evolcore 0.0.32 → 0.0.33

package/CHANGELOG.md

@@ -5,6 +5,30 @@
 
 ## Unreleased
 
+## 0.0.33 (2026-10-15)
+
+### 话题与会话
+
+- 新增话题管理与跨话题协作，支持查询历史、维护摘要和状态、删除与恢复话题，并通过定时复查跟进跨话题消息。
+- 新增当前主会话和话题的闲置触发设置，可通过聊天命令或菜单单独开启、关闭和调整等待时间。
+- 支持按会话编号查找本地存档，完善话题上下文衔接和后台会话清理。
+- 改进消息中断与任务恢复，避免已提交输入重复执行或未提交输入丢失。
+- 优化后台任务与子智能体的状态展示，将关联任务结果合并到原工具卡片，减少重复提示，并正确展示耗时及完成、失败、停止等状态。
+
+### Agent 与模型
+
+- 简化首次设定：沿用已有有效资料，仅确认缺失、歧义或新增内容；人格和头像可稍后完善，正式欢迎文案由 Agent 自主准备。
+- 完善模型推理强度选项，在模型目录未提供能力信息时按基座支持范围提供选项，并统一角色与关系设置。
+- 强化 Codex 安装与启动检查，支持修复失效绑定，切换到另一套有效安装路径前要求明确确认。
+- 改进 Codex 工具结果诊断，区分策略拒绝、用户拒绝和实际执行结果，减少错误归因。
+
+### 权限与运行稳定性
+
+- 强化受管命令、话题操作及个人和群文件访问的身份与目标校验，发送被拒时提供更明确的原因。
+- 无人值守任务不再请求交互审批，任务恢复与跨会话交接沿用原有审批策略。
+- 查看任务运行上下文不再消耗一次性授权，避免后续操作重复审批。
+- 修复重启提示被恢复后的进程重复投递的问题，并在无法判断错误原因时保留原始诊断信息。
+
 ## 0.0.32 (2026-10-12)
 
 - 统一受管命令的原始参数与审批哈希校验，按会话项目目录解析 Agent 初始化、人格和头像文件，强化授权后的文件访问边界。

package/bin/install-codex-managed-hooks.mjs

@@ -3,7 +3,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { isDeepStrictEqual } from 'node:util';
@@ -285,8 +285,55 @@ export function samePackageRoot(embedded, expected) {
   return normalize(embedded) === normalize(expected) || resolved(embedded) === resolved(expected);
 }
 
