evolcore 0.0.26 → 0.0.28

package/dist/core/message/response-engine.js

@@ -1,8 +1,13 @@
+import { initializationBlocksTasks } from '../../cli/agent-create.js';
 import path from 'path';
 import fs from 'fs';
 import os from 'os';
 import crypto from 'crypto';
-import { BaseagentRunnerUnavailableError, hasCompact, autoCompactWindowForModel, isClaudeContextUsageModel, numericToken } from '../../agents/runner-types.js';
+import { BaseagentRunnerUnavailableError, hasCompact, autoCompactWindowForModel, isClaudeContextUsageModel, numericToken, formatAsyncQuestionAnswer, parseAsyncUserQuestions, } from '../../agents/runner-types.js';
+import { loadedBaseagentIds } from '../../agents/baseagent-availability.js';
+import { isDiagnosticSessionActive } from '../command/diag-service.js';
+import { evaluateInboundAdmissionPreflight, evaluateOrdinaryInboundAdmission } from './message-admission.js';
+import { authorizeAccess, authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
 import { buildTaskRuntimeEnv, ensureRuntimeLockDir, ensureSessionRuntimeDir } from '../../cli/task-context.js';
 import { IMRenderer } from './im-renderer.js';
 import { createSendFileMarkerPattern } from './file-markers.js';
@@ -10,11 +15,11 @@ import { createTextInferenceProvider } from '../inference/text-inference.js';
 import { StreamIdleMonitor } from './stream-idle-monitor.js';
 import { logger } from '../../utils/logger.js';
 import { isHostChinese } from '../../utils/locale.js';
-import { getErrorMessage, classifyError, ErrorType, ERROR_PREFIX, isInfraError, isAbortTerminalReason, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
+import { ExecutionTimeoutError, OrphanedTargetSessionError, isExecutionFailure, getErrorMessage, classifyError, ErrorType, ERROR_PREFIX, isInfraError, isAbortTerminalReason, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
 import { readEvolcoreRuntimeFlavor, tagErrorTextWithEvolcoreVersion } from '../../utils/evolcore-version.js';
 import { describeProactiveSendCommandFailure, isExactEvolcoreSendCommandForSession } from '../permission/ec-command-parser.js';
-import { summarizeToolInput } from '../../utils/tool-summary.js';
-import { agentDir as resolveAgentDir, agentMdPath, getPackageRoot, resolveRoot, resolvePaths } from '../../paths.js';
+import { summarizeToolInputForDisplay } from '../../utils/tool-summary.js';
+import { agentDataDir, agentDir as resolveAgentDir, agentMdPath, getPackageRoot, resolveRoot, resolvePaths } from '../../paths.js';
 import { renderKitSections } from '../../eck/kit-renderer.js';
 import { renderMessageBody } from '../../eck/message-renderer.js';
 import { syncGroupRulesContext } from '../../eck/group-rules-sync.js';
@@ -22,8 +27,9 @@ import { consumeHints, hintsToSubMessages, composeHintFallback } from './pending
 import { createRootCausation, deriveCausation, normalizeCausation } from '../causation/context.js';
 import { recordCausationLink, recordCausationSpan } from '../causation/audit.js';
 import { normalizeBaseagent } from '../../agents/baseagent.js';
+import { renderActionAsText } from '../interaction-router.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
-import { buildEnvelope, replyContextFromSession, withEnvelopeReplyContext } from './message-utils.js';
+import { buildEnvelope, isInteractionSendAccepted, replyContextFromSession, sendInteractionPayload, withEnvelopeReplyContext } from './message-utils.js';
 import { isSystemOrServicePeer, resolveChatMode } from './peer-mode.js';
 import { AGENT_DELEGATION_TOKEN_ENV } from '../auth/agent-delegation.js';
 import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
@@ -52,7 +58,290 @@ import { classifyToolErrorCode, normalizeToolErrorCode } from '../permission/too
 import { normalizeExecutionPermissionMode } from '../permission/mode.js';
 import { buildToolLifecycleEventKey } from '../audit/event-key.js';
 import { isFullAccessEnabled, loadDaemonConfig } from '../../config-store.js';
+import { assertAgentPolicyAuthorization } from '../role/runtime-policy.js';
 import { auditFullAccessEvent } from '../auth/authorization-audit.js';
+import { TaskRecoveryService, isTaskRecoveryCurrent } from '../task/task-recovery-service.js';
+const QUESTION_TTL_MS = 24 * 60 * 60 * 1000;
+/** Pending async questions outlive the originating turn, but never change its backend binding. */
+export class AsyncQuestionService {
+    deps;
+    registered = new Map();
+    deliveries = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    directory(selfAid) {
+        return this.deps.directory?.(selfAid) ?? path.join(agentDataDir(selfAid), 'async-questions');
+    }
+    file(selfAid, id) {
+        if (!/^aq-[a-f0-9]{40}$/.test(id))
+            throw new Error('Invalid async question id');
+        return path.join(this.directory(selfAid), `${id}.json`);
+    }
+    save(record) {
+        fs.mkdirSync(this.directory(record.selfAid), { recursive: true, mode: 0o700 });
+        const destination = this.file(record.selfAid, record.id);
+        const temporary = `${destination}.tmp`;
+        const fd = fs.openSync(temporary, 'w', 0o600);
+        try {
+            fs.writeFileSync(fd, JSON.stringify(record));
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        // Replace atomically, without unlinking the previous durable state first.
+        fs.renameSync(temporary, destination);
+    }
+    read(selfAid, id) {
+        try {
+            const value = JSON.parse(fs.readFileSync(this.file(selfAid, id), 'utf8'));
+            if (value.version !== 1 || value.selfAid !== selfAid || value.id !== id
+                || !value.sessionId || !value.providerThreadId || !value.itemId
+                || !value.origin?.peerId || !value.channelKey || !Number.isFinite(value.expiresAt))
+                return undefined;
+            parseAsyncUserQuestions([value.question]);
+            return value;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            return undefined;
+        }
+    }
+    async present(session, request, message, adapter, envelope) {
+        if (!session.selfAID || !message.peerId)
+            throw new Error('Async question requires an authenticated route');
+        const questions = parseAsyncUserQuestions(request.questions);
+        const records = [];
+        for (const [index, question] of questions.entries()) {
+            const hash = crypto.createHash('sha256').update(JSON.stringify([
+                session.selfAID, session.id, request.providerThreadId, request.itemId, index,
+            ])).digest('hex').slice(0, 40);
+            const id = `aq-${hash}`;
+            const existing = this.read(session.selfAID, id);
+            if (existing && existing.status !== 'pending')
+                continue;
+            const replyContext = {
+                delivery: envelope.delivery ?? envelope.replyContext?.delivery,
+                threadId: session.threadId || undefined,
+                metadata: {
+                    encrypted: message.encrypted ?? envelope.replyContext?.metadata?.encrypted,
+                    chatmode: envelope.chatmode,
+                },
+            };
+            const record = existing ?? {
+                version: 1, id, sessionId: session.id, selfAid: session.selfAID,
+                providerThreadId: request.providerThreadId, providerTurnId: request.providerTurnId,
+                itemId: request.itemId, question,
+                origin: {
+                    channel: message.channel, channelType: session.channelType,
+                    channelId: session.channelId, peerId: message.peerId, peerType: message.peerType,
+                    chatType: session.chatType === 'group' ? 'group' : 'private',
+                    threadId: session.threadId || undefined, selfAID: session.selfAID,
+                },
+                envelope: { ...envelope, sessionId: session.id, replyContext, delivery: replyContext.delivery },
+                channelKey: adapter.channelKey, createdAt: Date.now(), expiresAt: Date.now() + QUESTION_TTL_MS,
+                status: 'pending',
+            };
+            if (!existing)
+                this.save(record);
+            records.push(record);
+        }
+        // Persist the complete batch before dispatch; one failed card must not lose the other questions.
+        const errors = [];
+        for (const record of records) {
+            try {
+                await this.deliver(record, adapter);
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+        if (errors.length)
+            throw new AggregateError(errors, 'Async question delivery failed; pending questions retained');
+    }
+    async restore(adapter, selfAid) {
+        let names;
+        try {
+            names = fs.readdirSync(this.directory(selfAid));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        for (const name of names) {
+            if (!/^aq-[a-f0-9]{40}\.json$/.test(name))
+                continue;
+            try {
+                const record = this.read(selfAid, name.slice(0, -5));
+                if (!record || record.channelKey !== adapter.channelKey)
+                    continue;
+                if (this.registered.get(record.id) === adapter)
+                    continue;
+                if (record.expiresAt <= Date.now()) {
+                    fs.unlinkSync(this.file(selfAid, record.id));
+                    continue;
+                }
+                if (record.status === 'submitting') {
+                    // A crash may have happened after Codex accepted the steer. Never replay it blindly.
+                    record.status = 'uncertain';
+                    record.reason = 'restart_during_submission';
+                    this.save(record);
+                }
+                if (record.status === 'pending')
+                    await this.deliver(record, adapter);
+            }
+            catch (error) {
+                logger.warn(`[AsyncQuestions] restore failed: id=${name} error=${String(error)}`);
+            }
+        }
+    }
+    async validSession(record) {
+        const session = await this.deps.getSession(record.sessionId);
+        if (!session || session.baseagent !== 'codex' || session.selfAID !== record.selfAid
+            || session.agentSessionId !== record.providerThreadId
+            || session.channel !== record.origin.channel
+            || session.channelType !== record.origin.channelType
+            || session.channelId !== record.origin.channelId
+            || (session.threadId || '') !== (record.origin.threadId || '')
+            || !(await this.deps.authorize(record, session)))
+            return undefined;
+        return session;
+    }
+    /** Recheck persisted answers after queue delays/restarts, immediately before a provider run. */
+    async validateQueuedAnswer(session, answer) {
+        if (!session.selfAID)
+            return false;
+        const record = this.read(session.selfAID, answer.requestId);
+        return !!record && record.sessionId === session.id
+            && ['submitting', 'answered', 'uncertain'].includes(record.status)
+            && record.providerThreadId === answer.providerThreadId
+            && record.itemId === answer.questionItemId && record.question.title === answer.question
+            && record.answer === answer.answer && !!(await this.validSession(record));
+    }
+    async deliver(record, adapter) {
+        if (this.registered.get(record.id) === adapter)
+            return;
+        // A channel reload replaces its callback/card registry. Rebind pending questions to the new adapter.
