evolcore 0.0.26 → 0.0.28

package/CHANGELOG.md

@@ -3,6 +3,38 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## Unreleased
+
+## 0.0.28 (2026-09-24)
+
+- 增加 npm 版本缓存，改进升级状态展示及启动、重启流程。
+- 改进 AUN 回复投递与消息展示。
+- 加固 Windows CLI 启动和 PowerShell 命令解析，完善 Codex CLI 诊断。
+- 强化 Menu 请求校验与错误处理。
+
+## 0.0.27 (2026-09-24)
+
+### AUN、群聊与消息
+
+- 持久化 AUN 群邀请的 Owner 审核流程，并增加 Base Agent 清单查询入口。
+- 支持 EC Agent 的角色级模型与推理强度策略；完善 Claude、Codex、EC Agent 会话的任务历史和中断恢复。
+- 模型类 Trigger 支持单次执行时限；目标会话失联时明确记录为失败。
+- 修复 AUN 撤回消息造成的私聊游标跳跃；手动停止的 Agent 重新加载后可恢复渠道连接。
+- 规范工具活动中的 Shell 命令展示，并在缺少本地证书时跳过控制 AID 名片发布。
+- 优化消息大小处理，提升长消息和复杂内容的发送稳定性。
+- 升级 AUN SDK 至 `0.5.17`，改进消息、群文件和存储上传的兼容性。
+- 改进附件、头像和文件存储处理，提升文件类型识别、上传和公开访问的稳定性。
+- 改进身份信息缓存刷新，确保对端资料更新后及时生效。
+- 支持无连续编号消息的完整拉取信息，并修正消息数量统计。
+- 群命令和托管群文件操作支持标准群 AID 格式。
+- 优化群名称生成和冲突处理，自定义名称保持原样。
+- 改进群组参数校验和成员身份识别，提升群聊操作准确性。
+
+### Agent、权限与运行稳定性
+
+- 收紧 Codex 分支会话的权限上下文，避免旧会话继承过期授权。
+- 完善 Agent 初始化、会话恢复、权限边界和运行状态处理。
+
 ## 0.0.26 (2026-09-18)
 
 ### AUN、联系人与远程诊断
@@ -21,6 +53,10 @@
 
 ### 权限与兼容性
 
+- 修复 App 管理页读取指定群关系配置时被当前关系限制拒绝：owner/admin 可读取当前 Agent 的目标关系字段，
+  保留 admin 字段权限、普通成员和跨关系写入限制。
+- 批量配置读取为当前版本未支持的 runner 字段返回逐字段 `UNSUPPORTED_FIELD`，
+  保留有效字段并以成功状态返回兼容缺项；真实权限与执行错误仍按失败处理。
 - npm 包整体排除本机 `skills/` 目录，避免本地 skill 文件随包发布。
 - 新建 agent.md 默认使用 `agent` 类型，并按白名单归一化类型；
   对齐 SDK 的可选 description、Unicode 字数、avatar 长度及 4 KB 文档上限校验。

package/bin/codex-managed-acl.ps1

@@ -28,6 +28,48 @@ function Add-Grant($Acl, [string]$Sid, [Security.AccessControl.FileSystemRights]
   $Acl.AddAccessRule($rule)
 }
 
