evolcore 0.0.28 → 0.0.29

package/dist/agents/codex-runner.js

@@ -5,7 +5,7 @@ import { formatAsyncQuestionAnswer, hasTrustedFullAccessContext, parseAsyncUserQ
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
-import { assertWindowsCodexFilesystemRuleBudget, buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
+import { assertWindowsCodexFilesystemRuleBudget, buildCodexProtectedFilesystemRules, getExistingRelationAttachmentDirs, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
 import { CODEX_THREAD_ACTIVE_WRITER, CodexAppServerClient, } from './codex/app-server-client.js';
 import { resolveOpenaiConfig, resolveCodexCliPath, resolveCodexPowerShellShimPath, } from './baseagent.js';
 import { logger } from '../utils/logger.js';
@@ -17,26 +17,20 @@ import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, CODEX_SESSION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, hasCodexCmdCarrierEcIntent, hasPowerShellCredentialAssignment, normalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, containsUnresolvedManagedTmpDirReference, hasCodexCmdCarrierEcIntent, hasPowerShellCredentialAssignment, normalizeEvolcoreCommandArgv, canonicalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, parseShellApplyPatchInvocation, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
-import { agentSessionsDir, resolvePaths, resolveRoot } from '../paths.js';
+import { agentCodexTokenPath, resolvePaths, resolveRoot } from '../paths.js';
 import { ensureSessionRuntimeDir, getManagedTaskTempDir } from '../cli/task-context.js';
-import { buildSessionTurnList } from '../core/session/session-turns.js';
+import { buildTranscriptTurns } from '../core/session/session-transcript.js';
 import { CodexSessionFileAdapter } from '../core/session/adapters/codex-session-file-adapter.js';
 import { execFileSync } from 'child_process';
 import { probeCli, probeCliSync } from '../utils/cross-platform.js';
 import { createHash, randomBytes } from 'crypto';
 import { buildModelRequestHeaders } from './request-identity.js';
+import { normalizeToolErrorClassification, normalizeToolErrorCode, normalizeToolErrorDetailCode, } from '../core/permission/tool-error-code.js';
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
-// ── MIME → 扩展名映射 ──
-const MIME_EXT = {
-    'image/png': '.png',
-    'image/jpeg': '.jpg',
-    'image/gif': '.gif',
-    'image/webp': '.webp',
-};
 const APPROVAL_LOG_SUMMARY_MAX_LENGTH = 256;
 const CODEX_INTERRUPT_TIMEOUT_MS = 5_000;
 function toAgentErrorType(message) {
@@ -92,7 +86,7 @@ class AsyncEventQueue {
         }
     }
 }
-function errorCodeForToolDenial(decisionSource, policyCode) {
+function fallbackErrorCodeForToolDenial(decisionSource, policyCode) {
     if (decisionSource === 'policy')
         return 'POLICY_DENIED';
     if (decisionSource === 'approval')
@@ -103,6 +97,35 @@ function errorCodeForToolDenial(decisionSource, policyCode) {
         return 'INVALID_ARGUMENT';
     return 'EXECUTION_FAILED';
 }
+function errorCodeForToolDenial(decisionSource, policyCode) {
+    return normalizeToolErrorClassification({
+        errorCode: fallbackErrorCodeForToolDenial(decisionSource, policyCode),
+        decisionSource,
+        policyCode,
+        executed: false,
+        executionState: 'blocked',
+    }).errorCode;
+}
+function errorDetailCodeForToolDenial(decisionSource, policyCode, errorDetailCode) {
+    return normalizeToolErrorClassification({
+        errorCode: fallbackErrorCodeForToolDenial(decisionSource, policyCode),
+        errorDetailCode,
+        decisionSource,
+        policyCode,
+        executed: false,
+        executionState: 'blocked',
+    }).errorDetailCode;
+}
+function codexItemErrorFields(item) {
+    const rawCode = item?.error?.code ?? item?.error?.errorCode;
+    if (typeof rawCode !== 'string' || !rawCode.trim())
+        return {};
+    const errorCode = normalizeToolErrorCode(rawCode);
+    if (errorCode)
+        return { errorCode };
+    const errorDetailCode = normalizeToolErrorDetailCode(rawCode);
+    return errorDetailCode ? { errorDetailCode } : {};
+}
 function isCodexReasoningNotification(method) {
     return method === 'item/reasoning/textDelta'
         || method === 'item/reasoning/summaryTextDelta'
@@ -429,6 +452,7 @@ export class CodexRunner {
             enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,
             approvalsReviewer: 'user',
             protectEvolcoreFilesystem: !fullAccess,
+            selfAid: this.resolvedConfig.agentAid,
             // A completed turn is explicitly unsubscribed below. This is only an
             // optimization on newer Codex versions; old versions retain the thread
             // until the cross-client archive fallback runs.
