evolcore 0.0.24 → 0.0.26

package/CHANGELOG.md

@@ -3,6 +3,65 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.26 (2026-09-18)
+
+### AUN、联系人与远程诊断
+
+- 将 `@agentunion/fastaun` 依赖和运行时最低版本要求提升至 `0.5.16`；
+  消息可靠投递适配独立的应用事件队列。
+- 完善消息卡片操作通知的可靠投递，保留卡片回调及回复的话题路由；
+  收紧 payload 大小检查，停止重试永久失败的 activity，阻止失效会话回投 handoff 结果。
+- 阻止空白正文进入消息发送链路，并保留关联任务的诊断信息。
+- 扩展联系人列表查询，支持按 `requestId` 处理联系人申请；
+  创建 Agent 后同步本地 Owner 联系人，展示 lifecycle 状态，并允许标签使用连字符。
+- 新增 `ec diag` 远程诊断邀请和 `ec diag stop` 撤销入口，校验发起身份并管理诊断授权生命周期。
+- 将群聊 slash 命令按权限收敛为帮助、状态、会话控制和只读查询；
+  群聊配置查询不再生成修改操作卡片。
+- 群聊命令回执统一使用控制通知，保留原始投递上下文，避免中间回执进入其它 Agent 的模型输入。
+
+### 权限与兼容性
+
+- npm 包整体排除本机 `skills/` 目录，避免本地 skill 文件随包发布。
+- 新建 agent.md 默认使用 `agent` 类型，并按白名单归一化类型；
+  对齐 SDK 的可选 description、Unicode 字数、avatar 长度及 4 KB 文档上限校验。
+- 收紧联系人申请处理、非管理角色跨 Agent 查询及配对码访问；
+  EC Web 支持 Owner 分配 admin 关系角色，并限制 admin 对同级角色的操作。
+- 已认证 EC Web 请求统一获得 daemon-owner 进程管理权限，开放远程基础设置修改与配置密钥查看，
+  取消连接参数额外脱敏，并补充请求关联、无会话范围和实际权限模式审计。
+- 通用 Trigger IPC 仍仅开放历史与事件目录查询；角色操作继续按服务端注入的授权上下文校验。
+- 保留 Codex 上游声明的 `max` 推理强度；模型目录保留上下文窗口后缀，查价和计费使用基础模型 ID。
+- 模型目录始终返回最近一次成功快照，并在后台刷新失败或过期数据。
+
+### Windows 与运行稳定性
+
+- 改进 Codex Windows 启动和进程管理，支持 PowerShell 当前会话临时目录引用；
+  为较长运行目录提供 IPC socket 路径回退。
+- Codex managed hook 安装和诊断统一解析包根路径，兼容 `npm link` 场景。
+- 停止与重启前校验进程身份，避免误操作复用的 PID；识别 Linux 僵尸进程并补充运行构建诊断。
+- 升级使用当前 Node 对应的 npm，保持版本查询与安装使用相同源，并校验安装后的实际版本。
+- 修复 echo RTT 时区计算，并为 EvolCore 错误信息补充版本标记。
+- Claude 工具沙箱初始化失败时结束当前查询，并将工具触发的熔断限制在当前会话。
+- Codex app-server 兼容嵌套错误通知，按实际原因分类并保留轮内自动重试；
+  模型输出预算耗尽作为独立终止原因处理，禁止重复提交并提示原会话续接。
+- 本地日志时间戳加入 UTC 偏移，便于跨时区关联诊断记录。
+
+## 0.0.25 (2026-09-15)
+
+### Agent 资料与头像
+
+- 新增 `ec aid avatar` 和菜单头像上传入口，支持本地图片与 HTTPS 图片地址，校验图片格式、大小、尺寸和宽高比，并广播头像更新事件。
+- 新增 `ec agent persona` 读写命令，支持在初始化过程中由 owner 确认可选人格设置。
+- 自动加载 `personal.md` 个人资料，并为 owner 会话配置各运行器的文件访问权限。
+- Agent 创建支持传入 tags，统一校验标签内容、数量并去重。
+
+### 权限、配置与运行时
+
+- 规范 owner 列表的校验与替换语义，保护最后一个 owner，避免清空管理权限。
+- 允许管理角色查询其他 Agent 的非敏感配置，并开放合法 AID 的公开查询与名片读取。
+- 恢复已认证远程 EC Web 请求的基础设置读写能力，敏感信息继续按需读取。
+- 加强 Windows 临时路径校验，限制临时写入在当前会话的托管目录内。
+- 升级 `@agentunion/fastaun` 至 `0.5.14`。
+
 ## 0.0.24 (2026-09-14)
 
