evolcore 0.0.25 → 0.0.27

package/dist/agents/claude-runner.js

@@ -25,13 +25,15 @@ import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
-import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, recordSandboxInitializationFailure, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, isSandboxInitializationToolResult, recordSandboxInitializationFailure, getSandboxInitializationFailureCounters, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldEnableClaudeWeakerNestedSandbox, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { getManagedTaskTempDir, isManagedSessionRuntimeDir } from '../cli/task-context.js';
-import { hasTrustedFullAccessContext } from './runner-types.js';
-import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
+import { unsettledInterruptError, withInterruptDeadline, hasTrustedFullAccessContext } from './runner-types.js';
+import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel, sdkAutoCompactWindowForModel } from './runner-types.js';
+import { hasContextWindowSuffix, stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
 const resolveModule = createRequire(import.meta.url);
+const CLAUDE_INTERRUPT_TIMEOUT_MS = 5_000;
 /**
  * Resolve the platform package explicitly instead of relying on the SDK's
  * internal optional-dependency lookup. The latter is sensitive to the module
@@ -281,16 +283,17 @@ function buildClaudeManagedLockdownSettings(capabilityOptions) {
 }
 const CLAUDE_SANDBOX_GLOB_MAGIC = /[*?[\]]/;
 function trustedRuntimeWritePaths(runtimeEnv) {
-    const tmp = process.env.TMPDIR?.trim();
-    if (!tmp || !path.isAbsolute(tmp))
+    const sessionDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR?.trim();
+    if (!sessionDir || !isManagedSessionRuntimeDir(sessionDir))
         return [];
-    const root = resolveProtectedCandidate(tmp);
+    const root = resolveProtectedCandidate(sessionDir);
     const candidates = [runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR, runtimeEnv?.EVOLCORE_RUNTIME_LOCK_DIR]
         .filter((value) => typeof value === 'string' && path.isAbsolute(value));
     const paths = [];
     for (const candidate of candidates) {
         const resolved = resolveProtectedCandidate(candidate);
-        if (!isSameOrDescendant(resolved, root))
+        if (!isSameOrDescendant(resolved, root)
+            || (resolved !== root && !(path.dirname(resolved) === root && path.basename(resolved) === 'locks')))
             continue;
         try {
             const stat = fs.lstatSync(resolved);
@@ -409,11 +412,18 @@ async function refreshGatewayPricing(baseUrl, apiKey, requestHeaders) {
 }
 /**
  * 为支持 1M 上下文的模型追加 `[1m]` 后缀——仅在交给 SDK query() 时调用。
- * 目录与校验层始终使用不带后缀的基础 ID，避免与网关 /models 返回值（无 `[1m]`）冲突。
+ *
+ * 若网关把窗口变体作为独立条目下发（目录里同时有 `claude-opus-5` 与
+ * `claude-opus-5[1m]`），裸 ID 就是用户明确选的非 1M 变体，不能擅自升级，
+ * 否则两条列表项的实际效果无法区分。只有目录未提供任何窗口变体时，才沿用
+ * 按本地名单补 `[1m]` 的旧行为。
  */
-function applyContextWindow(modelId) {
-    if (/\[1m\]$/.test(modelId))
-        return modelId; // 已带后缀
+function applyContextWindow(modelId, catalog) {
+    if (hasContextWindowSuffix(modelId))
+        return modelId; // 窗口已显式指定
+    const variantListed = catalog?.models.some(m => hasContextWindowSuffix(m.id) && stripContextWindowSuffix(m.id) === modelId);
+    if (variantListed)
+        return modelId;
     if (isOneMillionContextModel(modelId))
         return `${modelId}[1m]`;
     return modelId;
@@ -472,7 +482,7 @@ class MessageStream {
 }
 export class AgentRunner {
     name = 'claude';
-    capabilities = { fullaccess: true, clear: true, compact: true, fork: true, forkAtTurn: true, askUserQuestion: true, planApproval: true, fileRewind: 'checkpoint' };
+    capabilities = { taskRecovery: true, fullaccess: true, clear: true, compact: true, fork: true, forkAtTurn: true, askUserQuestion: true, planApproval: true, fileRewind: 'checkpoint' };
     apiKey;
     model;
     effort;
@@ -491,6 +501,7 @@ export class AgentRunner {
     sandboxSettingsFiles = new Map();
     streamDone = new Map();
     streamDoneResolvers = new Map();
+    unconfirmedLifecycleFences = new Map();
     onSessionIdUpdate;
     onCompactStart;
     permissionGateway;
@@ -500,9 +511,9 @@ export class AgentRunner {
     /** 每个 session 最近的子进程 stderr 行（环形缓冲），用于子进程崩溃时还原真正原因 */
     recentStderr = new Map();
     static STDERR_BUFFER_MAX = 80;
-    async recordSandboxInfrastructureFailure(sessionId, inputId, permissionMode, error, stderr = []) {
+    async recordSandboxInfrastructureFailure(sessionId, inputId, permissionMode, error, stderr = [], scope = 'process') {
         const detail = createSandboxInitializationError(error, stderr);
-        const circuit = recordSandboxInitializationFailure(detail, stderr);