+        if (this.registered.has(record.id))
+            await this.deps.router.cancel(record.id, 'daemon_restart');
+        const previous = this.deliveries.get(record.id);
+        if (previous)
+            return previous;
+        const delivery = this.deliverOnce(record, adapter);
+        this.deliveries.set(record.id, delivery);
+        try {
+            await delivery;
+        }
+        finally {
+            this.deliveries.delete(record.id);
+        }
+    }
+    async deliverOnce(record, adapter) {
+        if (record.expiresAt <= Date.now() || !(await this.validSession(record))) {
+            record.status = 'cancelled';
+            record.reason = 'expired_or_binding_changed';
+            this.save(record);
+            return;
+        }
+        const options = record.question.options ?? [];
+        const interaction = {
+            type: 'interaction', id: record.id, sessionId: record.sessionId, channelId: record.origin.channelId,
+            initiatorId: record.origin.peerId, blocking: false, expiresAt: record.expiresAt,
+            kind: {
+                kind: 'action', title: '请补充信息', body: record.question.title, bodyFormat: 'plain',
+                buttons: options.map((label, index) => ({ key: `opt-${index}`, label })),
+                allowCustomInput: true,
+            },
+            fallback: {
+                command: 'ask',
+                buttonArgMap: Object.fromEntries(options.map((_, index) => [`opt-${index}`, `${record.id} ${index + 1}`])),
+                acceptFreeText: true, freeTextHint: `回复 /ask ${record.id} <回答>`,
+            },
+        };
+        // Register before dispatch: a fast reply must not race card delivery.
+        this.registered.set(record.id, adapter);
+        this.deps.router.register(record.id, record.sessionId, async (action, values) => {
+            const current = this.read(record.selfAid, record.id);
+            if (!current || current.status !== 'pending' || current.expiresAt <= Date.now()) {
+                await this.deps.router.cancel(record.id, 'expired_or_resolved');
+                return false;
+            }
+            const answer = this.answerText(current.question, action, values);
+            if (!answer)
+                return false;
+            const session = await this.validSession(current);
+            if (!session) {
+                await this.deps.router.cancel(record.id, 'binding_or_authorization_changed');
+                return false;
+            }
+            current.answer = answer;
+            current.status = 'submitting';
+            this.save(current);
+            try {
+                await this.deps.submit(current, session, {
+                    requestId: current.id, providerThreadId: current.providerThreadId,
+                    questionItemId: current.itemId, question: current.question.title, answer,
+                });
+                current.status = 'answered';
+                this.save(current);
+                this.registered.delete(record.id);
+                logger.info(`[AsyncQuestions] answer accepted: session=${record.sessionId} request=${record.id}`);
+                return true;
+            }
+            catch (error) {
+                current.status = 'uncertain';
+                current.reason = 'submission_failed';
+                this.save(current);
+                logger.warn(`[AsyncQuestions] answer submission failed: request=${record.id} error=${String(error)}`);
+                throw error;
+            }
+        }, {
+            initiatorId: record.origin.peerId, initiatorChannelKey: adapter.channelKey,
+            blocking: false, retainOnRejected: true, fallbackCommand: 'ask', timeoutMs: record.expiresAt - Date.now(),
+            onCancel: async (reason) => {
+                this.registered.delete(record.id);
+                if (reason === 'daemon_restart')
+                    return;
+                const current = this.read(record.selfAid, record.id);
+                if (current?.status === 'pending') {
+                    current.status = 'cancelled';
+                    current.reason = reason;
+                    this.save(current);
+                }
+                await adapter.invalidateInteraction?.(record.id, reason);
+            },
+        });
+        try {
+            const receipt = await sendInteractionPayload(adapter, {
+                ...record.envelope, operationId: `${record.id}-${Date.now()}`,
+            }, interaction, renderActionAsText(interaction), record.envelope.replyContext);
+            if (!isInteractionSendAccepted(receipt))
+                throw new Error('Async question card was not accepted for delivery');
+        }
+        catch (error) {
+            // Keep the durable pending record for a later channel reconnect/daemon restore.
+            await this.deps.router.cancel(record.id, 'daemon_restart');
+            throw error;
+        }
+    }
+    answerText(question, action, values) {
+        if (action === 'cancel' || action === 'dismiss' || values?.behavior === 'dismiss')
+            return undefined;
+        let answer;
+        if (action === '_custom_input')
+            answer = typeof values?.custom_text === 'string' ? values.custom_text.trim() : undefined;
+        else if (/^opt-\d+$/.test(action))
+            answer = question.options?.[Number(action.slice(4))];
+        else if (question.options?.length && /^\d+$/.test(action))
+            answer = question.options[Number(action) - 1];
+        else
+            answer = action.trim();
+        return answer && answer.length <= 65_536 ? answer : undefined;
+    }
+}
 const INBOUND_MESSAGE_LOG_TEXT_MAX_LENGTH = 240;
 export function formatInboundMessageLogText(text) {
     const singleLine = text.replace(/\s+/gu, ' ').trim();
@@ -519,12 +808,15 @@ export class ResponseEngine {
     primaryRunnerKey;
     interruptedSessions = new Map(); // sessionId → reason ('new_message' | 'stop' | ...)
     timeoutErrors = new Map();
+    activeTimeoutHandlers = new Map();
     /** sessionId → 已成功的模型降级状态（进程重启清零） */
     modelFallbackMap = new Map();
     /** sessionId → interruptible task-level API retry delays. */
     retryDelayWaiters = new Map();
     interactionRouter;
+    asyncQuestions;
     messageQueue;
+    taskRecoveryService;
     handoffRuntime;
     /** sessionId → 活跃的空闲监控器，用于等待用户交互期间暂停/恢复计时 */
     activeMonitors = new Map();
@@ -598,10 +890,7 @@ export class ResponseEngine {
         return createTextInferenceProvider(baseagent, config);
     }
     getAvailableBaseagentsForOwner(evolName) {
-        const prefix = `${evolName}::`;
-        return [...this.agentMap.keys()]
-            .filter(key => key.startsWith(prefix))
-            .map(key => key.slice(prefix.length));
+        return loadedBaseagentIds(this.agentMap.keys(), evolName);
     }
     async sendBaseagentMismatch(channelKey, channelId, session, error, replyContext) {
         const channelInfo = this.resolveChannelInfo(channelKey);
@@ -742,6 +1031,12 @@ export class ResponseEngine {
     }
     setInteractionRouter(router) {
         this.interactionRouter = router;
+        this.asyncQuestions = new AsyncQuestionService({
+            router,
+            getSession: id => this.sessionManager.getSessionById(id),
+            authorize: async (record, session) => this.authorizeAsyncQuestion(record, session),
+            submit: (record, session, answer) => this.submitAsyncQuestionAnswer(record, session, answer),
+        });
         // 等待用户交互期间暂停 idle 监控，应答/取消/超时后恢复——
         // 避免把「正在等用户点按钮」误判为「任务卡死」而中断任务。
         router.setWaitHooks({
@@ -752,9 +1047,118 @@ export class ResponseEngine {
                 this.activeMonitors.get(sessionId)?.resume();
             },
         });
+        for (const { adapter } of this.channels.values())
+            this.restoreAsyncQuestions(adapter);
     }
     setMessageQueue(queue) {
         this.messageQueue = queue;
+        this.taskRecoveryService = new TaskRecoveryService({
+            sessions: this.sessionManager,
+            queue,
+            getRunner: (session) => this.getAgent(session.metadata?.channelKey || session.channel, session.baseagent, session.selfAID),
+            resumePause: (sessionId) => this.resumeSession(sessionId),
+            hasChannel: (session) => !!this.resolveChannelInfo(session.metadata?.channelKey || session.channel),
+        });
+    }
+    async recoverTask(request) {
+        if (!this.taskRecoveryService) {
+            return { ok: false, status: 'not_recoverable', sessionId: request.sessionId, message: '消息队列尚未初始化' };
+        }
+        return this.taskRecoveryService.resume(request);
+    }
+    authorizeAsyncQuestion(record, session) {
+        const origin = record.origin;
+        const owner = this.agentRegistry?.resolveByChannel(origin.channel);
+        if (owner?.aid !== record.selfAid)
+            return false;
+        const chatType = origin.chatType === 'group' ? 'group' : 'private';
+        const channelType = origin.channelType || record.channelKey.split('#')[0];
+        const preflight = evaluateInboundAdmissionPreflight({
+            selfAid: record.selfAid, channelKey: record.channelKey, channelType, chatType, actorId: origin.peerId,
+        });
+        if (!preflight.allow || !evaluateOrdinaryInboundAdmission(preflight.context).allow)
+            return false;
+        const identity = this.inferDirectSessionIdentity({ ...origin, content: '' }, owner);
+        if (!identity || identity.role === 'none')
+            return false;
+        return authorizeAccess(buildAuthSubject({
+            selfAid: record.selfAid, channel: record.channelKey, channelType, chatType,
+            actorId: origin.peerId, channelId: session.channelId, conversationId: session.channelId, identity,
+        })).allow;
+    }
+    async submitAsyncQuestionAnswer(record, session, answer) {
+        const runner = this.getAgent(record.origin.channel, 'codex', record.selfAid);
+        if (!runner.steerAsyncQuestionAnswer)
+            throw new Error('Codex async input is unavailable');
+        if (await runner.steerAsyncQuestionAnswer(session.id, answer) === 'accepted')
+            return;
+        if (!this.messageQueue)
+            throw new Error('Async question resume queue is unavailable');
+        // The queue owns idle-thread restoration and a fresh task/permission context.