+function Grant-PipeAccess([string]$Target) {
+  $prefix = '\\.\pipe\'
+  if (-not $Target.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) {
+    throw 'Only a local named pipe can receive Codex sandbox access.'
+  }
+  $pipeName = $Target.Substring($prefix.Length)
+  if (-not $pipeName -or $pipeName.Contains('\') -or $pipeName.Contains('/')) {
+    throw 'Invalid local named pipe name.'
+  }
+  $accounts = @()
+  foreach ($name in @('CodexSandboxOffline', 'CodexSandboxOnline')) {
+    try {
+      $account = New-Object Security.Principal.NTAccount([Environment]::MachineName, $name)
+      $sid = $account.Translate([Security.Principal.SecurityIdentifier])
+      $accounts += @{ name = $name; sid = $sid }
+    } catch [Security.Principal.IdentityNotMappedException] {
+      # Codex creates these local users during sandbox provisioning. Do not
+      # replace a missing user with Everyone, Authenticated Users, or a group.
+    }
+  }
+  if ($accounts.Count -eq 0) { return @{ granted = @() } }
+  $pipe = New-Object System.IO.Pipes.NamedPipeClientStream('.', $pipeName,
+    [System.IO.Pipes.PipeAccessRights]'ReadWrite,ReadPermissions,ChangePermissions',
+    [System.IO.Pipes.PipeOptions]::Asynchronous,
+    [Security.Principal.TokenImpersonationLevel]::Identification,
+    [System.IO.HandleInheritability]::None)
+  try {
+    $pipe.Connect(5000)
+    $acl = $pipe.GetAccessControl()
+    $rights = [System.IO.Pipes.PipeAccessRights]'ReadWrite,Synchronize'
+    foreach ($account in $accounts) {
+      # GenericWrite/FullControl also grant CreateNewInstance on named pipes.
+      # Grant only data I/O to the actual restricted user; the sandbox group
+      # alone does not satisfy Windows restricted-token access checks.
+      $acl.AddAccessRule((New-Object System.IO.Pipes.PipeAccessRule(
+        $account.sid, $rights, [Security.AccessControl.AccessControlType]::Allow)))
+    }
+    $pipe.SetAccessControl($acl)
+    return @{ granted = @($accounts | ForEach-Object { $_.name }) }
+  } finally { $pipe.Dispose() }
+}
+
 function Initialize-AccessProbe {
   # An elevated process reading the file is not evidence that a normal process
   # can read it. Evaluate the DACL with its UAC linked token when available.
@@ -122,6 +164,7 @@ function Verify-Access($Entry) {
 try {
   $payload = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Request)) | ConvertFrom-Json
   $result = switch ($payload.action) {
+    'pipe' { Grant-PipeAccess ([string]$payload.path) }
     'preflight' {
       $principal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
       if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {

package/dist/agents/baseagent-availability.js

@@ -1,3 +1,4 @@
+import { normalizeBaseagent } from './baseagent.js';
 import { commandExists } from '../utils/cross-platform.js';
 import { getCodexAppServerAvailability } from './codex-runner.js';
 export const BASEAGENT_CANDIDATES = ['claude', 'codex', 'gemini', 'ecagent'];
@@ -46,3 +47,70 @@ export function detectBaseagentDetails(codexAvailability = getCodexAppServerAvai
         },
     ];
 }
+/** Only loaded runners can be switched to; never infer this from PATH/config. */
+export function loadedBaseagentIds(keys, owner) {
+    const result = new Set();
+    for (const key of keys) {
+        if (owner !== undefined && !key.startsWith(`${owner}::`))
+            continue;
+        const separator = key.indexOf('::');
+        result.add(separator < 0 ? key : key.slice(separator + 2));
+    }
+    return [...result];
+}
+function canonical(value) {
+    if (typeof value !== 'string')
+        return null;
+    const id = normalizeBaseagent(value).canonical;
+    return id === 'unknown' ? null : id;
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function text(value) {
+    return typeof value === 'string' && value.trim() ? value : null;
+}
+/** Safe public projection: credentials and arbitrary backend settings never leave this boundary. */
+export function buildBaseagentSnapshot(config, detections, loaded) {
+    const blocks = new Map();
+    for (const [name, value] of Object.entries(record(config.baseagents))) {
+        const id = canonical(name);
+        if (id)
+            blocks.set(id, record(value));
+    }
+    const active = canonical(config.active_baseagent);
+    const probes = new Map((detections ?? []).map(item => [String(item.id), item]));
+    const loadedIds = loaded === undefined ? null : new Set(loaded);
+    const ids = new Set([
+        ...blocks.keys(),
+        ...(detections ?? []).filter(item => item.detected).map(item => item.id),
+        ...(loaded ?? []),
+        ...(active ? [active] : []),
+    ]);
+    return {
+        active,
+        baseagents: [...ids].map(id => ({
+            id,
+            label: normalizeBaseagent(id).displayName,
+            configured: blocks.has(id),
+            detected: detections === null ? null : probes.get(id)?.detected === true,
+            loaded: loadedIds?.has(id) ?? null,
+            active: id === active,
+            model: text(blocks.get(id)?.model),
+            effort: text(blocks.get(id)?.effort ?? blocks.get(id)?.reasoning),
+            version: probes.get(id)?.version ?? null,
+        })),
+    };
+}
+/** Shared defaults/Agent inventory for menu, slash and local history readers. */
+export async function getBaseagentSnapshot(options = {}) {
+    let config = options.config;
+    if (config === undefined) {
+        const { read, ConfigTarget } = await import('../config/config-manager.js');
+        config = read(ConfigTarget.Defaults, undefined, { cache: false, expand: false }) ?? {};
+    }
+    const detections = options.probe === false
+        ? null
+        : (await import('./baseagent-availability.js')).detectBaseagentDetails();
+    return buildBaseagentSnapshot(config ?? {}, detections, options.loaded);
+}

