evolcore 0.0.26 → 0.0.27

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## Unreleased
+
+## 0.0.27 (2026-09-24)
+
+- 持久化 AUN 群邀请的 Owner 审核流程，并增加 Base Agent 清单查询入口。
+- 支持 EC Agent 的角色级模型与推理强度策略；为 Claude、Codex、EC Agent runner 会话增加任务历史聚合，并在未确认中断后设置会话重用栅栏。
+- 模型类 Trigger 支持单次执行时限；目标会话失联时明确记录为孤儿执行失败。
+- 修复 AUN 撤回事件导致的私聊游标跳跃；手动停止的 Agent reload 后恢复渠道连接。
+- 规范 Shell 工具活动中的命令展示；本地缺少证书时跳过控制 AID 名片发布。
+- 收紧 Codex 分支会话的权限上下文，避免从旧会话缓存继承过期授权。
+- 移除 CodeBuddy、QwenWork 非标准 Base Agent 的运行时自动管理路径；EC Agent 默认配置恢复显式凭证要求。
+- 移除运行时命令索引中尚未实现的组织管理、任务、资源和工作流命令说明。
+- 修复 AUN 出站 payload 截断按原始字符串大小判断的问题；现在按最终 JSON/UTF-8 大小压缩嵌套日志和转义输出，避免可截断负载被误判为仍超限。
+- 升级 `@agentunion/fastaun` 至 `0.5.17`，同步运行时最低版本要求；包含 Storage / Group FS 上传 Content-Type 一致性修复，避免 OSS 预签名校验不一致导致的 403。
+- 附件 MIME 采用 SDK 字节识别及存储结果；头像与 Storage 上传、删除复用 SDK 文件系统，公开文件返回稳定 AID URL。
+- 订阅 `agentmd.changed` 失效 Core 身份缓存，按需刷新并保留失败重试，避免旧查询覆盖更新。
+- 对齐无持久序号消息的 Pull 类型，按实际返回透传 volatile 元数据，并修正 SDK 未返回 count 时的消息数量。
+- 群命令与托管群文件操作支持 `{base}.{issuer}` 群 AID；不再接受或转换 `group.{issuer}/{base}`，保留当前群权限检查。
+- 默认建群名称改为 `g-` 加五位随机数字（10000–99999），明确身份占用时最多尝试 5 次；自定义名称完整保留 `g-`，并提示实际创建身份与请求不一致的情况。
+- 群参数格式校验与主体类型提示分离；关系角色查询优先采用已存储的关系类型和已验签身份信息。
+
 ## 0.0.26 (2026-09-18)
 
 ### AUN、联系人与远程诊断
@@ -21,6 +42,10 @@
 
 ### 权限与兼容性
 
+- 修复 App 管理页读取指定群关系配置时被当前关系限制拒绝：owner/admin 可读取当前 Agent 的目标关系字段，
+  保留 admin 字段权限、普通成员和跨关系写入限制。
+- 批量配置读取为当前版本未支持的 runner 字段返回逐字段 `UNSUPPORTED_FIELD`，
+  保留有效字段并以成功状态返回兼容缺项；真实权限与执行错误仍按失败处理。
 - npm 包整体排除本机 `skills/` 目录，避免本地 skill 文件随包发布。
 - 新建 agent.md 默认使用 `agent` 类型，并按白名单归一化类型；
   对齐 SDK 的可选 description、Unicode 字数、avatar 长度及 4 KB 文档上限校验。

package/bin/codex-managed-acl.ps1

@@ -28,6 +28,48 @@ function Add-Grant($Acl, [string]$Sid, [Security.AccessControl.FileSystemRights]
   $Acl.AddAccessRule($rule)
 }
 
