInputForAudit('Bash', { command: this.summarizeAppServerRequest(request.method, params) })).slice(0, 512);
+        const threadId = this.requestThreadId(params);
+        const rawCwd = typeof toolInput.cwd === 'string' && toolInput.cwd
+            ? toolInput.cwd
+            : typeof params.cwd === 'string' && params.cwd
+                ? params.cwd
+                : undefined;
         auditCodexApprovalDecision({
             requestId: request.id !== undefined ? String(request.id) : undefined,
             callId,
@@ -2581,9 +3138,56 @@ export class CodexRunner {
             policyCode,
             permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
             role: context?.role,
+            taskId: context?.taskId,
+            summary: auditSummary,
+            threadId,
+            cwd: rawCwd,
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             parseFailure,
         });
+        const lifecycleRequestId = request.id !== undefined
+            ? String(request.id)
+            : this.approvalLifecycleIds.get(request)
+                ?? callId
+                ?? `codex-approval-${crypto.randomUUID()}`;
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId: lifecycleRequestId,
+            callId,
+            correlationId: callId,
+            sessionId: sessionKey,
+            agentAid: context?.selfAid,
+            agentName: context?.agentName,
+            permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+            toolName,
+            decision,
+            decisionSource,
+            policyCode,
+            reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
+            role: context?.role,
+            taskId: context?.taskId,
+            summary: auditSummary,
+            approvalMethod: request.method,
+        });
+        auditPermissionLifecycle({
+            phase: 'final',
+            requestId: lifecycleRequestId,
+            callId,
+            correlationId: callId,
+            sessionId: sessionKey,
+            agentAid: context?.selfAid,
+            agentName: context?.agentName,
+            permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+            toolName,
+            decision,
+            decisionSource,
+            policyCode,
+            reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
+            role: context?.role,
+            taskId: context?.taskId,
+            summary: auditSummary,
+            approvalMethod: request.method,
+        });
         logger.info(`[CodexRunner] app-server approval audit ${JSON.stringify({
             requestId: request.id !== undefined ? String(request.id) : undefined,
             ...(callId ? { callId, correlationId: callId } : {}),
@@ -2594,6 +3198,7 @@ export class CodexRunner {
             decisionSource,
             ...(policyCode ? { policyCode } : {}),
             ...(parseFailure ? { parseFailure } : {}),
+            ...(auditSummary ? { summary: auditSummary } : {}),
             reason: reason ?? policyCode ?? (decision === 'allow' ? 'approval accepted' : 'approval denied'),
             executed: false,
         })}`);
@@ -3364,7 +3969,7 @@ export class CodexRunner {
     async rollbackSessionTurnsLocked(agentSessionId, numTurns) {
         if (numTurns < 1)
             return true;
-        const response = await this.getAppServerClient().threadRollback(agentSessionId, numTurns);
+        const response = await this.getAppServerClientForThread(agentSessionId).threadRollback(agentSessionId, numTurns);
         return !!response.thread;
     }
     async rewindFiles(agentSessionId, projectPath, userMessageId) {
@@ -3611,7 +4216,7 @@ export class CodexRunner {
                 this.unregisterChildThread(childThreadId);
         }
     }
-    trackSubagentLifecycle(notification, state) {
+    trackSubagentLifecycle(notification, state, appServer) {
         const params = (notification.params || {});
         const item = params.item && typeof params.item === 'object' ? params.item : undefined;
         if (!this.isSubagentActivityItem(item))
@@ -3623,13 +4228,17 @@ export class CodexRunner {
         if (kind === 'started') {
             state.activeSubagentThreads.add(childThreadId);
             this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+            if (appServer)
+                this.markThreadSubscribed(appServer, childThreadId);
         }
         if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
             state.activeSubagentThreads.delete(childThreadId);
+            if (appServer)
+                void this.releaseThreadSubscription(appServer, childThreadId, 'subagent-finished');
             this.unregisterChildThread(childThreadId);
         }
     }
-    primeSubagentStateFromTurn(turn, state) {