+function normalizedPath(value) {
+  return path.normalize(String(value || '')).replace(/[\\/]+$/, '').toLowerCase();
+}
+
+function parseManagedCommand(value, hookPath) {
+  if (typeof value !== 'string') return null;
+  const match = /^"([^"\r\n]+)"\s+"([^"\r\n]+)"\s+%EVOLCORE_INSTANCE_SOCKET%$/i.exec(value.trim());
+  if (!match) return null;
+  const nodePath = match[1];
+  const commandHookPath = match[2];
+  if (!path.isAbsolute(nodePath) || /[%!]/.test(nodePath + commandHookPath)) return null;
+  if (normalizedPath(commandHookPath) !== normalizedPath(hookPath)) return null;
+  return { nodePath };
+}
+
+function runtimeFileMayExist(file) {
+  try { return fs.statSync(file).isFile(); }
+  catch (error) { return !['ENOENT', 'ENOTDIR'].includes(error?.code); }
+}
+
+export function managedBinding(source, launcher, hookPath) {
+  const embeddedPackageRoot = launcherPackageRoot(launcher);
+  if (!embeddedPackageRoot || !path.isAbsolute(embeddedPackageRoot)
+    || launcher.replaceAll('\r\n', '\n') !== managedHookLauncher(embeddedPackageRoot)) return null;
+  const retained = removeManagedBlock(source);
+  if (retained === source) return null;
+  const original = parseToml(source);
+  const retainedConfig = parseToml(retained);
+  const groups = original.hooks?.PreToolUse;
+  const retainedGroups = retainedConfig.hooks?.PreToolUse || [];
+  const owned = groups.filter(group => !retainedGroups.some(other => isDeepStrictEqual(group, other)));
+  if (owned.length !== 1) return null;
+  const group = owned[0];
+  if (group.matcher !== '*' || !Array.isArray(group.hooks) || group.hooks.length !== 1) return null;
+  const handler = group.hooks[0];
+  if (handler.type !== 'command' || handler.async === true) return null;
+  const command = parseManagedCommand(handler.command, hookPath);
+  const windowsCommand = parseManagedCommand(handler.command_windows, hookPath);
+  if (!command || !windowsCommand || normalizedPath(command.nodePath) !== normalizedPath(windowsCommand.nodePath)) return null;
+  if (!isDeepStrictEqual(group, { matcher: '*', hooks: [{
+    type: 'command', command: handler.command, command_windows: handler.command_windows,
+    statusMessage: 'Checking EvolCore session policy',
+  }] })) return null;
+  if (retainedGroups.some(other => JSON.stringify(other).toLowerCase().includes('pre-tool-use.mjs'))) return null;
+  return { embeddedPackageRoot, managedNodePath: command.nodePath };
+}
+
 /** Inspect only the canonical EvolCore managed-hook targets. */
-export function inspectManagedHookInstallation({ requirements, managedDir, packageRoot }) {
+export function inspectManagedHookInstallation({ requirements, managedDir, packageRoot, nodePath = process.execPath }) {
   const canonicalRequirements = path.resolve(requirements);
   const canonicalManagedDir = path.resolve(managedDir);
   const hookPath = path.join(canonicalManagedDir, 'pre-tool-use.mjs');
@@ -297,11 +344,12 @@ export function inspectManagedHookInstallation({ requirements, managedDir, packa
         return { status: 'unsafe', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: `${directory} must be a real directory` };
       }
     } catch (error) {
-      if (error?.code !== 'ENOENT') return { status: 'unsafe', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: error?.message || String(error) };
+      if (error?.code !== 'ENOENT') return { status: 'unavailable', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: error?.message || String(error) };
     }
   }
   const req = regularFile(canonicalRequirements);
   const hook = regularFile(hookPath);
+  if (req.error || hook.error) return { status: 'unavailable', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: 'unable to inspect requirements or launcher' };
   if (req.unsafe || hook.unsafe) return { status: 'unsafe', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: 'requirements or launcher is not a regular file' };
   if (!req.ok && hook.ok) return { status: 'unsafe', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: 'canonical launcher exists but requirements.toml is missing' };
   if (req.ok && !hook.ok) {
@@ -324,48 +372,81 @@ export function inspectManagedHookInstallation({ requirements, managedDir, packa
     }
   }
   if (!req.ok || !hook.ok) return { status: 'missing', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: 'requirements or launcher is missing' };
-  let parsed;
-  try { parsed = parseToml(fs.readFileSync(canonicalRequirements, 'utf8')); }
-  catch (error) { return { status: 'unsafe', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: `requirements.toml is invalid: ${error?.message || String(error)}` }; }
-  const configured = parsed.hooks?.windows_managed_dir ?? parsed.hooks?.managed_dir;
-  const normalized = value => path.normalize(String(value || '')).toLowerCase();
-  const launcher = fs.readFileSync(hookPath, 'utf8');
-  const packageMarker = launcher.includes('EVOLCORE_MANAGED_HOOK_LAUNCHER')
-    && samePackageRoot(launcherPackageRoot(launcher), path.resolve(packageRoot || process.cwd()));
-  const preToolUse = parsed.hooks?.PreToolUse;
-  const canonicalCommand = value => {
-    if (typeof value !== 'string' || !value || /[\r\n;&|<>]/.test(value)) return false;
-    const withoutSocket = value.replace(/\s+%EVOLCORE_INSTANCE_SOCKET%\s*$/i, '').trim();
-    return withoutSocket.replace(/["']+$/, '').toLowerCase().endsWith(normalized(hookPath));
-  };
-  const loaded = Array.isArray(preToolUse) && preToolUse.some(group => group?.matcher === '*'
-    && Array.isArray(group.hooks) && group.hooks.some(handler => handler?.type === 'command'
-      && handler.async !== true && typeof handler.command === 'string'
-      && canonicalCommand(handler.command)