@@ -613,6 +637,13 @@ export class CodexRunner {
         this.threadSubscriptions.set(threadId, { client: targetClient, state: 'subscribed' });
     }
     approvedLiteralEvolcoreCommand(command, managedTempDir, dialect = 'posix', expectedCredentialToken, executable) {
+        if (/\\\$(?:TMPDIR|\{TMPDIR\})/i.test(command)
+            && /\bec\s+fs\s+(?:cp|ls|stat|find|cat|mkdir|rm|mv|upload)\b/i.test(command)) {
+            return { parseFailure: {
+                    issue: 'unsafe-expansion', offset: 0, tokenIndex: 0,
+                    dialect, inputLength: command.length,
+                } };
+        }
         const parseOptions = {
             allowManagedTmpDir: true,
             dialect,
@@ -644,11 +675,21 @@ export class CodexRunner {
                 } };
         }
         return {
-            argv: normalizeEvolcoreCommandArgv(parsed.argv),
+            argv: canonicalizeEvolcoreCommandArgv(parsed.argv),
             ...(parsed.credentialToken ? { credentialToken: parsed.credentialToken } : {}),
         };
     }
     resolveCanonicalEcApproval(toolInput, managedTempDir, expectedCredentialToken) {
+        const rawCommand = typeof toolInput.command === 'string' ? toolInput.command : '';
+        if (/\\\$(?:TMPDIR|\{TMPDIR\})/i.test(rawCommand)
+            && /\bec\s+fs\s+(?:cp|ls|stat|find|cat|mkdir|rm|mv|upload)\b/i.test(rawCommand)
+            && !/\bec\s+(?:msg|group)\s+send\b/i.test(rawCommand)
+            && !/\bec\s+trigger\s+(?:create|set|update)\b/i.test(rawCommand)) {
+            return { parseFailure: {
+                    issue: 'unsafe-expansion', offset: 0, tokenIndex: 0,
+                    dialect: 'posix', inputLength: rawCommand.length,
+                } };
+        }
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
@@ -661,9 +702,9 @@ export class CodexRunner {
                         dialect: 'posix', inputLength: 0,
                     } };
             }
-            return containsLiteralManagedTmpDirOutsideSendContent(explicitArgv)
+            return containsLiteralManagedTmpDirOutsideSendContent(explicitArgv) || containsUnresolvedManagedTmpDirReference(explicitArgv)
                 ? { parseFailure: { issue: 'unsafe-expansion', offset: 0, tokenIndex: 0, dialect: 'posix', inputLength: 0 } }
-                : { argv: normalizeEvolcoreCommandArgv(explicitArgv) };
+                : { argv: canonicalizeEvolcoreCommandArgv(explicitArgv) };
         }
         const explicitCarrier = explicitArgv
             ? resolveCodexShellCarrierArgv(explicitArgv)
@@ -671,6 +712,21 @@ export class CodexRunner {
         if (explicitCarrier !== undefined) {
             return this.approvedLiteralEvolcoreCommand(explicitCarrier.command, managedTempDir, explicitCarrier.dialect, expectedCredentialToken, explicitCarrier.executable);
         }
+        if (explicitArgv?.length === 1 && typeof explicitArgv[0] === 'string') {
+            const parsed = parseCodexToolCommand({ commandArgv: explicitArgv }, {
+                allowManagedTmpDir: true,
+                verifyShellExecutable: process.platform === 'win32',
+                ...(managedTempDir ? { managedTempDir } : {}),
+                ...(expectedCredentialToken !== undefined ? { expectedCredentialToken } : {}),
+            });
+            if (parsed.ok && parsed.argv[0] === 'ec') {
+                return containsLiteralManagedTmpDirOutsideSendContent(parsed.argv) || containsUnresolvedManagedTmpDirReference(parsed.argv)
+                    ? { parseFailure: { issue: 'unsafe-expansion', offset: 0, tokenIndex: 0, dialect: 'powershell', inputLength: explicitArgv[0].length } }
+                    : { argv: canonicalizeEvolcoreCommandArgv(parsed.argv) };
+            }
+            if (!parsed.ok)
+                return { parseFailure: parsed };
+        }
         if (hasCodexCmdCarrierEcIntent(toolInput)) {
             const parsed = parseCodexToolCommand(toolInput, {
                 verifyShellExecutable: process.platform === 'win32',
@@ -679,13 +735,13 @@ export class CodexRunner {
             if (!parsed.ok)
                 return { parseFailure: parsed };
             if (parsed.argv[0] === 'ec') {
-                return containsLiteralManagedTmpDirOutsideSendContent(parsed.argv)
+                return containsLiteralManagedTmpDirOutsideSendContent(parsed.argv) || containsUnresolvedManagedTmpDirReference(parsed.argv)
                     ? { parseFailure: {
                             issue: 'unsafe-expansion', offset: 0, tokenIndex: 0,
                             dialect: 'cmd', inputLength: 0,
                         } }
                     : {
-                        argv: normalizeEvolcoreCommandArgv(parsed.argv),
+                        argv: canonicalizeEvolcoreCommandArgv(parsed.argv),
                         ...(parsed.credentialToken ? { credentialToken: parsed.credentialToken } : {}),
                     };
             }
@@ -709,7 +765,7 @@ export class CodexRunner {
             ...(expectedCredentialToken !== undefined ? { expectedCredentialToken } : {}),
         });
         if (canonicalCommand?.[0] === 'ec') {
-            return containsLiteralManagedTmpDirOutsideSendContent(canonicalCommand)
+            return containsLiteralManagedTmpDirOutsideSendContent(canonicalCommand) || containsUnresolvedManagedTmpDirReference(canonicalCommand)
                 ? { parseFailure: {
                         issue: 'unsafe-expansion',
                         offset: 0,
@@ -717,7 +773,7 @@ export class CodexRunner {
                         dialect: 'posix',
                         inputLength: command.length,
                     } }
-                : { argv: canonicalCommand };
+                : { argv: canonicalizeEvolcoreCommandArgv(canonicalCommand) };
         }
         const outer = parseLiteralShellCommand(command, {
             allowManagedTmpDir: true,
@@ -747,6 +803,10 @@ export class CodexRunner {
                 || shellCarrier !== undefined
                     && classifyEvolcoreShellCommand(shellCarrier.command, {
                         dialect: shellCarrier.dialect,
+                    }).kind !== 'none'
+                || rawArgv.length === 1
+                    && classifyEvolcoreShellCommand(rawArgv[0], {
+                        dialect: 'powershell',