+    primeSubagentStateFromTurn(turn, state, appServer) {
         for (const item of this.getTurnItems(turn)) {
             if (!this.isSubagentActivityItem(item))
                 continue;
@@ -3640,9 +4249,13 @@ export class CodexRunner {
             if (kind === 'started') {
                 state.activeSubagentThreads.add(childThreadId);
                 this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
+                if (appServer)
+                    this.markThreadSubscribed(appServer, childThreadId);
             }
             else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
                 state.activeSubagentThreads.delete(childThreadId);
+                if (appServer)
+                    void this.releaseThreadSubscription(appServer, childThreadId, 'subagent-finished');
                 this.unregisterChildThread(childThreadId);
             }
         }
@@ -3657,7 +4270,7 @@ export class CodexRunner {
         }
         queue.end();
     }
-    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, tempFiles) {
+    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, appServer, tempFiles) {
         try {
             let sessionIdEmitted = state.committed;
             if (sessionIdEmitted)
@@ -3665,27 +4278,39 @@ export class CodexRunner {
             for await (const notification of notifications) {
                 if (!this.activeAbortControllers.has(sessionId))
                     break;
-                if (!state.committed && notification.method === 'turn/completed') {
-                    const turn = notification.params?.turn ?? {};
-                    if (turn.status === 'completed') {
-                        const committed = await state.commitProvisional?.();
-                        if (!committed) {
-                            const staleError = new Error('Codex provisional thread was superseded before commit');
-                            staleError.code = 'RUNNER_START_SUPERSEDED';
-                            throw staleError;
-                        }
-                        state.committed = true;
-                        if (!sessionIdEmitted) {
-                            sessionIdEmitted = true;
-                            yield { type: 'session_id', sessionId: state.threadId };
-                        }
+                if (!state.committed && !state.persistenceFinalized) {
+                    const terminal = notification.method === 'turn/completed';
+                    const committed = await state.confirmProvisional?.(terminal ? 250 : 0) ?? false;
+                    if (committed && !sessionIdEmitted) {
+                        sessionIdEmitted = true;
+                        yield { type: 'session_id', sessionId: state.threadId };
+                    }
+                    else if (terminal && !committed) {
+                        state.persistenceFinalized = true;
+                        const persistenceError = new Error(`Codex turn completed before its rollout became recoverable: thread=${state.threadId} turn=${state.turnId ?? '<unknown>'}`);
+                        persistenceError.code = 'CODEX_TURN_PERSISTENCE_UNCONFIRMED';
+                        throw persistenceError;
                     }
                 }
                 yield* this.mapAppServerNotification(notification, sessionId, state);
             }
         }
         finally {
+            if (!state.committed && !state.persistenceFinalized && state.confirmProvisional) {
+                try {
+                    // Do not let an interrupt wait for persistence that did not exist at
+                    // cancellation time. A zero-wait check still captures a rollout
+                    // that was already durable before the stream was closed.
+                    await state.confirmProvisional(0);
+                }
+                catch (error) {
+                    logger.debug(`[CodexRunner] provisional thread rejected during final persistence check: `
+                        + `session=${sessionId} thread=${state.threadId} error=${error instanceof Error ? error.message : String(error)}`);
+                }
+                state.persistenceFinalized = true;
+            }
             unsubscribe();
+            await this.releaseThreadSubscription(appServer, state.threadId, 'turn-finished');
             if (this.activeAbortControllers.get(sessionId) === controller) {
                 this.activeAbortControllers.delete(sessionId);
             }
@@ -3730,6 +4355,15 @@ export class CodexRunner {
                 }
                 break;
             }
+            // Reasoning notifications are provider-internal liveness signals.
+            // Do not expose their content; the ResponseEngine consumes the heartbeat
+            // solely to reset the idle monitor.