+function Grant-PipeAccess([string]$Target) {
+  $prefix = '\\.\pipe\'
+  if (-not $Target.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) {
+    throw 'Only a local named pipe can receive Codex sandbox access.'
+  }
+  $pipeName = $Target.Substring($prefix.Length)
+  if (-not $pipeName -or $pipeName.Contains('\') -or $pipeName.Contains('/')) {
+    throw 'Invalid local named pipe name.'
+  }
+  $accounts = @()
+  foreach ($name in @('CodexSandboxOffline', 'CodexSandboxOnline')) {
+    try {
+      $account = New-Object Security.Principal.NTAccount([Environment]::MachineName, $name)
+      $sid = $account.Translate([Security.Principal.SecurityIdentifier])
+      $accounts += @{ name = $name; sid = $sid }
+    } catch [Security.Principal.IdentityNotMappedException] {
+      # Codex creates these local users during sandbox provisioning. Do not
+      # replace a missing user with Everyone, Authenticated Users, or a group.
+    }
+  }
+  if ($accounts.Count -eq 0) { return @{ granted = @() } }
+  $pipe = New-Object System.IO.Pipes.NamedPipeClientStream('.', $pipeName,
+    [System.IO.Pipes.PipeAccessRights]'ReadWrite,ReadPermissions,ChangePermissions',
+    [System.IO.Pipes.PipeOptions]::Asynchronous,
+    [Security.Principal.TokenImpersonationLevel]::Identification,
+    [System.IO.HandleInheritability]::None)
+  try {
+    $pipe.Connect(5000)
+    $acl = $pipe.GetAccessControl()
+    $rights = [System.IO.Pipes.PipeAccessRights]'ReadWrite,Synchronize'
+    foreach ($account in $accounts) {
+      # GenericWrite/FullControl also grant CreateNewInstance on named pipes.
+      # Grant only data I/O to the actual restricted user; the sandbox group
+      # alone does not satisfy Windows restricted-token access checks.
+      $acl.AddAccessRule((New-Object System.IO.Pipes.PipeAccessRule(
+        $account.sid, $rights, [Security.AccessControl.AccessControlType]::Allow)))
+    }
+    $pipe.SetAccessControl($acl)
+    return @{ granted = @($accounts | ForEach-Object { $_.name }) }
+  } finally { $pipe.Dispose() }
+}
+
 function Initialize-AccessProbe {
   # An elevated process reading the file is not evidence that a normal process
   # can read it. Evaluate the DACL with its UAC linked token when available.
@@ -122,6 +164,7 @@ function Verify-Access($Entry) {
 try {
   $payload = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Request)) | ConvertFrom-Json
   $result = switch ($payload.action) {
+    'pipe' { Grant-PipeAccess ([string]$payload.path) }
     'preflight' {
       $principal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
       if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {

package/dist/agents/baseagent-availability.js

@@ -1,3 +1,4 @@
+import { normalizeBaseagent } from './baseagent.js';
 import { commandExists } from '../utils/cross-platform.js';
 import { getCodexAppServerAvailability } from './codex-runner.js';
 export const BASEAGENT_CANDIDATES = ['claude', 'codex', 'gemini', 'ecagent'];
@@ -46,3 +47,70 @@ export function detectBaseagentDetails(codexAvailability = getCodexAppServerAvai
         },
     ];
 }
+/** Only loaded runners can be switched to; never infer this from PATH/config. */
+export function loadedBaseagentIds(keys, owner) {
+    const result = new Set();
+    for (const key of keys) {
+        if (owner !== undefined && !key.startsWith(`${owner}::`))
+            continue;
+        const separator = key.indexOf('::');
+        result.add(separator < 0 ? key : key.slice(separator + 2));
+    }
+    return [...result];
+}
+function canonical(value) {
+    if (typeof value !== 'string')
+        return null;
+    const id = normalizeBaseagent(value).canonical;
+    return id === 'unknown' ? null : id;
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function text(value) {
+    return typeof value === 'string' && value.trim() ? value : null;
+}
+/** Safe public projection: credentials and arbitrary backend settings never leave this boundary. */
+export function buildBaseagentSnapshot(config, detections, loaded) {
+    const blocks = new Map();
+    for (const [name, value] of Object.entries(record(config.baseagents))) {
+        const id = canonical(name);
+        if (id)
+            blocks.set(id, record(value));
+    }
+    const active = canonical(config.active_baseagent);
+    const probes = new Map((detections ?? []).map(item => [String(item.id), item]));
+    const loadedIds = loaded === undefined ? null : new Set(loaded);
+    const ids = new Set([
+        ...blocks.keys(),
+        ...(detections ?? []).filter(item => item.detected).map(item => item.id),
+        ...(loaded ?? []),
+        ...(active ? [active] : []),
+    ]);
+    return {
+        active,
+        baseagents: [...ids].map(id => ({
+            id,
+            label: normalizeBaseagent(id).displayName,
+            configured: blocks.has(id),
+            detected: detections === null ? null : probes.get(id)?.detected === true,
+            loaded: loadedIds?.has(id) ?? null,
+            active: id === active,
+            model: text(blocks.get(id)?.model),
+            effort: text(blocks.get(id)?.effort ?? blocks.get(id)?.reasoning),
+            version: probes.get(id)?.version ?? null,
+        })),
+    };
+}
+/** Shared defaults/Agent inventory for menu, slash and local history readers. */
+export async function getBaseagentSnapshot(options = {}) {
+    let config = options.config;
+    if (config === undefined) {
+        const { read, ConfigTarget } = await import('../config/config-manager.js');
+        config = read(ConfigTarget.Defaults, undefined, { cache: false, expand: false }) ?? {};
+    }
+    const detections = options.probe === false
+        ? null
+        : (await import('./baseagent-availability.js')).detectBaseagentDetails();
+    return buildBaseagentSnapshot(config ?? {}, detections, options.loaded);
+}