 ### Windows 与 Codex 运行时

package/bin/ec.js

@@ -12,10 +12,21 @@ const srcEntry = path.join(repoRoot, 'src', 'cli', 'index.ts');
 const distEntry = path.join(repoRoot, 'dist', 'cli', 'index.js');
 const args = process.argv.slice(2);
 
+// tsx derives its cache directory from `process.geteuid()` on POSIX and
+// `os.userInfo()` on Windows. In managed Windows sessions the latter can
+// transiently fail with uv_os_get_passwd/ENOMEM before the CLI starts. Make
+// tsx take its non-POSIX branch without changing the parent process.
+const tsxWindowsCompatImport = process.platform === 'win32'
+  ? 'data:text/javascript,globalThis.process.geteuid=()=>-1'
+  : undefined;
+
 if (fs.existsSync(srcEntry)) {
   try {
     const tsxImport = pathToFileURL(require.resolve('tsx')).href;
-    const result = spawnSync(process.execPath, ['--import', tsxImport, srcEntry, ...args], { stdio: 'inherit' });
+    const imports = tsxWindowsCompatImport
+      ? ['--import', tsxWindowsCompatImport, '--import', tsxImport]
+      : ['--import', tsxImport];
+    const result = spawnSync(process.execPath, [...imports, srcEntry, ...args], { stdio: 'inherit' });
     process.exit(result.status ?? (result.error ? 1 : 0));
   } catch {}
 }

package/bin/install-codex-managed-hooks.mjs

@@ -258,6 +258,33 @@ function sourceHasManagedMarker(source) {
   return source.includes(markerStart) || source.includes(markerEnd);
 }
 
+/** Read back the package root that managedHookLauncher() embedded. */
+export function launcherPackageRoot(launcher) {
+  const match = /^\s*const packageRoot = ("(?:[^"\\]|\\.)*")\s*;/m.exec(launcher);
+  if (!match) return null;
+  try {
+    const value = JSON.parse(match[1]);
+    return typeof value === 'string' && value ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A `npm link` install reaches the package through a symlinked global path, so
+ * the launcher and the running CLI legitimately spell the same package root
+ * differently. Compare the resolved targets instead of the literal strings;
+ * a launcher pointing at a genuinely different package still fails closed.
+ */
+export function samePackageRoot(embedded, expected) {
+  if (typeof embedded !== 'string' || !embedded) return false;
+  const normalize = value => path.normalize(String(value)).replace(/[\\/]+$/, '').toLowerCase();
+  const resolved = value => {
+    try { return normalize(fs.realpathSync(value)); } catch { return normalize(value); }
+  };
+  return normalize(embedded) === normalize(expected) || resolved(embedded) === resolved(expected);
+}
+
 /** Inspect only the canonical EvolCore managed-hook targets. */
 export function inspectManagedHookInstallation({ requirements, managedDir, packageRoot }) {
   const canonicalRequirements = path.resolve(requirements);
@@ -304,7 +331,7 @@ export function inspectManagedHookInstallation({ requirements, managedDir, packa
   const normalized = value => path.normalize(String(value || '')).toLowerCase();
   const launcher = fs.readFileSync(hookPath, 'utf8');
   const packageMarker = launcher.includes('EVOLCORE_MANAGED_HOOK_LAUNCHER')
-    && launcher.toLowerCase().includes(JSON.stringify(path.resolve(packageRoot || process.cwd())).toLowerCase());
+    && samePackageRoot(launcherPackageRoot(launcher), path.resolve(packageRoot || process.cwd()));
   const preToolUse = parsed.hooks?.PreToolUse;
   const canonicalCommand = value => {
     if (typeof value !== 'string' || !value || /[\r\n;&|<>]/.test(value)) return false;