+            case 'item/reasoning/textDelta':
+            case 'item/reasoning/summaryTextDelta':
+            case 'item/reasoning/summaryPartAdded': {
+                yield { type: 'heartbeat', source: 'reasoning' };
+                break;
+            }
             case 'item/completed': {
                 const item = params.item;
                 if (item?.id)
@@ -4266,10 +4900,10 @@ export class CodexRunner {
         if (!stat.isDirectory() || stat.isSymbolicLink()) {
             throw new Error(`managed temp path is not a real directory: ${directory}`);
         }
-        if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+        if (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
             throw new Error(`managed temp path is owned by another uid: ${directory}`);
         }
-        if ((stat.mode & 0o077) !== 0)
+        if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)
             fs.chmodSync(directory, 0o700);
     }
     ensureSessionTempDir(sessionId) {
@@ -4341,12 +4975,17 @@ export class CodexRunner {
         }
     }
     managedTempInstruction(sessionId) {
-        if (!this.ensureSessionTempDir(sessionId))
+        const managedTempDir = this.ensureSessionTempDir(sessionId);
+        if (!managedTempDir)
             return undefined;
-        return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 `/tmp/evolcore-codex-*` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 `$TMPDIR` 重新创建，再继续执行后续 `ec` 命令。';
+        return `临时文件必须使用环境变量 \`$TMPDIR\`。当前值是 \`${managedTempDir}\`，它是当前 EvolCore 会话唯一允许的临时工作区；不要直接使用 \`/tmp\`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 \`/tmp/evolcore-codex-*\` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 \`$TMPDIR\` 重新创建，再继续执行后续 \`ec\` 命令。`;
     }
-    buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier) {
+    buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier, taskDelegationToken, threadId) {
         const managedTempDir = this.ensureSessionTempDir(sessionId);
+        // The managed-hook credential rides the thread's shell environment so the
+        // PreToolUse hook can prove the call belongs to an EvolCore-owned thread.
+        // It follows the thread (start AND resume) rather than the daemon process.
+        const sessionToken = threadId ? this.ensureThreadCredential(threadId) : undefined;
         return {
             shell_environment_policy: {
                 set: {
@@ -4354,7 +4993,10 @@ export class CodexRunner {
                     EVOLCORE_HOME: resolveRoot(),
                     ...(managedTempDir ? { EVOLCORE_SESSION_RUNTIME_DIR: managedTempDir } : {}),
                     ...(managedTempDir ? { EVOLCORE_RUNTIME_LOCK_DIR: path.join(path.dirname(managedTempDir), 'evolcore-locks') } : {}),
-                    ...(delegationCarrier ? { [AGENT_DELEGATION_TOKEN_ENV]: delegationCarrier } : {}),
+                    ...(taskDelegationToken || delegationCarrier
+                        ? { [AGENT_DELEGATION_TOKEN_ENV]: taskDelegationToken ?? delegationCarrier }
+                        : {}),
+                    ...(sessionToken ? { [CODEX_SESSION_TOKEN_ENV]: sessionToken } : {}),
                     ...(managedTempDir ? { TMPDIR: managedTempDir } : {}),
                 },
             },
@@ -4384,6 +5026,8 @@ export class CodexRunner {
             controller.abort('dispose');
         }
         await Promise.all([...this.activeSubagentTurns.entries()].map(([threadId, active]) => this.interruptAppServerTurn(threadId, active.turnId).catch(() => { })));
+        await Promise.all([...this.threadSubscriptions.entries()].map(([threadId, subscription]) => this.releaseThreadSubscription(subscription.client, threadId, 'runner-dispose')));
+        this.threadSubscriptions.clear();
         this.activeAbortControllers.clear();
         this.activeStreams.clear();
         this.activeSessions.clear();
@@ -4404,8 +5048,13 @@ export class CodexRunner {
         this.threadOperationLocks.clear();
         for (const sessionId of [...this.sessionTempDirs.keys()])
             this.cleanupSessionTempDir(sessionId);
-        await this.appServerClient?.close();
+        await Promise.all([
+            this.appServerClient?.close(),
+            this.fullAccessAppServerClient?.close(),
+        ]);
+        this.codexSessionFileAdapter.close();
         this.appServerClient = null;
+        this.fullAccessAppServerClient = null;
     }
 }
 // ── Plugin ──
@@ -4414,8 +5063,6 @@ export class CodexAgentPlugin {
     isEnabled(agent) {
         if (!agent.config.baseagents?.codex)
             return false;
-        if (!isCodexAppServerAvailable())
-            return false;
         try {
             const override = agent.config.baseagents.codex;
             const syntheticConfig = { agents: { codex: override } };
@@ -4426,8 +5073,8 @@ export class CodexAgentPlugin {
             return false;
         }
     }
-    createAgent(agent, callbacks) {
-        const availability = getCodexAppServerAvailability();
+    async createAgent(agent, callbacks) {
+        const availability = await getCodexAppServerAvailabilityAsync();
         if (!availability.available) {
             throw new Error(availability.reason || 'Missing codex CLI with app-server');
         }