evolcore 0.0.25 → 0.0.27

package/dist/agents/codex-runner.js

@@ -1,24 +1,26 @@
 import { getRunnerCatalog, catalogEfforts, assertCatalogSelectable } from '../core/model/model-catalog.js';
-import { hasTrustedFullAccessContext } from './runner-types.js';
+// Codex/OpenAI API 不认识 Claude Code SDK 的窗口后缀，必须传入基础模型 ID。
+import { stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
+import { formatAsyncQuestionAnswer, hasTrustedFullAccessContext, parseAsyncUserQuestions, unsettledInterruptError, withInterruptDeadline } from './runner-types.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
-import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/permission/protected-paths.js';
+import { assertWindowsCodexFilesystemRuleBudget, buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
 import { CODEX_THREAD_ACTIVE_WRITER, CodexAppServerClient, } from './codex/app-server-client.js';
 import { resolveOpenaiConfig, resolveCodexCliPath } from './baseagent.js';
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { auditCodexApprovalDecision, auditPermissionLifecycle, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
-import { isRetryableError } from '../utils/error-utils.js';
+import { classifyError, ErrorType, isOutputTokenLimitError, isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
-import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
+import { AGENT_DELEGATION_TOKEN_ENV, CODEX_SESSION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, hasPowerShellDelegationAssignment, normalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, hasPowerShellCredentialAssignment, normalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { agentSessionsDir, resolvePaths, resolveRoot } from '../paths.js';
-import { ensureProcessManagedTempDir, getManagedTaskTempDir } from '../cli/task-context.js';
+import { ensureSessionRuntimeDir, getManagedTaskTempDir } from '../cli/task-context.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
 import { CodexSessionFileAdapter } from '../core/session/adapters/codex-session-file-adapter.js';
 import { execFileSync } from 'child_process';
@@ -36,19 +38,23 @@ const MIME_EXT = {
     'image/webp': '.webp',
 };
 const APPROVAL_LOG_SUMMARY_MAX_LENGTH = 256;
+const CODEX_INTERRUPT_TIMEOUT_MS = 5_000;
+function toAgentErrorType(message) {
+    switch (classifyError(new Error(message))) {
+        case ErrorType.CONTEXT_TOO_LONG: return 'context_too_long';
+        case ErrorType.AUTH_ERROR: return 'auth';
+        case ErrorType.API_ERROR:
+        case ErrorType.STREAM_ERROR:
+        case ErrorType.SDK_TIMEOUT: return 'network';
+        default: return 'unknown';
+    }
+}
 export function formatApprovalLogSummary(summary) {
     const singleLine = summary.replace(/\s+/gu, ' ').trim();
     if (singleLine.length <= APPROVAL_LOG_SUMMARY_MAX_LENGTH)
         return singleLine;
     return singleLine.slice(0, APPROVAL_LOG_SUMMARY_MAX_LENGTH - 3).trimEnd() + '...';
 }
-/**
- * 规范化模型 ID：去掉 Claude Code SDK 专有的上下文窗口后缀 [1m]/[200k]
- * Codex/OpenAI API 不认识这些后缀，必须传入标准模型 ID
- */
-function stripContextWindowSuffix(modelId) {
-    return modelId.replace(/\[(?:1m|200k)\]$/i, '');
-}
 // ── Codex 模型目录（动态获取，含 effort） ──
 class AsyncEventQueue {
     queue = [];
@@ -103,60 +109,6 @@ function isCodexReasoningNotification(method) {
         || method === 'item/reasoning/summaryPartAdded';
 }
 const CODEX_THREAD_HANDOFF_TIMEOUT_MS = 2_000;
-const managedTempDirsForExitCleanup = new Map();
-let managedTempExitCleanupRegistered = false;
-function isTrustedManagedTempDirectory(directory, parent) {
-    try {
-        const parentPath = path.resolve(parent);
-        const directoryPath = path.resolve(directory);
-        // The session directory must be a direct child of the private parent.
-        // This lexical check is required before canonicalization so a replaced
-        // parent symlink cannot turn an old session path into another tree.
-        if (path.dirname(directoryPath) !== parentPath)
-            return false;
-        const trustedDirectory = (candidate) => {
-            const stat = fs.lstatSync(candidate);
-            if (!stat.isDirectory() || stat.isSymbolicLink())
-                return false;
-            if (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())
-                return false;
-            return process.platform === 'win32' || (stat.mode & 0o077) === 0;
-        };
-        if (!trustedDirectory(parentPath) || !trustedDirectory(directoryPath))
-            return false;
-        const canonicalParent = resolveProtectedCandidate(parentPath);
-        const canonicalDirectory = resolveProtectedCandidate(directoryPath);
-        // Keep the canonical and lexical paths identical after the lstat checks;
-        // this rejects symlink replacement in either node or an existing ancestor.
-        return canonicalParent === parentPath
-            && canonicalDirectory === directoryPath
-            && canonicalDirectory !== canonicalParent
-            && path.dirname(canonicalDirectory) === canonicalParent
-            && isSameOrDescendant(canonicalDirectory, canonicalParent);
-    }
-    catch {
-        return false;
-    }
-}
-function registerManagedTempDirForExitCleanup(directory, parent) {
-    managedTempDirsForExitCleanup.set(directory, parent);
-    if (managedTempExitCleanupRegistered)
-        return;
-    managedTempExitCleanupRegistered = true;
-    process.once('exit', () => {
-        for (const [candidatePath, parentPath] of managedTempDirsForExitCleanup) {
-            try {
-                if (isTrustedManagedTempDirectory(candidatePath, parentPath)) {
-                    fs.rmSync(path.resolve(candidatePath), { recursive: true, force: true });
-                }
-            }
-            catch {
-                // Process exit cleanup is best effort; session cleanup logs failures
-                // while the runner is still active.
-            }
-        }
-    });
-}
 function stableSecurityValue(value) {
     if (value === undefined)
         return 'undefined';
@@ -198,11 +150,13 @@ function parseManagedPreToolUseDenial(value) {
         .trim();
     if (!reason)
         reason = 'EvolCore PreToolUse policy denied this tool call';
-    const policyCode = /工具调用已达到\s*\d+\s*次/.test(reason)
-        ? 'proactive_tool_report_required'
-        : /请先用\s+ec\s+(?:group\s+send|msg\s+send)/.test(reason)
-            ? 'proactive_first_send_required'
-            : 'managed_pre_tool_use_denied';
+    const policyCode = /当前汇报命令(?:未通过规范解析|不符合当前会话)/.test(reason)
+        ? 'proactive_send_invalid'
+        : /工具调用已达到\s*\d+\s*次/.test(reason)
+            ? 'proactive_tool_report_required'
+            : /请先用\s+ec\s+(?:group\s+send|msg\s+send)/.test(reason)
+                ? 'proactive_first_send_required'
+                : 'managed_pre_tool_use_denied';
     return { policyCode, reason };
 }
 function outputTextForManagedHook(value) {
@@ -227,7 +181,6 @@ function outputTextForManagedHook(value) {
     }
     return String(value);
 }
-const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
 const CODEX_NO_ROLLOUT_RE = /no rollout found for thread id/i;
 const CODEX_ACTIVE_WRITER_RE = /already has an active writer/i;
 function isCodexNoRolloutError(error) {
@@ -354,7 +307,6 @@ export async function getCodexAppServerAvailabilityAsync() {
                 : `Codex CLI 探测失败：${error instanceof Error ? error.message : String(error)}` };
     }
 }
-export const CODEX_SESSION_TOKEN_ENV = 'EVOLCORE_CODEX_SESSION_TOKEN';
 export class CodexRunner {
     name = 'codex';
     // turn/start persists a new user turn before runQuery resolves. App-server
@@ -373,14 +325,12 @@ export class CodexRunner {
     threadProjectPaths = new Map();
     /** Child Codex threads inherit the EvolCore session that started them. */
     childThreadSessions = new Map();
-    sessionTempDirs = new Map();
-    managedTempNonce = randomBytes(16).toString('hex');
     threadExternalToolFingerprints = new Map();
     threadExternalToolBoundaries = new Map();
     trackedApprovalItems = new Map();
     pendingToolDenials = new Map();
-    threadDelegationCarriers = new Map();
     pendingInterrupts = new Map();
+    unconfirmedInterrupts = new Map();
     steeringTails = new Map();
     threadOperationLocks = new Map();
     activeOperationReleases = new Map();
@@ -403,6 +353,9 @@ export class CodexRunner {
     codexSessionFileAdapter = new CodexSessionFileAdapter();
     /** threadId → managed-hook credential, issued by this runner's agent only. */
     threadCredentials = new Map();
+    /** @deprecated Compatibility alias for direct runner integrations. */
+    threadDelegationCarriers = this.threadCredentials;
+    asyncQuestionItems = new Set();
     constructor(config, callbacks, runtime) {
         // Compatibility for legacy direct callers that still pass the removed
         // internal fields in a synthetic config. AgentLoader uses runtime binding.