package/dist/agents/claude-runner.js

@@ -25,14 +25,15 @@ import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
-import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, isSandboxInitializationToolResult, recordSandboxInitializationFailure, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, isSandboxInitializationToolResult, recordSandboxInitializationFailure, getSandboxInitializationFailureCounters, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldEnableClaudeWeakerNestedSandbox, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { getManagedTaskTempDir, isManagedSessionRuntimeDir } from '../cli/task-context.js';
-import { hasTrustedFullAccessContext } from './runner-types.js';
+import { unsettledInterruptError, withInterruptDeadline, hasTrustedFullAccessContext } from './runner-types.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel, sdkAutoCompactWindowForModel } from './runner-types.js';
 import { hasContextWindowSuffix, stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
 const resolveModule = createRequire(import.meta.url);
+const CLAUDE_INTERRUPT_TIMEOUT_MS = 5_000;
 /**
  * Resolve the platform package explicitly instead of relying on the SDK's
  * internal optional-dependency lookup. The latter is sensitive to the module
@@ -282,16 +283,17 @@ function buildClaudeManagedLockdownSettings(capabilityOptions) {
 }
 const CLAUDE_SANDBOX_GLOB_MAGIC = /[*?[\]]/;
 function trustedRuntimeWritePaths(runtimeEnv) {
-    const tmp = process.env.TMPDIR?.trim();
-    if (!tmp || !path.isAbsolute(tmp))
+    const sessionDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR?.trim();
+    if (!sessionDir || !isManagedSessionRuntimeDir(sessionDir))
         return [];
-    const root = resolveProtectedCandidate(tmp);
+    const root = resolveProtectedCandidate(sessionDir);
     const candidates = [runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR, runtimeEnv?.EVOLCORE_RUNTIME_LOCK_DIR]
         .filter((value) => typeof value === 'string' && path.isAbsolute(value));
     const paths = [];
     for (const candidate of candidates) {
         const resolved = resolveProtectedCandidate(candidate);
-        if (!isSameOrDescendant(resolved, root))
+        if (!isSameOrDescendant(resolved, root)
+            || (resolved !== root && !(path.dirname(resolved) === root && path.basename(resolved) === 'locks')))
             continue;
         try {
             const stat = fs.lstatSync(resolved);
@@ -480,7 +482,7 @@ class MessageStream {
 }
 export class AgentRunner {
     name = 'claude';
-    capabilities = { fullaccess: true, clear: true, compact: true, fork: true, forkAtTurn: true, askUserQuestion: true, planApproval: true, fileRewind: 'checkpoint' };
+    capabilities = { taskRecovery: true, fullaccess: true, clear: true, compact: true, fork: true, forkAtTurn: true, askUserQuestion: true, planApproval: true, fileRewind: 'checkpoint' };
     apiKey;
     model;
     effort;
@@ -499,6 +501,7 @@ export class AgentRunner {
     sandboxSettingsFiles = new Map();
     streamDone = new Map();
     streamDoneResolvers = new Map();
+    unconfirmedLifecycleFences = new Map();
     onSessionIdUpdate;
     onCompactStart;
     permissionGateway;
@@ -524,6 +527,11 @@ export class AgentRunner {
             callId: inputId,
             taskId: context?.taskId,
             occurrences: circuit.occurrences,
+            sandboxFailure: {
+                kind: circuit.kind,
+                observation: 'initialization_failed',
+                counters: getSandboxInitializationFailureCounters(),
+            },
         });
         await context?.recordExecutionAnomaly?.({
             code: 'capability_unavailable',
@@ -1337,7 +1345,7 @@ export class AgentRunner {
      * SDK 原始事件 → 标准 AgentEvent 转换
      * 所有 SDK 特有的事件类型引用封装在此方法内
      */
-    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false) {
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false, recoverySessionId) {
         let lastSessionId;
         let pendingSessionId;
         let hasTurnActivity = false;
@@ -1364,6 +1372,9 @@ export class AgentRunner {
             const candidate = pendingSessionId;
             if (!candidate)
                 return undefined;
+            if (recoverySessionId && candidate !== recoverySessionId) {
+                throw new Error('Task recovery cannot replace the original Claude session');