+        // Keep the exact Session/backend identity; never create a new topic for an old card.
+        await this.messageQueue.enqueuePersisted(session.id, {
+            ...record.origin, content: formatAsyncQuestionAnswer(answer),
+            asyncQuestionAnswer: answer, boundSessionId: session.id, baseagent: 'codex',
+            source: 'card-trigger', messageId: `async-answer-${record.id}`,
+            timestamp: Date.now(), receivedAt: Date.now(),
+            encrypted: record.envelope.replyContext?.metadata?.encrypted,
+            replyContext: record.envelope.replyContext,
+        }, session.projectPath, {
+            interruptible: false, interruptSamePeer: false,
+            agentName: this.agentRegistry?.resolveByChannel(record.origin.channel)?.name,
+            selfAID: record.selfAid, sessionKeyField: session.sessionKey,
+        });
+    }
+    /** Read the exact attempt's lifecycle without touching any newer task. */
+    async inspectTargetExecution(sessionId, attemptId, selfAid) {
+        const session = await this.sessionManager.getSessionById(sessionId);
+        if (!session || session.deletedAt || session.selfAID !== selfAid)
+            return { state: 'missing' };
+        const state = this.turnCoordinator.current(session);
+        const terminal = state.lastTerminal;
+        const matches = (context) => (context?.triggerAttemptId ?? context?.recovery?.attemptId) === attemptId;
+        if (terminal && matches(terminal.recoveryContext)) {
+            return { state: 'terminal', taskId: terminal.taskId, generation: terminal.generation,
+                outcome: terminal.status === 'committed' ? 'completed'
+                    : ['cancelled', 'superseded', 'interrupted'].includes(terminal.status) ? 'skipped' : 'failed',
+                reason: terminal.reason };
+        }
+        const queued = this.messageQueue?.getMessageState(sessionId, attemptId, selfAid);
+        if (queued?.state === 'queued')
+            return { state: 'live' };
+        const active = state.active;
+        if (active && matches(active.recoveryContext)) {
+            const identity = { taskId: active.taskId, generation: active.generation };
+            if (active.status === 'waiting_interaction' || active.status === 'interrupting'
+                || active.interactions.some(item => !item.settlement)
+                || this.isPauseRequested(sessionId) || this.retryDelayWaiters.has(sessionId))
+                return { state: 'live', ...identity };
+            const runner = this.getAgent(session.metadata?.channelKey || session.channel, session.baseagent, selfAid);
+            return { state: runner.hasActiveStream(sessionId) ? 'live' : 'missing', ...identity,
+                hasTerminalOwner: this.activeTimeoutHandlers.has(sessionId) };
+        }
+        // Never adopt or interrupt a newer task to clean up an older attempt.
+        if (active) {
+            return { state: 'terminal', outcome: 'skipped', reason: 'stale_generation',
+                taskId: active.taskId, generation: active.generation };
+        }
+        if (queued?.state === 'active') {
+            return { state: 'missing', hasTerminalOwner: this.activeTimeoutHandlers.has(sessionId) };
+        }
+        if (queued?.state === 'missing' && (active || terminal)) {
+            const current = active ?? terminal;
+            return { state: 'terminal', outcome: 'skipped', reason: 'stale_generation',
+                taskId: current.taskId, generation: current.generation };
+        }
+        return { state: 'missing' };
+    }
+    /** Outer execution deadlines use the same terminal owner as runner idle timeouts. */
+    async timeoutSession(sessionId, error) {
+        const timeout = this.activeTimeoutHandlers.get(sessionId);
+        if (timeout)
+            await timeout(error);
+        else
+            await this.interruptSession(sessionId, error instanceof OrphanedTargetSessionError ? 'execution_error' : 'timeout');
     }
     async interruptSession(sessionId, reason) {
         this.clearPauseSession(sessionId);
@@ -808,7 +1212,7 @@ export class ResponseEngine {
             // TimeoutController owns timeout delivery (including user-facing timeout
             // details) and already guarantees a single terminal status. Sending it
             // here as well would race that barrier and duplicate status.timeout.
-            if (!interruptedTaskId || effectiveReason === 'timeout')
+            if (!interruptedTaskId || effectiveReason === 'timeout' || effectiveReason === 'execution_error')
                 return Promise.resolve();
             const channelInfo = this.resolveChannelInfo(channelKey);
             if (!channelInfo)
@@ -930,6 +1334,8 @@ export class ResponseEngine {
     agentRegistry;
     setAgentRegistry(registry) {
         this.agentRegistry = registry;
+        for (const { adapter } of this.channels.values())
+            this.restoreAsyncQuestions(adapter);
     }
     /** 更新 EvolAgent.lastActivity —— 每次发出 status.* 事件（含 progress）时调用 */
     touchAgentActivity(channelKey) {
@@ -1026,6 +1432,15 @@ export class ResponseEngine {
         if (!this.channelTypeMap.has(type)) {
             this.channelTypeMap.set(type, adapter.channelName);
         }
+        this.restoreAsyncQuestions(adapter);
+    }
+    restoreAsyncQuestions(adapter) {
+        const selfAid = this.agentRegistry?.resolveByChannel(adapter.channelKey)?.aid;
+        if (selfAid && this.asyncQuestions) {
+            void this.asyncQuestions.restore(adapter, selfAid).catch(error => {
+                logger.warn(`[AsyncQuestions] channel restore failed: ${String(error)}`);
+            });
+        }
     }
     /**
      * 注销渠道适配器（热重载断开渠道时调用，避免遗留死实例）。
@@ -1219,7 +1634,10 @@ export class ResponseEngine {
             && (!authorization.triggerId || !authorization.runId || !authorization.attemptId)) {
             throw new Error('fullaccess Trigger authorization lacks scheduler identity or approval provenance');
         }
-        if (authorization.source !== 'fullaccess-command' && authorization.source !== 'trigger') {
+        if (authorization.source === 'agent-policy') {
+            assertAgentPolicyAuthorization(authorization);
+        }
+        else if (authorization.source !== 'fullaccess-command' && authorization.source !== 'trigger') {
             throw new Error('fullaccess execution authorization has an unsupported source');
         }
         if (!isFullAccessEnabled()) {
@@ -1241,6 +1659,8 @@ export class ResponseEngine {
         const originChannelKey = message.triggerMeta.originChannelKey;
         if (!selfAid || !actorId || !channelType || !originChannelKey)
             return undefined;
+        const chatType = message.triggerMeta.originChatType ?? 'private';
+        const conversationId = message.triggerMeta.originConversationId ?? actorId;
         const control = message.triggerMeta.originControl === true;
         let actor;
         let resolvedRole = 'none';
@@ -1249,9 +1669,9 @@ export class ResponseEngine {
                 selfAid,
                 channelKey: originChannelKey,
                 channelType,
-                chatType: 'private',
+                chatType,
                 actorId,
-                conversationId: actorId,
+                conversationId,
             });
             actor = detail.actor;
             resolvedRole = detail.effectiveRole || 'none';
@@ -1271,7 +1691,7 @@ export class ResponseEngine {
             channelType,
             originChannelKey,
             control,
-            peerKey: formatPeerKey(channelType, actorId),
+            peerKey: formatPeerKey(channelType, chatType === 'group' ? conversationId : actorId),
         };
     }
     resolveHandoffOriginExecutionIdentity(message, selfAid) {
@@ -1437,7 +1857,8 @@ export class ResponseEngine {
                 auditFullAccessEvent({
                     event: fallbackFullAccessAudit.authorization.source === 'trigger'
                         ? 'fullaccess.trigger.execution.ended'
-                        : 'fullaccess.execution.ended',
+                        : fallbackFullAccessAudit.authorization.source === 'agent-policy'
+                            ? 'fullaccess.agent-policy.execution.ended' : 'fullaccess.execution.ended',
                     source: fallbackFullAccessAudit.authorization.source,
                     actorId: fallbackFullAccessAudit.authorization.authorizedBy,
                     processRole: fallbackFullAccessAudit.processRole,
@@ -1458,6 +1879,9 @@ export class ResponseEngine {
     async processMessageWithMonitors(message) {
         const idleMs = (this.globalSettings.idleMonitor?.timeout ?? 120) * 1000;
         const totalExecutionMs = this.totalExecutionLimitMs();
+        // A discarded handoff must be dropped before any bound-session lookup.
+        // Restored origin deliveries may point at a session that has already been
+        // replaced; resolving it first would reactivate the stale session path.
         if (message.handoffDelivery
             && this.handoffRuntime
             && this.handoffRuntime.isDiscardedDelivery(message)) {
@@ -1466,9 +1890,32 @@ export class ResponseEngine {
                 + ` handoff=${message.handoffDelivery.handoffId}`);
             return;
         }
+        // Includes persisted queues, recovery triggers and delayed owner replies.
+        // A closed diagnostic must not activate its old main session again.