@@ -419,6 +372,7 @@ export class CodexRunner {
             configuredHeaders: this.resolvedConfig.headers,
         });
         this.capabilities = {
+            taskRecovery: true,
             clear: false,
             compact: true,
             fork: true,
@@ -442,6 +396,7 @@ export class CodexRunner {
             return existing;
         const client = new CodexAppServerClient({
             apiKey: this.resolvedConfig.apiKey,
+            authType: this.resolvedConfig.authType,
             baseUrl: this.resolvedConfig.baseUrl,
             provider: this.resolvedConfig.provider,
             headers: this.resolvedConfig.headers,
@@ -634,16 +589,13 @@ export class CodexRunner {
         }
         this.threadSubscriptions.set(threadId, { client: targetClient, state: 'subscribed' });
     }
-    createDelegationCarrier() {
-        return randomBytes(32).toString('base64url');
-    }
-    approvedLiteralEvolcoreCommand(command, managedTempDir, dialect = 'posix', expectedDelegationToken, executable) {
+    approvedLiteralEvolcoreCommand(command, managedTempDir, dialect = 'posix', expectedCredentialToken, executable) {
         const parseOptions = {
             allowManagedTmpDir: true,
             dialect,
             verifyShellExecutable: process.platform === 'win32',
             ...(managedTempDir ? { managedTempDir } : {}),
-            ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
+            ...(expectedCredentialToken !== undefined ? { expectedCredentialToken } : {}),
         };
         const classification = classifyEvolcoreShellCommand(command, parseOptions);
         if (classification.kind === 'bounded-output')
@@ -670,10 +622,10 @@ export class CodexRunner {
         }
         return {
             argv: normalizeEvolcoreCommandArgv(parsed.argv),
-            ...(parsed.delegationToken ? { delegationToken: parsed.delegationToken } : {}),
+            ...(parsed.credentialToken ? { credentialToken: parsed.credentialToken } : {}),
         };
     }
-    resolveCanonicalEcApproval(toolInput, managedTempDir, expectedDelegationToken) {
+    resolveCanonicalEcApproval(toolInput, managedTempDir, expectedCredentialToken) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
@@ -694,12 +646,12 @@ export class CodexRunner {
             ? resolveCodexShellCarrierArgv(explicitArgv)
             : undefined;
         if (explicitCarrier !== undefined) {
-            return this.approvedLiteralEvolcoreCommand(explicitCarrier.command, managedTempDir, explicitCarrier.dialect, expectedDelegationToken, explicitCarrier.executable);
+            return this.approvedLiteralEvolcoreCommand(explicitCarrier.command, managedTempDir, explicitCarrier.dialect, expectedCredentialToken, explicitCarrier.executable);
         }
         if (hasCodexCmdCarrierEcIntent(toolInput)) {
             const parsed = parseCodexToolCommand(toolInput, {
                 verifyShellExecutable: process.platform === 'win32',
-                ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
+                ...(expectedCredentialToken !== undefined ? { expectedCredentialToken } : {}),
             });
             if (!parsed.ok)
                 return { parseFailure: parsed };
@@ -711,7 +663,7 @@ export class CodexRunner {
                         } }
                     : {
                         argv: normalizeEvolcoreCommandArgv(parsed.argv),
-                        ...(parsed.delegationToken ? { delegationToken: parsed.delegationToken } : {}),
+                        ...(parsed.credentialToken ? { credentialToken: parsed.credentialToken } : {}),
                     };
             }
             const command = typeof toolInput.command === 'string' ? toolInput.command : '';
@@ -731,7 +683,7 @@ export class CodexRunner {
             allowManagedTmpDir: true,
             verifyShellExecutable: process.platform === 'win32',
             ...(managedTempDir ? { managedTempDir } : {}),
-            ...(expectedDelegationToken !== undefined ? { expectedDelegationToken } : {}),
+            ...(expectedCredentialToken !== undefined ? { expectedCredentialToken } : {}),
         });
         if (canonicalCommand?.[0] === 'ec') {
             return containsLiteralManagedTmpDirOutsideSendContent(canonicalCommand)
@@ -766,7 +718,7 @@ export class CodexRunner {
                 return true;
             const shellCarrier = resolveCodexShellCarrierArgv(rawArgv);
             if (shellCarrier?.dialect === 'powershell'
-                && hasPowerShellDelegationAssignment(shellCarrier.command))
+                && hasPowerShellCredentialAssignment(shellCarrier.command))
                 return true;
             return hasCodexCmdCarrierEcIntent(toolInput)
                 || shellCarrier !== undefined
@@ -779,20 +731,20 @@ export class CodexRunner {
     }
     armApprovedDelegationCommand(sessionId, argv) {
         const threadId = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
-        const carrierToken = threadId ? this.threadDelegationCarriers.get(threadId) : undefined;
+        const sessionToken = threadId ? this.ensureThreadCredentialLoaded(threadId) : undefined;
         const commandHash = hashDelegatedCommandArgv(argv);
         const arm = this.permissionContexts.get(sessionId)?.armApprovedDelegationCommand;
-        if (!carrierToken || !commandHash || !arm)
+        if (!sessionToken || !commandHash || !arm)
             return false;
         try {
-            return arm(carrierToken, commandHash);
+            return arm(sessionToken, commandHash);
         }
         catch (error) {
             logger.warn(`[CodexRunner] delegation arm callback failed: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
             return false;
         }
     }
-    delegationCarrierForSession(sessionId, threadId) {
+    sessionTokenForSession(sessionId, threadId) {
         const candidates = [
             threadId,
             this.activeSessions.get(sessionId),
@@ -801,45 +753,13 @@ export class CodexRunner {
         for (const candidate of candidates) {
             if (!candidate)
                 continue;
-            const carrier = this.threadDelegationCarriers.get(candidate);
-            if (carrier)
-                return carrier;
+            const token = this.ensureThreadCredentialLoaded(candidate);
+            if (token)
+                return token;
         }
         return undefined;
     }
-    async readThreadDelegationCarrier(appServer, threadId) {
-        try {
-            const result = await appServer.threadShellCommand(threadId, `node -e "process.stdout.write(process.env.${AGENT_DELEGATION_TOKEN_ENV}||String())"`);
-            const carrier = result.output.trim();
-            if (result.exitCode !== undefined && result.exitCode !== 0)
-                return undefined;
-            return /^[A-Za-z0-9_-]{32,128}$/.test(carrier) ? carrier : undefined;
-        }
-        catch (error) {
-            logger.warn(`[CodexRunner] failed to recover delegation carrier for loaded thread ${threadId}: ${error instanceof Error ? error.message : String(error)}`);
-            return undefined;
-        }
-    }
-    async loadPersistedDelegationCarrier(sessionManager, sessionId, threadId) {
-        if (typeof sessionManager?.getSessionById !== 'function')
-            return undefined;
-        try {
-            const session = await sessionManager.getSessionById(sessionId);
-            const persisted = session?.metadata?.[CODEX_DELEGATION_CARRIER_METADATA_KEY];
-            if (!persisted || typeof persisted !== 'object' || Array.isArray(persisted))
-                return undefined;
-            if (persisted.threadId !== threadId || typeof persisted.carrier !== 'string')
-                return undefined;
-            return /^[A-Za-z0-9_-]{32,128}$/.test(persisted.carrier)
-                ? persisted.carrier
-                : undefined;
-        }
-        catch (error) {
-            logger.debug(`[CodexRunner] failed to load persisted delegation carrier: session=${sessionId} error=${error}`);
-            return undefined;
-        }
-    }
-    async commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn) {
+    async commitProvisionalThread(sessionId, threadId, turn) {
         if (this.provisionalSessions.get(sessionId) !== threadId)
             return false;
         const bindingResult = this.onSessionIdUpdate
@@ -863,10 +783,6 @@ export class CodexRunner {
             return false;
         this.provisionalSessions.delete(sessionId);
         this.activeSessions.set(sessionId, threadId);
-        if (carrierToPublish) {
-            this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
-            await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
-        }
         this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         return true;
     }
@@ -899,9 +815,9 @@ export class CodexRunner {
             return;
         this.provisionalSessions.delete(sessionId);
         this.threadProjectPaths.delete(threadId);
-        this.threadDelegationCarriers.delete(threadId);
         this.unbindExternalToolBoundary(threadId);
         this.clearTrackedApprovalItemsForThread(threadId);
+        this.dropThreadCredential(threadId);
         // A stale provisional start can finish after a replacement run has
         // already activated another parent thread for this session. Do not tear
         // down the replacement run's child mappings in that race.
@@ -911,31 +827,6 @@ export class CodexRunner {
         }
         this.pruneThreadOperationLocks();
     }
-    async persistDelegationCarrier(sessionManager, sessionId, threadId, carrier) {
-        if (typeof sessionManager?.getSessionById !== 'function')
-            return;
-        try {
-            const session = await sessionManager.getSessionById(sessionId);
-            if (!session)
-                return;
-            const current = session.metadata?.[CODEX_DELEGATION_CARRIER_METADATA_KEY];
-            if (current?.threadId === threadId && current?.carrier === carrier)
-                return;
-            if (typeof sessionManager.patchSessionMetadata === 'function') {
-                await sessionManager.patchSessionMetadata(sessionId, {
-                    [CODEX_DELEGATION_CARRIER_METADATA_KEY]: { threadId, carrier },
-                });
-            }
-            else if (typeof sessionManager.updateSession === 'function') {
-                await sessionManager.updateSession(sessionId, {
-                    metadata: { [CODEX_DELEGATION_CARRIER_METADATA_KEY]: { threadId, carrier } },
-                });
-            }
-        }
-        catch (error) {
-            logger.warn(`[CodexRunner] failed to persist delegation carrier: session=${sessionId} thread=${threadId} error=${error}`);
-        }
-    }
     resetAppServerClient() {
         const clients = [this.appServerClient, this.fullAccessAppServerClient]
             .filter((client) => !!client);
@@ -944,8 +835,8 @@ export class CodexRunner {
         this.threadSubscriptions.clear();
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
-        for (const childThreadId of this.childThreadSessions.keys())
-            this.threadProjectPaths.delete(childThreadId);
+        for (const childThreadId of [...this.childThreadSessions.keys()])
+            this.unregisterChildThread(childThreadId);
         // Child turn ids belong to the discarded app-server connection. Keeping
         // them would make a later session interrupt attempt target stale threads
         // through the replacement client.