                     }).kind !== 'none';
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
@@ -1218,8 +1278,15 @@ export class CodexRunner {
             enabled: true,
             unix_sockets: { [resolvePaths().instanceSocket]: 'allow' },
         };
+        const relationAttachmentDenies = {};
+        for (const directory of getExistingRelationAttachmentDirs(resolveRoot(), {
+            selfAid: this.resolvedConfig.agentAid,
+            onlyOtherAgents: true,
+        }))
+            relationAttachmentDenies[directory] = 'deny';
         const filesystem = {
             ...buildCodexProtectedFilesystemRules(resolveRoot(), {
+                selfAid: this.resolvedConfig.agentAid,
                 denyLClassRead: mode === 'readonly',
                 // The app-server itself is launched behind EvolCore's Linux
                 // H-class guard, which already mounts every L-class directory
@@ -1235,6 +1302,7 @@ export class CodexRunner {
             ...(personalMdPath ? {
                 [path.resolve(personalMdPath)]: mode === 'readonly' ? 'read' : 'write',
             } : {}),
+            ...relationAttachmentDenies,
             ...(mode !== 'readonly' && managedTempDir ? {
                 [managedTempDir]: 'write',
                 [managedTempDir + '/**']: 'write',
@@ -1395,6 +1463,7 @@ export class CodexRunner {
         const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
             ? toolInput
             : {};
+        const isShellTool = toolName === 'Bash' || toolName === 'Shell' || toolName === 'exec_command';
         const recordPreToolUseDenial = async (policyCode, reason) => {
             const summary = summarizeToolInputForAudit(toolName, normalizedInput).slice(0, 512);
             auditToolPreflightDenial({
@@ -1469,6 +1538,28 @@ export class CodexRunner {
             await recordPreToolUseDenial('fullaccess_context_untrusted', reason);
             return { ok: false, applicable: true, decision: 'deny', reason };
         }
+        const preflightProjectPath = this.threadProjectPaths.get(threadId)
+            ?? (activeThread ? this.threadProjectPaths.get(activeThread) : undefined)
+            ?? process.cwd();
+        const preflight = evaluateToolPreflight(isShellTool ? 'Bash' : toolName, normalizedInput, {
+            sessionId: sessionKey,
+            managedTempDir: context.managedTempDir ?? this.getManagedTempDir(sessionKey) ?? '',
+            sessionCredential: sessionToken,
+            allowProtectedMetadata: false,
+            selfAid: context.selfAid,
+            channel: context.channel,
+            userId: context.userId,
+            role: context.role,
+            permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
+            allowReadonlySourceDiagnostics: context.allowReadonlySourceDiagnostics === true,
+            projectPath: preflightProjectPath,
+            workspacePath: preflightProjectPath,
+        });
+        if (preflight.behavior === 'deny') {
+            const reason = preflight.message ?? 'tool preflight denied';
+            await recordPreToolUseDenial(preflight.policyCode ?? 'tool_preflight_denied', reason);
+            return { ok: true, applicable: true, decision: 'deny', reason };
+        }
         // A tracked interactive thread still needs an authenticated, explicit
         // allow so the managed hook can fail closed when no runner matches.
         if (!context.preToolUsePolicyHook)
@@ -1710,7 +1801,7 @@ export class CodexRunner {
         }
         this.chatModes.set(sessionId, callMode);
         const callApprovalPolicy = this.toApprovalPolicy(callMode);
-        const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath, modelOverride?.personalMdPath);
+        const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath, modelOverride?.personalMdPath, undefined);
         const appServer = this.getAppServerClient(callMode === 'fullaccess');
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
@@ -1839,12 +1930,11 @@ export class CodexRunner {
         this.bindExternalToolBoundary(threadId, externalToolConfig);
         const controller = new AbortController();
         this.activeAbortControllers.set(sessionId, controller);
-        const tempFiles = [];
         const answer = modelOverride?.asyncQuestionAnswer;
         if (answer && answer.providerThreadId !== threadId) {
             throw new Error('Async question reply cannot resume a different Codex thread');
         }
-        const input = this.buildAppServerInput(answer ? formatAsyncQuestionAnswer(answer) : prompt, images, tempFiles, sessionId, runtimeEnv);
+        const input = this.buildAppServerInput(answer ? formatAsyncQuestionAnswer(answer) : prompt, images);
         const queue = new AsyncEventQueue();
         controller.signal.addEventListener('abort', () => queue.end(), { once: true });
         const state = {
@@ -1931,7 +2021,7 @@ export class CodexRunner {
             if (!resumingThread)
                 this.cleanupProvisionalThread(sessionId, threadId);
             logger.info(`[CodexRunner] Applied pending interrupt before turn start: ${sessionId}`);
-            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer, tempFiles);
+            return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer);
         }
         try {
             const turnResponse = await appServer.turnStart(threadId, input, {
@@ -2013,12 +2103,11 @@ export class CodexRunner {
             this.activeAbortControllers.delete(sessionId);
             this.activeTurns.delete(sessionId);
             this.pendingInterrupts.delete(sessionId);
-            this.cleanupTempFiles(tempFiles);
             if (!resumingThread)
                 this.cleanupProvisionalThread(sessionId, threadId);
             throw error;
         }
-        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer, tempFiles);
+        return this.transformAppServerStream(queue, sessionId, state, controller, unsubscribe, appServer);
     }
     // ── Interrupt ──
     async interrupt(sessionKey) {
@@ -2467,15 +2556,9 @@ export class CodexRunner {
     // They follow the thread (not the daemon process) so a daemon restart does
     // not strand a resumable thread: the token file is re-read on resume, and
     // it is removed lazily once the rollout file itself disappears.