package/dist/agents/baseagent.js

@@ -12,22 +12,26 @@
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
-import { commandExists, isWindows, resolveProbePath } from '../utils/cross-platform.js';
+import { buildCliLaunchCommand, commandExists, isWindows, resolvePowerShellShimPath, resolveProbePath, } from '../utils/cross-platform.js';
 import { execFileSync } from 'child_process';
 import { parse as parseToml } from 'smol-toml';
 /** Resolve the installed Codex CLI entrypoint, including npm shims on Windows. */
 export function resolveCodexCliPath() {
     return resolveProbePath('codex');
 }
+/** Return a PS1-only Codex shim for installation diagnostics, never execution. */
+export function resolveCodexPowerShellShimPath() {
+    return resolvePowerShellShimPath('codex');
+}
 export function resolveCodexLaunchCommand(args, options = {}) {
     const windows = options.isWindows ?? isWindows;
     const commandPath = options.commandPath !== undefined ? options.commandPath : resolveCodexCliPath();
     if (!commandPath)
         return null;
-    if (windows && /\.(cmd|bat)$/i.test(commandPath)) {
-        return { command: options.comSpec ?? process.env.ComSpec ?? 'cmd.exe', args: ['/d', '/s', '/c', commandPath, ...args] };
-    }
-    return { command: commandPath, args };
+    return buildCliLaunchCommand(commandPath, args, {
+        isWindows: windows,
+        comSpec: options.comSpec,
+    });
 }
 /** Execute a Codex CLI command using the resolved npm shim/path. */
 export function execCodexCliSync(args, options) {
@@ -40,6 +44,7 @@ export function execCodexCliSync(args, options) {
     return execFileSync(launchCommand.command, launchCommand.args, {
         ...(options ?? {}),
         windowsHide: isWindows,
+        windowsVerbatimArguments: launchCommand.windowsVerbatimArguments,
     });
 }
 const BASEAGENT_ALIASES = {