-      && canonicalCommand(handler.command_windows ?? handler.commandWindows)));
-  const valid = parsed.allow_managed_hooks_only === true
-    && parsed.features?.hooks === true
-    && normalized(configured) === normalized(canonicalManagedDir)
-    && packageMarker && loaded;
-  return valid
-    ? { status: 'installed', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath }
-    : { status: 'unsafe', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: 'managed-hook policy is missing, altered, or points outside the canonical target' };
-}
-
-/** Idempotently repair a missing canonical installation; unsafe edits fail closed. */
+  let source;
+  let launcher;
+  try {
+    source = fs.readFileSync(canonicalRequirements, 'utf8');
+    launcher = fs.readFileSync(hookPath, 'utf8');
+  } catch (error) {
+    return { status: 'unavailable', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: error?.message || String(error) };
+  }
+  try {
+    const parsed = parseToml(source);
+    const binding = managedBinding(source, launcher, hookPath);
+    if (!binding || parsed.allow_managed_hooks_only !== true || parsed.features?.hooks !== true
+      || normalizedPath(parsed.hooks?.windows_managed_dir) !== normalizedPath(canonicalManagedDir)
+      || (parsed.hooks?.managed_dir !== undefined
+        && normalizedPath(parsed.hooks.managed_dir) !== normalizedPath(canonicalManagedDir))) {
+      throw new Error('managed-hook policy is missing, altered, or points outside the canonical target');
+    }
+    const { embeddedPackageRoot, managedNodePath } = binding;
+    const packageMatches = samePackageRoot(embeddedPackageRoot, path.resolve(packageRoot || process.cwd()));
+    const nodeMatches = samePackageRoot(managedNodePath, nodePath);
+    const state = {
+      requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath,
+      managedPackageRoot: embeddedPackageRoot, managedNodePath,
+      repairFingerprint: createHash('sha256').update(source).update('\0').update(launcher).digest('hex'),
+    };
+    if (packageMatches && nodeMatches) return { ...state, status: 'installed' };
+    return {
+      ...state, status: 'stale',
+      repairAmbiguous: runtimeFileMayExist(path.join(embeddedPackageRoot, 'bin', 'codex-managed-hook.mjs'))
+        && runtimeFileMayExist(managedNodePath),
+      reason: !packageMatches && !nodeMatches
+        ? 'managed-hook points to a different EvolCore package root and Node runtime'
+        : !packageMatches ? 'managed-hook points to a different EvolCore package root'
+          : 'managed-hook points to a different Node runtime',
+    };
+  } catch (error) {
+    return { status: 'unsafe', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, reason: error?.message || String(error) };
+  }
+}
+
+/** Idempotently repair a missing or stale canonical installation; unsafe edits fail closed. */
 export function repairManagedHookInstallation(options, acl = windowsAcl) {
   const { requirements, managedDir, packageRoot, nodePath = process.execPath } = options;
   const canonicalRequirements = path.resolve(requirements);
   const canonicalManagedDir = path.resolve(managedDir);
   const hookPath = path.join(canonicalManagedDir, 'pre-tool-use.mjs');
   const sourceHook = path.join(packageRoot, 'bin', 'codex-managed-hook.mjs');
-  const state = inspectManagedHookInstallation({ requirements: canonicalRequirements, managedDir: canonicalManagedDir, packageRoot });
+  const state = inspectManagedHookInstallation({ requirements: canonicalRequirements, managedDir: canonicalManagedDir, packageRoot, nodePath });
   if (state.status === 'installed') return { ...state, repaired: false, warnings: [] };
-  if (state.status === 'unsafe') throw new Error(`Refusing automatic managed-hook repair: ${state.reason}`);
+  if (!['missing', 'stale'].includes(state.status)) throw new Error(`Refusing automatic managed-hook repair: ${state.reason}`);
+  if (state.status === 'stale' && (options.expectedFingerprint !== state.repairFingerprint
+    || (state.repairAmbiguous && options.confirmRebind !== true))) {
+    throw new Error('Refusing automatic managed-hook repair: binding changed or requires explicit confirmation');
+  }
   if (!fs.existsSync(sourceHook)) throw new Error(`Required Hook runtime file was not found: ${sourceHook}`);
   const previousContent = fs.existsSync(canonicalRequirements) ? fs.readFileSync(canonicalRequirements, 'utf8') : '';
   const content = buildManagedRequirements(previousContent, { targetDirectory: canonicalManagedDir, nodePath, hookPath });
-  const warnings = provisionManagedFiles({ requirements: canonicalRequirements, hookPath, sourceHook, nodePath, previousContent, content, launcher: managedHookLauncher(packageRoot) }, acl);
+  const inspect = () => inspectManagedHookInstallation({
+    requirements: canonicalRequirements, managedDir: canonicalManagedDir, packageRoot, nodePath,
+  });
+  const warnings = provisionManagedFiles({
+    requirements: canonicalRequirements, hookPath, sourceHook, nodePath, previousContent, content,
+    launcher: managedHookLauncher(packageRoot),
+    beforePublish: () => {
+      const latest = inspect();
+      if (latest.status !== state.status || latest.repairFingerprint !== state.repairFingerprint
+        || latest.repairAmbiguous !== state.repairAmbiguous) {
+        throw new Error('Managed-hook state changed before publication; retry the startup check');
+      }
+    },
+    verifyPublished: () => {
+      const verified = inspect();
+      if (verified.status !== 'installed') throw new Error('Managed-hook verification failed: ' + verified.reason);
+    },
+  }, acl);
   return { status: 'installed', requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath, repaired: true, warnings };
 }
 