+            }
             if (!isResuming && topicBinding) {
                 const ready = waitForFile
                     ? await waitForClaudeSessionFile(projectPath, candidate)
@@ -1490,6 +1501,12 @@ export class AgentRunner {
                 if (event.type === 'stream_event') {
                     const streamEvent = event.event;
                     if (streamEvent?.type === 'content_block_start'
+                        && streamEvent.content_block?.type === 'text') {
+                        hasTurnActivity = true;
+                        const contentIndex = typeof streamEvent.index === 'number' ? streamEvent.index : 0;
+                        yield { type: 'text_start', contentIndex, turn: turnCount || undefined };
+                    }
+                    else if (streamEvent?.type === 'content_block_start'
                         && (streamEvent.content_block?.type === 'thinking' || streamEvent.content_block?.type === 'redacted_thinking')) {
                         hasTurnActivity = true;
                         yield { type: 'heartbeat', source: 'reasoning', turn: turnCount || undefined };
@@ -1936,6 +1953,17 @@ export class AgentRunner {
         // Validate the daemon-injected session namespace before the SDK inherits
         // the process environment for any temporary state.
         getManagedTaskTempDir(runtimeEnv);
+        this.assertLifecycleQuiescent(sessionId);
+        const staleLifecycle = this.activeStreams.has(sessionId)
+            || this.activeQueries.has(sessionId)
+            || this.activeMessageStreams.has(sessionId)
+            || this.interruptFns.has(sessionId);
+        if (staleLifecycle) {
+            logger.warn(`[AgentRunner] Stale query lifecycle before runQuery; forcing cleanup: session=${sessionId}`);
+            await this.interrupt(sessionId).catch(error => {
+                logger.warn(`[AgentRunner] Stale query interrupt failed before runQuery: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
         // 记录当前 evolcore session ID，用于 Agent ctl 环境变量注入
         // 同步用户级配置到内存
         this.syncFromUserSettings();
@@ -1966,6 +1994,10 @@ export class AgentRunner {
         if (topicBinding && topicAgentSessionId !== agentSessionId) {
             agentSessionId = topicAgentSessionId || undefined;
         }
+        const recoverySessionId = modelOverride?.recovery?.agentSessionId;
+        if (modelOverride?.recovery && (!recoverySessionId || agentSessionId !== recoverySessionId)) {
+            throw new Error('Task recovery requires the original Claude session binding');
+        }
         // 验证会话文件是否存在且有效（仅在有 agentSessionId 时）
         if (agentSessionId) {
             const homeDir = os.homedir();
@@ -1980,7 +2012,7 @@ export class AgentRunner {
                     for (const line of lines) {
                         try {
                             const data = JSON.parse(line);
-                            if (data.sessionId && data.version) {
+                            if (data.sessionId && data.version && (!recoverySessionId || data.sessionId === recoverySessionId)) {
                                 isValid = true;
                                 break;
                             }
@@ -1996,6 +2028,9 @@ export class AgentRunner {
                 }
             }
             if (!isValid) {
+                if (recoverySessionId) {
+                    throw new Error(`Task recovery backend is unavailable: ${recoverySessionId}`);
+                }
                 if (topicBinding) {
                     const error = new Error(`bound topic backend is unavailable: ${agentSessionId}`);
                     error.code = 'TOPIC_BACKEND_UNAVAILABLE';
@@ -2047,6 +2082,11 @@ export class AgentRunner {
                     callId: inputId,
                     taskId: context?.taskId,
                     occurrences: activeSandboxFailure.occurrences,
+                    sandboxFailure: {
+                        kind: activeSandboxFailure.kind,
+                        observation: 'circuit_open',
+                        counters: getSandboxInitializationFailureCounters(),
+                    },
                 });
                 await context?.recordExecutionAnomaly?.({
                     code: 'capability_unavailable',
@@ -2517,6 +2557,7 @@ export class AgentRunner {
             : await (async () => {