package/dist/agents/claude-runner.js

@@ -25,14 +25,15 @@ import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
-import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, isSandboxInitializationToolResult, recordSandboxInitializationFailure, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, isSandboxInitializationToolResult, recordSandboxInitializationFailure, getSandboxInitializationFailureCounters, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldEnableClaudeWeakerNestedSandbox, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { getManagedTaskTempDir, isManagedSessionRuntimeDir } from '../cli/task-context.js';
-import { hasTrustedFullAccessContext } from './runner-types.js';
+import { unsettledInterruptError, withInterruptDeadline, hasTrustedFullAccessContext } from './runner-types.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel, sdkAutoCompactWindowForModel } from './runner-types.js';
 import { hasContextWindowSuffix, stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
 const resolveModule = createRequire(import.meta.url);
+const CLAUDE_INTERRUPT_TIMEOUT_MS = 5_000;
 /**
  * Resolve the platform package explicitly instead of relying on the SDK's
  * internal optional-dependency lookup. The latter is sensitive to the module
@@ -282,16 +283,17 @@ function buildClaudeManagedLockdownSettings(capabilityOptions) {
 }
 const CLAUDE_SANDBOX_GLOB_MAGIC = /[*?[\]]/;
 function trustedRuntimeWritePaths(runtimeEnv) {
-    const tmp = process.env.TMPDIR?.trim();
-    if (!tmp || !path.isAbsolute(tmp))
+    const sessionDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR?.trim();
+    if (!sessionDir || !isManagedSessionRuntimeDir(sessionDir))
         return [];
-    const root = resolveProtectedCandidate(tmp);
+    const root = resolveProtectedCandidate(sessionDir);
     const candidates = [runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR, runtimeEnv?.EVOLCORE_RUNTIME_LOCK_DIR]
         .filter((value) => typeof value === 'string' && path.isAbsolute(value));
     const paths = [];
     for (const candidate of candidates) {
         const resolved = resolveProtectedCandidate(candidate);
-        if (!isSameOrDescendant(resolved, root))
+        if (!isSameOrDescendant(resolved, root)
+            || (resolved !== root && !(path.dirname(resolved) === root && path.basename(resolved) === 'locks')))
             continue;
         try {
             const stat = fs.lstatSync(resolved);
@@ -480,7 +482,7 @@ class MessageStream {
 }
 export class AgentRunner {
     name = 'claude';
-    capabilities = { fullaccess: true, clear: true, compact: true, fork: true, forkAtTurn: true, askUserQuestion: true, planApproval: true, fileRewind: 'checkpoint' };
+    capabilities = { taskRecovery: true, fullaccess: true, clear: true, compact: true, fork: true, forkAtTurn: true, askUserQuestion: true, planApproval: true, fileRewind: 'checkpoint' };
     apiKey;
     model;
     effort;
@@ -499,6 +501,7 @@ export class AgentRunner {
     sandboxSettingsFiles = new Map();
     streamDone = new Map();
     streamDoneResolvers = new Map();
+    unconfirmedLifecycleFences = new Map();
     onSessionIdUpdate;
     onCompactStart;
     permissionGateway;
@@ -524,6 +527,11 @@ export class AgentRunner {
             callId: inputId,
             taskId: context?.taskId,
             occurrences: circuit.occurrences,
+            sandboxFailure: {
+                kind: circuit.kind,
+                observation: 'initialization_failed',
+                counters: getSandboxInitializationFailureCounters(),
+            },
         });
         await context?.recordExecutionAnomaly?.({
             code: 'capability_unavailable',
@@ -1337,7 +1345,7 @@ export class AgentRunner {
      * SDK 原始事件 → 标准 AgentEvent 转换
      * 所有 SDK 特有的事件类型引用封装在此方法内
      */
-    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false) {
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false, recoverySessionId) {
         let lastSessionId;
         let pendingSessionId;
         let hasTurnActivity = false;
@@ -1364,6 +1372,9 @@ export class AgentRunner {
             const candidate = pendingSessionId;
             if (!candidate)
                 return undefined;
+            if (recoverySessionId && candidate !== recoverySessionId) {
+                throw new Error('Task recovery cannot replace the original Claude session');