@@ -475,6 +556,7 @@ export function provisionManagedFiles(options, acl = windowsAcl) {
   let committed = false;
   try {
     fs.writeFileSync(lock, JSON.stringify({ pid: process.pid, started: new Date().toISOString() }));
+    options.beforePublish?.();
     const existing = existingFile(requirements, fs);
     // Detect edits made after configuration generation, including a second
     // installer completing just before this process acquired the lock.
@@ -509,11 +591,13 @@ export function provisionManagedFiles(options, acl = windowsAcl) {
         const target = temporary ? entry.temporary : entry.file;
         if (fs.readFileSync(target, 'utf8') !== entry.value) throw new Error(`Installed content differs: ${target}`);
       }
-      return acl('verify', { entries: [
+      const report = acl('verify', { entries: [
         { path: directory, protected: true, execute: true },
         ...staged.map(entry => ({ path: temporary ? entry.temporary : entry.file, protected: true })),
         ...readable,
       ] });
+      if (temporary === false) options.verifyPublished?.();
+      return report;
     };
     verify(true);
     let accessReport;
@@ -561,7 +645,10 @@ function main() {
     if (!fs.statSync(file).isFile()) fail(`Required Hook runtime file was not found: ${file}`);
   }
   if (hasArgument('--repair')) {
-    const result = repairManagedHookInstallation({ requirements, managedDir: targetDirectory, packageRoot, nodePath });
+    const result = repairManagedHookInstallation({
+      requirements, managedDir: targetDirectory, packageRoot, nodePath,
+      expectedFingerprint: argument('--expected-fingerprint'), confirmRebind: hasArgument('--confirm-rebind'),
+    });
     process.stdout.write(`${JSON.stringify(result)}\n`);
     return;
   }