package/dist/agents/baseagent.js

@@ -14,6 +14,7 @@ import path from 'path';
 import os from 'os';
 import { commandExists, isWindows, resolveProbePath } from '../utils/cross-platform.js';
 import { execFileSync } from 'child_process';
+import { parse as parseToml } from 'smol-toml';
 /** Resolve the installed Codex CLI entrypoint, including npm shims on Windows. */
 export function resolveCodexCliPath() {
     return resolveProbePath('codex');
@@ -185,55 +186,74 @@ export function resolveAnthropicConfig(config, override) {
         || pickExec(config.agents?.claude?.pathToClaudeCodeExecutable);
     return { apiKey, baseUrl, headers, queryParams, model, effort, pathToClaudeCodeExecutable };
 }
+function nonEmptyString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+function recordValue(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
 export function loadCodexSettings() {
+    const configuredHome = process.env.CODEX_HOME?.trim();
+    const codexHome = configuredHome ? path.resolve(configuredHome) : path.join(os.homedir(), '.codex');
+    const authPath = path.join(codexHome, 'auth.json');
+    const configPath = path.join(codexHome, 'config.toml');
+    let authJsonApiKey;
     try {
-        const configuredHome = process.env.CODEX_HOME?.trim();
-        const codexHome = configuredHome ? path.resolve(configuredHome) : path.join(os.homedir(), '.codex');
-        const authPath = path.join(codexHome, 'auth.json');
-        let apiKey;
         if (fs.existsSync(authPath)) {
             const auth = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
-            apiKey = auth.OPENAI_API_KEY;
+            authJsonApiKey = nonEmptyString(auth?.OPENAI_API_KEY);
         }
-        const configPath = path.join(codexHome, 'config.toml');
-        let model;
-        let baseUrl;
-        let provider;
+    }
+    catch {
+        // A corrupt auth.json must not prevent the provider config from loading.
+    }
+    let model;
+    let baseUrl;
+    let provider;
+    let bearerToken;
+    let requiresOpenaiAuth;
+    try {
         if (fs.existsSync(configPath)) {
-            const content = fs.readFileSync(configPath, 'utf-8');
-            const modelMatch = content.match(/^model\s*=\s*"([^"]+)"/m);
-            if (modelMatch)
-                model = modelMatch[1];
-            const providerMatch = content.match(/^model_provider\s*=\s*"([^"]+)"/m);
-            if (providerMatch) {
-                provider = providerMatch[1];
-                baseUrl = readCodexProviderBaseUrl(content, provider);
-            }
+            const parsed = recordValue(parseToml(fs.readFileSync(configPath, 'utf-8')));
+            model = nonEmptyString(parsed?.model);
+            provider = nonEmptyString(parsed?.model_provider);
+            const providers = recordValue(parsed?.model_providers);
+            const selectedProvider = provider ? recordValue(providers?.[provider]) : undefined;
+            baseUrl = nonEmptyString(selectedProvider?.base_url);