                 const sandboxProjectionStartedAt = Date.now();
                 ensureClaudeGitWorktreeConfig(projectPath);
+                const enableWeakerNestedSandbox = shouldEnableClaudeWeakerNestedSandbox();
                 const sandboxFilesystem = buildClaudeProtectedFilesystem(resolvePaths().root, {
                     denyLClassRead: callPermissionMode === 'readonly',
                 });
@@ -2537,10 +2578,12 @@ export class AgentRunner {
                     throw new Error(`[ClaudeSandbox] protected filesystem projection exceeded 2000ms: ${sandboxProjectionDurationMs}ms`);
                 }
                 logger.info(`[ClaudeSandbox] projection ready denyRead=${sandboxFilesystem.denyRead.length} ` +
-                    `denyWrite=${sandboxFilesystem.denyWrite.length} durationMs=${sandboxProjectionDurationMs}`);
+                    `denyWrite=${sandboxFilesystem.denyWrite.length} durationMs=${sandboxProjectionDurationMs} ` +
+                    `weakerNestedSandbox=${enableWeakerNestedSandbox}`);
                 return {
                     enabled: true,
                     failIfUnavailable: shouldFailIfClaudeSandboxUnavailable(),
+                    enableWeakerNestedSandbox,
                     allowUnsandboxedCommands: true,
                     network: {
                         allowUnixSockets: sandboxUnixSockets,
@@ -2740,7 +2783,7 @@ export class AgentRunner {
                 // Topic bindings are authoritative for every input shape.  Starting
                 // an unresumed Claude query for a bound topic would discover a second
                 // backend and then fail activation with a binding conflict.
-                sdkStream = topicBinding
+                sdkStream = topicBinding || recoverySessionId
                     ? createQuery(msgStream, agentSessionId, resumeAt)
                     : createQuery(msgStream);
             }
@@ -2785,7 +2828,7 @@ export class AgentRunner {
             this.interruptFns.set(sessionId, () => sdkStream.interrupt());
         }
         // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
-        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding);
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding, recoverySessionId);
         const self = this;
         return (async function* () {
             try {
@@ -2808,43 +2851,92 @@ export class AgentRunner {
     async interrupt(sessionId) {
         this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const streamRegistered = this.activeStreams.has(sessionId);
+        const registeredStream = this.activeStreams.get(sessionId);
         const fn = this.interruptFns.get(sessionId);
         const query = this.activeQueries.get(sessionId);
+        const messageStream = this.activeMessageStreams.get(sessionId);
         const cancelledInputIds = [];
         let stillQueued;
+        let interruptConfirmed = false;
+        let queuedCancellationComplete = true;
         if (fn) {
+            let interruptTimer;
             try {
-                const receipt = await fn();
+                const receipt = await Promise.race([
+                    fn(),
+                    new Promise((_, reject) => {
+                        interruptTimer = setTimeout(() => reject(new Error('CLAUDE_INTERRUPT_TIMEOUT')), CLAUDE_INTERRUPT_TIMEOUT_MS);
+                        interruptTimer.unref?.();
+                    }),
+                ]);
+                interruptConfirmed = true;
                 stillQueued = Array.isArray(receipt?.still_queued) ? receipt.still_queued.filter((id) => typeof id === 'string') : undefined;
                 if (stillQueued && query && typeof query.cancelAsyncMessage === 'function') {
-                    for (const inputId of stillQueued) {
+                    const cancellations = await Promise.all(stillQueued.map(async (inputId) => {
                         try {
-                            if (await query.cancelAsyncMessage(inputId))
+                            const cancelled = await withInterruptDeadline(query.cancelAsyncMessage(inputId), 'Claude cancel queued input', CLAUDE_INTERRUPT_TIMEOUT_MS);
+                            if (cancelled)
                                 cancelledInputIds.push(inputId);
+                            return cancelled;
                         }
                         catch (error) {