-    threadCredentialsDir() {
-        const aid = this.resolvedConfig.agentAid;
-        if (!aid)
-            return undefined;
-        return path.join(agentSessionsDir(aid), 'codex-tokens');
-    }
     threadCredentialPath(threadId) {
-        const dir = this.threadCredentialsDir();
-        return dir ? path.join(dir, `${encodeURIComponent(threadId)}.json`) : undefined;
+        const aid = this.resolvedConfig.agentAid;
+        return aid ? agentCodexTokenPath(aid, threadId) : undefined;
     }
     createThreadCredential() {
         return randomBytes(32).toString('hex');
@@ -2615,7 +2698,7 @@ export class CodexRunner {
             const appServer = this.getAppServerClient();
             const history = await this.readForkHistory(appServer, agentSessionId);
             const messages = this.mapThreadToSessionMessages(history, agentSessionId);
-            const turns = buildSessionTurnList(messages);
+            const turns = buildTranscriptTurns(messages);
             const targetIndex = turns.findIndex(turn => turn.assistantUuid === assistantMessageId);
             if (targetIndex < 0)
                 throw new Error('fork point not found');
@@ -2633,7 +2716,7 @@ export class CodexRunner {
             if (typeof turn.id !== 'string' || !turn.id)
                 continue;
             for (const item of this.getTurnItems(turn)) {
-                if (item.type === 'agentMessage' && item.id === assistantMessageId)
+                if (item.id === assistantMessageId)
                     return turn.id;
             }
             // Older app-server histories may omit item ids; the mapper then uses the
@@ -3039,7 +3122,7 @@ export class CodexRunner {
             ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey), sessionCredential)
             : undefined;
         const approvedCommand = canonicalEcApproval?.argv;
-        const denyInfrastructure = async (policyCode, message) => {
+        const denyInfrastructure = async (policyCode, message, errorDetailCode) => {
             logger.warn(`[CodexRunner] ${message}: session=${sessionKey} requestId=${request.id ?? '<missing>'}`);
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
@@ -3067,6 +3150,7 @@ export class CodexRunner {
                 decision: 'deny',
                 decisionSource: 'infrastructure',
                 policyCode,
+                ...(errorDetailCode ? { errorDetailCode } : {}),
                 reason: message,
             });
             this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode, message, canonicalEcApproval?.parseFailure);
@@ -3077,18 +3161,28 @@ export class CodexRunner {
             if (canonicalEcApproval?.parseFailure?.issue === 'untrusted-shell') {
                 return await denyInfrastructure('ec_shell_untrusted_executable', 'EC command approval denied because the shell executable failed Windows Authenticode trust validation');
             }
+            if (canonicalEcApproval?.parseFailure?.issue === 'unsupported-escape') {
+                return await denyInfrastructure('ec_shell_unsupported_escape', 'EC inline text does not support PowerShell `n. Use literal \\n in the argument instead.');
+            }
+            if (canonicalEcApproval?.parseFailure?.issue === 'lossy-cmd-shim') {
+                return await denyInfrastructure('ec_shell_lossy_cmd_shim', 'PowerShell cannot pass physical multiline EC arguments through ec.cmd intact. Use ec ... via the PowerShell-native shim instead.');
+            }
             return await denyInfrastructure('ec_command_not_canonical', canonicalEcApproval?.parseFailure
                 ? `EC command approval denied because canonical argv parsing failed (${canonicalEcApproval.parseFailure.issue})`
                     + (canonicalEcApproval.parseFailure.dialect === 'powershell' && canonicalEcApproval.parseFailure.issue === 'invalid-quote'
                         ? '. PowerShell treats smart quotes as delimiters too; escape quotes for PowerShell or use --text-from-file for message text.'
                         : '')
-                : 'EC command approval denied because no canonical argv could be derived');
+                : 'EC command approval denied because no canonical argv could be derived', canonicalEcApproval?.parseFailure?.issue === 'invalid-quote' ? 'INVALID_QUOTE' : undefined);
         }
         try {
             const resolution = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id, typeof params.itemId === 'string' ? params.itemId : typeof params.item_id === 'string' ? params.item_id : undefined);
             const decision = typeof resolution === 'string' ? resolution : resolution.decision;
             const resolutionMeta = typeof resolution === 'string' ? undefined : resolution;
             if (decision !== 'deny' && managedEcIntent && approvedCommand) {
+                if (containsLiteralManagedTmpDirOutsideSendContent(approvedCommand)
+                    || containsUnresolvedManagedTmpDirReference(approvedCommand)) {
+                    return await denyInfrastructure('ec_command_unsafe_tmpdir_reference', 'EC command contains an unresolved or unsafe managed TMPDIR reference');
+                }
                 const credentialThreadIds = [
                     this.activeSessions.get(sessionKey),
                     this.provisionalSessions.get(sessionKey),
@@ -3123,6 +3217,7 @@ export class CodexRunner {
                     decision: 'deny',
                     decisionSource,
                     ...(policyCode ? { policyCode } : {}),
+                    ...(resolutionMeta?.errorDetailCode ? { errorDetailCode: resolutionMeta.errorDetailCode } : {}),
                     reason: denialReason,
                 });
                 setImmediate(() => this.steerPolicyReason(sessionKey, policyCode, denialReason));
@@ -3166,6 +3261,7 @@ export class CodexRunner {
             decision,
             decisionSource,
             policyCode,
+            ...(parseFailure?.issue === 'invalid-quote' ? { errorDetailCode: 'INVALID_QUOTE' } : {}),
             permissionMode: normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode),
             role: context?.role,
             taskId: context?.taskId,
@@ -3687,6 +3783,7 @@ export class CodexRunner {
             channel: permCtx?.channel,
             peerId: permCtx?.userId,
             role: permCtx?.role,