+            bearerToken = nonEmptyString(selectedProvider?.experimental_bearer_token);
+            requiresOpenaiAuth = typeof selectedProvider?.requires_openai_auth === 'boolean'
+                ? selectedProvider.requires_openai_auth
+                : undefined;
         }
-        return { apiKey, baseUrl, model, provider };
     }
     catch { }
-    return {};
-}
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-function readCodexProviderBaseUrl(content, provider) {
-    const segments = /^[A-Za-z0-9_-]+$/.test(provider)
-        ? [provider, JSON.stringify(provider)]
-        : [JSON.stringify(provider)];
-    for (const segment of segments) {
-        const section = new RegExp(`^\\s*\\[\\s*model_providers\\s*\\.\\s*${escapeRegExp(segment)}\\s*\\]\\s*(?:#.*)?$`, 'm').exec(content);
-        if (!section || section.index === undefined)
-            continue;
-        const tail = content.slice(section.index + section[0].length);
-        const nextSection = tail.search(/^\s*\[/m);
-        const block = nextSection >= 0 ? tail.slice(0, nextSection) : tail;
-        const baseUrl = block.match(/^\s*base_url\s*=\s*"([^"]+)"/m)?.[1];
-        if (baseUrl)
-            return baseUrl;
+    // Codex applies a provider's explicit bearer token before auth.json. Keep
+    // that precedence so EvolCore and the app-server select the same identity.
+    if (bearerToken) {
+        return {
+            apiKey: bearerToken,
+            authType: 'bearerToken',
+            authSource: 'config.toml',
+            baseUrl,
+            model,
+            provider,
+            requiresOpenaiAuth,
+        };
     }
-    return undefined;
+    if (authJsonApiKey) {
+        return {
+            apiKey: authJsonApiKey,
+            authType: 'apiKey',
+            authSource: 'auth.json',
+            baseUrl,
+            model,
+            provider,
+            requiresOpenaiAuth,
+        };
+    }
+    return { baseUrl, model, provider, requiresOpenaiAuth };
 }
 /**
  * Resolve a complete credential/endpoint pair for direct OpenAI HTTP calls.
@@ -248,14 +268,23 @@ export function resolveOpenaiDirectConfig(override) {
             ...normalizeRequestMetadata(override),
         };
     }
-    const environment = directInferencePair(process.env.OPENAI_API_KEY, process.env.OPENAI_BASE_URL);
+    const settings = loadCodexSettings();
+    const configuredBearer = settings.authType === 'bearerToken'
+        ? directInferencePair(settings.apiKey, settings.baseUrl)
+        : undefined;
+    if (configuredBearer) {
+        return {
+            ...configuredBearer,
+            ...normalizeRequestMetadata(override),
+        };
+    }
+    const environment = directInferencePair(process.env.OPENAI_API_KEY || process.env.CODEX_API_KEY, process.env.OPENAI_BASE_URL);
     if (environment) {
         return {
             ...environment,
             ...normalizeRequestMetadata(override),
         };