+        const diagnosticBoundId = message.boundSessionId ?? message.triggerMeta?.boundSessionId;
+        if (diagnosticBoundId) {
+            const bound = await this.sessionManager.getSessionById(diagnosticBoundId);
+            if (bound && (bound.metadata?.diagnostic || bound.metadata?.diagnosticStatus === 'cancelled')
+                && !isDiagnosticSessionActive(bound, this.sessionManager.getChatDir(bound))) {
+                logger.info(`[ResponseEngine] Skip closed diagnostic session ${bound.id}`);
+                return;
+            }
+        }
+        if (message.taskRecovery) {
+            const current = message.boundSessionId
+                ? await this.sessionManager.getSessionById(message.boundSessionId)
+                : undefined;
+            if (!current || current.selfAID !== message.selfAID || !isTaskRecoveryCurrent(current, message.taskRecovery)) {
+                this.publishTriggerExecutionSkipped(message, 'recovery_stale');
+                return;
+            }
+        }
         // 先解析会话，再优先用 session.metadata.channelKey 精确定位实例级 adapter
         // message.channel 现在存实例名（channelName），可直接用于精确路由
         const { session, absoluteProjectPath } = await this.resolveSession(message);
+        if ((session.metadata?.diagnostic || session.metadata?.diagnosticStatus === 'cancelled')
+            && !isDiagnosticSessionActive(session, this.sessionManager.getChatDir(session)))
+            return;
         const accessChannelKey = this.messageChannelKey(message, session);
         const accessChannelInfo = this.resolveChannelInfo(accessChannelKey);
         const accessAdapter = accessChannelInfo?.adapter;
@@ -1520,7 +1967,8 @@ export class ResponseEngine {
         const userRole = session.identity?.role || 'none';
         const isInternalHandoff = message.source === 'handoff';
         const fullAccessAuditCandidate = this.resolveFullAccessAuditCandidate(message);
-        const isCurrentFullAccessCommand = fullAccessAuditCandidate?.authorization.source === 'fullaccess-command'
+        const isCurrentFullAccessCommand = (fullAccessAuditCandidate?.authorization.source === 'fullaccess-command'
+            || fullAccessAuditCandidate?.authorization.source === 'agent-policy')
             && fullAccessAuditCandidate.processRole === 'fullaccess-run';
         const isCurrentFullAccessTrigger = fullAccessAuditCandidate?.authorization.source === 'trigger'
             && fullAccessAuditCandidate.processRole === 'fullaccess-run';
@@ -1609,11 +2057,17 @@ export class ResponseEngine {
             claimedByInternal: false,
             terminalDelivered: false,
             claim: () => {
-                if (!timeoutControl.error || this.interruptedSessions.get(session.id) !== 'timeout')
+                if (!timeoutControl.error || !['timeout', 'execution_error'].includes(this.interruptedSessions.get(session.id) ?? ''))
                     return undefined;
                 timeoutControl.claimedByInternal = true;
                 return timeoutControl.error;
             },
+            claimTerminal: () => {
+                if (timeoutControl.terminalDelivered)
+                    return false;
+                timeoutControl.terminalDelivered = true;
+                return true;
+            },
         };
         const rejectAfterInterruptBarrier = (error) => {
             if (timeoutTriggered)
@@ -1622,9 +2076,10 @@ export class ResponseEngine {
             timeoutControl.error = error;
             this.timeoutErrors.set(session.id, error);
             this.turnCoordinator.hydrate(session);
-            this.turnCoordinator.invalidate(session.id, 'timeout');
-            this.interruptedSessions.set(session.id, 'timeout');
-            const barrier = this.interruptSession(session.id, 'timeout')
+            const reason = error instanceof OrphanedTargetSessionError ? 'execution_error' : 'timeout';
+            this.turnCoordinator.invalidate(session.id, reason);
+            this.interruptedSessions.set(session.id, reason);
+            const barrier = this.interruptSession(session.id, reason)
                 .catch(interruptError => {
                 logger.debug(`[ResponseEngine] Timeout interrupt barrier failed: ${interruptError instanceof Error ? interruptError.message : String(interruptError)}`);
             });
@@ -1635,6 +2090,11 @@ export class ResponseEngine {
             });
         };
         const triggerAttemptId = message.replyContext?.metadata?.triggerAttemptId;
+        const externalTimeout = async (error) => {
+            rejectAfterInterruptBarrier(error);
+            await timeoutControl.barrier;
+        };
+        this.activeTimeoutHandlers.set(session.id, externalTimeout);
         const resetTimer = (eventType, toolName) => {
             monitor?.recordEvent(eventType || 'unknown', toolName);
             if (typeof triggerAttemptId === 'string') {
@@ -1714,11 +2174,9 @@ export class ResponseEngine {
             await Promise.race(processingPromises);
         }
         catch (error) {
-            if (error instanceof Error && (error.message === 'SDK_TIMEOUT' || error.message === 'TOTAL_EXECUTION_TIMEOUT')) {
+            if (error instanceof Error && (isExecutionFailure(error) || error.message === 'SDK_TIMEOUT' || error.message === 'TOTAL_EXECUTION_TIMEOUT')) {
                 await timeoutControl.barrier;
-                if (!timeoutControl.terminalDelivered) {
-                    await timeoutControl.deliverUnhandled?.(error);
-                }
+                await timeoutControl.deliverUnhandled?.(error);
                 this.timeoutErrors.delete(session.id);
             }
             // 超时错误：kill 级别已发送诊断信息，无需再发
@@ -1759,6 +2217,8 @@ export class ResponseEngine {
             if (totalExecutionTimer)
                 clearTimeout(totalExecutionTimer);
             this.activeMonitors.delete(streamKey);
+            if (this.activeTimeoutHandlers.get(session.id) === externalTimeout)
+                this.activeTimeoutHandlers.delete(session.id);
         }
     }
     resolveFullAccessAuditCandidate(message) {
@@ -1766,15 +2226,18 @@ export class ResponseEngine {
         if (commandAuthorization?.permissionMode === 'fullaccess'
             && commandAuthorization.processRole === 'fullaccess-run'
             && commandAuthorization.dataScope === 'daemon'
-            && commandAuthorization.source === 'fullaccess-command'
+            && (commandAuthorization.source === 'fullaccess-command' || commandAuthorization.source === 'agent-policy')
             && typeof commandAuthorization.authorizedBy === 'string'
             && commandAuthorization.authorizedBy.length > 0) {
             let currentOwner = false;
             try {
                 currentOwner = isFullAccessEnabled()
                     && new Set(loadDaemonConfig().owners ?? []).has(commandAuthorization.authorizedBy);
+                if (commandAuthorization.source === 'agent-policy')
+                    assertAgentPolicyAuthorization(commandAuthorization);
             }
             catch {
+                currentOwner = false;
                 // Runtime validation will fail closed; the audit must still retain the
                 // attempted authorization without falsely labeling it active.
             }
@@ -1894,7 +2357,7 @@ export class ResponseEngine {
         // states. An untransitioned `created` agent or malformed lifecycle must
         // not fall through to a base runner's default prompt. Missing lifecycle
         // is normalized to active for legacy configurations.
-        if (owningAgentForTask && !isActive && !isBootstrapping) {
+        if (owningAgentForTask && ((!isActive && !isBootstrapping) || initializationBlocksTasks(owningAgentForTask.config))) {
             const blockedLifecycle = lifecycle
                 ?? `invalid (${String(owningAgentForTask.config.lifecycle)})`;
             logger.error(`[ResponseEngine] Agent lifecycle is not runnable: agent=${owningAgentForTask.aid} lifecycle=${blockedLifecycle}`);
@@ -1991,7 +2454,7 @@ export class ResponseEngine {
             ?? this.resolveHandoffOriginExecutionIdentity(message, selfAid);
         const configChannelType = authorizationIdentity?.channelType ?? currentChannelType;
         const configChatType = authorizationIdentity
-            ? (message.handoffDelivery?.originAuthorization?.chatType ?? 'private')
+            ? (message.triggerMeta?.originChatType ?? message.handoffDelivery?.originAuthorization?.chatType ?? 'private')
             : (chatType === 'group' ? 'group' : 'private');
         // A group channel ID identifies the conversation, not the authenticated
         // operator.  Keep the historical private-chat fallback (where channelId
@@ -2179,25 +2642,30 @@ export class ResponseEngine {
         });
         if (timeoutControl) {
             timeoutControl.deliverUnhandled = async (timeoutError) => {
-                if (timeoutControl.terminalDelivered)
+                if (!timeoutControl.claimTerminal())
                     return;
-                timeoutControl.terminalDelivered = true;
                 const isTotalExecutionTimeout = timeoutError.message === 'TOTAL_EXECUTION_TIMEOUT';
-                const totalExecutionMs = this.totalExecutionLimitMs();
-                const statusPayload = {
+                const totalExecutionMs = timeoutError instanceof ExecutionTimeoutError ? timeoutError.timeoutMs : this.totalExecutionLimitMs();
+                const statusPayload = timeoutError instanceof OrphanedTargetSessionError ? {
+                    kind: 'status.error',
+                    metadata: { errorType: timeoutError.reason, message: '任务执行状态丢失，已结束本次执行。' },
+                } : {
                     kind: 'status.timeout',
                     metadata: isTotalExecutionTimeout
-                        ? (totalExecutionMs === undefined ? {} : { totalExecutionMs })
+                        ? { ...(totalExecutionMs === undefined ? {} : { totalExecutionMs }),
+                            ...(timeoutError instanceof ExecutionTimeoutError ? { reason: timeoutError.reason } : {}) }
                         : { idleSec: getLastIdleSec?.() || undefined },
                 };
                 const idleSec = getLastIdleSec?.() || 0;
-                const userMessage = isTotalExecutionTimeout
-                    ? (totalExecutionMs === undefined
-                        ? '⚠️ 任务超过总执行时限，已自动中断'
-                        : `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`)
-                    : idleSec > 0
-                        ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断`
-                        : '⚠️ 任务超时，已自动中断';
+                const userMessage = timeoutError instanceof OrphanedTargetSessionError
+                    ? '⚠️ 任务执行状态丢失，已结束本次执行。'
+                    : isTotalExecutionTimeout
+                        ? (totalExecutionMs === undefined
+                            ? '⚠️ 任务超过总执行时限，已自动中断'
+                            : `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`)
+                        : idleSec > 0
+                            ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断`
+                            : '⚠️ 任务超时，已自动中断';
                 agent.cleanupStream(streamKey);
                 this.sessionManager.clearProcessingIfTask(session.id, taskId);
                 if (this.activeTaskRuntimeContexts.get(session.id)?.taskId === taskId) {
@@ -2211,13 +2679,13 @@ export class ResponseEngine {
                 await adapter.send(envelope, {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: isTotalExecutionTimeout ? 'total_execution_timeout' : 'timeout',
+                    reason: isExecutionFailure(timeoutError) ? timeoutError.reason : isTotalExecutionTimeout ? 'total_execution_timeout' : 'timeout',
                 }).catch(() => { });
                 if (daemonTrigger) {
                     await adapter.send(envelope, statusPayload).catch(() => { });
                 }
                 this.touchAgentActivity(channelKey);
-                this.publishTriggerExecutionFailure(message, timeoutError.message, {
+                this.publishTriggerExecutionFailure(message, isExecutionFailure(timeoutError) ? timeoutError.reason : timeoutError.message, {
                     messageId,
                     causation: taskCausation,
                 });
@@ -2225,9 +2693,14 @@ export class ResponseEngine {
                 this.eventBus.publish({
                     type: 'task:error',
                     sessionId: session.id,
+                    agentAid: runnerSelfAid,
+                    peerId: configActorId,
+                    encrypted: message.encrypted ?? message.replyContext?.metadata?.encrypted,
+                    originTriggerId: message.triggerMeta?.triggerId,
                     taskId,
                     generation: turnLease?.generation,
                     error: timeoutError.message,
+                    terminalReason: isExecutionFailure(timeoutError) ? timeoutError.reason : undefined,
                     errorType,
                     agentName: agentNameForStats,
                     causation: taskCausation,
@@ -2356,14 +2829,28 @@ export class ResponseEngine {
             // message is authoritative; session metadata is only a fallback for
             // legacy paths that do not carry a per-message display name.