@@ -953,7 +844,6 @@ export class CodexRunner {
         this.childThreadSessions.clear();
         this.trackedApprovalItems.clear();
         this.pendingToolDenials.clear();
-        this.threadDelegationCarriers.clear();
         for (const client of clients) {
             client.close().catch(error => {
                 logger.debug(`[CodexRunner] Failed to close stale app-server client: ${error}`);
@@ -1300,47 +1190,53 @@ export class CodexRunner {
     }
     buildPermissionProfileConfig(sessionId, mode, projectPath, bootstrapAgentMdPath, personalMdPath) {
         const profileName = this.permissionProfileName(sessionId);
-        const managedTempDir = this.ensureSessionTempDir(sessionId);
+        const managedTempDir = ensureSessionRuntimeDir(sessionId);
         const network = {
             enabled: true,
             unix_sockets: { [resolvePaths().instanceSocket]: 'allow' },
         };
+        const filesystem = {
+            ...buildCodexProtectedFilesystemRules(resolveRoot(), {
+                denyLClassRead: mode === 'readonly',
+                // The app-server itself is launched behind EvolCore's Linux
+                // H-class guard, which already mounts every L-class directory
+                // read-only. Avoid Codex's per-file glob expansion inside that
+                // nested mount namespace; it can fail while creating a missing
+                // target such as triggers/history.jsonl.
+                expandLClassReadDeny: process.platform !== 'linux',
+            }),
+            ...this.resolveGitMetadataWriteRules(projectPath, mode),
+            ...(bootstrapAgentMdPath ? {
+                [path.resolve(bootstrapAgentMdPath)]: mode === 'readonly' ? 'read' : 'write',
+            } : {}),
+            ...(personalMdPath ? {
+                [path.resolve(personalMdPath)]: mode === 'readonly' ? 'read' : 'write',
+            } : {}),
+            ...(mode !== 'readonly' && managedTempDir ? {
+                [managedTempDir]: 'write',
+                [managedTempDir + '/**']: 'write',
+                [path.join(managedTempDir, 'locks')]: 'write',
+                [path.join(managedTempDir, 'locks') + '/**']: 'write',
+            } : {}),
+        };
+        // Codex resolves this complete profile before serializing the Windows
+        // helper payload. Check after all runner-owned additions, not merely the
+        // protected-path base projection, so Git and managed-temp rules cannot
+        // push an otherwise valid profile back over CreateProcess' limit.
+        assertWindowsCodexFilesystemRuleBudget(filesystem);
         return {
             default_permissions: profileName,
             permissions: {
                 [profileName]: {
                     extends: mode === 'readonly' ? ':read-only' : ':workspace',
-                    filesystem: {
-                        ...buildCodexProtectedFilesystemRules(resolveRoot(), {
-                            denyLClassRead: mode === 'readonly',
-                            // The app-server itself is launched behind EvolCore's Linux
-                            // H-class guard, which already mounts every L-class directory
-                            // read-only. Avoid Codex's per-file glob expansion inside that
-                            // nested mount namespace; it can fail while creating a missing
-                            // target such as triggers/history.jsonl.
-                            expandLClassReadDeny: process.platform !== 'linux',
-                        }),
-                        ...this.resolveGitMetadataWriteRules(projectPath, mode),
-                        ...(bootstrapAgentMdPath ? {
-                            [path.resolve(bootstrapAgentMdPath)]: mode === 'readonly' ? 'read' : 'write',
-                        } : {}),
-                        ...(personalMdPath ? {
-                            [path.resolve(personalMdPath)]: mode === 'readonly' ? 'read' : 'write',
-                        } : {}),
-                        ...(mode !== 'readonly' && managedTempDir ? {
-                            [managedTempDir]: 'write',
-                            [managedTempDir + '/**']: 'write',
-                            [path.join(path.dirname(managedTempDir), 'evolcore-locks')]: 'write',
-                            [path.join(path.dirname(managedTempDir), 'evolcore-locks') + '/**']: 'write',
-                        } : {}),
-                    },
+                    filesystem,
                     network,
                 },
             },
         };
     }
-    buildExecutionSandboxOptions(sessionId, mode, projectPath, bootstrapAgentMdPath, personalMdPath) {
-        const decision = resolvePhaseOneExecutionSandbox(mode, this.permissionContexts.get(sessionId)?.role);
+    buildExecutionSandboxOptions(sessionId, mode, projectPath, bootstrapAgentMdPath, personalMdPath, permissionContext = this.permissionContexts.get(sessionId) ?? {}) {
+        const decision = resolvePhaseOneExecutionSandbox(mode, permissionContext.role);
         return {
             decision,
             permissionProfileConfig: decision.state === 'active'
@@ -1378,6 +1274,26 @@ export class CodexRunner {
     }
     setSendPrompt(fn) { this.sendPromptFn = fn; }
     setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    async steerAsyncQuestionAnswer(sessionId, answer) {
+        const active = this.activeTurns.get(sessionId);
+        if (!active)
+            return 'inactive';
+        if (active.threadId !== answer.providerThreadId)
+            throw new Error('Async question backend has changed');
+        const client = this.getAppServerClientForThread(active.threadId);
+        try {
+            await client.turnSteer(active.threadId, active.turnId, [{
+                    type: 'text', text: formatAsyncQuestionAnswer(answer), text_elements: [],
+                }]);
+        }
+        catch (error) {
+            if (error.code === 'CODEX_NO_ACTIVE_TURN')
+                return 'inactive';
+            // Transport failures are ambiguous: never risk submitting the same answer twice.
+            throw error;
+        }
+        return 'accepted';
+    }
     injectUserMessage(sessionId, text) {
         // Bind queued reminders to the turn that generated them. A completed
         // turn may be replaced before the serialized steer reaches app-server;
@@ -1714,9 +1630,11 @@ export class CodexRunner {
         const knownThreadId = topicBinding
             ? this.cachedThreadForTopic(sessionId, topicAgentSessionId)
             : initialAgentSessionId || this.activeSessions.get(sessionId);
-        const operationKey = this.threadOperationKey(knownThreadId, sessionId);
+        const operationKey = this.threadOperationKey(modelOverride?.recovery?.agentSessionId || knownThreadId, sessionId);
+        await this.assertInterruptSettled(sessionId, modelOverride?.recovery?.agentSessionId || knownThreadId);
         const release = await this.acquireThreadOperation(operationKey, 'thread/resume+turn/start');
         try {
+            await this.assertInterruptSettled(sessionId, modelOverride?.recovery?.agentSessionId || knownThreadId);
             const stream = await this.runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv);
             this.activeOperationReleases.set(sessionId, release);
             return this.holdThreadOperation(stream, sessionId, release);
@@ -1746,6 +1664,14 @@ export class CodexRunner {
                 logger.debug(`[CodexRunner] persisted main backend lookup failed; using local cache: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
             }
         }
+        const recoverySessionId = modelOverride?.recovery?.agentSessionId;
+        if (modelOverride?.recovery && (!recoverySessionId || agentSessionId !== recoverySessionId)) {
+            throw new Error('Task recovery requires the original Codex thread binding');
+        }
+        if (modelOverride?.asyncQuestionAnswer && agentSessionId !== modelOverride.asyncQuestionAnswer.providerThreadId) {
+            throw new Error('Async question reply requires its original Codex backend');
+        }
+        await this.assertInterruptSettled(sessionId, agentSessionId);
         let resumingThread = !!agentSessionId;
         const callModel = stripContextWindowSuffix(modelOverride?.model || this.model);
         const callEffort = modelOverride?.effortMode === 'model_default'
@@ -1766,6 +1692,10 @@ export class CodexRunner {
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
+        const userInputConfig = { features: {
+                default_mode_request_user_input: modelOverride?.enableRequestUserInput
+                    ?? this.resolvedConfig.enableRequestUserInput ?? true,
+            } };
         const externalToolConfig = callMode === 'fullaccess'
             ? {}
             : await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, callMode);
@@ -1773,25 +1703,21 @@ export class CodexRunner {
             await this.assertProactiveHookAvailability(sessionId, appServer);
         const managedTempInstruction = this.managedTempInstruction(sessionId);
         const developerInstructions = [systemPromptAppend, managedTempInstruction].filter(Boolean).join('\n\n') || undefined;
-        let knownDelegationCarrier = agentSessionId
-            ? this.threadDelegationCarriers.get(agentSessionId)
+        let threadSessionToken = agentSessionId
+            ? this.ensureThreadCredential(agentSessionId)
+            : this.createThreadCredential();
+        if (!threadSessionToken)
+            throw new Error('Codex thread session credential is unavailable');
+        const persistentRuntimeEnv = runtimeEnv
+            ? Object.fromEntries(Object.entries(runtimeEnv).filter(([name]) => callMode === 'fullaccess' || name.toUpperCase() !== AGENT_DELEGATION_TOKEN_ENV))
             : undefined;
-        if (agentSessionId && !knownDelegationCarrier) {
-            knownDelegationCarrier = await this.loadPersistedDelegationCarrier(sessionManager, sessionId, agentSessionId);
-        }
-        let delegationCarrierCandidate = knownDelegationCarrier ?? this.createDelegationCarrier();
-        // Keep newly discovered carrier state local until generation-aware
-        // activation accepts the backend. A stale run must not publish a carrier
-        // that a later generation could mistake for its own thread.