package/dist/agents/claude-runner.js

@@ -586,6 +586,8 @@ export class AgentRunner {
     permissionGateway;
     sendPromptFn;
     permissionContexts = new Map();
+    /** tool_use_id → 模型返回序号（turnCount），供 PreToolUse 钩子把 turn 传给 policyHook */
+    toolTurnByCallId = new Map();
     claudeExecutablePath;
     /** 每个 session 最近的子进程 stderr 行（环形缓冲），用于子进程崩溃时还原真正原因 */
     recentStderr = new Map();
@@ -714,6 +716,9 @@ export class AgentRunner {
             ANTHROPIC_API_KEY: this.apiKey,
             PATH: process.env.PATH,
             DISABLE_AUTOUPDATER: '1',
+            // 记忆只走 EvolCore（ec memory）：关闭 Claude Code 原生 auto-memory 的
+            // 读写，避免两套记忆并存污染上下文。
+            CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1',
             ...(anthropicBaseUrl ? { ANTHROPIC_BASE_URL: anthropicBaseUrl } : {}),
             ...(this.customHeaders
                 ? { ANTHROPIC_CUSTOM_HEADERS: Object.entries(this.customHeaders).map(([name, value]) => `${name}: ${value}`).join('\n') }
@@ -779,6 +784,9 @@ export class AgentRunner {
             settings: {
                 ...settings,
                 skillOverrides: { ...skillOverrides, eclink: 'off' },
+                // 记忆只走 EvolCore（ec memory）：关闭 Claude Code 原生 auto-memory，
+                // 与 getAgentEnv 的 CLAUDE_CODE_DISABLE_AUTO_MEMORY 双保险。
+                autoMemoryEnabled: false,
             },
         };
     }
@@ -1765,6 +1773,8 @@ export class AgentRunner {
                         if (content.type === 'tool_use') {
                             if (content.id)
                                 toolUseNames.set(content.id, content.name);
+                            if (content.id)
+                                this.toolTurnByCallId.set(content.id, turnCount);
                             if (content.id && content.name === 'Bash' && content.input?.dangerouslyDisableSandbox !== true
                                 && resolvePhaseOneExecutionSandbox(permissionMode, this.permissionContexts.get(sessionId)?.role).state !== 'off') {
                                 sandboxedBashCalls.add(content.id);
@@ -1772,7 +1782,9 @@ export class AgentRunner {
                             yield { type: 'tool_use', name: content.name, input: content.input, callId: content.id, turn: turnCount, outputTokens: turnOutputChars, assistantUuid: event.uuid };
                         }
                         else if (content.type === 'text' && content.text) {
-                            yield { type: 'text', text: content.text, outputTokens: turnOutputChars, turn: turnCount, assistantUuid: event.uuid };
+                            // 携带出身标记：`<synthetic>` assistant 是 API/传输故障的错误回显，
+                            // 消费端据此把它与模型正文区分开，不必靠字符串或计数猜。
+                            yield { type: 'text', text: content.text, outputTokens: turnOutputChars, turn: turnCount, assistantUuid: event.uuid, synthetic: isSyntheticAssistant || undefined };
                         }
                     }
                 }
@@ -1787,6 +1799,8 @@ export class AgentRunner {
                                 : block.content != null ? JSON.stringify(block.content) : '';
                             if (block.tool_use_id)
                                 emittedToolResultIds.add(block.tool_use_id);
+                            if (block.tool_use_id)
+                                this.toolTurnByCallId.delete(block.tool_use_id);
                             if (sandboxedBashCalls.delete(block.tool_use_id) && block.is_error === true
                                 && isSandboxInitializationToolResult(block.content)) {
                                 const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, block.tool_use_id, permissionMode, new Error(resultContent), [], 'session');
@@ -2359,7 +2373,20 @@ export class AgentRunner {
                 });
             }
             // proactive 模式行为策略（首次工具调用必须是 ec msg send）
-            const policyResult = this.permissionContexts.get(sessionId)?.policyHook?.(toolName, toolInput);
+            const sessionPolicyHook = this.permissionContexts.get(sessionId)?.policyHook;
+            let policyResult;
+            if (sessionPolicyHook) {
+                // 钩子可能先于流里的 tool_use 事件到达：按 tool_use_id 取模型返回序号，取不到短等（最多 200ms）
+                const policyCallId = (input.tool_use_id ?? input.toolUseID);
+                let policyTurn = policyCallId ? this.toolTurnByCallId.get(policyCallId) : undefined;
+                for (let waited = 0; policyCallId && policyTurn === undefined && waited < 200; waited += 20) {
+                    await new Promise(resolve => setTimeout(resolve, 20));
+                    policyTurn = this.toolTurnByCallId.get(policyCallId);
+                }
+                if (policyCallId)
+                    this.toolTurnByCallId.delete(policyCallId);
+                policyResult = sessionPolicyHook(toolName, toolInput, { turn: policyTurn });
+            }
             if (policyResult?.block) {
                 await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, policyResult.policyCode ?? 'session_policy_hook');
                 return hookDecision('deny', policyResult.reason || '当前会话策略拒绝此工具调用', updatedInput);

package/dist/agents/codex/app-server-client.js

@@ -745,6 +745,9 @@ export class CodexAppServerClient {
     }
     buildProcessArgs() {
         const args = ['app-server', '--listen', 'stdio://'];
+        // 记忆只走 EvolCore（ec memory）：显式关闭 Codex 原生 memories，
+        // 不依赖其默认值（当前 stable 默认 false，此处写死防未来翻转）。
+        args.push('--config', 'features.memories=false');
         if (this.options.enableRequestUserInput !== false) {
             args.push('--enable', 'default_mode_request_user_input');
         }