+        const circuit = recordSandboxInitializationFailure(detail, stderr, Date.now(), scope === 'session' ? sessionId : undefined);
         const context = this.permissionContexts.get(sessionId);
         auditToolInfrastructureFailure({
             toolName: 'Bash',
@@ -516,6 +527,11 @@ export class AgentRunner {
             callId: inputId,
             taskId: context?.taskId,
             occurrences: circuit.occurrences,
+            sandboxFailure: {
+                kind: circuit.kind,
+                observation: 'initialization_failed',
+                counters: getSandboxInitializationFailureCounters(),
+            },
         });
         await context?.recordExecutionAnomaly?.({
             code: 'capability_unavailable',
@@ -1329,7 +1345,7 @@ export class AgentRunner {
      * SDK 原始事件 → 标准 AgentEvent 转换
      * 所有 SDK 特有的事件类型引用封装在此方法内
      */
-    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false) {
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false, recoverySessionId) {
         let lastSessionId;
         let pendingSessionId;
         let hasTurnActivity = false;
@@ -1343,6 +1359,7 @@ export class AgentRunner {
         const taskMetadata = new Map();
         // tool_use_id → tool_name 映射，用于从 SDKUserMessage 的 tool_result 块中还原工具名
         const toolUseNames = new Map();
+        const sandboxedBashCalls = new Set();
         const emittedToolResultIds = new Set();
         let turnCount = 0;
         const seenMessageIds = new Set();
@@ -1355,6 +1372,9 @@ export class AgentRunner {
             const candidate = pendingSessionId;
             if (!candidate)
                 return undefined;
+            if (recoverySessionId && candidate !== recoverySessionId) {
+                throw new Error('Task recovery cannot replace the original Claude session');
+            }
             if (!isResuming && topicBinding) {
                 const ready = waitForFile
                     ? await waitForClaudeSessionFile(projectPath, candidate)
@@ -1481,6 +1501,12 @@ export class AgentRunner {
                 if (event.type === 'stream_event') {
                     const streamEvent = event.event;
                     if (streamEvent?.type === 'content_block_start'
+                        && streamEvent.content_block?.type === 'text') {
+                        hasTurnActivity = true;
+                        const contentIndex = typeof streamEvent.index === 'number' ? streamEvent.index : 0;
+                        yield { type: 'text_start', contentIndex, turn: turnCount || undefined };
+                    }
+                    else if (streamEvent?.type === 'content_block_start'
                         && (streamEvent.content_block?.type === 'thinking' || streamEvent.content_block?.type === 'redacted_thinking')) {
                         hasTurnActivity = true;
                         yield { type: 'heartbeat', source: 'reasoning', turn: turnCount || undefined };
@@ -1617,6 +1643,10 @@ export class AgentRunner {
                         if (content.type === 'tool_use') {
                             if (content.id)
                                 toolUseNames.set(content.id, content.name);
+                            if (content.id && content.name === 'Bash' && content.input?.dangerouslyDisableSandbox !== true
+                                && resolvePhaseOneExecutionSandbox(permissionMode, this.permissionContexts.get(sessionId)?.role).state !== 'off') {
+                                sandboxedBashCalls.add(content.id);
+                            }
                             yield { type: 'tool_use', name: content.name, input: content.input, callId: content.id, turn: turnCount, outputTokens: turnOutputChars, assistantUuid: event.uuid };
                         }
                         else if (content.type === 'text' && content.text) {
@@ -1635,6 +1665,31 @@ export class AgentRunner {
                                 : block.content != null ? JSON.stringify(block.content) : '';
                             if (block.tool_use_id)
                                 emittedToolResultIds.add(block.tool_use_id);
+                            if (sandboxedBashCalls.delete(block.tool_use_id) && block.is_error === true
+                                && isSandboxInitializationToolResult(block.content)) {
+                                const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, block.tool_use_id, permissionMode, new Error(resultContent), [], 'session');
+                                // Stop this SDK query before another model/tool retry. Do not use
+                                // interrupt(), which waits for this very generator to finish.