+            }
             if (!isResuming && topicBinding) {
                 const ready = waitForFile
                     ? await waitForClaudeSessionFile(projectPath, candidate)
@@ -1490,6 +1501,12 @@ export class AgentRunner {
                 if (event.type === 'stream_event') {
                     const streamEvent = event.event;
                     if (streamEvent?.type === 'content_block_start'
+                        && streamEvent.content_block?.type === 'text') {
+                        hasTurnActivity = true;
+                        const contentIndex = typeof streamEvent.index === 'number' ? streamEvent.index : 0;
+                        yield { type: 'text_start', contentIndex, turn: turnCount || undefined };
+                    }
+                    else if (streamEvent?.type === 'content_block_start'
                         && (streamEvent.content_block?.type === 'thinking' || streamEvent.content_block?.type === 'redacted_thinking')) {
                         hasTurnActivity = true;
                         yield { type: 'heartbeat', source: 'reasoning', turn: turnCount || undefined };
@@ -1936,6 +1953,17 @@ export class AgentRunner {
         // Validate the daemon-injected session namespace before the SDK inherits
         // the process environment for any temporary state.
         getManagedTaskTempDir(runtimeEnv);
+        this.assertLifecycleQuiescent(sessionId);
+        const staleLifecycle = this.activeStreams.has(sessionId)
+            || this.activeQueries.has(sessionId)
+            || this.activeMessageStreams.has(sessionId)
+            || this.interruptFns.has(sessionId);
+        if (staleLifecycle) {
+            logger.warn(`[AgentRunner] Stale query lifecycle before runQuery; forcing cleanup: session=${sessionId}`);
+            await this.interrupt(sessionId).catch(error => {
+                logger.warn(`[AgentRunner] Stale query interrupt failed before runQuery: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
         // 记录当前 evolcore session ID，用于 Agent ctl 环境变量注入
         // 同步用户级配置到内存
         this.syncFromUserSettings();
@@ -1966,6 +1994,10 @@ export class AgentRunner {
         if (topicBinding && topicAgentSessionId !== agentSessionId) {
             agentSessionId = topicAgentSessionId || undefined;
         }
+        const recoverySessionId = modelOverride?.recovery?.agentSessionId;
+        if (modelOverride?.recovery && (!recoverySessionId || agentSessionId !== recoverySessionId)) {
+            throw new Error('Task recovery requires the original Claude session binding');
+        }
         // 验证会话文件是否存在且有效（仅在有 agentSessionId 时）
         if (agentSessionId) {
             const homeDir = os.homedir();
@@ -1980,7 +2012,7 @@ export class AgentRunner {
                     for (const line of lines) {
                         try {
                             const data = JSON.parse(line);
-                            if (data.sessionId && data.version) {
+                            if (data.sessionId && data.version && (!recoverySessionId || data.sessionId === recoverySessionId)) {
                                 isValid = true;
                                 break;
                             }
@@ -1996,6 +2028,9 @@ export class AgentRunner {
                 }
             }
             if (!isValid) {
+                if (recoverySessionId) {
+                    throw new Error(`Task recovery backend is unavailable: ${recoverySessionId}`);
+                }
                 if (topicBinding) {
                     const error = new Error(`bound topic backend is unavailable: ${agentSessionId}`);
                     error.code = 'TOPIC_BACKEND_UNAVAILABLE';
@@ -2047,6 +2082,11 @@ export class AgentRunner {
                     callId: inputId,
                     taskId: context?.taskId,
                     occurrences: activeSandboxFailure.occurrences,
+                    sandboxFailure: {
+                        kind: activeSandboxFailure.kind,
+                        observation: 'circuit_open',
+                        counters: getSandboxInitializationFailureCounters(),
+                    },
                 });
                 await context?.recordExecutionAnomaly?.({
                     code: 'capability_unavailable',
@@ -2517,6 +2557,7 @@ export class AgentRunner {
             : await (async () => {