     }
-    const settings = loadCodexSettings();
     const settingsResolved = directInferencePair(settings.apiKey, settings.baseUrl);
     return settingsResolved
         ? {
@@ -269,12 +298,31 @@ export function resolveOpenaiConfig(config, override, runtime) {
     const isPlaceholder = (v) => !v || v.includes('your-') || v.includes('placeholder');
     const overrideApiKey = isPlaceholder(override?.apiKey) ? undefined : override?.apiKey;
     const globalApiKey = isPlaceholder(config.agents?.codex?.apiKey) ? undefined : config.agents?.codex?.apiKey;
-    const apiKey = overrideApiKey
-        || globalApiKey
-        || process.env.OPENAI_API_KEY
-        || codexSettings.apiKey;
+    const environmentApiKey = [process.env.OPENAI_API_KEY, process.env.CODEX_API_KEY]
+        .map(value => isPlaceholder(value) ? undefined : value)
+        .find((value) => !!value);
+    const configuredBearer = codexSettings.authType === 'bearerToken' ? codexSettings.apiKey : undefined;
+    const storedApiKey = codexSettings.authType === 'apiKey' ? codexSettings.apiKey : undefined;
+    // A selected provider's explicit token is authoritative for that provider.
+    // OPENAI_API_KEY is not used by Codex when the provider declares its own
+    // bearer token, so choosing it here would make EvolCore and app-server use
+    // different credentials.
+    const credential = overrideApiKey
+        ? { apiKey: overrideApiKey, authType: 'apiKey', authSource: 'agent-config' }
+        : globalApiKey
+            ? { apiKey: globalApiKey, authType: 'apiKey', authSource: 'agent-config' }
+            : configuredBearer
+                ? { apiKey: configuredBearer, authType: 'bearerToken', authSource: 'config.toml' }
+                : environmentApiKey
+                    ? { apiKey: environmentApiKey, authType: 'apiKey', authSource: 'environment' }
+                    : storedApiKey
+                        ? { apiKey: storedApiKey, authType: 'apiKey', authSource: 'auth.json' }
+                        : undefined;
+    const apiKey = credential?.apiKey;
+    const authType = credential?.authType;
+    const authSource = credential?.authSource;
     if (!apiKey) {
-        throw new Error('No OpenAI API key found. Set one of: baseagents.codex.apiKey (per-agent or defaults), env OPENAI_API_KEY, or ~/.codex/auth.json');
+        throw new Error('No Codex credential found. Set baseagents.codex.apiKey, env OPENAI_API_KEY/CODEX_API_KEY, ~/.codex/auth.json, or a provider experimental_bearer_token in ~/.codex/config.toml');
     }
     const isPlaceholderUrl = (v) => !v || v.includes('api.openai.com');
     const overrideBaseUrl = isPlaceholderUrl(override?.baseUrl) ? undefined : override?.baseUrl;
@@ -303,6 +351,8 @@ export function resolveOpenaiConfig(config, override, runtime) {
         ?? undefined;
     return {
         apiKey,
+        authType,
+        authSource,
         baseUrl,
         provider: codexSettings.provider,
         headers,