+            selfAid: permCtx?.selfAid ?? this.resolvedConfig.agentAid,
             allowProtectedMetadata: false,
             // Revalidate ownership, mode, and parent containment at the final
             // readonly decision. The map entry alone is stale if the directory was
@@ -3795,9 +3892,17 @@ export class CodexRunner {
             && this.hasNetworkPermissionRequest(toolInput);
         const hasUnknownPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
             && this.hasUnknownPermissionRequest(toolInput);
+        const applyPatch = (toolName === 'Bash' || toolName === 'Shell' || toolName === 'exec_command')
+            ? parseShellApplyPatchInvocation(toolInput)
+            : { kind: 'not-apply-patch' };
+        const applyPatchFileChanges = applyPatch.kind === 'file-change' ? applyPatch.fileChanges : undefined;
+        const applyPatchInput = applyPatchFileChanges
+            ? { ...toolInput, fileChanges: applyPatchFileChanges }
+            : toolInput;
         const hasPermissionExpansion = hasFilesystemPermissions || hasNetworkPermissions || hasUnknownPermissions;
         const hasFileChangeExpansion = toolName === 'FileChange'
-            && this.fileChangeRequiresExpansion(toolInput, workspacePath, sessionKey);
+            ? this.fileChangeRequiresExpansion(toolInput, workspacePath, sessionKey)
+            : !!applyPatchFileChanges && this.fileChangeRequiresExpansion(applyPatchInput, workspacePath, sessionKey);
         // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const mode = normalizeExecutionPermissionMode(rawMode);
@@ -3876,12 +3981,17 @@ export class CodexRunner {
                 decision: 'deny',
                 decisionSource: 'policy',
                 policyCode: preflight.policyCode ?? 'tool_preflight_denied',
+                ...(preflight.errorDetailCode ? { errorDetailCode: preflight.errorDetailCode } : {}),
                 reason: preflight.message ?? 'tool preflight denied',
             };
         }
         if (preflight.behavior === 'allow')
             return 'allow';
         const checkedInput = preflight.input;
+        const policyInput = applyPatchFileChanges
+            ? { ...checkedInput, fileChanges: applyPatchFileChanges }
+            : checkedInput;
+        const policyToolName = applyPatchFileChanges ? 'FileChange' : toolName;
         if (toolName === 'FileChange') {
             const hasGrantRoot = typeof checkedInput.grantRoot === 'string'
                 && checkedInput.grantRoot.length > 0;
@@ -3901,9 +4011,9 @@ export class CodexRunner {
             return 'deny';
         const grantScope = `codex:${this.permissionProfileName(sessionKey)}:${mode}`;
         if (mode === 'readonly') {
-            const readonly = this.checkCodexReadonly(toolName, checkedInput, operationCwd, sessionKey);
+            const readonly = this.checkCodexReadonly(policyToolName, policyInput, operationCwd, sessionKey);
             if (readonly.behavior === 'deny') {
-                await recordBlockedOperation(readonly.policyCode ?? 'readonly_mode', checkedInput, readonly.message);
+                await recordBlockedOperation(readonly.policyCode ?? 'readonly_mode', policyInput, readonly.message);
                 return 'deny';
             }
             return 'allow';
@@ -3914,7 +4024,7 @@ export class CodexRunner {
         // auto 模式下检查危险命令，危险命令自动拒绝
         if (mode === 'auto') {
             if (hasFileChangeExpansion || hasFilesystemPermissions || hasUnknownPermissions) {
-                await recordBlockedOperation('auto_permission_expansion', checkedInput);
+                await recordBlockedOperation('auto_permission_expansion', policyInput);
                 return 'deny';
             }
             if (toolName === 'PermissionGrant' && !hasNetworkPermissions) {
@@ -3934,8 +4044,8 @@ export class CodexRunner {
         if (requiresSandboxExpansionApproval) {
             if (!this.permissionGateway || !permissionPrompt)
                 return 'deny';
-            if (toolName === 'FileChange') {
-                return this.permissionGateway.requestPermission(sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope, undefined, { fileChangeCwd: workspacePath });
+            if (policyToolName === 'FileChange') {
+                return this.permissionGateway.requestPermission(sessionKey, policyToolName, policyInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope, undefined, { fileChangeCwd: workspacePath });
             }
             return this.permissionGateway.requestPermission(sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope);
         }
@@ -3980,20 +4090,80 @@ export class CodexRunner {
         }
         throw new Error('Unsupported Codex app-server request: ' + method);
     }
-    async rollbackSessionTurns(agentSessionId, _projectPath, numTurns) {
-        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'rollback');
+    async rollbackSessionTurns(agentSessionId, projectPath, numTurns, targetAssistantMessageId) {
+        const release = await this.acquireThreadOperation(this.threadOperationKey(agentSessionId), 'resume+rollback');
         try {
-            return await this.rollbackSessionTurnsLocked(agentSessionId, numTurns);
+            return await this.rollbackSessionTurnsLocked(agentSessionId, projectPath, numTurns, targetAssistantMessageId);
         }
         finally {
             release();
         }
     }
-    async rollbackSessionTurnsLocked(agentSessionId, numTurns) {
+    async rollbackSessionTurnsLocked(agentSessionId, projectPath, numTurns, targetAssistantMessageId) {
         if (numTurns < 1)
             return true;
-        const response = await this.getAppServerClientForThread(agentSessionId).threadRollback(agentSessionId, numTurns);
-        return !!response.thread;
+        const appServer = this.getAppServerClientForThread(agentSessionId);
+        const previousAppServer = await this.prepareThreadSubscription(appServer, agentSessionId);
+        let resumed = false;
+        try {
+            let resumeResponse;
+            try {
+                resumeResponse = await appServer.threadResume(agentSessionId, projectPath);
+            }
+            catch (error) {
+                if (isCodexActiveWriterError(error) && previousAppServer && previousAppServer !== appServer) {
+                    await this.archiveThreadForHandoff(previousAppServer, appServer, agentSessionId);