+                                this.activeMessageStreams.get(sessionId)?.end();
+                                const query = sdkStream;
+                                try {
+                                    await query.close?.();
+                                }
+                                catch (error) {
+                                    logger.warn(`[ClaudeSandbox] failed to close sandbox-failed query: ${error}`);
+                                }
+                                yield {
+                                    type: 'tool_result', name: toolName, result: resultContent, isError: true,
+                                    error: detail.message, errorCode: 'CAPABILITY_UNAVAILABLE', callId: block.tool_use_id,
+                                    correlationId: block.tool_use_id, decision: 'error', decisionSource: 'infrastructure',
+                                    policyCode: SANDBOX_INITIALIZATION_FAILED, executed: false, executionState: 'blocked',
+                                };
+                                yield {
+                                    type: 'complete', isError: true, subtype: 'infrastructure',
+                                    terminalReason: SANDBOX_INITIALIZATION_FAILED, errors: [detail.message], queryFinal: true,
+                                };
+                                return;
+                            }
                             yield {
                                 type: 'tool_result',
                                 name: toolName,
@@ -1898,6 +1953,17 @@ export class AgentRunner {
         // Validate the daemon-injected session namespace before the SDK inherits
         // the process environment for any temporary state.
         getManagedTaskTempDir(runtimeEnv);
+        this.assertLifecycleQuiescent(sessionId);
+        const staleLifecycle = this.activeStreams.has(sessionId)
+            || this.activeQueries.has(sessionId)
+            || this.activeMessageStreams.has(sessionId)
+            || this.interruptFns.has(sessionId);
+        if (staleLifecycle) {
+            logger.warn(`[AgentRunner] Stale query lifecycle before runQuery; forcing cleanup: session=${sessionId}`);
+            await this.interrupt(sessionId).catch(error => {
+                logger.warn(`[AgentRunner] Stale query interrupt failed before runQuery: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
         // 记录当前 evolcore session ID，用于 Agent ctl 环境变量注入
         // 同步用户级配置到内存
         this.syncFromUserSettings();
@@ -1928,6 +1994,10 @@ export class AgentRunner {
         if (topicBinding && topicAgentSessionId !== agentSessionId) {
             agentSessionId = topicAgentSessionId || undefined;
         }
+        const recoverySessionId = modelOverride?.recovery?.agentSessionId;
+        if (modelOverride?.recovery && (!recoverySessionId || agentSessionId !== recoverySessionId)) {
+            throw new Error('Task recovery requires the original Claude session binding');
+        }
         // 验证会话文件是否存在且有效（仅在有 agentSessionId 时）
         if (agentSessionId) {
             const homeDir = os.homedir();
@@ -1942,7 +2012,7 @@ export class AgentRunner {
                     for (const line of lines) {
                         try {
                             const data = JSON.parse(line);
-                            if (data.sessionId && data.version) {
+                            if (data.sessionId && data.version && (!recoverySessionId || data.sessionId === recoverySessionId)) {
                                 isValid = true;
                                 break;
                             }
@@ -1958,6 +2028,9 @@ export class AgentRunner {
                 }
             }
             if (!isValid) {
+                if (recoverySessionId) {
+                    throw new Error(`Task recovery backend is unavailable: ${recoverySessionId}`);
+                }
                 if (topicBinding) {
                     const error = new Error(`bound topic backend is unavailable: ${agentSessionId}`);
                     error.code = 'TOPIC_BACKEND_UNAVAILABLE';
@@ -1992,7 +2065,7 @@ export class AgentRunner {