package/dist/agents/claude-runner.js

@@ -25,12 +25,13 @@ import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
-import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, recordSandboxInitializationFailure, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, isSandboxInitializationToolResult, recordSandboxInitializationFailure, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { getManagedTaskTempDir, isManagedSessionRuntimeDir } from '../cli/task-context.js';
 import { hasTrustedFullAccessContext } from './runner-types.js';
-import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
+import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel, sdkAutoCompactWindowForModel } from './runner-types.js';
+import { hasContextWindowSuffix, stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
 const resolveModule = createRequire(import.meta.url);
 /**
  * Resolve the platform package explicitly instead of relying on the SDK's
@@ -409,11 +410,18 @@ async function refreshGatewayPricing(baseUrl, apiKey, requestHeaders) {
 }
 /**
  * 为支持 1M 上下文的模型追加 `[1m]` 后缀——仅在交给 SDK query() 时调用。
- * 目录与校验层始终使用不带后缀的基础 ID，避免与网关 /models 返回值（无 `[1m]`）冲突。
+ *
+ * 若网关把窗口变体作为独立条目下发（目录里同时有 `claude-opus-5` 与
+ * `claude-opus-5[1m]`），裸 ID 就是用户明确选的非 1M 变体，不能擅自升级，
+ * 否则两条列表项的实际效果无法区分。只有目录未提供任何窗口变体时，才沿用
+ * 按本地名单补 `[1m]` 的旧行为。
  */
-function applyContextWindow(modelId) {
-    if (/\[1m\]$/.test(modelId))
-        return modelId; // 已带后缀
+function applyContextWindow(modelId, catalog) {
+    if (hasContextWindowSuffix(modelId))
+        return modelId; // 窗口已显式指定
+    const variantListed = catalog?.models.some(m => hasContextWindowSuffix(m.id) && stripContextWindowSuffix(m.id) === modelId);
+    if (variantListed)
+        return modelId;
     if (isOneMillionContextModel(modelId))
         return `${modelId}[1m]`;
     return modelId;
@@ -500,9 +508,9 @@ export class AgentRunner {
     /** 每个 session 最近的子进程 stderr 行（环形缓冲），用于子进程崩溃时还原真正原因 */
     recentStderr = new Map();
     static STDERR_BUFFER_MAX = 80;
-    async recordSandboxInfrastructureFailure(sessionId, inputId, permissionMode, error, stderr = []) {
+    async recordSandboxInfrastructureFailure(sessionId, inputId, permissionMode, error, stderr = [], scope = 'process') {
         const detail = createSandboxInitializationError(error, stderr);
-        const circuit = recordSandboxInitializationFailure(detail, stderr);
+        const circuit = recordSandboxInitializationFailure(detail, stderr, Date.now(), scope === 'session' ? sessionId : undefined);
         const context = this.permissionContexts.get(sessionId);
         auditToolInfrastructureFailure({
             toolName: 'Bash',
@@ -1343,6 +1351,7 @@ export class AgentRunner {
         const taskMetadata = new Map();
         // tool_use_id → tool_name 映射，用于从 SDKUserMessage 的 tool_result 块中还原工具名
         const toolUseNames = new Map();
+        const sandboxedBashCalls = new Set();
         const emittedToolResultIds = new Set();
         let turnCount = 0;
         const seenMessageIds = new Set();
@@ -1617,6 +1626,10 @@ export class AgentRunner {
                         if (content.type === 'tool_use') {
                             if (content.id)
                                 toolUseNames.set(content.id, content.name);
+                            if (content.id && content.name === 'Bash' && content.input?.dangerouslyDisableSandbox !== true
+                                && resolvePhaseOneExecutionSandbox(permissionMode, this.permissionContexts.get(sessionId)?.role).state !== 'off') {
+                                sandboxedBashCalls.add(content.id);
+                            }
                             yield { type: 'tool_use', name: content.name, input: content.input, callId: content.id, turn: turnCount, outputTokens: turnOutputChars, assistantUuid: event.uuid };
                         }
                         else if (content.type === 'text' && content.text) {
@@ -1635,6 +1648,31 @@ export class AgentRunner {
                                 : block.content != null ? JSON.stringify(block.content) : '';
                             if (block.tool_use_id)
                                 emittedToolResultIds.add(block.tool_use_id);
+                            if (sandboxedBashCalls.delete(block.tool_use_id) && block.is_error === true
+                                && isSandboxInitializationToolResult(block.content)) {
+                                const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, block.tool_use_id, permissionMode, new Error(resultContent), [], 'session');
+                                // Stop this SDK query before another model/tool retry. Do not use
+                                // interrupt(), which waits for this very generator to finish.