-        let carrierToPublish;
-        const hasTaskDelegation = typeof runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] === 'string';
         let threadOptions = {
             model: callModel,
             effort: callEffort,
             approvalPolicy: effectiveApprovalPolicy,
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined, agentSessionId), this.buildLifecycleLockdownConfig(callMode)), callMode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, persistentRuntimeEnv ? { shell_environment_policy: { set: persistentRuntimeEnv } } : undefined, capabilityConfig, userInputConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, threadSessionToken, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined), this.buildLifecycleLockdownConfig(callMode)), callMode, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined),
             ...(developerInstructions ? { developerInstructions } : {}),
         };
         logger.info(`[CodexRunner] runQuery permMode=${requestedPermissionMode}->${callMode} ` +
@@ -1817,12 +1743,12 @@ export class CodexRunner {
                     // A legacy main session can retain a provider ID after its rollout was
                     // removed externally. It is safe to recover before input submission;
                     // topic bindings remain authoritative and fail closed.
-                    if (topicBinding || !isCodexNoRolloutError(error))
+                    if (topicBinding || recoverySessionId || modelOverride?.asyncQuestionAnswer || !isCodexNoRolloutError(error))
                         throw error;
                     if (typeof sessionManager?.clearMainSessionBackendIfMatches !== 'function')
                         throw error;
                     const missingThreadId = agentSessionId;
-                    const cleared = await sessionManager.clearMainSessionBackendIfMatches(sessionId, missingThreadId, [CODEX_DELEGATION_CARRIER_METADATA_KEY]);
+                    const cleared = await sessionManager.clearMainSessionBackendIfMatches(sessionId, missingThreadId);
                     if (cleared !== 'cleared' && cleared !== 'already_clear') {
                         const recoveryError = new Error(`Codex missing-rollout recovery rejected: ${cleared}`);
                         recoveryError.code = 'CODEX_MISSING_ROLLOUT_RECOVERY_REJECTED';
@@ -1831,17 +1757,15 @@ export class CodexRunner {
                     if (this.activeSessions.get(sessionId) === missingThreadId)
                         this.activeSessions.delete(sessionId);
                     this.threadProjectPaths.delete(missingThreadId);
-                    this.threadDelegationCarriers.delete(missingThreadId);
                     this.unbindExternalToolBoundary(missingThreadId);
                     this.clearTrackedApprovalItemsForThread(missingThreadId);
                     this.dropThreadCredential(missingThreadId);
                     agentSessionId = undefined;
                     resumingThread = false;
-                    knownDelegationCarrier = undefined;
-                    delegationCarrierCandidate = this.createDelegationCarrier();
+                    threadSessionToken = this.createThreadCredential();
                     threadOptions = {
                         ...threadOptions,
-                        config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, runtimeEnv ? { shell_environment_policy: { set: runtimeEnv } } : undefined, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrierCandidate, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined), this.buildLifecycleLockdownConfig(callMode)), callMode),
+                        config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, persistentRuntimeEnv ? { shell_environment_policy: { set: persistentRuntimeEnv } } : undefined, capabilityConfig, userInputConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionId, threadSessionToken, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined), this.buildLifecycleLockdownConfig(callMode)), callMode, callMode === 'fullaccess' ? runtimeEnv?.[AGENT_DELEGATION_TOKEN_ENV] : undefined),
                     };
                     logger.warn(`[CodexRunner] recovered missing rollout before input submission: session=${sessionId} thread=${missingThreadId}`);
                     threadResponse = await appServer.threadStart(projectPath, threadOptions);
@@ -1854,43 +1778,12 @@ export class CodexRunner {
         let threadId = threadResponse.thread?.id || agentSessionId;
         if (!threadId)
             throw new Error('Codex app-server did not return a thread id');
-        this.markThreadSubscribed(appServer, threadId);
-        if (!resumingThread) {
-            carrierToPublish = { threadId, carrier: delegationCarrierCandidate };
-        }
-        else if (hasTaskDelegation && !knownDelegationCarrier) {
-            // A BOUND topic cannot silently fork to migrate carrier metadata: its
-            // active-turn activation is allowed to confirm only the authoritative
-            // backend ID, so a fork would deterministically conflict. threadResume
-            // already received the candidate in this turn's environment config;
-            // publish it for the same thread after binding confirmation instead.
-            let recoveredCarrier = topicBinding
-                ? delegationCarrierCandidate
-                : await this.readThreadDelegationCarrier(appServer, threadId);
-            if (!recoveredCarrier) {
-                const staleThreadId = threadId;
-                logger.warn(`[CodexRunner] loaded thread has no recoverable delegation carrier; forking once to preserve history: thread=${staleThreadId}`);
-                const forked = await appServer.threadFork(staleThreadId, projectPath, undefined, {
-                    model: callModel,
-                    effort: callEffort,
-                    approvalPolicy: effectiveApprovalPolicy,
-                    approvalsReviewer: 'user',
-                    ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-                    config: threadOptions.config,
-                });
-                const forkedThreadId = forked.thread?.id;
-                if (!forkedThreadId)
-                    throw new Error('Codex delegation-carrier recovery fork did not return a thread id');
-                this.markThreadSubscribed(appServer, forkedThreadId);
-                await this.releaseThreadSubscription(appServer, staleThreadId, 'carrier-recovery-fork-source');
-                await this.releaseThreadSubscription(appServer, forkedThreadId, 'carrier-recovery-fork');
-                threadId = forkedThreadId;
-                recoveredCarrier = delegationCarrierCandidate;
-            }
-            carrierToPublish = { threadId, carrier: recoveredCarrier };
+        if (recoverySessionId && threadId !== recoverySessionId) {
+            throw new Error('Task recovery cannot replace the original Codex thread');
         }
-        else if (knownDelegationCarrier) {
-            carrierToPublish = { threadId, carrier: knownDelegationCarrier };
+        this.markThreadSubscribed(appServer, threadId);
+        if (!resumingThread && this.ensureThreadCredential(threadId, threadSessionToken) !== threadSessionToken) {
+            throw new Error('Codex thread session credential could not be bound');
         }
         const turn = modelOverride?.turn;
         if (!resumingThread) {
@@ -1898,9 +1791,6 @@ export class CodexRunner {
             // has been accepted. In particular, a pending interrupt must not leave
             // a durable ID for a thread that never produced a rollout.
             this.provisionalSessions.set(sessionId, threadId);
-            if (carrierToPublish) {
-                this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
-            }
         }
         else {
             agentSessionId = threadId;
@@ -1920,10 +1810,6 @@ export class CodexRunner {
                 throw error;
             }
             this.activeSessions.set(sessionId, threadId);
-            if (carrierToPublish) {
-                this.threadDelegationCarriers.set(carrierToPublish.threadId, carrierToPublish.carrier);
-                await this.persistDelegationCarrier(sessionManager, sessionId, carrierToPublish.threadId, carrierToPublish.carrier);
-            }
             this.bindThreadOperationKeys(`session:${sessionId}`, `thread:${threadId}`);
         }
         this.threadProjectPaths.set(threadId, path.resolve(projectPath));
@@ -1931,7 +1817,11 @@ export class CodexRunner {
         const controller = new AbortController();
         this.activeAbortControllers.set(sessionId, controller);
         const tempFiles = [];
-        const input = this.buildAppServerInput(prompt, images, tempFiles, sessionId, runtimeEnv);
+        const answer = modelOverride?.asyncQuestionAnswer;
+        if (answer && answer.providerThreadId !== threadId) {
+            throw new Error('Async question reply cannot resume a different Codex thread');
+        }
+        const input = this.buildAppServerInput(answer ? formatAsyncQuestionAnswer(answer) : prompt, images, tempFiles, sessionId, runtimeEnv);
         const queue = new AsyncEventQueue();
         controller.signal.addEventListener('abort', () => queue.end(), { once: true });
         const state = {
@@ -2045,7 +1935,7 @@ export class CodexRunner {
                         if (!persisted)
                             return false;
                         try {
-                            const committed = await this.commitProvisionalThread(sessionId, threadId, carrierToPublish, sessionManager, turn);
+                            const committed = await this.commitProvisionalThread(sessionId, threadId, turn);
                             if (!committed) {
                                 const staleError = new Error('Codex provisional thread was superseded before persistence confirmation');
                                 staleError.code = 'RUNNER_START_SUPERSEDED';
@@ -2156,16 +2046,65 @@ export class CodexRunner {
         }
     }
     async interruptAppServerTurn(threadId, turnId) {
+        const sessionId = this.findSessionKeyByThread(threadId);
+        const subscribed = this.threadSubscriptions.get(threadId);
+        const client = subscribed
+            ? subscribed.client
+            : this.getAppServerClient(sessionId ? this.chatModes.get(sessionId) === 'fullaccess' : false);
+        const key = JSON.stringify([threadId, turnId]);
+        const previous = this.unconfirmedInterrupts.get(key);
+        previous?.unsubscribe?.();
+        const record = { sessionId, threadId, turnId, client };
+        this.unconfirmedInterrupts.set(key, record);
+        let confirm;
+        const confirmed = new Promise(resolve => { confirm = resolve; });
+        const clear = () => {
+            if (this.unconfirmedInterrupts.get(key) === record)
+                this.unconfirmedInterrupts.delete(key);
+            record.unsubscribe?.();
+            confirm();
+        };
+        record.unsubscribe = client.onNotification?.(notification => {
+            const params = notification.params ?? {};
+            if ((params.threadId ?? params.thread_id) !== threadId)
+                return;
+            if (notification.method === 'thread/closed'
+                || (notification.method === 'turn/completed'
+                    && (params.turn?.id ?? params.turnId ?? params.turn_id) === turnId))
+                clear();
+        });
         try {
-            const sessionId = this.findSessionKeyByThread(threadId);
-            const subscribed = this.threadSubscriptions.get(threadId);
-            const client = subscribed
-                ? subscribed.client
-                : this.getAppServerClient(sessionId ? this.chatModes.get(sessionId) === 'fullaccess' : false);
-            await client.turnInterrupt(threadId, turnId);
+            await withInterruptDeadline(Promise.race([
+                client.turnInterrupt(threadId, turnId).then(accepted => {
+                    if (!accepted)
+                        throw new Error('Codex interrupt was not accepted');
+                }),
+                confirmed,
+            ]), 'Codex turn/interrupt', CODEX_INTERRUPT_TIMEOUT_MS);
         }
         catch (error) {
-            logger.debug(`[CodexRunner] app-server turn interrupt failed: ${error}`);
+            logger.warn(`[CodexRunner] Unconfirmed interrupt: thread=${threadId} turn=${turnId} error=${String(error)}`);
+        }
+    }
+    async assertInterruptSettled(sessionId, threadId) {
+        const pending = [...this.unconfirmedInterrupts.entries()].filter(([, record]) => record.sessionId === sessionId || (threadId && record.threadId === threadId));
+        await Promise.all(pending.map(async ([key, record]) => {
+            try {
+                // Local stream closure and unsubscribe do not prove the backend turn
+                // stopped. Check its exact identity before allowing another writer.