         const executionSandbox = resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
         const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
         if (executionSandbox.state !== 'off') {
-            const activeSandboxFailure = getActiveSandboxInitializationFailure();
+            const activeSandboxFailure = getActiveSandboxInitializationFailure(undefined, undefined, sessionId);
             if (activeSandboxFailure) {
                 const detail = createSandboxInitializationError(new Error(`sandbox bootstrap circuit open; firstObservedAt=${activeSandboxFailure.openedAt} ` +
                     `occurrences=${activeSandboxFailure.occurrences}; ${activeSandboxFailure.detail}`));
@@ -2009,6 +2082,11 @@ export class AgentRunner {
                     callId: inputId,
                     taskId: context?.taskId,
                     occurrences: activeSandboxFailure.occurrences,
+                    sandboxFailure: {
+                        kind: activeSandboxFailure.kind,
+                        observation: 'circuit_open',
+                        counters: getSandboxInitializationFailureCounters(),
+                    },
                 });
                 await context?.recordExecutionAnomaly?.({
                     code: 'capability_unavailable',
@@ -2469,7 +2547,7 @@ export class AgentRunner {
         else {
             logger.info(`[AgentRunner] systemPromptAppend: none`);
         }
-        const sdkModel = applyContextWindow(resolveCatalogModel(runCatalog, callModel));
+        const sdkModel = applyContextWindow(resolveCatalogModel(runCatalog, callModel), runCatalog);
         const capabilityOptions = await this.resolveCapabilityRunOptions(projectPath);
         const managedSettings = callPermissionMode === 'fullaccess'
             ? undefined
@@ -2479,6 +2557,7 @@ export class AgentRunner {
             : await (async () => {
                 const sandboxProjectionStartedAt = Date.now();
                 ensureClaudeGitWorktreeConfig(projectPath);
+                const enableWeakerNestedSandbox = shouldEnableClaudeWeakerNestedSandbox();
                 const sandboxFilesystem = buildClaudeProtectedFilesystem(resolvePaths().root, {
                     denyLClassRead: callPermissionMode === 'readonly',
                 });
@@ -2499,10 +2578,12 @@ export class AgentRunner {
                     throw new Error(`[ClaudeSandbox] protected filesystem projection exceeded 2000ms: ${sandboxProjectionDurationMs}ms`);
                 }
                 logger.info(`[ClaudeSandbox] projection ready denyRead=${sandboxFilesystem.denyRead.length} ` +
-                    `denyWrite=${sandboxFilesystem.denyWrite.length} durationMs=${sandboxProjectionDurationMs}`);
+                    `denyWrite=${sandboxFilesystem.denyWrite.length} durationMs=${sandboxProjectionDurationMs} ` +
+                    `weakerNestedSandbox=${enableWeakerNestedSandbox}`);
                 return {
                     enabled: true,
                     failIfUnavailable: shouldFailIfClaudeSandboxUnavailable(),
+                    enableWeakerNestedSandbox,
                     allowUnsandboxedCommands: true,
                     network: {
                         allowUnixSockets: sandboxUnixSockets,
@@ -2552,7 +2633,7 @@ export class AgentRunner {
             ...(executionSandbox.state === 'off' && callPermissionMode !== 'fullaccess' && process.platform === 'linux' ? {
                 spawnClaudeCodeProcess: (options) => spawnClaudeWithHClassGuard(options, resolvePaths().root, handleClaudeStderr),
             } : {}),
-            autoCompactWindow: autoCompactWindowForModel(sdkModel),
+            autoCompactWindow: sdkAutoCompactWindowForModel(sdkModel),
             advisorModel: 'haiku',
             canUseTool: canUseToolCallback,
             permissionMode: sdkPermissionMode,
@@ -2702,7 +2783,7 @@ export class AgentRunner {
                 // Topic bindings are authoritative for every input shape.  Starting
                 // an unresumed Claude query for a bound topic would discover a second
                 // backend and then fail activation with a binding conflict.