             const peerName = message.peerName ?? session.metadata?.peerName;
-            const peerId = session.metadata?.peerId ?? message.peerId ?? message.channelId;
+            const peerId = message.peerId ?? session.metadata?.peerId ?? message.channelId;
             const peerShort = peerId ? peerId.split('.')[0].split(':')[0] : '?';
             const peerLabel = peerName && peerName !== peerShort ? `${peerShort}(${peerName})` : peerShort;
             logger.info(`[ResponseEngine] session=${session.id} task=${taskId} peer=${peerLabel} chatType=${session.chatType} chatMode=${effectiveChatMode} baseagent=${session.baseagent} msgChatType=${message.chatType ?? 'n/a'}`);
             // Establish the durable turn before exposing any processing state. This
             // lets an immediate /stop or replacement message close the same task and
             // prevents a BusinessTrip reaction from becoming orphaned during setup.
-            turnLease = await this.turnCoordinator.begin(session, taskId);
+            if (message.taskRecovery && !isTaskRecoveryCurrent({
+                ...session, metadata: { ...session.metadata, turnState: this.turnCoordinator.current(session) },
+            }, message.taskRecovery)) {
+                this.publishTriggerExecutionSkipped(message, 'recovery_stale');
+                return;
+            }
+            turnLease = await this.turnCoordinator.begin(session, taskId, undefined, configActorId ? {
+                peerId: configActorId,
+                encrypted: message.encrypted ?? message.replyContext?.metadata?.encrypted,
+                baseagent: session.baseagent,
+                agentSessionId: session.agentSessionId,
+                originTriggerId: message.triggerMeta?.triggerId,
+                recovery: message.taskRecovery?.origin,
+                triggerAttemptId: message.triggerMeta?.attemptId,
+            } : undefined);
             // 记录开始处理
             const taskEncrypt = message.replyContext?.metadata?.encrypted != null ? !!(message.replyContext.metadata.encrypted) : undefined;
             this.eventBus.publish({
@@ -2405,6 +2892,7 @@ export class ResponseEngine {
                 flushDelay: (options?.flushDelay ?? this.agentRegistry?.resolveByChannel(channelKey)?.config?.flush_delay ?? 3) * 1000,
                 suppressActivityItems: isProactive ? false : middleOutputMode !== 'all',
                 suppressIntermediateText: isProactive ? false : middleOutputMode === 'none',
+                deferTextUntilBoundary: (message.channelType ?? session.channelType) === 'aun' && session.chatType === 'private',
                 operationalNoticesAsText: !isProactive && middleOutputMode !== 'none',
                 fileMarkerPattern: options?.fileMarkerPattern,
                 send: async (payload) => {
@@ -2440,7 +2928,10 @@ export class ResponseEngine {
                     if (payload.kind === 'result.text' && payload.isFinal) {
                         opts.title = '\u2705 \u6700\u7ec8\u56de\u590d:';
                     }
-                    opts.metadata = withTaskMetadata(opts.metadata);
+                    opts.metadata = withTaskMetadata({
+                        ...(opts.metadata ?? {}),
+                        ...(payload.kind === 'result.text' ? payload.metadata : {}),
+                    });
                     // status.notice is a diagnostic observation, not execution activity.
                     if (payload.kind.startsWith('status.') && payload.kind !== 'status.notice') {
                         this.touchAgentActivity(channelKey);
@@ -2585,10 +3076,10 @@ export class ResponseEngine {
                 };
             })();
             let effectivePermissionMode = 'readonly';
-            // Allocate/register the session-owned root before any runner preflight
-            // context is installed. Codex may already own a stronger directory;
-            // other runners receive a private child of the process TMPDIR.
-            const sessionRuntimeDir = agent.getManagedTempDir?.(session.id) ?? ensureSessionRuntimeDir(session.id);
+            // Allocate the stable session-owned root before any runner preflight
+            // context is installed. Every runner for this EvolCore session receives
+            // the same directory, independent of daemon or runner lifetimes.
+            const sessionRuntimeDir = ensureSessionRuntimeDir(session.id);
             const recordExecutionAnomaly = triggerRunId
                 ? (anomaly) => {
                     recordTriggerExecutionAnomaly(triggerRunId, {
@@ -2636,8 +3127,8 @@ export class ResponseEngine {
                 pauseController: taskPauseController,
                 preToolUsePolicyHook: pureSessionPolicyHook,
                 armApprovedDelegationCommand: this.agentDelegationRegistry
-                    ? (carrierToken, commandHash) => this.agentDelegationRegistry.armApprovedCommand({
-                        carrierToken,
+                    ? (sessionToken, commandHash) => this.agentDelegationRegistry.armApprovedCommand({
+                        sessionToken,
                         sessionId: session.id,
                         taskId,
                         commandHash,
@@ -2812,10 +3303,19 @@ export class ResponseEngine {
                         if (commandFullAccess.permissionMode !== 'fullaccess'
                             || commandFullAccess.processRole !== 'fullaccess-run'
                             || commandFullAccess.dataScope !== 'daemon'
-                            || commandFullAccess.source !== 'fullaccess-command'
+                            || (commandFullAccess.source !== 'fullaccess-command' && commandFullAccess.source !== 'agent-policy')
                             || !commandFullAccess.authorizedBy) {
                             throw new Error('fullaccess command authorization is missing or malformed');
                         }
+                        if (commandFullAccess.source === 'agent-policy'
+                            && (commandFullAccess.agentAid !== runnerSelfAid
+                                || configChatType !== 'private'
+                                || (message.source !== undefined && message.source !== 'user')
+                                || !hasTrustedPrincipal(authenticatedActor)
+                                || authenticatedActor.principalId !== commandFullAccess.authorizedBy
+                                || authenticatedActor.operatorId !== commandFullAccess.policyActor?.operatorId)) {
+                            throw new Error('Agent fullaccess policy authorization is missing its Agent identity');
+                        }
                         fullAccessAuthorization = commandFullAccess;
                     }
                     else {
@@ -3030,18 +3530,25 @@ export class ResponseEngine {
                 // happen before task-start auto compact because compact is a backend
                 // management action just like the subsequent runQuery.