package/dist/agents/codex/diagnostics.js

@@ -2,7 +2,9 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { parse as parseToml } from 'smol-toml';
+const managedHookInstaller = await import(new URL('../../../bin/install-codex-managed-hooks.mjs', import.meta.url).href);
 export function checkCodexProjectPath(value, options = {}) {
     const configured = typeof value === 'string' ? value.trim() : '';
     if (!configured) {
@@ -180,19 +182,6 @@ function realDirectoryState(directory) {
         return 'unavailable';
     }
 }
-/** Read back the package root that managedHookLauncher() embedded. */
-function launcherPackageRoot(launcher) {
-    const match = /^\s*const packageRoot = ("(?:[^"\\]|\\.)*")\s*;/m.exec(launcher);
-    if (!match)
-        return null;
-    try {
-        const value = JSON.parse(match[1]);
-        return typeof value === 'string' && value ? value : null;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * A `npm link` install reaches the package through a symlinked global path, so
  * the launcher and the running CLI legitimately spell the same package root
@@ -213,6 +202,20 @@ function samePackageRoot(embedded, expected) {
     };
     return normalize(embedded) === normalize(expected) || resolved(embedded) === resolved(expected);
 }
+function normalizedPath(value) {
+    return path.normalize(String(value || '')).replace(/[\\/]+$/, '').toLowerCase();
+}
+function runtimeFileMayExist(file) {
+    try {
+        return fs.statSync(file).isFile();
+    }
+    catch (error) {
+        return !['ENOENT', 'ENOTDIR'].includes(error?.code || '');
+    }
+}
+function managedBinding(source, launcher, hookPath) {
+    return managedHookInstaller.managedBinding(source, launcher, hookPath);
+}
 /** Read-only inspection of the machine-wide Windows Codex managed hook. */
 export function inspectCodexManagedHook(options = {}) {
     const paths = codexManagedHookPaths(options);
@@ -283,32 +286,35 @@ export function inspectCodexManagedHook(options = {}) {
     catch (error) {
         return { status: 'unavailable', requirements, managedDir, hookPath, reason: error instanceof Error ? error.message : String(error) };
     }
-    const normalized = (value) => path.normalize(String(value || '')).toLowerCase();
     const expectedPackageRoot = path.resolve(options.packageRoot || process.cwd());
-    const launcherValid = launcher.includes('EVOLCORE_MANAGED_HOOK_LAUNCHER')
-        && samePackageRoot(launcherPackageRoot(launcher), expectedPackageRoot);
-    const configuredDir = config.hooks?.windows_managed_dir ?? config.hooks?.managed_dir;
-    const groups = config.hooks?.PreToolUse;
-    const canonicalCommand = (value) => {
-        if (typeof value !== 'string' || !value || /[\r\n;&|<>]/.test(value))
-            return false;
-        const withoutSocket = value.replace(/\s+%EVOLCORE_INSTANCE_SOCKET%\s*$/i, '').trim();
-        return withoutSocket.replace(/["']+$/, '').toLowerCase().endsWith(normalized(hookPath));
-    };
-    const hookLoaded = Array.isArray(groups) && groups.some((group) => group?.matcher === '*'
-        && Array.isArray(group.hooks) && group.hooks.some((handler) => {
-        const command = typeof handler?.command === 'string' ? handler.command : '';
-        const windowsCommand = typeof handler?.command_windows === 'string' ? handler.command_windows : '';
-        return handler?.type === 'command' && handler.async !== true
-            && canonicalCommand(command) && canonicalCommand(windowsCommand);
-    }));
-    const valid = config.allow_managed_hooks_only === true
-        && config.features?.hooks === true
-        && normalized(configuredDir) === normalized(managedDir)
-        && launcherValid && hookLoaded;
-    return valid
-        ? { status: 'installed', requirements, managedDir, hookPath }
-        : { status: 'unsafe', requirements, managedDir, hookPath, reason: 'managed-hook policy is missing, altered, or points outside the canonical target' };
+    try {
+        const binding = managedBinding(source, launcher, hookPath);
+        if (!binding || config.allow_managed_hooks_only !== true || config.features?.hooks !== true
+            || normalizedPath(config.hooks?.windows_managed_dir) !== normalizedPath(managedDir)
+            || (config.hooks?.managed_dir !== undefined
+                && normalizedPath(config.hooks.managed_dir) !== normalizedPath(managedDir))) {
+            throw new Error('managed-hook policy is missing, altered, or points outside the canonical target');
+        }
+        const { embeddedPackageRoot, managedNodePath } = binding;
+        const packageMatches = samePackageRoot(embeddedPackageRoot, expectedPackageRoot);
+        const nodeMatches = samePackageRoot(managedNodePath, options.nodePath || process.execPath);
+        const repairFingerprint = createHash('sha256').update(source).update('\0').update(launcher).digest('hex');
+        if (packageMatches && nodeMatches)