                 const sandboxProjectionStartedAt = Date.now();
                 ensureClaudeGitWorktreeConfig(projectPath);
+                const enableWeakerNestedSandbox = shouldEnableClaudeWeakerNestedSandbox();
                 const sandboxFilesystem = buildClaudeProtectedFilesystem(resolvePaths().root, {
                     denyLClassRead: callPermissionMode === 'readonly',
                 });
@@ -2537,10 +2578,12 @@ export class AgentRunner {
                     throw new Error(`[ClaudeSandbox] protected filesystem projection exceeded 2000ms: ${sandboxProjectionDurationMs}ms`);
                 }
                 logger.info(`[ClaudeSandbox] projection ready denyRead=${sandboxFilesystem.denyRead.length} ` +
-                    `denyWrite=${sandboxFilesystem.denyWrite.length} durationMs=${sandboxProjectionDurationMs}`);
+                    `denyWrite=${sandboxFilesystem.denyWrite.length} durationMs=${sandboxProjectionDurationMs} ` +
+                    `weakerNestedSandbox=${enableWeakerNestedSandbox}`);
                 return {
                     enabled: true,
                     failIfUnavailable: shouldFailIfClaudeSandboxUnavailable(),
+                    enableWeakerNestedSandbox,
                     allowUnsandboxedCommands: true,
                     network: {
                         allowUnixSockets: sandboxUnixSockets,
@@ -2740,7 +2783,7 @@ export class AgentRunner {
                 // Topic bindings are authoritative for every input shape.  Starting
                 // an unresumed Claude query for a bound topic would discover a second
                 // backend and then fail activation with a binding conflict.
-                sdkStream = topicBinding
+                sdkStream = topicBinding || recoverySessionId
                     ? createQuery(msgStream, agentSessionId, resumeAt)
                     : createQuery(msgStream);
             }
@@ -2785,7 +2828,7 @@ export class AgentRunner {
             this.interruptFns.set(sessionId, () => sdkStream.interrupt());
         }
         // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
-        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding);
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding, recoverySessionId);
         const self = this;
         return (async function* () {
             try {
@@ -2808,43 +2851,92 @@ export class AgentRunner {
     async interrupt(sessionId) {
         this.permissionContexts.get(sessionId)?.pauseController?.cancel();
         const streamRegistered = this.activeStreams.has(sessionId);
+        const registeredStream = this.activeStreams.get(sessionId);
         const fn = this.interruptFns.get(sessionId);
         const query = this.activeQueries.get(sessionId);
+        const messageStream = this.activeMessageStreams.get(sessionId);
         const cancelledInputIds = [];
         let stillQueued;
+        let interruptConfirmed = false;
+        let queuedCancellationComplete = true;
         if (fn) {
+            let interruptTimer;
             try {
-                const receipt = await fn();
+                const receipt = await Promise.race([
+                    fn(),
+                    new Promise((_, reject) => {
+                        interruptTimer = setTimeout(() => reject(new Error('CLAUDE_INTERRUPT_TIMEOUT')), CLAUDE_INTERRUPT_TIMEOUT_MS);
+                        interruptTimer.unref?.();
+                    }),
+                ]);
+                interruptConfirmed = true;
                 stillQueued = Array.isArray(receipt?.still_queued) ? receipt.still_queued.filter((id) => typeof id === 'string') : undefined;
                 if (stillQueued && query && typeof query.cancelAsyncMessage === 'function') {
-                    for (const inputId of stillQueued) {
+                    const cancellations = await Promise.all(stillQueued.map(async (inputId) => {
                         try {
-                            if (await query.cancelAsyncMessage(inputId))
+                            const cancelled = await withInterruptDeadline(query.cancelAsyncMessage(inputId), 'Claude cancel queued input', CLAUDE_INTERRUPT_TIMEOUT_MS);
+                            if (cancelled)
                                 cancelledInputIds.push(inputId);
+                            return cancelled;
                         }
                         catch (error) {