                 let runAgentSessionId = session.agentSessionId;
-                if (session.threadId
+                if ((session.threadId || message.taskRecovery)
                     && typeof this.sessionManager.getSessionById === 'function') {
                     const latestBackendSession = await this.sessionManager.getSessionById(session.id);
-                    if (!latestBackendSession || latestBackendSession.threadId !== session.threadId) {
+                    if (!latestBackendSession || latestBackendSession.deletedAt || latestBackendSession.threadId !== session.threadId) {
                         throw new Error('topic session changed before backend run started');
                     }
+                    if (message.taskRecovery && (latestBackendSession.agentSessionId !== message.taskRecovery.agentSessionId
+                        || latestBackendSession.baseagent !== message.taskRecovery.baseagent)) {
+                        throw new Error('recovery backend changed before execution');
+                    }
                     runAgentSessionId = latestBackendSession.agentSessionId;
                     session.agentSessionId = runAgentSessionId;
                     session.metadata = latestBackendSession.metadata;
                 }
                 modelOverride = {
                     ...(modelOverride || {}),
+                    ...(message.taskRecovery
+                        ? { recovery: { agentSessionId: message.taskRecovery.agentSessionId } }
+                        : {}),
                     ...(session.threadId
                         ? { backend: { kind: 'topic', agentSessionId: runAgentSessionId ?? null } }
                         : {}),
@@ -3054,13 +3561,17 @@ export class ResponseEngine {
                     },
                 };
                 const refreshTopicBindingForLogicalRetry = async () => {
-                    if (!session.threadId || typeof this.sessionManager.getSessionById !== 'function')
+                    if ((!session.threadId && !message.taskRecovery) || typeof this.sessionManager.getSessionById !== 'function')
                         return;
                     const latest = await this.sessionManager.getSessionById(session.id);
                     if (!latest || latest.threadId !== session.threadId) {
                         throw new Error('topic session changed during backend run');
                     }
                     const latestAgentSessionId = latest.agentSessionId;
+                    if (message.taskRecovery && (latestAgentSessionId !== message.taskRecovery.agentSessionId
+                        || latest.baseagent !== message.taskRecovery.baseagent)) {
+                        throw new Error('recovery backend changed during execution');
+                    }
                     session.agentSessionId = latestAgentSessionId;
                     session.metadata = latest.metadata;
                     if (latestAgentSessionId === runAgentSessionId)
@@ -3097,6 +3608,26 @@ export class ResponseEngine {
                     groupId: session.metadata?.groupId || message.channelId,
                     channel: currentChannelType || message.channel,
                 });
+                const historyGroupId = session.metadata?.groupId || message.channelId;
+                const canUseGroupHistory = (operation) => {
+                    if (currentChannelType !== 'aun' || session.chatType !== 'group' || !selfAid || !historyGroupId)
+                        return false;
+                    const historySubject = buildAuthSubject({
+                        selfAid, actorId: configActorId, channel: channelKey, channelType: configChannelType,
+                        chatType: configChatType, channelId: message.channelId,
+                        conversationId: configChatType === 'group' ? historyGroupId : configActorId,
+                        permissionMode: effectivePermissionMode,
+                    });
+                    return authorizeOperation({
+                        source: 'agent-tool', subject: historySubject, audit: false,
+                        intent: {
+                            operation, scope: ['owner', 'admin'].includes(historySubject.role) ? 'agent' : 'relation',
+                            source: 'agent-tool',
+                            args: { self: selfAid, targetId: historyGroupId, peer: historyGroupId,
+                                peerKey: formatPeerKey('aun', historyGroupId) },
+                        },
+                    }).allow;
+                };
                 // Kit renderer: 组装上下文
                 const pkgRoot = getPackageRoot();
                 const kitCtx = {
@@ -3128,11 +3659,12 @@ export class ResponseEngine {
                         peerKey,
                         peerName: peerName || undefined,
                         peerRole,
-                        peerType: message.peerType || session.metadata?.peerType || undefined,
+                        // Display missing identity explicitly without changing the mode resolver's legacy fallback.
+                        peerType: peerType || 'unknown',
                         sameDevice: message.sameDevice ?? false,
                         sameNetwork: message.sameNetwork ?? false,
                         sameEgressIp: message.sameEgressIp ?? false,
-                        groupId: session.metadata?.groupId || undefined,
+                        groupId: session.chatType === 'group' ? historyGroupId : undefined,
                         groupName: session.metadata?.groupName || undefined,
                         // 信封展示用：有群名则「名<ID>」，否则纯 ID。规避模板引擎无 not/else 的限制。
                         groupLabel: session.metadata?.groupId
@@ -3147,6 +3679,7 @@ export class ResponseEngine {
                             ?? session.metadata?.mentionMode
                             ?? message.mentionMode
                             ?? undefined,
+                        groupHistoryAvailable: canUseGroupHistory('ec.group.history'),
                         clientType: message.clientType || undefined,
                         permissionMode: effectivePermissionMode,
                         capabilities: capParts.length > 0 ? capParts.join('、') : undefined,
@@ -3343,11 +3876,9 @@ export class ResponseEngine {
                         }
                     }
                 }
-                // The runner may already own a stronger per-session directory (Codex
-                // registers one before constructing its thread). Other runners use a
-                // private child of the process-provided TMPDIR. Both paths are passed
-                // explicitly so sandboxed helper commands never fall back to a shared
-                // agent or project directory for transient state.
+                // Pass the stable session directory explicitly so sandboxed helper
+                // commands never fall back to a process, agent, or project directory
+                // for transient state.
                 const taskRuntimeContext = {
                     taskId,
                     sessionId: session.id,
@@ -3430,7 +3961,8 @@ export class ResponseEngine {
                                 auditFullAccessEvent({
                                     event: fullAccessAuthorization.source === 'trigger'
                                         ? 'fullaccess.trigger.execution.started'
-                                        : 'fullaccess.execution.started',
+                                        : fullAccessAuthorization.source === 'agent-policy'
+                                            ? 'fullaccess.agent-policy.execution.started' : 'fullaccess.execution.started',
                                     source: fullAccessAuthorization.source,
                                     actorId: fullAccessAuthorization.authorizedBy,
                                     processRole: fullAccessAuditProcessRole,
@@ -3454,6 +3986,23 @@ export class ResponseEngine {
                             }
                             fullAccessRunnerInvoked = true;
                         }
+                        if (message.asyncQuestionAnswer) {
+                            if (session.baseagent !== 'codex' || runAgentSessionId !== message.asyncQuestionAnswer.providerThreadId) {
+                                throw new Error('Async question backend changed before queued resume');
+                            }
+                            if (!(await this.asyncQuestions?.validateQueuedAnswer(session, message.asyncQuestionAnswer))) {
+                                throw new Error('Async question authorization or persisted answer changed before queued resume');
+                            }
+                            // An active queue item restored after submission resumes the unfinished work.
+                            // Its native answer is already in Codex history and must not be appended twice.
+                            if (!message.restartResume?.submitted) {
+                                modelOverride = { ...modelOverride, asyncQuestionAnswer: message.asyncQuestionAnswer };
+                            }
+                        }
+                        if (session.baseagent === 'codex') {
+                            modelOverride = { ...modelOverride,
+                                enableRequestUserInput: effectiveAgentConfig?.baseagents?.codex?.enableRequestUserInput ?? true };
+                        }
                         const stream = await agent.runQuery(session.id, effectivePrompt, absoluteProjectPath, runAgentSessionId, renderResult?.images.length ? renderResult.images : message.images, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
                         // The turn may be superseded while the runner is still creating its
                         // backend query. Replay the interrupt after runQuery resolves, when
@@ -3470,7 +4019,23 @@ export class ResponseEngine {
                         const processAttempt = this.processEventStream(stream, session, agent, renderer, (eventType, toolName) => {
                             resetTimer(eventType, toolName);
                             attemptTimeout?.reset();
-                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode, selfAid);
+                        }, shouldSuppress, proactive, resolvedMode ? { mode: resolvedMode.mode, state: modeState } : undefined, taskCausation, turnLease, effectivePermissionMode, selfAid, async (request) => {
+                            if (!this.asyncQuestions)
+                                throw new Error('Async question service is unavailable');
+                            if (permissionContext.approvalInteractionPolicy === 'deny') {
+                                logger.info(`[AsyncQuestions] no interactive recipient for unattended task: session=${session.id}`);
+                                return;
+                            }
+                            await renderer.flush(false);
+                            try {
+                                await this.asyncQuestions.present(session, request, message, adapter, envelope);
+                            }
+                            catch (error) {
+                                // Card dispatch is non-blocking business input. Keep consuming the running turn;
+                                // pending records can be delivered after reconnect/restart.
+                                logger.warn(`[AsyncQuestions] presentation failed: session=${session.id} error=${String(error)}`);
+                            }
+                        });
                         streamResult = attemptTimeout
                             ? await Promise.race([processAttempt, attemptTimeout.promise])
                             : await processAttempt;
@@ -3889,7 +4454,7 @@ export class ResponseEngine {
                 // `hasReceivedText` 是任务级计数。工具调用前的文字已经显示，并不表示最后一轮
                 // （通常来自 complete.result）的文字也已显示；用本轮投影标记避免终态丢失。
                 if (shouldSuppress() || !streamResult.hasProjectedCurrentReplyText) {
-                    renderer.addText(visibleFinalReplyText);
+                    await renderer.addText(visibleFinalReplyText, undefined, undefined, streamResult.assistantUuid);
                 }
             }
             // 先清理流和处理中状态（保证即使 flush 卡住，session 也不会永久处于"处理中"）
@@ -3908,7 +4473,7 @@ export class ResponseEngine {
                 const suffix = showHint
                     ? `\n\n---\n⚠️ [降级模型: ${usedFallback.model} | 可告诉我"帮我检查可用模型"来诊断]`
                     : `\n\n---\n⚠️ [降级模型: ${usedFallback.model}]`;
-                renderer.addText(suffix);
+                await renderer.addText(suffix, undefined, undefined, streamResult.assistantUuid);
                 if (showHint && curFbState) {
                     curFbState.hintShown = true;
                     this.modelFallbackMap.set(session.id, curFbState);
@@ -3921,7 +4486,14 @@ export class ResponseEngine {
             }
             else {
                 // Flush 剩余内容（文件标记已在 flush 时自动移除）
-                await renderer.flush(true);
+                // A final text flush can also contain failed output. Preserve the
+                // outcome so AUN does not label that text as normal completion.
+                if (streamResult.isError && !isExpectedTerminalInterrupt(streamResult.terminalReason)) {
+                    await renderer.flush(true, 'failed');
+                }
+                else {
+                    await renderer.flush(!isExpectedTerminalInterrupt(streamResult.terminalReason));
+                }
             }
             const terminalInterrupt = isExpectedTerminalInterrupt(streamResult.terminalReason);
             if (!streamResult.isError && !terminalInterrupt) {
@@ -3944,7 +4516,8 @@ export class ResponseEngine {
                 }
             }
             else {
-                await this.turnCoordinator.finish(session, turnLease, terminalInterrupt ? 'cancelled' : 'failed', streamResult.protocolIncompleteReason || streamResult.terminalReason || streamResult.subtype);
+                await this.turnCoordinator.finish(session, turnLease, terminalInterrupt ? 'cancelled' : 'failed', permissionTerminalFailure ? 'permission_denied'
+                    : streamResult.protocolIncompleteReason || streamResult.terminalReason || streamResult.subtype);
             }
             // 注意：不在此处清除 interruptedSessions，由下一条消息的 prompt 包装逻辑消费
             const interruptReason = this.interruptedSessions.get(session.id);
@@ -3978,7 +4551,7 @@ export class ResponseEngine {
                     // DaemonChannel settles a trigger when it receives a terminal
                     // payload. Send the metadata-bearing status first so failed runs do
                     // not lose their tool counts and recovery diagnostics.