+            return { status: 'installed', requirements, managedDir, hookPath };
+        return {
+            status: 'stale', requirements, managedDir, hookPath,
+            managedPackageRoot: embeddedPackageRoot, managedNodePath, repairFingerprint,
+            repairAmbiguous: runtimeFileMayExist(path.join(embeddedPackageRoot, 'bin', 'codex-managed-hook.mjs'))
+                && runtimeFileMayExist(managedNodePath),
+            reason: !packageMatches && !nodeMatches
+                ? 'managed-hook points to a different EvolCore package root and Node runtime'
+                : !packageMatches ? 'managed-hook points to a different EvolCore package root'
+                    : 'managed-hook points to a different Node runtime',
+        };
+    }
+    catch (error) {
+        return { status: 'unsafe', requirements, managedDir, hookPath, reason: error instanceof Error ? error.message : String(error) };
+    }
 }
 function powershellLiteral(value) {
     return `'${value.replaceAll("'", "''")}'`;
@@ -319,7 +325,10 @@ function windowsArgument(value) {
 }
 export function buildCodexManagedHookElevationCommand(options) {
     const argumentLine = [options.installer, '--package-root', options.packageRoot,
-        '--requirements', options.requirements, '--managed-dir', options.managedDir, '--repair']
+        '--requirements', options.requirements, '--managed-dir', options.managedDir,
+        '--node-path', options.nodePath, '--repair',
+        ...(options.expectedFingerprint ? ['--expected-fingerprint', options.expectedFingerprint] : []),
+        ...(options.confirmRebind ? ['--confirm-rebind'] : [])]
         .map(windowsArgument).join(' ');
     return [
         "$ErrorActionPreference = 'Stop'",
@@ -334,11 +343,11 @@ export function buildCodexManagedHookElevationCommand(options) {
     ].join('\n');
 }
 /**
- * Ensure the machine-wide Windows hook before starting the daemon. Missing
- * files are repaired through one UAC elevation; altered policy remains
+ * Ensure the machine-wide Windows hook before starting the daemon. Missing or
+ * stale files are repaired through one UAC elevation; altered policy remains
  * fail-closed and is never overwritten automatically.
  */
-export function ensureCodexManagedHook(options) {
+export async function ensureCodexManagedHook(options) {
     const platformName = options.platform ?? process.platform;
     const paths = codexManagedHookPaths({
         platform: platformName,
@@ -358,8 +367,27 @@ export function ensureCodexManagedHook(options) {
     let state = inspectCodexManagedHook(inspectOptions);
     if (state.status === 'installed')
         return { ...state, repaired: false };
-    if (state.status !== 'missing')
+    if (state.status !== 'missing' && state.status !== 'stale')
         return { ...state, repaired: false };
+    let confirmedRebind = false;
+    if (state.status === 'stale' && state.repairAmbiguous) {
+        try {
+            confirmedRebind = await options.repairDecision?.(state) === true;
+        }
+        catch (error) {
+            return { ...state, repaired: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    if (state.status === 'stale' && state.repairAmbiguous && !confirmedRebind) {
+        return { ...state, repaired: false, cancelled: true, error: 'managed-hook repair cancelled or requires confirmation' };
+    }
+    const rechecked = inspectCodexManagedHook(inspectOptions);
+    if (rechecked.status === 'installed')
+        return { ...rechecked, repaired: false };
+    if (rechecked.status !== state.status || rechecked.repairFingerprint !== state.repairFingerprint
+        || rechecked.repairAmbiguous !== state.repairAmbiguous) {
+        return { ...rechecked, repaired: false, error: 'managed-hook state changed during the startup check; retry to confirm the current binding' };
+    }
     const installer = path.join(path.resolve(options.packageRoot), 'bin', 'install-codex-managed-hooks.mjs');
     if (!fs.existsSync(installer)) {
         return { ...state, repaired: false, error: `managed-hook installer is missing: ${installer}` };
@@ -370,6 +398,10 @@ export function ensureCodexManagedHook(options) {
             nodePath: process.execPath, installer: script, packageRoot,
             requirements: path.resolve(inspectOptions.requirements),
             managedDir: path.resolve(inspectOptions.managedDir),
+            ...(state.status === 'stale' ? {
+                expectedFingerprint: state.repairFingerprint,
+                confirmRebind: confirmedRebind,
+            } : {}),
         });
         const result = spawnSync(powershell, [
             // Do not use -NonInteractive here: Start-Process -Verb RunAs must be
@@ -385,7 +417,7 @@ export function ensureCodexManagedHook(options) {
         }
         return { ok: true };
     });
-    options.onInstallRequired?.();
+    options.onInstallRequired?.(state);
     let elevated;
     try {
         elevated = runElevated(installer, path.resolve(options.packageRoot));