                             logger.debug(`[AgentRunner] Failed to cancel queued input ${inputId}: ${error}`);
+                            return false;
                         }
-                    }
+                    }));
+                    queuedCancellationComplete = cancellations.every(Boolean);
                 }
                 logger.info(`[AgentRunner] Interrupted session: ${sessionId}`);
             }
             catch (error) {
-                logger.warn(`[AgentRunner] Interrupt failed (transport closed): ${sessionId}`);
+                logger.warn(`[AgentRunner] Interrupt failed: ${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+            finally {
+                if (interruptTimer)
+                    clearTimeout(interruptTimer);
             }
         }
         this.activeMessageStreams.get(sessionId)?.end();
         if (query && typeof query.close === 'function')
             query.close();
         const done = this.streamDone.get(sessionId);
+        let streamDoneSettled = false;
         // A stream interrupted after runQuery resolves but before registerStream has
         // no consumer that can enter the wrapper generator's finally block. Waiting
         // for streamDone here would always burn the full timeout.
         if (done && streamRegistered) {
-            await Promise.race([done, new Promise(resolve => setTimeout(resolve, 5_000))]);
+            await Promise.race([
+                done.then(() => { streamDoneSettled = queuedCancellationComplete; }),
+                new Promise(resolve => setTimeout(resolve, CLAUDE_INTERRUPT_TIMEOUT_MS)),
+            ]);
+        }
+        else if (done) {
+            // A runQuery result can exist before ResponseEngine registers a consumer.
+            // In that state there is no wrapper-finally callback to observe. Trust an
+            // acknowledged SDK interrupt; otherwise keep the session fenced.
+            streamDoneSettled = (!query || interruptConfirmed) && queuedCancellationComplete;
+        }
+        // Local queue cleanup cannot authorize a second SDK writer while the old
+        // query remains unconfirmed.
+        // Do not let a late interrupt from an older turn delete a lifecycle that
+        // a newer turn installed while the old SDK call was unwinding.
+        if (this.activeStreams.get(sessionId) === registeredStream
+            && this.interruptFns.get(sessionId) === fn
+            && this.activeQueries.get(sessionId) === query
+            && this.activeMessageStreams.get(sessionId) === messageStream) {
+            if ((done && !streamDoneSettled) || !queuedCancellationComplete) {
+                const fence = done ?? new Promise(() => { });
+                this.unconfirmedLifecycleFences.set(sessionId, fence);
+                if (queuedCancellationComplete) {
+                    void fence.then(() => {
+                        if (this.unconfirmedLifecycleFences.get(sessionId) === fence) {
+                            this.unconfirmedLifecycleFences.delete(sessionId);
+                        }
+                    });
+                }
+            }
+            this.cleanupStreamLifecycle(sessionId, false, streamDoneSettled);
         }
-        this.interruptFns.delete(sessionId);
-        this.activeStreams.delete(sessionId);
         this.cleanupSandboxSettingsFiles(sessionId);
         return { stillQueued, cancelledInputIds, closed: true };
     }
@@ -2855,9 +2947,18 @@ export class AgentRunner {
         this.activeStreams.set(key, stream);
     }
     cleanupStream(sessionId) {
-        this.activeMessageStreams.get(sessionId)?.end();
+        this.cleanupStreamLifecycle(sessionId, true, true);
+    }
+    assertLifecycleQuiescent(sessionId) {
+        if (this.unconfirmedLifecycleFences.has(sessionId))
+            throw unsettledInterruptError('Claude');
+    }
+    cleanupStreamLifecycle(sessionId, endMessageStream, resolveDone) {
+        if (endMessageStream)
+            this.activeMessageStreams.get(sessionId)?.end();
         this.activeMessageStreams.delete(sessionId);
-        this.streamDoneResolvers.get(sessionId)?.();
+        if (resolveDone)
+            this.streamDoneResolvers.get(sessionId)?.();
         this.streamDoneResolvers.delete(sessionId);
         this.streamDone.delete(sessionId);
         this.activeStreams.delete(sessionId);