+                    resumeResponse = await appServer.threadResume(agentSessionId, projectPath);
+                }
+                else {
+                    throw error;
+                }
+            }
+            this.markThreadSubscribed(appServer, agentSessionId);
+            this.threadProjectPaths.set(agentSessionId, path.resolve(projectPath));
+            resumed = true;
+            if (resumeResponse.thread?.historyMode === 'paginated') {
+                const beforeTurnId = await this.findPaginatedRewindTurnId(appServer, agentSessionId, numTurns, targetAssistantMessageId);
+                const response = await appServer.threadRevert(agentSessionId, beforeTurnId);
+                return !!response.thread;
+            }
+            const response = await appServer.threadRollback(agentSessionId, numTurns);
+            return !!response.thread;
+        }
+        finally {
+            if (resumed) {
+                await this.releaseThreadSubscription(appServer, agentSessionId, 'rollback-finished');
+            }
+        }
+    }
+    async findPaginatedRewindTurnId(appServer, threadId, numTurns, targetAssistantMessageId) {
+        if (targetAssistantMessageId) {
+            const history = await this.readForkHistory(appServer, threadId);
+            const targetTurnId = this.findTurnIdForAssistantMessage(history, targetAssistantMessageId);
+            if (!targetTurnId)
+                throw new Error('Codex paginated rewind target turn not found');
+            return targetTurnId;
+        }
+        let cursor;
+        let seenCursor;
+        let seenTurns = 0;
+        do {
+            const page = await appServer.threadTurnsList(threadId, 100, cursor);
+            for (const turn of page.data ?? []) {
+                if (seenTurns === numTurns - 1) {
+                    if (typeof turn.id !== 'string' || !turn.id)
+                        throw new Error('Codex paginated thread rewind target has no turn id');
+                    return turn.id;
+                }
+                seenTurns++;
+            }
+            const nextCursor = typeof page.nextCursor === 'string' && page.nextCursor ? page.nextCursor : undefined;
+            if (!nextCursor || nextCursor === seenCursor)
+                break;
+            seenCursor = nextCursor;
+            cursor = nextCursor;
+        } while (true);
+        throw new Error('Codex paginated thread has fewer than ' + numTurns + ' turns');
     }
     async rewindFiles(agentSessionId, projectPath, userMessageId) {
         const messages = await this.getSessionMessages(agentSessionId, projectPath);
@@ -4062,6 +4232,26 @@ export class CodexRunner {
                         parent_tool_use_id: null,
                     });
                 }
+                else if (item.id && [
+                    'commandExecution', 'mcpToolCall', 'dynamicToolCall', 'fileChange',
+                    'webSearch', 'collabAgentToolCall', 'imageView', 'sleep', 'imageGeneration',
+                ].includes(item.type || '')) {
+                    messages.push({
+                        type: 'assistant',
+                        uuid: item.id,
+                        session_id: threadId,
+                        message: { role: 'assistant', content: this.mapCodexToolItemToContent(item) },
+                        parent_tool_use_id: null,
+                    });
+                    if (item.type === 'fileChange')
+                        messages.push({
+                            type: 'system',
+                            uuid: `${item.id}-file-change`,
+                            session_id: threadId,
+                            message: { role: 'system', content: this.mapFileChangeToContent(item) },
+                            parent_tool_use_id: null,
+                        });
+                }
                 else if (item.type === 'file_change') {
                     messages.push({
                         type: 'system',
@@ -4075,6 +4265,86 @@ export class CodexRunner {
         }
         return messages;
     }
+    /** Preserve the same bounded display data that live tool cards receive. */
+    mapCodexToolItemToContent(item) {
+        const id = typeof item.id === 'string' ? item.id : undefined;
+        const type = item.type || 'tool';
+        let name = type;
+        let input;
+        let result;
+        let isError = false;
+        switch (type) {
+            case 'commandExecution':
+                name = 'Shell';
+                input = { command: item.command, cwd: item.cwd };
+                result = item.aggregatedOutput ?? item.output ?? '';
+                isError = item.exitCode != null
+                    ? Number(item.exitCode) !== 0
+                    : item.status === 'failed' || item.status === 'declined';
+                break;
+            case 'mcpToolCall':
+                name = `MCP:${item.server}/${item.tool}`;
+                input = item.arguments;
+                result = item.result ?? item.contentItems;
+                isError = item.status === 'failed';
+                break;
+            case 'dynamicToolCall':
+                name = item.namespace ? `${item.namespace}:${item.tool}` : String(item.tool || 'tool');
+                input = item.arguments;
+                result = item.result ?? item.contentItems;
+                isError = item.success === false || item.status === 'failed';
+                break;
+            case 'fileChange':
+                name = 'FileChange';
+                input = { changes: item.changes };
+                result = item.changes;
+                isError = item.status === 'failed';
+                break;
+            case 'webSearch':
+                name = 'WebSearch';
+                input = { query: item.query, ...(item.action != null ? { action: item.action } : {}) };
+                result = input;
+                break;
+            case 'collabAgentToolCall':
+                name = `Collab:${item.tool}`;
+                input = {
+                    receiverThreadIds: item.receiverThreadIds,
+                    ...(item.prompt != null ? { prompt: item.prompt } : {}),
+                    ...(item.model != null ? { model: item.model } : {}),
+                    ...(item.reasoningEffort != null ? { reasoningEffort: item.reasoningEffort } : {}),