+                const response = await withInterruptDeadline(record.client.threadRead(record.threadId, true, 2_000), 'Codex interrupt verification', 2_000);
+                const turn = response.thread?.turns?.find(turn => turn.id === record.turnId);
+                if (turn && ['completed', 'failed', 'interrupted'].includes(String(turn.status))
+                    && !response.thread?.turns?.some(turn => turn.status === 'inProgress')
+                    && this.unconfirmedInterrupts.get(key) === record) {
+                    this.unconfirmedInterrupts.delete(key);
+                    record.unsubscribe?.();
+                }
+            }
+            catch { /* Ambiguous execution remains fenced; report it below. */ }
+        }));
+        if ([...this.unconfirmedInterrupts.values()].some(record => record.sessionId === sessionId || (threadId && record.threadId === threadId))) {
+            throw unsettledInterruptError('Codex');
         }
     }
     // ── Session commands ──
@@ -2177,7 +2116,6 @@ export class CodexRunner {
                 return;
             if (previousThreadId && previousThreadId !== agentSessionId) {
                 this.threadProjectPaths.delete(previousThreadId);
-                this.threadDelegationCarriers.delete(previousThreadId);
                 this.unbindExternalToolBoundary(previousThreadId);
                 this.clearTrackedApprovalItemsForThread(previousThreadId);
             }
@@ -2261,10 +2199,8 @@ export class CodexRunner {
             if (this.activeSessions.get(sessionId) === capturedThreadId)
                 this.activeSessions.delete(sessionId);
             this.chatModes.delete(sessionId);
-            this.cleanupSessionTempDir(sessionId);
             if (capturedThreadId) {
                 this.threadProjectPaths.delete(capturedThreadId);
-                this.threadDelegationCarriers.delete(capturedThreadId);
                 this.unbindExternalToolBoundary(capturedThreadId);
             }
             this.clearTrackedApprovalItemsForThread(capturedThreadId);
@@ -2304,9 +2240,7 @@ export class CodexRunner {
         this.activeTurns.delete(sessionId);
         this.steeringTails.delete(sessionId);
         this.chatModes.delete(sessionId);
-        this.cleanupSessionTempDir(sessionId);
         this.threadProjectPaths.delete(threadId);
-        this.threadDelegationCarriers.delete(threadId);
         this.unbindExternalToolBoundary(threadId);
         this.clearTrackedApprovalItemsForThread(threadId);
         this.pruneThreadOperationLocks();
@@ -2347,19 +2281,19 @@ export class CodexRunner {
                     : await this.resolveExternalToolApprovalConfig(appServer, _projectPath, capabilityConfig, compactMode);
                 if (compactMode !== 'fullaccess')
                     await this.assertProactiveHookAvailability(_sessionId, appServer);
-                const compactDelegationCarrier = this.threadDelegationCarriers.get(agentSessionId)
-                    ?? this.createDelegationCarrier();
+                const compactSessionToken = this.ensureThreadCredential(agentSessionId);
+                if (!compactSessionToken)
+                    throw new Error('Codex thread session credential is unavailable');
                 await appServer.threadResume(agentSessionId, _projectPath, {
                     model: compactModel,
                     effort: compactEffort,
                     approvalPolicy: compactPolicy,
                     approvalsReviewer: 'user',
                     ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactDelegationCarrier, undefined, agentSessionId), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
+                    config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(_sessionId, compactSessionToken), this.buildLifecycleLockdownConfig(compactMode)), compactMode),
                 });
                 this.markThreadSubscribed(appServer, agentSessionId);
                 this.threadProjectPaths.set(agentSessionId, path.resolve(_projectPath));
-                this.threadDelegationCarriers.set(agentSessionId, compactDelegationCarrier);
                 this.bindExternalToolBoundary(agentSessionId, externalToolConfig);
                 await this.startAndWaitForCompact(appServer, agentSessionId);
                 return finish({ ok: true, durationMs: Date.now() - startedAt });
@@ -2520,23 +2454,32 @@ export class CodexRunner {
         const dir = this.threadCredentialsDir();
         return dir ? path.join(dir, `${encodeURIComponent(threadId)}.json`) : undefined;
     }
+    createThreadCredential() {
+        return randomBytes(32).toString('hex');
+    }
     /** Issue or re-read this agent's credential for a thread. */
-    ensureThreadCredential(threadId) {
+    ensureThreadCredential(threadId, candidate) {
         const cached = this.threadCredentials.get(threadId);
         if (cached)
-            return cached;
+            return !candidate || cached === candidate ? cached : undefined;
         const file = this.threadCredentialPath(threadId);
-        if (!file)
-            return undefined;
+        // Low-level runner callers may not have an agent binding (for example a
+        // standalone integration test). Keep those calls functional in memory;
+        // daemon-owned runners always have an AID and persist the credential.
+        if (!file) {
+            const token = candidate ?? this.createThreadCredential();
+            this.threadCredentials.set(threadId, token);
+            return token;
+        }
         try {
             const record = JSON.parse(fs.readFileSync(file, 'utf8'));
             if (record && typeof record.token === 'string' && record.token && record.threadId === threadId) {
                 this.threadCredentials.set(threadId, record.token);
-                return record.token;
+                return !candidate || record.token === candidate ? record.token : undefined;
             }
         }
         catch { /* missing or unreadable: fall through to issuance */ }
-        const token = randomBytes(32).toString('hex');
+        const token = candidate ?? this.createThreadCredential();
         const record = {
             token,
             threadId,
@@ -2598,70 +2541,128 @@ export class CodexRunner {
         }
         catch { /* best effort */ }
     }
-    async forkSession(agentSessionId, projectPath, title) {
+    async forkSession(agentSessionId, projectPath, title, context) {
         const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'fork');
         try {
-            return await this.forkSessionLocked(agentSessionId, projectPath, title);
+            return await this.forkSessionLocked(agentSessionId, projectPath, title, undefined, context);
         }
         finally {
             release();
         }
     }
-    async forkSessionLocked(agentSessionId, projectPath, title) {
-        const sessionKey = this.findSessionKeyByThread(agentSessionId);
-        const mode = this.chatModes.get(sessionKey) ?? this.currentMode;
-        const executionSandbox = this.buildExecutionSandboxOptions(sessionKey, mode, projectPath);
+    async forkSessionLocked(agentSessionId, projectPath, title, lastTurnId, context) {
+        // Historical threads may have no live runner binding after idle cleanup or
+        // restart. Cached turn permissions can also outlive a role change. Derive
+        // this management operation solely from its current authenticated request;
+        // callers without that context remain readonly, including old fullaccess
+        // threads. Do not mutate shared turn/session permission maps while forking.