+                                this.activeMessageStreams.get(sessionId)?.end();
+                                const query = sdkStream;
+                                try {
+                                    await query.close?.();
+                                }
+                                catch (error) {
+                                    logger.warn(`[ClaudeSandbox] failed to close sandbox-failed query: ${error}`);
+                                }
+                                yield {
+                                    type: 'tool_result', name: toolName, result: resultContent, isError: true,
+                                    error: detail.message, errorCode: 'CAPABILITY_UNAVAILABLE', callId: block.tool_use_id,
+                                    correlationId: block.tool_use_id, decision: 'error', decisionSource: 'infrastructure',
+                                    policyCode: SANDBOX_INITIALIZATION_FAILED, executed: false, executionState: 'blocked',
+                                };
+                                yield {
+                                    type: 'complete', isError: true, subtype: 'infrastructure',
+                                    terminalReason: SANDBOX_INITIALIZATION_FAILED, errors: [detail.message], queryFinal: true,
+                                };
+                                return;
+                            }
                             yield {
                                 type: 'tool_result',
                                 name: toolName,
@@ -1992,7 +2030,7 @@ export class AgentRunner {
         const executionSandbox = resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
         const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
         if (executionSandbox.state !== 'off') {
-            const activeSandboxFailure = getActiveSandboxInitializationFailure();
+            const activeSandboxFailure = getActiveSandboxInitializationFailure(undefined, undefined, sessionId);
             if (activeSandboxFailure) {
                 const detail = createSandboxInitializationError(new Error(`sandbox bootstrap circuit open; firstObservedAt=${activeSandboxFailure.openedAt} ` +
                     `occurrences=${activeSandboxFailure.occurrences}; ${activeSandboxFailure.detail}`));
@@ -2469,7 +2507,7 @@ export class AgentRunner {
         else {
             logger.info(`[AgentRunner] systemPromptAppend: none`);
         }
-        const sdkModel = applyContextWindow(resolveCatalogModel(runCatalog, callModel));
+        const sdkModel = applyContextWindow(resolveCatalogModel(runCatalog, callModel), runCatalog);
         const capabilityOptions = await this.resolveCapabilityRunOptions(projectPath);
         const managedSettings = callPermissionMode === 'fullaccess'
             ? undefined
@@ -2489,7 +2527,10 @@ export class AgentRunner {
                 const bootstrapWritePaths = modelOverride?.bootstrapAgentMdPath
                     ? [path.resolve(modelOverride.bootstrapAgentMdPath)]
                     : [];
-                const allowedWritePaths = [...new Set([...runtimeWritePaths, ...bootstrapWritePaths])];
+                const personalWritePaths = modelOverride?.personalMdPath
+                    ? [path.resolve(modelOverride.personalMdPath)]
+                    : [];
+                const allowedWritePaths = [...new Set([...runtimeWritePaths, ...bootstrapWritePaths, ...personalWritePaths])];
                 await assertClaudeSettingSourcesHaveLiteralSandboxPaths(projectPath, [...settingSources], managedSettings);
                 const sandboxProjectionDurationMs = Date.now() - sandboxProjectionStartedAt;
                 if (sandboxProjectionDurationMs > 2_000) {
@@ -2549,7 +2590,7 @@ export class AgentRunner {
             ...(executionSandbox.state === 'off' && callPermissionMode !== 'fullaccess' && process.platform === 'linux' ? {
                 spawnClaudeCodeProcess: (options) => spawnClaudeWithHClassGuard(options, resolvePaths().root, handleClaudeStderr),
             } : {}),
-            autoCompactWindow: autoCompactWindowForModel(sdkModel),
+            autoCompactWindow: sdkAutoCompactWindowForModel(sdkModel),
             advisorModel: 'haiku',
             canUseTool: canUseToolCallback,
             permissionMode: sdkPermissionMode,
@@ -2888,7 +2929,7 @@ export class AgentRunner {
             prompt,
             options: {
                 cwd: projectPath,
-                ...(catalog && callModel ? { model: applyContextWindow(resolveCatalogModel(catalog, callModel)) } : {}),
+                ...(catalog && callModel ? { model: applyContextWindow(resolveCatalogModel(catalog, callModel), catalog) } : {}),
                 resume: agentSessionId,
                 maxTurns: 1,
                 tools: [],