+                };
+                result = item.contentItems ?? { receiverThreadIds: item.receiverThreadIds, agentsStates: item.agentsStates };
+                isError = item.status === 'failed';
+                break;
+            case 'imageView':
+                name = 'ViewImage';
+                input = { path: item.path };
+                result = input;
+                break;
+            case 'sleep':
+                name = 'Sleep';
+                input = { durationMs: item.durationMs };
+                result = input;
+                break;
+            case 'imageGeneration':
+                name = 'ImageGeneration';
+                input = item.revisedPrompt != null ? { prompt: item.revisedPrompt } : {};
+                result = item.result ?? item.output;
+                break;
+            default:
+                input = item.input;
+                result = item.result ?? item.output;
+        }
+        return [
+            { type: 'tool_use', id, name, input },
+            {
+                type: 'tool_result',
+                ...(id ? { tool_use_id: id } : {}),
+                content: result,
+                is_error: isError,
+            },
+        ];
+    }
     getTurnItems(turn) {
         const items = Array.isArray(turn?.items) ? turn.items : [];
         const input = Array.isArray(turn?.input) ? turn.input : [];
@@ -4143,36 +4413,18 @@ export class CodexRunner {
         this.onCompactStart = callback;
     }
     // ── Event stream transformation ──
-    buildAppServerInput(prompt, images, tempFiles, sessionId, runtimeEnv) {
+    buildAppServerInput(prompt, images) {
         const input = [{ type: 'text', text: prompt, text_elements: [] }];
         if (!images?.length)
             return input;
-        const tmpDir = getManagedTaskTempDir(runtimeEnv)
-            ?? runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR
-            ?? (sessionId ? this.getManagedTempDir(sessionId) : undefined)
-            ?? process.env.TMPDIR;
-        if (!tmpDir || !path.isAbsolute(tmpDir))
-            throw new Error('managed TMPDIR is unset or not absolute');
-        for (let i = 0; i < images.length; i++) {
-            const img = images[i];
-            const ext = MIME_EXT[img.mimeType || ''] || '.jpg';
-            const tmpPath = path.join(tmpDir, `evolcore-img-${Date.now()}-${i}${ext}`);
-            fs.writeFileSync(tmpPath, Buffer.from(img.data, 'base64'));
-            tempFiles.push(tmpPath);
-            input.push({ type: 'localImage', path: tmpPath });
-        }
-        logger.info(`[CodexRunner] Attached ${images.length} image(s) as localImage`);
-        return input;
-    }
-    cleanupTempFiles(tempFiles) {
-        if (!tempFiles?.length)
-            return;
-        for (const tempFile of tempFiles) {
-            try {
-                fs.unlinkSync(tempFile);
-            }
-            catch { /* ignore */ }
+        for (const image of images) {
+            input.push({
+                type: 'image',
+                url: `data:${image.mimeType || 'image/png'};base64,${image.data}`,
+            });
         }
+        logger.info(`[CodexRunner] Attached ${images.length} image(s) as base64 data URL`);
+        return input;
     }
     extractTurnId(notification) {
         const params = notification.params || {};
@@ -4293,7 +4545,7 @@ export class CodexRunner {
         }
         queue.end();
     }
-    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, appServer, tempFiles) {
+    async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, appServer) {
         try {
             let sessionIdEmitted = state.committed;
             if (sessionIdEmitted)
@@ -4347,7 +4599,6 @@ export class CodexRunner {
             for (const childThreadId of state.activeSubagentThreads)
                 this.unregisterChildThread(childThreadId);
             state.activeSubagentThreads.clear();
-            this.cleanupTempFiles(tempFiles);
         }
     }
     *mapAppServerNotification(notification, sessionId, state) {
@@ -4365,7 +4616,8 @@ export class CodexRunner {
             case 'item/started': {
                 for (const event of this.mapAppServerItemStarted(params.item, state)) {
                     this.trackAppServerToolLifecycle(event, state);
-                    yield event;
+                    yield event.type === 'tool_use' && params.item?.id
+                        ? { ...event, assistantUuid: params.item.id } : event;
                 }
                 break;
             }
@@ -4397,7 +4649,8 @@ export class CodexRunner {
                     state.completedItemIds.add(item.id);
                 for (const event of this.mapAppServerItemCompleted(item, state)) {
                     this.trackAppServerToolLifecycle(event, state);
-                    yield event;
+                    yield event.type === 'tool_result' && item?.id
+                        ? { ...event, assistantUuid: item.id } : event;
                 }
                 break;
             }
@@ -4629,6 +4882,9 @@ export class CodexRunner {
                 isError: true,
                 error: denial.reason,
                 errorCode: errorCodeForToolDenial(denial.decisionSource, denial.policyCode),
+                ...(errorDetailCodeForToolDenial(denial.decisionSource, denial.policyCode, denial.errorDetailCode)
+                    ? { errorDetailCode: errorDetailCodeForToolDenial(denial.decisionSource, denial.policyCode, denial.errorDetailCode) }
+                    : {}),
                 decision: 'deny',
                 decisionSource: denial.decisionSource,
                 policyCode: denial.policyCode,
@@ -4655,6 +4911,9 @@ export class CodexRunner {
                 isError: true,
                 error: managedHookDenial.reason,
                 errorCode: 'POLICY_DENIED',
+                ...(errorDetailCodeForToolDenial('policy', managedHookDenial.policyCode, managedHookDenial.errorDetailCode)
+                    ? { errorDetailCode: errorDetailCodeForToolDenial('policy', managedHookDenial.policyCode, managedHookDenial.errorDetailCode) }
+                    : {}),
                 decision: 'deny',
                 decisionSource: 'policy',
                 policyCode: managedHookDenial.policyCode,
@@ -4716,17 +4975,29 @@ export class CodexRunner {
                 }
                 break;