-                    if (message.source === 'trigger') {
+                    if (this.isTrustedDaemonTrigger(message)) {
                         await adapter.send(envelope, { kind: 'status.error', metadata: terminalMetadata }).catch(() => { });
                         await adapter.send(envelope, { kind: 'result.error', text: userErrorSummary, reason: rawSubtype }).catch(() => { });
                     }
@@ -4019,6 +4592,10 @@ export class ResponseEngine {
                     this.eventBus.publish({
                         type: 'task:error',
                         sessionId: session.id,
+                        agentAid: runnerSelfAid,
+                        peerId: configActorId,
+                        encrypted: message.encrypted ?? message.replyContext?.metadata?.encrypted,
+                        originTriggerId: message.triggerMeta?.triggerId,
                         taskId,
                         generation: turnLease?.generation,
                         error: errorSummary,
@@ -4297,7 +4874,8 @@ export class ResponseEngine {
                 await timeoutControl?.barrier;
             }
             const handlingTimeout = error instanceof Error
-                && (error.message === 'SDK_TIMEOUT' || error.message === 'TOTAL_EXECUTION_TIMEOUT');
+                && (isExecutionFailure(error) || error.message === 'SDK_TIMEOUT' || error.message === 'TOTAL_EXECUTION_TIMEOUT');
+            const ownsTimeoutTerminal = !handlingTimeout || !timeoutControl || timeoutControl.claimTerminal();
             if (handlingTimeout) {
                 this.timeoutErrors.delete(session.id);
             }
@@ -4319,11 +4897,12 @@ export class ResponseEngine {
             const errType = classifyError(error);
             const interruptReason = this.interruptedSessions.get(session.id);
             const isTotalExecutionTimeout = error instanceof Error && error.message === 'TOTAL_EXECUTION_TIMEOUT';
-            const isTimeout = error instanceof Error && error.message === 'SDK_TIMEOUT';
+            const isTimeout = error instanceof Error && (error.message === 'SDK_TIMEOUT' || error instanceof ExecutionTimeoutError);
             const canPublishTerminal = !turnLease || this.turnCoordinator.canPublish(turnLease);
             const staleSupersededTurn = !!turnLease
                 && !canPublishTerminal
                 && interruptReason !== 'timeout'
+                && interruptReason !== 'execution_error'
                 && !isTimeout
                 && !isTotalExecutionTimeout;
             const isUserInterrupt = isNonErrorInterruptReason(interruptReason) || staleSupersededTurn;
@@ -4331,7 +4910,7 @@ export class ResponseEngine {
             if (isUserInterrupt) {
                 await this.publishTriggerExecutionInterrupted(message, adapter, envelope, interruptReason ?? 'stale_turn', taskCausation);
             }
-            else {
+            else if (ownsTimeoutTerminal) {
                 this.publishTriggerExecutionFailure(message, errorMsg, {
                     messageId,
                     causation: taskCausation,
@@ -4340,24 +4919,27 @@ export class ResponseEngine {
             if (leaseWasCurrent && turnLease) {
                 await this.turnCoordinator.finish(session, turnLease, 'failed', error instanceof Error ? error.message : String(error));
             }
-            const totalExecutionMs = this.totalExecutionLimitMs();
+            const totalExecutionMs = error instanceof ExecutionTimeoutError ? error.timeoutMs : this.totalExecutionLimitMs();
             const procStatus = errType === ErrorType.SDK_TIMEOUT || isTotalExecutionTimeout ? 'timeout'
                 : errType === ErrorType.STREAM_ERROR ? 'interrupted'
                     : 'error';
             const daemonTrigger = this.isTrustedDaemonTrigger(message);
-            const statusPayload = procStatus === 'timeout'
-                ? { kind: 'status.timeout', metadata: isTotalExecutionTimeout
-                        ? (totalExecutionMs === undefined ? {} : { totalExecutionMs })
-                        : { idleSec: getLastIdleSec?.() || undefined } }
-                : procStatus === 'interrupted'
-                    ? { kind: 'status.interrupted', metadata: { reason: 'stream_error' } }
-                    : { kind: 'status.error' };
+            const statusPayload = error instanceof OrphanedTargetSessionError
+                ? { kind: 'status.error', metadata: { errorType: error.reason, message: '任务执行状态丢失，已结束本次执行。' } }
+                : procStatus === 'timeout'
+                    ? { kind: 'status.timeout', metadata: isTotalExecutionTimeout
+                            ? { ...(totalExecutionMs === undefined ? {} : { totalExecutionMs }),
+                                ...(error instanceof ExecutionTimeoutError ? { reason: error.reason } : {}) }
+                            : { idleSec: getLastIdleSec?.() || undefined } }
+                    : procStatus === 'interrupted'
+                        ? { kind: 'status.interrupted', metadata: { reason: 'stream_error' } }
+                        : { kind: 'status.error' };
             // 用户主动中断（新消息打断 或 /stop 命令）时静默，不发送中断/错误提示
-            if (!isUserInterrupt && !daemonTrigger) {
+            if (!isUserInterrupt && ownsTimeoutTerminal && !daemonTrigger) {
                 await adapter.send(envelope, statusPayload).catch(() => { });
                 this.touchAgentActivity(channelKey);
             }
-            if (!isUserInterrupt && daemonTrigger)
+            if (!isUserInterrupt && ownsTimeoutTerminal && daemonTrigger)
                 this.touchAgentActivity(channelKey);
             // 用户主动中断时降级日志；其余仍按 error 记录
             if (isUserInterrupt) {
@@ -4371,13 +4953,18 @@ export class ResponseEngine {
             // （message-queue / slash-handler）已发过 task:interrupted（它填充了
             // interruptedSessions，isUserInterrupt 才会为真），stats 侧已据此收尾任务。
             // 此处不再发任何事件——发 task:error 会误归类，重发 task:interrupted 会重复记账。
-            if (!isUserInterrupt) {
+            if (!isUserInterrupt && ownsTimeoutTerminal) {
                 this.eventBus.publish({
                     type: 'task:error',
                     sessionId: session.id,
+                    agentAid: runnerSelfAid,
+                    peerId: configActorId,
+                    encrypted: message.encrypted ?? message.replyContext?.metadata?.encrypted,
+                    originTriggerId: message.triggerMeta?.triggerId,
                     taskId,
                     generation: turnLease?.generation,
                     error: errorMsg,
+                    terminalReason: isExecutionFailure(error) ? error.reason : undefined,
                     errorType,
                     agentName: agentNameForStats,
                     causation: taskCausation,
@@ -4385,14 +4972,19 @@ export class ResponseEngine {
                 recordCausationSpan(taskCausation, 'task.run', { status: 'failed', refs: { taskId, sessionId: session.id, messageId }, reason: errorType });
             }
             // 记录处理失败
-            logger.message({
-                msgId: messageId,
-                sessionId: session.id,
-                dir: 'inbound',
-                status: isUserInterrupt ? 'interrupted' : 'failed',
-                error: error instanceof Error ? error.message : String(error)
-            });
-            if (error instanceof Error && !isUserInterrupt) {
+            if (ownsTimeoutTerminal) {
+                logger.message({
+                    msgId: messageId,
+                    sessionId: session.id,
+                    dir: 'inbound',
+                    status: isUserInterrupt ? 'interrupted' : 'failed',
+                    error: error instanceof Error ? error.message : String(error)
+                });
+            }
+            else {
+                logger.info(`[ResponseEngine] Duplicate timeout terminal suppressed: session=${session.id} task=${taskId}`);
+            }
+            if (error instanceof Error && !isUserInterrupt && ownsTimeoutTerminal) {
                 logger.error(`[${message.channel}] Error stack:`, error.stack);
             }
             // 发送用户友好的错误消息
@@ -4402,7 +4994,11 @@ export class ResponseEngine {
             const retryExhaustedCount = getRetryExhaustedCount(error);
             const modelFallbackExhaustedMessage = getModelFallbackExhaustedMessage(error);
             const retryInputAlreadySubmitted = wasRetryInputAlreadySubmitted(error);
-            if (isUserInterrupt) {
+            if (!ownsTimeoutTerminal) {
+                // The monitor path already owns delivery for this timeout. Cleanup and
+                // durable turn finalization above still run, but no terminal is emitted twice.