-                sdkStream = topicBinding
+                sdkStream = topicBinding || recoverySessionId
                     ? createQuery(msgStream, agentSessionId, resumeAt)
                     : createQuery(msgStream);
             }
@@ -2747,7 +2828,7 @@ export class AgentRunner {
             this.interruptFns.set(sessionId, () => sdkStream.interrupt());
         }
         // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
-        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding);
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding, recoverySessionId);
         const self = this;
         return (async function* () {
             try {
@@ -2770,43 +2851,92 @@ export class AgentRunner {
     async interrupt(sessionId) {
         this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const streamRegistered = this.activeStreams.has(sessionId);
+        const registeredStream = this.activeStreams.get(sessionId);
         const fn = this.interruptFns.get(sessionId);
         const query = this.activeQueries.get(sessionId);
+        const messageStream = this.activeMessageStreams.get(sessionId);
         const cancelledInputIds = [];
         let stillQueued;
+        let interruptConfirmed = false;
+        let queuedCancellationComplete = true;
         if (fn) {
+            let interruptTimer;
             try {
-                const receipt = await fn();
+                const receipt = await Promise.race([
+                    fn(),
+                    new Promise((_, reject) => {
+                        interruptTimer = setTimeout(() => reject(new Error('CLAUDE_INTERRUPT_TIMEOUT')), CLAUDE_INTERRUPT_TIMEOUT_MS);
+                        interruptTimer.unref?.();
+                    }),
+                ]);
+                interruptConfirmed = true;
                 stillQueued = Array.isArray(receipt?.still_queued) ? receipt.still_queued.filter((id) => typeof id === 'string') : undefined;
                 if (stillQueued && query && typeof query.cancelAsyncMessage === 'function') {
-                    for (const inputId of stillQueued) {
+                    const cancellations = await Promise.all(stillQueued.map(async (inputId) => {
                         try {
-                            if (await query.cancelAsyncMessage(inputId))
+                            const cancelled = await withInterruptDeadline(query.cancelAsyncMessage(inputId), 'Claude cancel queued input', CLAUDE_INTERRUPT_TIMEOUT_MS);
+                            if (cancelled)
                                 cancelledInputIds.push(inputId);
+                            return cancelled;
                         }
                         catch (error) {
                             logger.debug(`[AgentRunner] Failed to cancel queued input ${inputId}: ${error}`);
+                            return false;
                         }
-                    }
+                    }));
+                    queuedCancellationComplete = cancellations.every(Boolean);
                 }
                 logger.info(`[AgentRunner] Interrupted session: ${sessionId}`);
             }
             catch (error) {
-                logger.warn(`[AgentRunner] Interrupt failed (transport closed): ${sessionId}`);
+                logger.warn(`[AgentRunner] Interrupt failed: ${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+            finally {
+                if (interruptTimer)
+                    clearTimeout(interruptTimer);
             }
         }
         this.activeMessageStreams.get(sessionId)?.end();
         if (query && typeof query.close === 'function')
             query.close();
         const done = this.streamDone.get(sessionId);
+        let streamDoneSettled = false;
         // A stream interrupted after runQuery resolves but before registerStream has
         // no consumer that can enter the wrapper generator's finally block. Waiting
         // for streamDone here would always burn the full timeout.
         if (done && streamRegistered) {
-            await Promise.race([done, new Promise(resolve => setTimeout(resolve, 5_000))]);
+            await Promise.race([
+                done.then(() => { streamDoneSettled = queuedCancellationComplete; }),
+                new Promise(resolve => setTimeout(resolve, CLAUDE_INTERRUPT_TIMEOUT_MS)),
+            ]);
+        }
+        else if (done) {
+            // A runQuery result can exist before ResponseEngine registers a consumer.
+            // In that state there is no wrapper-finally callback to observe. Trust an
+            // acknowledged SDK interrupt; otherwise keep the session fenced.
+            streamDoneSettled = (!query || interruptConfirmed) && queuedCancellationComplete;
+        }
+        // Local queue cleanup cannot authorize a second SDK writer while the old
+        // query remains unconfirmed.
+        // Do not let a late interrupt from an older turn delete a lifecycle that
+        // a newer turn installed while the old SDK call was unwinding.