             case 'commandExecution':
-                yield {
-                    type: 'tool_result',
-                    name: 'Shell',
-                    result: item.aggregatedOutput ?? '',
-                    ...(blockedFields ?? {
-                        isError: item.exitCode !== null && item.exitCode !== undefined ? item.exitCode !== 0 : item.status === 'failed' || item.status === 'declined',
-                        ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
-                    }),
-                    callId: item.id,
-                    durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
-                };
+                {
+                    const exitCode = typeof item.exitCode === 'number' && Number.isInteger(item.exitCode)
+                        ? item.exitCode
+                        : undefined;
+                    const isError = exitCode !== undefined
+                        ? exitCode !== 0
+                        : item.status === 'failed' || item.status === 'declined';
+                    yield {
+                        type: 'tool_result',
+                        name: 'Shell',
+                        result: item.aggregatedOutput ?? '',
+                        ...(blockedFields ?? {
+                            isError,
+                            ...codexItemErrorFields(item),
+                            executed: true,
+                            executionState: isError ? 'failed' : 'completed',
+                            ...(exitCode !== undefined ? { exitCode } : {}),
+                        }),
+                        ...(blockedFields ? {} : exitCode !== undefined ? { exitCode } : {}),
+                        callId: item.id,
+                        durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
+                    };
+                }
                 break;
             case 'mcpToolCall':
                 yield {
@@ -4735,7 +5006,11 @@ export class CodexRunner {
                     result: item.result,
                     ...(blockedFields ?? { isError: item.status === 'failed' }),
                     ...(blockedFields ? {} : { error: item.error?.message }),
-                    ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
+                    ...(blockedFields ? {} : codexItemErrorFields(item)),
+                    ...(blockedFields ?? {
+                        executed: true,
+                        executionState: item.status === 'failed' ? 'failed' : 'completed',
+                    }),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
                 };
@@ -4746,7 +5021,11 @@ export class CodexRunner {
                     name: item.namespace ? `${item.namespace}:${item.tool}` : item.tool,
                     result: item.contentItems,
                     ...(blockedFields ?? { isError: item.success === false || item.status === 'failed' }),
-                    ...(item.error?.code || item.error?.errorCode ? { errorCode: String(item.error.code ?? item.error.errorCode) } : {}),
+                    ...(blockedFields ? {} : codexItemErrorFields(item)),
+                    ...(blockedFields ?? {
+                        executed: true,
+                        executionState: item.success === false || item.status === 'failed' ? 'failed' : 'completed',
+                    }),
                     callId: item.id,
                     durationMs: typeof item.durationMs === 'number' ? item.durationMs : undefined,
                 };
@@ -4760,12 +5039,34 @@ export class CodexRunner {
                             yield editEvent;
                         }
                     }
-                    yield { type: 'tool_result', name: 'Edit', result: item.changes, ...(blockedFields ?? { isError: item.status === 'failed' }), callId: item.id };
+                    yield {
+                        type: 'tool_result',
+                        name: 'Edit',
+                        result: item.changes,
+                        ...(blockedFields ?? {
+                            isError: item.status === 'failed',
+                            executed: true,
+                            executionState: item.status === 'failed' ? 'failed' : 'completed',
+                            ...codexItemErrorFields(item),
+                        }),
+                        callId: item.id,
+                    };
                 }
                 else {
                     const desc = this.normalizeFileChanges(item.changes).map((change) => this.describeFileChange(change)).join(', ');
                     yield { type: 'tool_use', name: 'FileChange', input: { description: desc }, callId: item.id };
-                    yield { type: 'tool_result', name: 'FileChange', result: item.changes, ...(blockedFields ?? { isError: item.status === 'failed' }), callId: item.id };
+                    yield {
+                        type: 'tool_result',
+                        name: 'FileChange',
+                        result: item.changes,
+                        ...(blockedFields ?? {
+                            isError: item.status === 'failed',
+                            executed: true,
+                            executionState: item.status === 'failed' ? 'failed' : 'completed',
+                            ...codexItemErrorFields(item),
+                        }),
+                        callId: item.id,
+                    };
                 }
                 break;
             case 'webSearch':
@@ -4970,7 +5271,7 @@ export class CodexRunner {
         const managedTempDir = ensureSessionRuntimeDir(sessionId);
         if (!managedTempDir)
             return undefined;
-        return `临时文件必须使用环境变量 \`$TMPDIR\`。当前值是 \`${managedTempDir}\`，它是当前 EvolCore 会话唯一允许的临时工作区；不要直接使用 \`/tmp\`，也不要使用其他会话的临时目录。该目录随 EvolCore sessionId 保持稳定；若文件不存在，请先在当前 \`$TMPDIR\` 重新创建，再继续执行后续 \`ec\` 命令。`;
+        return `临时文件必须使用环境变量 \`$TMPDIR\`。当前值是 \`${managedTempDir}\`，它是当前 EvolCore 会话唯一允许的临时工作区；不要直接使用 \`/tmp\`，也不要使用其他会话的临时目录。该目录随 EvolCore sessionId 保持稳定；若文件不存在，请先在当前 \`$TMPDIR\` 重新创建，再继续执行后续 \`ec\` 命令。文件修改优先使用 Codex 原生 FileChange/Edit；若当前 Codex 版本未暴露该工具，可使用独立且可解析的 \`apply_patch\` patch。不得把 patch 与其它命令拼接、放入管道或使用任意重定向；目标文件仍受 workspace、H/L 路径和当前权限模式限制。`;
     }
     buildEvolcoreShellEnvironmentConfig(sessionId, sessionToken, taskDelegationToken) {
         const managedTempDir = ensureSessionRuntimeDir(sessionId);