package/dist/agents/codex/app-server-client.js

@@ -232,7 +232,7 @@ export class CodexAppServerClient {
                     : { sandbox: options?.sandbox ?? null }),
             config: this.buildThreadConfig(effort, options?.config),
             excludeTurns: false,
-            persistExtendedHistory: false,
+            ...(options?.lastTurnId ? { lastTurnId: options.lastTurnId } : {}),
         });
         const forkedThreadId = response.thread?.id;
         if (title && forkedThreadId) {
@@ -252,16 +252,19 @@ export class CodexAppServerClient {
         await this.request('thread/compact/start', { threadId });
         return true;
     }
-    async threadTurnsList(threadId, limit) {
+    async threadTurnsList(threadId, limit, cursor) {
         return this.request('thread/turns/list', {
             threadId,
             ...(limit ? { limit } : {}),
-            sortDirection: 'asc',
+            ...(cursor ? { cursor } : {}),
+            // The app-server defaults to newest-first. `nextCursor` then walks
+            // toward older turns, which is the direction needed to hydrate history.
+            sortDirection: 'desc',
             itemsView: 'full',
         });
     }
     async threadTurnsItemsList(threadId, turnId, limit) {
-        return this.request('thread/turns/items/list', {
+        return this.request('thread/items/list', {
             threadId,
             turnId,
             ...(limit ? { limit } : {}),
@@ -643,7 +646,12 @@ export class CodexAppServerClient {
                 logger.warn(`[CodexAppServer] managed runtime lock directory unavailable: ${runtimeLockDir}`);
             }
         }
-        env.CODEX_API_KEY = this.options.apiKey;
+        if (this.options.authType === 'bearerToken') {
+            delete env.CODEX_API_KEY;
+        }
+        else {
+            env.CODEX_API_KEY = this.options.apiKey;
+        }
         env.EVOLCORE_INSTANCE_SOCKET = resolvePaths().instanceSocket;
         for (const [name, value] of Object.entries(this.options.headers ?? {})) {
             env[codexHeaderEnvName(name)] = value;

package/dist/agents/codex/catalog.js

@@ -28,7 +28,7 @@ export async function codexNativeCatalog(context) {
     if (context.baseagent !== 'codex')
         return null;
     const client = new CodexAppServerClient({
-        apiKey: context.apiKey ?? '', baseUrl: context.baseUrl, provider: context.provider,
+        apiKey: context.apiKey ?? '', authType: context.authType, baseUrl: context.baseUrl, provider: context.provider,
         headers: context.headers, queryParams: context.queryParams,
     });
     let timer;

package/dist/agents/codex/diagnostics.js

@@ -179,6 +179,39 @@ function realDirectoryState(directory) {
         return 'unavailable';
     }
 }
+/** Read back the package root that managedHookLauncher() embedded. */
+function launcherPackageRoot(launcher) {
+    const match = /^\s*const packageRoot = ("(?:[^"\\]|\\.)*")\s*;/m.exec(launcher);
+    if (!match)
+        return null;
+    try {
+        const value = JSON.parse(match[1]);
+        return typeof value === 'string' && value ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A `npm link` install reaches the package through a symlinked global path, so
+ * the launcher and the running CLI legitimately spell the same package root
+ * differently. Compare the resolved targets instead of the literal strings;
+ * a launcher pointing at a genuinely different package still fails closed.
+ */
+function samePackageRoot(embedded, expected) {
+    if (!embedded)
+        return false;
+    const normalize = (value) => path.normalize(value).replace(/[\\/]+$/, '').toLowerCase();
+    const resolved = (value) => {
+        try {
+            return normalize(fs.realpathSync(value));
+        }
+        catch {
+            return normalize(value);
+        }
+    };
+    return normalize(embedded) === normalize(expected) || resolved(embedded) === resolved(expected);
+}
 /** Read-only inspection of the machine-wide Windows Codex managed hook. */
 export function inspectCodexManagedHook(options = {}) {
     const paths = codexManagedHookPaths(options);
@@ -252,7 +285,7 @@ export function inspectCodexManagedHook(options = {}) {
     const normalized = (value) => path.normalize(String(value || '')).toLowerCase();
     const expectedPackageRoot = path.resolve(options.packageRoot || process.cwd());
     const launcherValid = launcher.includes('EVOLCORE_MANAGED_HOOK_LAUNCHER')
-        && launcher.toLowerCase().includes(JSON.stringify(expectedPackageRoot).toLowerCase());
+        && samePackageRoot(launcherPackageRoot(launcher), expectedPackageRoot);
     const configuredDir = config.hooks?.windows_managed_dir ?? config.hooks?.managed_dir;
     const groups = config.hooks?.PreToolUse;
     const canonicalCommand = (value) => {