package/dist/agents/codex-runner.js

@@ -177,10 +177,10 @@ function parseManagedPreToolUseDenial(value) {
         reason = 'EvolCore PreToolUse policy denied this tool call';
     const policyCode = /当前汇报命令(?:未通过规范解析|不符合当前会话)/.test(reason)
         ? 'proactive_send_invalid'
-        : /工具调用已达到\s*\d+\s*次/.test(reason)
-            ? 'proactive_tool_report_required'
-            : /请先用\s+ec\s+(?:group\s+send|msg\s+send)/.test(reason)
-                ? 'proactive_first_send_required'
+        : /连续违规\s*\d+\s*次，任务已中断/.test(reason)
+            ? 'proactive_circuit_break'
+            : /未包含意图表达，本轮只允许\s+ec\s+(?:group\s+send|msg\s+send)/.test(reason)
+                ? 'proactive_intent_required'
                 : 'managed_pre_tool_use_denied';
     return { policyCode, reason };
 }
@@ -2206,12 +2206,21 @@ export class CodexRunner {
         const pending = [...this.unconfirmedInterrupts.entries()].filter(([, record]) => record.sessionId === sessionId || (threadId && record.threadId === threadId));
         await Promise.all(pending.map(async ([key, record]) => {
             try {
-                // Local stream closure and unsubscribe do not prove the backend turn
-                // stopped. Check its exact identity before allowing another writer.
-                const response = await withInterruptDeadline(record.client.threadRead(record.threadId, true, 2_000), 'Codex interrupt verification', 2_000);
-                const turn = response.thread?.turns?.find(turn => turn.id === record.turnId);
+                const response = await withInterruptDeadline(record.client.threadRead(record.threadId, false, 2_000), 'Codex interrupt verification', 2_000);
+                const threadStatus = response.thread?.status?.type;
+                if (threadStatus === 'idle' || threadStatus === 'notLoaded') {
+                    if (this.unconfirmedInterrupts.get(key) === record) {
+                        this.unconfirmedInterrupts.delete(key);
+                        record.unsubscribe?.();
+                    }
+                    return;
+                }
+                if (threadStatus !== undefined)
+                    return;
+                const history = await withInterruptDeadline(record.client.threadRead(record.threadId, true, 2_000), 'Codex interrupt history verification', 2_000);
+                const turn = history.thread?.turns?.find(turn => turn.id === record.turnId);
                 if (turn && ['completed', 'failed', 'interrupted'].includes(String(turn.status))
-                    && !response.thread?.turns?.some(turn => turn.status === 'inProgress')
+                    && !history.thread?.turns?.some(turn => turn.status === 'inProgress')
                     && this.unconfirmedInterrupts.get(key) === record) {
                     this.unconfirmedInterrupts.delete(key);
                     record.unsubscribe?.();
@@ -4965,17 +4974,12 @@ export class CodexRunner {
             }
             : undefined;
         const itemErrorText = outputTextForManagedHook(typeof item.error === 'string' ? item.error : item.error?.message);
-        const hookErrorText = /(?:Command|Tool call) blocked by PreToolUse hook\s*:/i.test(itemErrorText)
-            ? itemErrorText
-            : undefined;
-        const managedHookDenial = (item.status === 'failed' || item.status === 'declined' || hookErrorText)
-            ? parseManagedPreToolUseDenial([
-                item.aggregatedOutput,
-                item.output,
-                item.result,
-                hookErrorText,
-            ].filter(value => value !== undefined && value !== null).map(outputTextForManagedHook).join('\n'))
+        const hookOutput = item.type === 'commandExecution' && item.exitCode == null && !itemErrorText
+            && (item.status === 'failed' || item.status === 'declined')
+            ? [item.aggregatedOutput, item.output, item.result].map(outputTextForManagedHook).find(text => /^\s*(?:Script failed\s+)?(?:Script error:\s*)?(?:Command|Tool call) blocked by PreToolUse hook\s*:/i.test(text))
             : undefined;
+        const managedHookDenial = parseManagedPreToolUseDenial(itemErrorText)
+            ?? parseManagedPreToolUseDenial(hookOutput);
         const managedHookFields = !denial && managedHookDenial
             ? {
                 isError: true,