+        const sessionKey = context?.sessionId ?? this.findSessionKeyByThread(agentSessionId);
+        const mode = normalizePermissionMode(context?.permissionMode).mode;
+        const executionSandbox = this.buildExecutionSandboxOptions(sessionKey, mode, projectPath, undefined, undefined, context ?? {});
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
-        const appServer = this.threadSubscriptions.get(agentSessionId)?.client
-            ?? this.getAppServerClient(mode === 'fullaccess');
+        const appServer = this.getAppServerClient();
         const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, mode);
         if (sessionKey)
             await this.assertProactiveHookAvailability(sessionKey, appServer);
-        const delegationCarrier = this.createDelegationCarrier();
+        const forkSessionToken = this.createThreadCredential();
         const response = await appServer.threadFork(agentSessionId, projectPath, title, {
             model: this.model,
             effort: this.effort,
             approvalPolicy: this.toApprovalPolicy(mode),
             approvalsReviewer: 'user',
             ...(executionSandbox.sandbox ? { sandbox: executionSandbox.sandbox } : {}),
-            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, delegationCarrier), this.buildLifecycleLockdownConfig(mode)), mode),
+            config: this.sanitizeThreadEnvironmentConfig(this.mergeThreadConfig(executionSandbox.permissionProfileConfig, capabilityConfig, externalToolConfig, this.buildEvolcoreShellEnvironmentConfig(sessionKey, forkSessionToken), this.buildLifecycleLockdownConfig(mode)), mode),
+            ...(lastTurnId ? { lastTurnId } : {}),
         });
         const forkedThreadId = response.thread?.id;
         if (!forkedThreadId)
             throw new Error('Codex fork did not return a thread id');
+        if (this.ensureThreadCredential(forkedThreadId, forkSessionToken) !== forkSessionToken) {
+            throw new Error('Codex fork session credential could not be bound');
+        }
         this.markThreadSubscribed(appServer, forkedThreadId);
-        this.threadDelegationCarriers.set(forkedThreadId, delegationCarrier);
         this.threadProjectPaths.set(forkedThreadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(forkedThreadId, externalToolConfig);
         await this.releaseThreadSubscription(appServer, forkedThreadId, 'fork-finished');
         return forkedThreadId;
     }
-    async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title) {
+    async forkSessionAt(agentSessionId, projectPath, assistantMessageId, title, context) {
         const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'forkAt');
         try {
-            const turns = buildSessionTurnList(await this.getSessionMessages(agentSessionId, projectPath));
+            const appServer = this.getAppServerClient();
+            const history = await this.readForkHistory(appServer, agentSessionId);
+            const messages = this.mapThreadToSessionMessages(history, agentSessionId);
+            const turns = buildSessionTurnList(messages);
             const targetIndex = turns.findIndex(turn => turn.assistantUuid === assistantMessageId);
             if (targetIndex < 0)
                 throw new Error('fork point not found');
-            const forkedThreadId = await this.forkSessionLocked(agentSessionId, projectPath, title);
-            const turnsToDiscard = turns.length - targetIndex - 1;
-            if (turnsToDiscard > 0) {
-                const rollbackRelease = await this.acquireThreadOperation(this.threadOperationKey(forkedThreadId), 'rollback');
-                try {
-                    const rolledBack = await this.rollbackSessionTurnsLocked(forkedThreadId, turnsToDiscard);
-                    if (!rolledBack)
-                        throw new Error('forked thread rollback failed');
-                }
-                finally {
-                    rollbackRelease();
-                }
-            }
-            return forkedThreadId;
+            const targetTurnId = this.findTurnIdForAssistantMessage(history, assistantMessageId);
+            if (!targetTurnId)
+                throw new Error('fork point turn not found');
+            return await this.forkSessionLocked(agentSessionId, projectPath, title, targetTurnId, context);
         }
         finally {
             release();
         }
     }
+    findTurnIdForAssistantMessage(response, assistantMessageId) {
+        for (const turn of response.thread?.turns ?? []) {
+            if (typeof turn.id !== 'string' || !turn.id)
+                continue;
+            for (const item of this.getTurnItems(turn)) {
+                if (item.type === 'agentMessage' && item.id === assistantMessageId)
+                    return turn.id;
+            }
+            // Older app-server histories may omit item ids; the mapper then uses the
+            // turn id as the assistant message id fallback.
+            if (turn.id === assistantMessageId)
+                return turn.id;
+        }
+        return undefined;
+    }
+    async readForkHistory(appServer, threadId) {
+        let directRead;
+        let directReadError;
+        try {
+            directRead = await appServer.threadRead(threadId, true);
+            if ((directRead.thread?.turns?.length ?? 0) > 0)
+                return directRead;
+        }
+        catch (error) {
+            directReadError = error;
+        }
+        // Paginated threads reject full-history thread/read. Hydrate turns through
+        // the experimental paging RPC, retaining full items so assistant message
+        // IDs can be mapped to their containing turn.
+        const turns = [];
+        let cursor;
+        const seenCursors = new Set();
+        try {
+            do {
+                const page = await appServer.threadTurnsList(threadId, 100, cursor);
+                if (Array.isArray(page.data)) {
+                    turns.push(...page.data.filter((turn) => !!turn && typeof turn === 'object'));
+                }
+                const nextCursor = typeof page.nextCursor === 'string' && page.nextCursor ? page.nextCursor : undefined;
+                if (!nextCursor || seenCursors.has(nextCursor))
+                    break;
+                seenCursors.add(nextCursor);
+                cursor = nextCursor;
+            } while (true);
+        }
+        catch (error) {
+            if (directReadError)
+                throw directReadError;
+            throw error;
+        }
+        // Pages are returned newest-first when following `nextCursor`; restore
+        // chronological order before mapping turns to session messages.
+        if (turns.length > 0)
+            return { thread: { ...(directRead?.thread ?? {}), id: threadId, turns: turns.reverse() } };
+        if (directRead)
+            return directRead;
+        throw directReadError instanceof Error ? directReadError : new Error('Codex thread history unavailable');
+    }
     async setSessionName(agentSessionId, name) {
         return this.getAppServerClientForThread(agentSessionId).threadSetName(agentSessionId, name);
     }
@@ -2670,7 +2671,7 @@ export class CodexRunner {
         return this.getAppServerClientForThread(agentSessionId).threadMetadataUpdate(agentSessionId, gitInfo);
     }
     async getSessionMessages(agentSessionId, projectPath) {
-        const response = await this.getAppServerClientForThread(agentSessionId).threadRead(agentSessionId, true);
+        const response = await this.readForkHistory(this.getAppServerClientForThread(agentSessionId), agentSessionId);
         return this.mapThreadToSessionMessages(response, agentSessionId);
     }
     approvalItemKey(threadId, turnId, itemId) {
@@ -3010,9 +3011,9 @@ export class CodexRunner {
         const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
             || request.method === 'execCommandApproval';
         const managedEcIntent = isCommandApproval && this.isManagedEvolcoreCommandIntent(toolInput);
-        const delegationCarrier = this.delegationCarrierForSession(sessionKey, typeof params.threadId === 'string' ? params.threadId : undefined);
+        const sessionCredential = this.sessionTokenForSession(sessionKey, typeof params.threadId === 'string' ? params.threadId : undefined);
         const canonicalEcApproval = isCommandApproval
-            ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey), delegationCarrier)
+            ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey), sessionCredential)
             : undefined;
         const approvedCommand = canonicalEcApproval?.argv;
         const denyInfrastructure = async (policyCode, message) => {
@@ -3062,23 +3063,23 @@ export class CodexRunner {
             const decision = typeof resolution === 'string' ? resolution : resolution.decision;
             const resolutionMeta = typeof resolution === 'string' ? undefined : resolution;
             if (decision !== 'deny' && managedEcIntent && approvedCommand) {
-                const carrierThreadIds = [
+                const credentialThreadIds = [
                     this.activeSessions.get(sessionKey),
                     this.provisionalSessions.get(sessionKey),
                     typeof params.threadId === 'string' ? params.threadId : undefined,
                     typeof params.conversationId === 'string' ? params.conversationId : undefined,
                 ];
-                const hasDelegationCarrier = carrierThreadIds.some(threadId => !!threadId && this.threadDelegationCarriers.has(threadId));
+                const hasSessionCredential = credentialThreadIds.some(threadId => !!threadId && !!this.ensureThreadCredentialLoaded(threadId));
                 const canArmDelegation = typeof permissionContext?.armApprovedDelegationCommand === 'function';
-                // A carrier-bearing thread is managed even if its permission context
+                // A credentialed thread is managed even if its permission context
                 // was not wired with an arm callback; it must fail closed here rather
-                // than reaching daemon IPC with an unarmed carrier.
-                if ((hasDelegationCarrier || canArmDelegation)
-                    && canonicalEcApproval?.delegationToken
-                    && canonicalEcApproval.delegationToken !== delegationCarrier) {
-                    return await denyInfrastructure('delegation_token_mismatch', 'EC command approval contains a delegation token different from the active thread carrier');
+                // than reaching daemon IPC with an unarmed session credential.
+                if ((hasSessionCredential || canArmDelegation)
+                    && canonicalEcApproval?.credentialToken
+                    && canonicalEcApproval.credentialToken !== sessionCredential) {
+                    return await denyInfrastructure('delegation_token_mismatch', 'EC command approval contains a delegation token different from the active thread credential');
                 }
-                if ((hasDelegationCarrier || canArmDelegation)
+                if ((hasSessionCredential || canArmDelegation)
                     && !this.armApprovedDelegationCommand(sessionKey, approvedCommand)) {
                     return await denyInfrastructure('delegation_not_armed', 'EC command approval failed to arm delegation');
                 }
@@ -3733,14 +3734,7 @@ export class CodexRunner {
         if (paths.length === 0)
             return true;
         const workspace = resolveProtectedCandidate(projectPath);
-        const managedTempDir = this.sessionTempDirs.get(sessionKey);
-        const trustedTempDir = managedTempDir ? this.isTrustedSessionTempDir(managedTempDir) : false;
-        if (managedTempDir && !trustedTempDir) {
-            logger.warn(`[CodexRunner] managed TMPDIR lost its trusted ownership or mode: session=${sessionKey} path=${managedTempDir}`);
-        }
-        const canonicalTempDir = managedTempDir && trustedTempDir
-            ? resolveProtectedCandidate(managedTempDir)
-            : undefined;
+        const canonicalTempDir = this.getManagedTempDir(sessionKey);
         return paths.some(candidate => {
             const absolute = path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(workspace, candidate);
             const canonical = resolveProtectedCandidate(absolute);
@@ -3835,7 +3829,7 @@ export class CodexRunner {
             // distinguishes this explicit empty value from runners without a
             // session-temp capability.
             managedTempDir: permissionContext?.managedTempDir ?? this.getManagedTempDir(sessionKey) ?? '',
-            delegationCarrier: this.delegationCarrierForSession(sessionKey),
+            sessionCredential: this.sessionTokenForSession(sessionKey),
             allowProtectedMetadata: false,
             selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
@@ -4192,17 +4186,17 @@ export class CodexRunner {
             return;
         this.childThreadSessions.set(childThreadId, sessionId);
         this.threadProjectPaths.set(childThreadId, path.resolve(projectPath));
-        // Child approvals use the parent's capability boundary and delegation
-        // carrier. This is inheritance, not a second permission decision.