package/dist/agents/codex/app-server-client.js

@@ -210,8 +210,8 @@ export class CodexAppServerClient {
         }
         return undefined;
     }
-    async threadRead(threadId, includeTurns = true) {
-        return this.request('thread/read', { threadId, includeTurns });
+    async threadRead(threadId, includeTurns = true, timeoutMs) {
+        return this.request('thread/read', { threadId, includeTurns }, timeoutMs);
     }
     async threadRollback(threadId, numTurns) {
         return this.request('thread/rollback', { threadId, numTurns });
@@ -622,7 +622,7 @@ export class CodexAppServerClient {
         env.TMPDIR = managedTmpDir;
         delete env.EVOLCORE_RUNTIME_LOCK_DIR;
         if (managedTmpDir) {
-            const runtimeLockDir = path.join(managedTmpDir, 'evolcore-locks');
+            const runtimeLockDir = path.join(managedTmpDir, 'locks');
             try {
                 // The parent is the already-validated process root, so only create
                 // and validate the final component. Never follow a pre-existing
@@ -768,30 +768,63 @@ export class CodexAppServerClient {
         }
         return args;
     }
-    async request(method, params) {
-        await this.ensureReadyFor(method);
-        const proc = this.proc;
-        if (!proc)
-            throw new Error('Codex app-server is not running');
-        const id = String(this.nextId++);
-        const payload = { id, method };
-        if (params !== undefined && params !== null)
-            payload.params = params;
-        return new Promise((resolve, reject) => {
-            this.pending.set(id, {
-                resolve,
-                reject,
-                method,
-                params,
-                stderrStartSequence: this.stderrSequence,
-            });
-            proc.stdin.write(`${JSON.stringify(payload)}\n`, error => {
-                if (!error)
-                    return;
-                this.pending.delete(id);
-                reject(error);
+    async request(method, params, timeoutMs) {
+        // Only lifecycle RPCs get short deadlines. Model work has its own policy.
+        const deadline = timeoutMs ?? (method === 'turn/interrupt' ? 5_000 : undefined);
+        let timer;
+        let requestId;
+        let expired = false;
+        const operation = (async () => {
+            await this.ensureReadyFor(method);
+            if (expired)
+                throw new Error(`Codex ${method} expired before dispatch`);
+            const proc = this.proc;
+            if (!proc)
+                throw new Error('Codex app-server is not running');
+            const id = String(this.nextId++);
+            requestId = id;
+            const payload = { id, method };
+            if (params !== undefined && params !== null)
+                payload.params = params;
+            return new Promise((resolve, reject) => {
+                this.pending.set(id, {
+                    resolve,
+                    reject,
+                    method,
+                    params,
+                    stderrStartSequence: this.stderrSequence,
+                });
+                proc.stdin.write(`${JSON.stringify(payload)}\n`, error => {
+                    if (!error)
+                        return;
+                    this.pending.delete(id);
+                    reject(error);
+                });
             });
-        });
+        })();
+        if (deadline === undefined)
+            return operation;
+        try {
+            return await Promise.race([
+                operation,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => {
+                        expired = true;
+                        reject(new Error(`Codex ${method} deadline exceeded`));
+                    }, deadline);
+                    timer.unref?.();
+                }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            if (requestId && expired) {
+                const pending = this.pending.get(requestId);
+                this.pending.delete(requestId);
+                pending?.reject(new Error(`Codex ${method} deadline exceeded`));
+            }
+        }
     }
     respond(id, result) {
         if (!this.proc)
@@ -870,6 +903,10 @@ export class CodexAppServerClient {
             else if (/already has an active writer/i.test(detail)) {
                 error.code = CODEX_THREAD_ACTIVE_WRITER;
             }
+            else if (pending.method === 'turn/steer' && /\bno active turn\b/i.test(detail)) {
+                // Explicit server rejection proves the input was not accepted. Transport errors do not.
+                error.code = 'CODEX_NO_ACTIVE_TURN';
+            }
             pending.reject(error);
             return;
         }