+        if (this.activeStreams.get(sessionId) === registeredStream
+            && this.interruptFns.get(sessionId) === fn
+            && this.activeQueries.get(sessionId) === query
+            && this.activeMessageStreams.get(sessionId) === messageStream) {
+            if ((done && !streamDoneSettled) || !queuedCancellationComplete) {
+                const fence = done ?? new Promise(() => { });
+                this.unconfirmedLifecycleFences.set(sessionId, fence);
+                if (queuedCancellationComplete) {
+                    void fence.then(() => {
+                        if (this.unconfirmedLifecycleFences.get(sessionId) === fence) {
+                            this.unconfirmedLifecycleFences.delete(sessionId);
+                        }
+                    });
+                }
+            }
+            this.cleanupStreamLifecycle(sessionId, false, streamDoneSettled);
         }
-        this.interruptFns.delete(sessionId);
-        this.activeStreams.delete(sessionId);
         this.cleanupSandboxSettingsFiles(sessionId);
         return { stillQueued, cancelledInputIds, closed: true };
     }
@@ -2817,9 +2947,18 @@ export class AgentRunner {
         this.activeStreams.set(key, stream);
     }
     cleanupStream(sessionId) {
-        this.activeMessageStreams.get(sessionId)?.end();
+        this.cleanupStreamLifecycle(sessionId, true, true);
+    }
+    assertLifecycleQuiescent(sessionId) {
+        if (this.unconfirmedLifecycleFences.has(sessionId))
+            throw unsettledInterruptError('Claude');
+    }
+    cleanupStreamLifecycle(sessionId, endMessageStream, resolveDone) {
+        if (endMessageStream)
+            this.activeMessageStreams.get(sessionId)?.end();
         this.activeMessageStreams.delete(sessionId);
-        this.streamDoneResolvers.get(sessionId)?.();
+        if (resolveDone)
+            this.streamDoneResolvers.get(sessionId)?.();
         this.streamDoneResolvers.delete(sessionId);
         this.streamDone.delete(sessionId);
         this.activeStreams.delete(sessionId);
@@ -2891,7 +3030,7 @@ export class AgentRunner {
             prompt,
             options: {
                 cwd: projectPath,
-                ...(catalog && callModel ? { model: applyContextWindow(resolveCatalogModel(catalog, callModel)) } : {}),
+                ...(catalog && callModel ? { model: applyContextWindow(resolveCatalogModel(catalog, callModel), catalog) } : {}),
                 resume: agentSessionId,
                 maxTurns: 1,
                 tools: [],

package/dist/agents/codex/app-server-client.js

@@ -210,8 +210,8 @@ export class CodexAppServerClient {
         }
         return undefined;
     }
-    async threadRead(threadId, includeTurns = true) {
-        return this.request('thread/read', { threadId, includeTurns });
+    async threadRead(threadId, includeTurns = true, timeoutMs) {
+        return this.request('thread/read', { threadId, includeTurns }, timeoutMs);
     }
     async threadRollback(threadId, numTurns) {
         return this.request('thread/rollback', { threadId, numTurns });
@@ -232,7 +232,7 @@ export class CodexAppServerClient {
                     : { sandbox: options?.sandbox ?? null }),
             config: this.buildThreadConfig(effort, options?.config),
             excludeTurns: false,
-            persistExtendedHistory: false,
+            ...(options?.lastTurnId ? { lastTurnId: options.lastTurnId } : {}),
         });
         const forkedThreadId = response.thread?.id;
         if (title && forkedThreadId) {
@@ -252,16 +252,19 @@ export class CodexAppServerClient {
         await this.request('thread/compact/start', { threadId });
         return true;
     }
-    async threadTurnsList(threadId, limit) {
+    async threadTurnsList(threadId, limit, cursor) {
         return this.request('thread/turns/list', {
             threadId,
             ...(limit ? { limit } : {}),
-            sortDirection: 'asc',
+            ...(cursor ? { cursor } : {}),
+            // The app-server defaults to newest-first. `nextCursor` then walks
+            // toward older turns, which is the direction needed to hydrate history.