+            }
+            else if (isUserInterrupt) {
                 logger.info(`[ResponseEngine] User interrupt by new_message, skip sending error message`);
             }
             else if (error?._errorAlreadySent && !daemonTrigger && !retryExhaustedCount && !isTimeout && !isTotalExecutionTimeout) {
@@ -4411,19 +5007,21 @@ export class ResponseEngine {
             else {
                 // SDK_TIMEOUT：status.timeout 已发结构化状态，此处再补一条用户可见的错误文本（result.error）
                 const idleSec = getLastIdleSec?.() || 0;
-                const userMessage = retryExhaustedCount
-                    ? formatRetryableErrorFinalMessage(error, retryExhaustedCount)
-                    : retryInputAlreadySubmitted
-                        ? formatRetryInputAlreadySubmittedMessage(error)
-                        : modelFallbackExhaustedMessage
-                            ? modelFallbackExhaustedMessage
-                            : isTotalExecutionTimeout
-                                ? (totalExecutionMs === undefined
-                                    ? '⚠️ 任务超过总执行时限，已自动中断'
-                                    : `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`)
-                                : isTimeout
-                                    ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
-                                    : getErrorMessage(error, undefined);
+                const userMessage = error instanceof OrphanedTargetSessionError
+                    ? '⚠️ 任务执行状态丢失，已结束本次执行。'
+                    : retryExhaustedCount
+                        ? formatRetryableErrorFinalMessage(error, retryExhaustedCount)
+                        : retryInputAlreadySubmitted
+                            ? formatRetryInputAlreadySubmittedMessage(error)
+                            : modelFallbackExhaustedMessage
+                                ? modelFallbackExhaustedMessage
+                                : isTotalExecutionTimeout
+                                    ? (totalExecutionMs === undefined
+                                        ? '⚠️ 任务超过总执行时限，已自动中断'
+                                        : `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`)
+                                    : isTimeout
+                                        ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
+                                        : getErrorMessage(error, undefined);
                 // 获取 session 用于话题回复（如果 resolveSession 已执行）
                 let sendOpts;
                 try {
@@ -4440,7 +5038,7 @@ export class ResponseEngine {
                 const errorPayload = {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: retryExhaustedCount ? 'retry_exhausted' : retryInputAlreadySubmitted ? 'input_already_submitted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
+                    reason: isExecutionFailure(error) ? error.reason : retryExhaustedCount ? 'retry_exhausted' : retryInputAlreadySubmitted ? 'input_already_submitted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
                 };
                 if (!isUserInterrupt && daemonTrigger && procStatus === 'error') {
                     // DaemonChannel settles a trigger on the first terminal payload. Put
@@ -4483,9 +5081,6 @@ export class ResponseEngine {
                     }).catch(() => { });
                 }
             }
-            if (handlingTimeout && timeoutControl) {
-                timeoutControl.terminalDelivered = true;
-            }
         }
         finally {
             if (fullAccessAuthorization) {
@@ -4496,7 +5091,8 @@ export class ResponseEngine {
                 auditFullAccessEvent({
                     event: fullAccessAuthorization.source === 'trigger'
                         ? 'fullaccess.trigger.execution.ended'
-                        : 'fullaccess.execution.ended',
+                        : fullAccessAuthorization.source === 'agent-policy'
+                            ? 'fullaccess.agent-policy.execution.ended' : 'fullaccess.execution.ended',
                     source: fullAccessAuthorization.source,
                     actorId: fullAccessAuthorization.authorizedBy,
                     processRole: fullAccessAuditProcessRole,
@@ -4668,7 +5264,7 @@ export class ResponseEngine {
                 // valid mapped owner/admin to role=none at the execution boundary.
                 if (resolvedIdentity)
                     bound.identity = resolvedIdentity;
-                if (bound.threadId) {
+                if (bound.threadId || bound.metadata?.diagnostic) {
                     const absoluteProjectPath = path.isAbsolute(bound.projectPath)
                         ? bound.projectPath : path.resolve(process.cwd(), bound.projectPath);
                     return { session: bound, absoluteProjectPath };
@@ -4694,7 +5290,7 @@ export class ResponseEngine {
                 logger.warn(`[ResponseEngine] Bound session ${boundSessionId} not found, falling back to latest`);
             }
         }
-        const session = await this.sessionManager.getOrCreateSession(message.channel, message.channelId, projectPath, message.threadId, metadata, message.topicName, message.peerId, message.chatType, resolvedBaseagent, message.selfAID, message.channelType, message.peerType, resolvedIdentity);
+        const session = await this.sessionManager.getOrCreateSession(message.channel, message.channelId, projectPath, message.threadId, metadata, message.topicName, message.peerId, message.chatType, resolvedBaseagent, message.selfAID, message.channelType, message.peerType, resolvedIdentity, message.lable);
         this.ensureSessionBaseagent(session, resolvedBaseagent);
         // 群名解析：群会话首次取群显示名（group.get），缓存到 metadata，供信封渲染。
         // 渠道私有方法 getGroupName 自带进程缓存 + 容错；取不到不阻塞（groupName 保持空，模板回退 groupId）。
@@ -4752,7 +5348,7 @@ export class ResponseEngine {
      */
     async processEventStream(stream, session, agent, renderer, resetTimer, shouldSuppress, proactive, 
     /** [迁移点4/5] 响应模式插件 + 状态，用于调 onToolUse/onComplete 钩子 */
-    modeHooks, causation, turnLease, permissionMode, proactiveSelfAid) {
+    modeHooks, causation, turnLease, permissionMode, proactiveSelfAid, onAsyncQuestion) {
         // Per-session agent name for stats bucketing
         const statsChannelKey = session.channel === 'daemon' ? session.channel : (session.metadata?.channelKey || session.channel);
         const agentNameForStats = this.agentRegistry?.resolveByChannel(statsChannelKey)?.name ?? '<unknown>';
@@ -4839,6 +5435,15 @@ export class ResponseEngine {
                 // It must never be projected as progress, activity, text, or transcript.
                 if (event.type === 'heartbeat')
                     continue;
+                if (event.type === 'user_question') {
+                    if (!onAsyncQuestion)
+                        throw new Error('Async question has no delivery context');
+                    await onAsyncQuestion(event.request);
+                    madeProgress = true;
+                    // A structured question is user-visible progress without being a text reply.
+                    textCount++;
+                    continue;
+                }
                 if (event.type === 'input_accepted') {
                     inputAccepted = !turnLease || event.inputId === turnLease.inputId;
                     logger.debug(`[ResponseEngine] Input accepted: session=${session.id} input=${event.inputId}`);
@@ -4934,7 +5539,7 @@ export class ResponseEngine {
                         || (typeof input?.prompt === 'string' ? input.prompt.slice(0, 80) : '')
                         || (typeof input?.query === 'string' ? input.query.slice(0, 80) : '')
                         || '';
-                    eventDetail = ` tool=${event.name}${desc ? ` desc="${desc}"` : ''}`;
+                    eventDetail = ` tool=${event.name}${desc ? ` desc="${String(desc).replace(/\s+/g, ' ')}"` : ''}`;
                 }
                 else if (event.type === 'tool_result') {
                     const decision = event.decision ?? (event.isError ? 'error' : 'allow');
@@ -4954,6 +5559,10 @@ export class ResponseEngine {
                 }
                 // IMRenderer 旁路：proactive 模式逐事件投影为 thought（fire-and-forget）
                 renderer.emit(event);
+                if (event.type === 'text_start') {
+                    await renderer.sendTextStart(event.contentIndex, event.turn);
+                    continue;
+                }
                 // session_id 已在 AgentRunner.transformStream 中处理，此处仅记录
                 if (event.type === 'session_id') {
                     logger.debug(`[ResponseEngine] Session ID updated: ${event.sessionId} for session: ${session.id}`);
@@ -5115,7 +5724,7 @@ export class ResponseEngine {
                             this.eventBus.publish({ type: 'message:text', sessionId: session.id, text: visibleText, isFinal: false });
                         }
                         if (visibleText && !shouldSuppress()) {
-                            renderer.addText(visibleText, event.outputTokens, event.turn);
+                            await renderer.addText(visibleText, event.outputTokens, event.turn, event.assistantUuid, event.phase);
                             hasProjectedCurrentReplyText = true;
                         }
                     }
@@ -5175,7 +5784,7 @@ export class ResponseEngine {
                             timestamp: Date.now(),
                             causation,
                         });
-                        const desc = summarizeToolInput(event.name, event.input || {});
+                        const desc = summarizeToolInputForDisplay(event.name, event.input || {});
                         const pendingInput = { name: event.name, input: event.input || {} };
                         if (event.callId)
                             toolInputByCallId.set(event.callId, pendingInput);
@@ -5351,7 +5960,7 @@ export class ResponseEngine {
                             let errorMsg = event.error || (typeof event.result === 'string' ? event.result : JSON.stringify(event.result)) || '\u6267\u884c\u5931\u8d25';
                             // 移除 XML 风格的错误标签
                             errorMsg = errorMsg.replace(/<tool_use_error>(.*?)<\/tool_use_error>/gs, '$1');
-                            renderer.addToolResult(event.name || '\u5de5\u5177', false, undefined, errorMsg, event.callId, event.durationMs, cachedDesc);
+                            renderer.addToolResult(event.name || '\u5de5\u5177', false, undefined, errorMsg, event.callId, event.durationMs, cachedDesc, event);
                         }
                         else if (!event.isError && !shouldSuppress()) {
                             renderer.addToolResult(event.name || '\u5de5\u5177', true, event.result, undefined, event.callId, event.durationMs, cachedDesc);
@@ -5452,7 +6061,7 @@ export class ResponseEngine {
             // User interrupt (AbortError) is expected, log at info level
             const catchInterruptReason = this.interruptedSessions.get(session.id);
             const catchIsUserInterrupt = isNonErrorInterruptReason(catchInterruptReason);
-            if (catchInterruptReason === 'timeout') {
+            if (catchInterruptReason === 'timeout' || catchInterruptReason === 'execution_error') {
                 logger.info('[ResponseEngine] Stream closed by timeout barrier');
                 throw this.timeoutErrors.get(session.id) ?? new Error('SDK_TIMEOUT');
             }
@@ -5490,7 +6099,9 @@ export class ResponseEngine {
             if (hasErrorSuppressingContent) {
                 let errorOutputFlushed = false;
                 try {
-                    await renderer.flush(true);
+                    // The outer retry/terminal handler has not decided the outcome yet.
+                    // Pending stream output must not announce successful completion.
+                    await renderer.flush(false);
                     errorOutputFlushed = true;
                 }
                 catch (flushError) {