+        // Child approvals use the parent's capability boundary and session
+        // credential. This is inheritance, not a second permission decision.
         const parentBoundary = parentThreadId ? this.threadExternalToolBoundaries.get(parentThreadId) : undefined;
         const parentFingerprint = parentThreadId ? this.threadExternalToolFingerprints.get(parentThreadId) : undefined;
         if (parentBoundary)
             this.threadExternalToolBoundaries.set(childThreadId, parentBoundary);
         if (parentFingerprint)
             this.threadExternalToolFingerprints.set(childThreadId, parentFingerprint);
-        const parentCarrier = parentThreadId ? this.threadDelegationCarriers.get(parentThreadId) : undefined;
-        if (parentCarrier)
-            this.threadDelegationCarriers.set(childThreadId, parentCarrier);
+        const parentToken = parentThreadId ? this.ensureThreadCredentialLoaded(parentThreadId) : undefined;
+        if (parentToken)
+            this.ensureThreadCredential(childThreadId, parentToken);
     }
     unregisterChildThread(childThreadId) {
         this.childThreadSessions.delete(childThreadId);
@@ -4210,8 +4204,8 @@ export class CodexRunner {
         this.threadProjectPaths.delete(childThreadId);
         this.threadExternalToolBoundaries.delete(childThreadId);
         this.threadExternalToolFingerprints.delete(childThreadId);
-        this.threadDelegationCarriers.delete(childThreadId);
         this.clearTrackedApprovalItemsForThread(childThreadId);
+        this.dropThreadCredential(childThreadId);
     }
     cleanupChildThreadsForSession(sessionId) {
         for (const [childThreadId, ownerSessionId] of this.childThreadSessions) {
@@ -4351,10 +4345,14 @@ export class CodexRunner {
             }
             case 'item/agentMessage/delta': {
                 const itemId = typeof params.itemId === 'string' ? params.itemId : undefined;
-                if (itemId)
-                    state.streamedAgentMessageIds.add(itemId);
-                if (itemId && typeof params.delta === 'string' && params.delta) {
-                    state.agentMessageDeltaText.set(itemId, (state.agentMessageDeltaText.get(itemId) || '') + params.delta);
+                const delta = typeof params.delta === 'string' ? params.delta : '';
+                if (itemId && delta) {
+                    if (!state.streamedAgentMessageIds.has(itemId)) {
+                        state.streamedAgentMessageIds.add(itemId);
+                        yield { type: 'text_start', contentIndex: 0 };
+                    }
+                    state.agentMessageDeltaText.set(itemId, (state.agentMessageDeltaText.get(itemId) || '') + delta);
+                    yield { type: 'heartbeat', source: 'text' };
                 }
                 break;
             }
@@ -4415,24 +4413,46 @@ export class CodexRunner {
                 this.clearPendingToolDenialsForTurn(state.threadId, turnId);
                 yield* this.reconcileOpenAppServerToolCalls(state, turnId);
                 if (turn.status === 'failed' && turn.error?.message) {
+                    logger.warn(`[CodexRunner] turn failed: ${JSON.stringify({
+                        sessionId, threadId: state.threadId, turnId, model: state.model,
+                        errorType: classifyError(new Error(turn.error.message)),
+                        message: formatApprovalLogSummary(turn.error.message),
+                        lastReportedUsage: state.tokenUsage?.last,
+                    })}`);
                     if (isRetryableError(new Error(turn.error.message))) {
                         throw new Error(turn.error.message);
                     }
-                    yield { type: 'error', error: turn.error.message, errorType: 'unknown' };
+                    yield { type: 'error', error: turn.error.message, errorType: toAgentErrorType(turn.error.message) };
                 }
                 yield this.mapAppServerTurnComplete(turn, state);
                 break;
             }
             case 'error': {
-                if (!params.message) {
-                    // SSE idle timeout reconnect — not a real task error, suppress
-                    logger.debug(`[CodexRunner] app-server SSE reconnect (no message)`);
+                // Current app-server uses error.message; older builds used message.
+                const message = typeof params.error?.message === 'string' ? params.error.message : params.message;
+                if (typeof message !== 'string' || !message.trim()) {
+                    logger.debug('[CodexRunner] app-server error notification without a diagnostic message');
                     break;
                 }
-                if (isRetryableError(new Error(params.message))) {
-                    throw new Error(params.message);
+                logger.warn(`[CodexRunner] error notification: ${JSON.stringify({
+                    sessionId, threadId: state.threadId, turnId: state.turnId, model: state.model,
+                    willRetry: params.willRetry ?? null,
+                    errorType: classifyError(new Error(message)), message: formatApprovalLogSummary(message),
+                })}`);
+                // Codex owns retries within this turn. Throwing here closes our subscription
+                // before its recovery can finish; runQuery must not submit the input again.
+                if (params.willRetry === true) {
+                    yield {
+                        type: 'notice', severity: 'warn', subtype: 'codex-model-retry',
+                        message: isOutputTokenLimitError(new Error(message))
+                            ? '模型响应达到输出上限，Codex 正在当前轮内重试。'
+                            : 'Codex 正在当前轮内重试模型请求。',
+                    };
+                    break;
                 }
-                yield { type: 'error', error: params.message, errorType: 'unknown' };
+                if (isRetryableError(new Error(message)))
+                    throw new Error(message);
+                yield { type: 'error', error: message, errorType: toAgentErrorType(message) };
                 break;
             }
         }
@@ -4633,10 +4653,35 @@ export class CodexRunner {
         switch (item.type) {
             case 'agentMessage':
                 {
+                    if (item.questions != null) {
+                        if (item.id)
+                            state.agentMessageDeltaText.delete(item.id);
+                        try {
+                            const questions = parseAsyncUserQuestions(item.questions);
+                            if (!item.id || !state.turnId)
+                                throw new Error('Async question is missing its item or turn id');
+                            const key = JSON.stringify([state.threadId, state.turnId, item.id]);
+                            if (this.asyncQuestionItems.has(key))
+                                break;
+                            this.asyncQuestionItems.add(key);
+                            if (this.asyncQuestionItems.size > 2048)
+                                this.asyncQuestionItems.delete(this.asyncQuestionItems.values().next().value);
+                            yield { type: 'user_question', request: {
+                                    providerThreadId: state.threadId, providerTurnId: state.turnId, itemId: item.id, questions,
+                                } };
+                        }
+                        catch (error) {
+                            yield { type: 'notice', severity: 'warn', subtype: 'invalid_async_question',
+                                message: `Codex 异步问题无法显示：${error instanceof Error ? error.message : String(error)}` };
+                        }
+                        break;
+                    }
                     const buffered = item.id ? state.agentMessageDeltaText.get(item.id) : undefined;
                     const text = typeof item.text === 'string' && item.text ? item.text : buffered;
-                    if (text)
-                        yield { type: 'text', text };
+                    if (text) {
+                        state.lastAssistantUuid = item.id || state.turnId;
+                        yield { type: 'text', text, assistantUuid: state.lastAssistantUuid };
+                    }
                     if (item.id)
                         state.agentMessageDeltaText.delete(item.id);
                 }
@@ -4863,16 +4908,18 @@ export class CodexRunner {
     }
     mapAppServerTurnComplete(turn, state) {
         const status = turn.status || 'completed';
+        const outputLimit = status === 'failed' && isOutputTokenLimitError(new Error(turn.error?.message ?? ''));
         const tokenUsage = this.mapCodexTokenUsage(state.tokenUsage?.last ?? turn.tokenUsage ?? turn.usage);
         const contextUsage = this.mapCodexContextUsage(turn.contextUsage ?? state.tokenUsage?.contextUsage ?? state.tokenUsage?.context);
         const terminalReason = status === 'completed'
             ? undefined
             : status === 'interrupted'
                 ? 'aborted_streaming'
-                : status;
+                : outputLimit ? 'max_output_tokens' : status;
         return {
             type: 'complete',
-            subtype: status === 'completed' ? 'success' : status,
+            subtype: status === 'completed' ? 'success' : outputLimit ? 'max_output_tokens' : status,
+            assistantUuid: state.lastAssistantUuid,
             isError: status === 'failed',
             errors: turn.error?.message ? [turn.error.message] : undefined,
             terminalReason,
@@ -4886,126 +4933,36 @@ export class CodexRunner {
             contextUsage,
         };
     }
-    managedTempParent() {
-        const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
-        const base = ensureProcessManagedTempDir();
-        return path.join(resolveProtectedCandidate(base), `evolcore-codex-${uid}`);
-    }
-    ensurePrivateDirectory(directory) {
-        try {
-            fs.mkdirSync(directory, { mode: 0o700 });
-        }
-        catch (error) {
-            if (error?.code !== 'EEXIST')
-                throw error;
-        }
-        const stat = fs.lstatSync(directory);
-        if (!stat.isDirectory() || stat.isSymbolicLink()) {
-            throw new Error(`managed temp path is not a real directory: ${directory}`);
-        }
-        if (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
-            throw new Error(`managed temp path is owned by another uid: ${directory}`);
-        }
-        if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)
-            fs.chmodSync(directory, 0o700);
-    }
-    ensureSessionTempDir(sessionId) {
-        const existing = this.sessionTempDirs.get(sessionId);
-        if (existing) {
-            try {
-                this.ensurePrivateDirectory(this.managedTempParent());
-                this.ensurePrivateDirectory(existing);
-                return existing;
-            }
-            catch (error) {
-                this.sessionTempDirs.delete(sessionId);
-                logger.warn(`[CodexRunner] existing managed TMPDIR is no longer usable: session=${sessionId} path=${existing} error=${error instanceof Error ? error.message : String(error)}`);
-                return undefined;
-            }
-        }
-        try {
-            const parent = this.managedTempParent();
-            this.ensurePrivateDirectory(parent);
-            this.ensurePrivateDirectory(path.join(parent, 'evolcore-locks'));
-            // Include a per-runner nonce so a daemon restart never reuses contents
-            // left behind by an unclean shutdown for the same EvolCore session id.