+            sortDirection: 'desc',
             itemsView: 'full',
         });
     }
     async threadTurnsItemsList(threadId, turnId, limit) {
-        return this.request('thread/turns/items/list', {
+        return this.request('thread/items/list', {
             threadId,
             turnId,
             ...(limit ? { limit } : {}),
@@ -619,7 +622,7 @@ export class CodexAppServerClient {
         env.TMPDIR = managedTmpDir;
         delete env.EVOLCORE_RUNTIME_LOCK_DIR;
         if (managedTmpDir) {
-            const runtimeLockDir = path.join(managedTmpDir, 'evolcore-locks');
+            const runtimeLockDir = path.join(managedTmpDir, 'locks');
             try {
                 // The parent is the already-validated process root, so only create
                 // and validate the final component. Never follow a pre-existing
@@ -643,7 +646,12 @@ export class CodexAppServerClient {
                 logger.warn(`[CodexAppServer] managed runtime lock directory unavailable: ${runtimeLockDir}`);
             }
         }
-        env.CODEX_API_KEY = this.options.apiKey;
+        if (this.options.authType === 'bearerToken') {
+            delete env.CODEX_API_KEY;
+        }
+        else {
+            env.CODEX_API_KEY = this.options.apiKey;
+        }
         env.EVOLCORE_INSTANCE_SOCKET = resolvePaths().instanceSocket;
         for (const [name, value] of Object.entries(this.options.headers ?? {})) {
             env[codexHeaderEnvName(name)] = value;
@@ -760,30 +768,63 @@ export class CodexAppServerClient {
         }
         return args;
     }
-    async request(method, params) {
-        await this.ensureReadyFor(method);
-        const proc = this.proc;
-        if (!proc)
-            throw new Error('Codex app-server is not running');
-        const id = String(this.nextId++);
-        const payload = { id, method };
-        if (params !== undefined && params !== null)
-            payload.params = params;
-        return new Promise((resolve, reject) => {
-            this.pending.set(id, {
-                resolve,
-                reject,
-                method,
-                params,
-                stderrStartSequence: this.stderrSequence,
-            });
-            proc.stdin.write(`${JSON.stringify(payload)}\n`, error => {
-                if (!error)
-                    return;
-                this.pending.delete(id);
-                reject(error);
+    async request(method, params, timeoutMs) {
+        // Only lifecycle RPCs get short deadlines. Model work has its own policy.
+        const deadline = timeoutMs ?? (method === 'turn/interrupt' ? 5_000 : undefined);
+        let timer;
+        let requestId;
+        let expired = false;
+        const operation = (async () => {
+            await this.ensureReadyFor(method);
+            if (expired)
+                throw new Error(`Codex ${method} expired before dispatch`);
+            const proc = this.proc;
+            if (!proc)
+                throw new Error('Codex app-server is not running');
+            const id = String(this.nextId++);
+            requestId = id;
+            const payload = { id, method };
+            if (params !== undefined && params !== null)
+                payload.params = params;
+            return new Promise((resolve, reject) => {
+                this.pending.set(id, {
+                    resolve,
+                    reject,
+                    method,
+                    params,
+                    stderrStartSequence: this.stderrSequence,
+                });
+                proc.stdin.write(`${JSON.stringify(payload)}\n`, error => {
+                    if (!error)
+                        return;
+                    this.pending.delete(id);
+                    reject(error);
+                });
             });
-        });
+        })();
+        if (deadline === undefined)
+            return operation;
+        try {
+            return await Promise.race([
+                operation,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => {
+                        expired = true;
+                        reject(new Error(`Codex ${method} deadline exceeded`));
+                    }, deadline);
+                    timer.unref?.();
+                }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            if (requestId && expired) {
+                const pending = this.pending.get(requestId);
+                this.pending.delete(requestId);
+                pending?.reject(new Error(`Codex ${method} deadline exceeded`));
+            }
+        }
     }
     respond(id, result) {
         if (!this.proc)
@@ -862,6 +903,10 @@ export class CodexAppServerClient {
             else if (/already has an active writer/i.test(detail)) {
                 error.code = CODEX_THREAD_ACTIVE_WRITER;
             }
+            else if (pending.method === 'turn/steer' && /\bno active turn\b/i.test(detail)) {
+                // Explicit server rejection proves the input was not accepted. Transport errors do not.
+                error.code = 'CODEX_NO_ACTIVE_TURN';
+            }
             pending.reject(error);
             return;
         }

package/dist/agents/codex/catalog.js

@@ -28,7 +28,7 @@ export async function codexNativeCatalog(context) {
     if (context.baseagent !== 'codex')
         return null;
     const client = new CodexAppServerClient({
-        apiKey: context.apiKey ?? '', baseUrl: context.baseUrl, provider: context.provider,
+        apiKey: context.apiKey ?? '', authType: context.authType, baseUrl: context.baseUrl, provider: context.provider,
         headers: context.headers, queryParams: context.queryParams,
     });
     let timer;