                             logger.debug(`[AgentRunner] Failed to cancel queued input ${inputId}: ${error}`);
+                            return false;
                         }
-                    }
+                    }));
+                    queuedCancellationComplete = cancellations.every(Boolean);
                 }
                 logger.info(`[AgentRunner] Interrupted session: ${sessionId}`);
             }
             catch (error) {
-                logger.warn(`[AgentRunner] Interrupt failed (transport closed): ${sessionId}`);
+                logger.warn(`[AgentRunner] Interrupt failed: ${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+            finally {
+                if (interruptTimer)
+                    clearTimeout(interruptTimer);
             }
         }
         this.activeMessageStreams.get(sessionId)?.end();
         if (query && typeof query.close === 'function')
             query.close();
         const done = this.streamDone.get(sessionId);
+        let streamDoneSettled = false;
         // A stream interrupted after runQuery resolves but before registerStream has
         // no consumer that can enter the wrapper generator's finally block. Waiting
         // for streamDone here would always burn the full timeout.
         if (done && streamRegistered) {
-            await Promise.race([done, new Promise(resolve => setTimeout(resolve, 5_000))]);
+            await Promise.race([
+                done.then(() => { streamDoneSettled = queuedCancellationComplete; }),
+                new Promise(resolve => setTimeout(resolve, CLAUDE_INTERRUPT_TIMEOUT_MS)),
+            ]);
+        }
+        else if (done) {
+            // A runQuery result can exist before ResponseEngine registers a consumer.
+            // In that state there is no wrapper-finally callback to observe. Trust an
+            // acknowledged SDK interrupt; otherwise keep the session fenced.
+            streamDoneSettled = (!query || interruptConfirmed) && queuedCancellationComplete;
+        }
+        // Local queue cleanup cannot authorize a second SDK writer while the old
+        // query remains unconfirmed.
+        // Do not let a late interrupt from an older turn delete a lifecycle that
+        // a newer turn installed while the old SDK call was unwinding.
+        if (this.activeStreams.get(sessionId) === registeredStream
+            && this.interruptFns.get(sessionId) === fn
+            && this.activeQueries.get(sessionId) === query
+            && this.activeMessageStreams.get(sessionId) === messageStream) {
+            if ((done && !streamDoneSettled) || !queuedCancellationComplete) {
+                const fence = done ?? new Promise(() => { });
+                this.unconfirmedLifecycleFences.set(sessionId, fence);
+                if (queuedCancellationComplete) {
+                    void fence.then(() => {
+                        if (this.unconfirmedLifecycleFences.get(sessionId) === fence) {
+                            this.unconfirmedLifecycleFences.delete(sessionId);
+                        }
+                    });
+                }
+            }
+            this.cleanupStreamLifecycle(sessionId, false, streamDoneSettled);
         }
-        this.interruptFns.delete(sessionId);
-        this.activeStreams.delete(sessionId);
         this.cleanupSandboxSettingsFiles(sessionId);
         return { stillQueued, cancelledInputIds, closed: true };
     }
@@ -2855,9 +2947,18 @@ export class AgentRunner {
         this.activeStreams.set(key, stream);
     }
     cleanupStream(sessionId) {
-        this.activeMessageStreams.get(sessionId)?.end();
+        this.cleanupStreamLifecycle(sessionId, true, true);
+    }
+    assertLifecycleQuiescent(sessionId) {
+        if (this.unconfirmedLifecycleFences.has(sessionId))
+            throw unsettledInterruptError('Claude');
+    }
+    cleanupStreamLifecycle(sessionId, endMessageStream, resolveDone) {
+        if (endMessageStream)
+            this.activeMessageStreams.get(sessionId)?.end();
         this.activeMessageStreams.delete(sessionId);
-        this.streamDoneResolvers.get(sessionId)?.();
+        if (resolveDone)
+            this.streamDoneResolvers.get(sessionId)?.();
         this.streamDoneResolvers.delete(sessionId);
         this.streamDone.delete(sessionId);
         this.activeStreams.delete(sessionId);