-            const digest = createHash('sha256')
-                .update(this.managedTempNonce)
-                .update('\0')
-                .update(sessionId)
-                .digest('hex')
-                .slice(0, 24);
-            const directory = path.join(parent, digest);
-            this.ensurePrivateDirectory(directory);
-            this.sessionTempDirs.set(sessionId, directory);
-            registerManagedTempDirForExitCleanup(directory, parent);
-            return directory;
-        }
-        catch (error) {
-            logger.warn(`[CodexRunner] managed TMPDIR unavailable for session=${sessionId}: ${error instanceof Error ? error.message : String(error)}`);
-            return undefined;
-        }
-    }
-    isTrustedSessionTempDir(directory) {
-        return isTrustedManagedTempDirectory(directory, this.managedTempParent());
-    }
     getManagedTempDir(sessionId) {
-        const directory = this.ensureSessionTempDir(sessionId);
-        if (!directory || !this.isTrustedSessionTempDir(directory))
-            return undefined;
-        return resolveProtectedCandidate(directory);
-    }
-    cleanupSessionTempDir(sessionId) {
-        const directory = this.sessionTempDirs.get(sessionId);
-        this.sessionTempDirs.delete(sessionId);
-        if (!directory)
-            return;
-        // Reuse the same ownership, mode, lexical-parent, and canonicalization
-        // checks used at execution time. If the path changed, leave it in place
-        // rather than recursively removing an attacker-selected target.
-        if (!this.isTrustedSessionTempDir(directory)) {
-            managedTempDirsForExitCleanup.delete(directory);
-            logger.warn(`[CodexRunner] refused to clean unmanaged TMPDIR: session=${sessionId} path=${directory}`);
-            return;
-        }
-        const candidate = path.resolve(directory);
-        try {
-            fs.rmSync(candidate, { recursive: true, force: true });
-            managedTempDirsForExitCleanup.delete(directory);
-        }
-        catch (error) {
-            logger.warn(`[CodexRunner] failed to clean managed TMPDIR: session=${sessionId} path=${candidate} error=${error instanceof Error ? error.message : String(error)}`);
-        }
+        const directory = ensureSessionRuntimeDir(sessionId);
+        return directory ? resolveProtectedCandidate(directory) : undefined;
     }
     managedTempInstruction(sessionId) {
-        const managedTempDir = this.ensureSessionTempDir(sessionId);
+        const managedTempDir = ensureSessionRuntimeDir(sessionId);
         if (!managedTempDir)
             return undefined;
-        return `临时文件必须使用环境变量 \`$TMPDIR\`。当前值是 \`${managedTempDir}\`，它是当前 EvolCore 会话唯一允许的临时工作区；不要直接使用 \`/tmp\`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 \`/tmp/evolcore-codex-*\` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 \`$TMPDIR\` 重新创建，再继续执行后续 \`ec\` 命令。`;
+        return `临时文件必须使用环境变量 \`$TMPDIR\`。当前值是 \`${managedTempDir}\`，它是当前 EvolCore 会话唯一允许的临时工作区；不要直接使用 \`/tmp\`，也不要使用其他会话的临时目录。该目录随 EvolCore sessionId 保持稳定；若文件不存在，请先在当前 \`$TMPDIR\` 重新创建，再继续执行后续 \`ec\` 命令。`;
     }
-    buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier, taskDelegationToken, threadId) {
-        const managedTempDir = this.ensureSessionTempDir(sessionId);
+    buildEvolcoreShellEnvironmentConfig(sessionId, sessionToken, taskDelegationToken) {
+        const managedTempDir = ensureSessionRuntimeDir(sessionId);
         // The managed-hook credential rides the thread's shell environment so the
         // PreToolUse hook can prove the call belongs to an EvolCore-owned thread.
         // It follows the thread (start AND resume) rather than the daemon process.
-        const sessionToken = threadId ? this.ensureThreadCredential(threadId) : undefined;
         return {
             shell_environment_policy: {
                 set: {
                     EVOLCORE_SESSION_ID: sessionId,
                     EVOLCORE_HOME: resolveRoot(),
                     ...(managedTempDir ? { EVOLCORE_SESSION_RUNTIME_DIR: managedTempDir } : {}),
-                    ...(managedTempDir ? { EVOLCORE_RUNTIME_LOCK_DIR: path.join(path.dirname(managedTempDir), 'evolcore-locks') } : {}),
-                    ...(taskDelegationToken || delegationCarrier
-                        ? { [AGENT_DELEGATION_TOKEN_ENV]: taskDelegationToken ?? delegationCarrier }
-                        : {}),
+                    ...(managedTempDir ? { EVOLCORE_RUNTIME_LOCK_DIR: path.join(managedTempDir, 'locks') } : {}),
+                    ...(taskDelegationToken ? { [AGENT_DELEGATION_TOKEN_ENV]: taskDelegationToken } : {}),
                     ...(sessionToken ? { [CODEX_SESSION_TOKEN_ENV]: sessionToken } : {}),
                     ...(managedTempDir ? { TMPDIR: managedTempDir } : {}),
                 },
             },
         };
     }
-    sanitizeThreadEnvironmentConfig(config, permissionMode) {
+    sanitizeThreadEnvironmentConfig(config, permissionMode, taskDelegationToken) {
         if (!config)
             return null;
         const policy = this.configRecord(config.shell_environment_policy);
@@ -5015,11 +4972,40 @@ export class CodexRunner {
         const safeSet = sanitizeShellExecutionEnvironment(set, {
             lockExecutableResolution: permissionMode === 'readonly',
         });
+        const sessionToken = typeof safeSet[CODEX_SESSION_TOKEN_ENV] === 'string'
+            ? safeSet[CODEX_SESSION_TOKEN_ENV]
+            : undefined;
+        for (const name of Object.keys(safeSet)) {
+            const normalized = name.toUpperCase();
+            if (normalized === AGENT_DELEGATION_TOKEN_ENV || normalized === CODEX_SESSION_TOKEN_ENV) {
+                delete safeSet[name];
+            }
+        }
+        if (sessionToken)
+            safeSet[CODEX_SESSION_TOKEN_ENV] = sessionToken;
+        const existingExclude = Array.isArray(policy.exclude)
+            ? policy.exclude.filter((name) => typeof name === 'string')
+            : [];
+        const carriesTaskDelegation = permissionMode === 'fullaccess'
+            && !!taskDelegationToken;
+        if (carriesTaskDelegation)
+            safeSet[AGENT_DELEGATION_TOKEN_ENV] = taskDelegationToken;
+        const filteredExclude = existingExclude.filter(name => {
+            const normalized = name.toUpperCase();
+            return normalized !== AGENT_DELEGATION_TOKEN_ENV
+                && normalized !== CODEX_SESSION_TOKEN_ENV;
+        });
+        const exclude = carriesTaskDelegation
+            ? filteredExclude
+            : [...new Set([...filteredExclude, AGENT_DELEGATION_TOKEN_ENV])];
         return {
             ...config,
             shell_environment_policy: {
                 ...policy,
                 set: safeSet,
+                // The task token is invocation-scoped. Persistent non-fullaccess
+                // threads must not inherit a stale value from the app-server process.
+                exclude,
             },
         };
     }
@@ -5036,21 +5022,23 @@ export class CodexRunner {
         this.activeSessions.clear();
         this.provisionalSessions.clear();
         this.activeTurns.clear();
+        for (const childThreadId of [...this.childThreadSessions.keys()])
+            this.unregisterChildThread(childThreadId);
         this.activeSubagentTurns.clear();
         this.childThreadSessions.clear();
         this.threadProjectPaths.clear();
         this.threadExternalToolFingerprints.clear();
         this.threadExternalToolBoundaries.clear();
         this.trackedApprovalItems.clear();
-        this.threadDelegationCarriers.clear();
         this.pendingInterrupts.clear();
+        for (const record of this.unconfirmedInterrupts.values())
+            record.unsubscribe?.();
+        this.unconfirmedInterrupts.clear();
         this.steeringTails.clear();
         this.permissionContexts.clear();
         this.chatModes.clear();
         this.pruneThreadOperationLocks();
         this.threadOperationLocks.clear();
-        for (const sessionId of [...this.sessionTempDirs.keys()])
-            this.cleanupSessionTempDir(sessionId);
         await Promise.all([
             this.appServerClient?.close(),
             this.fullAccessAppServerClient?.close(),