evolcore 0.0.32 → 0.0.34

package/dist/agents/claude-runner.js

@@ -1,6 +1,6 @@
 import { getRunnerCatalog, peekRunnerCatalog, catalogEfforts, resolveCatalogModel, assertCatalogSelectable } from '../core/model/model-catalog.js';
 import { query, forkSession as sdkForkSession, getSessionMessages as sdkGetSessionMessages, resolveSettings as sdkResolveSettings, } from '@anthropic-ai/claude-agent-sdk';
-import { spawn } from 'child_process';
+import { spawn, execFileSync } from 'child_process';
 import { createRequire } from 'module';
 import { ensureDir } from '../utils/atomic-write.js';
 import { resolveAnthropicConfig } from './baseagent.js';
@@ -30,7 +30,8 @@ import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-p
 import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { getManagedTaskTempDir, isManagedSessionRuntimeDir } from '../cli/task-context.js';
 import { unsettledInterruptError, withInterruptDeadline, hasTrustedFullAccessContext } from './runner-types.js';
-import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel, sdkAutoCompactWindowForModel } from './runner-types.js';
+import { resolveModelSpec } from '../stats/billing.js';
+import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, realContextWindowForModel, autoCompactWindowForModel, sdkAutoCompactWindowForModel } from './runner-types.js';
 import { hasContextWindowSuffix, stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
 const resolveModule = createRequire(import.meta.url);
 const CLAUDE_INTERRUPT_TIMEOUT_MS = 5_000;
@@ -148,6 +149,22 @@ export function resolveBundledClaudeExecutable() {
         return undefined;
     }
 }
+/**
+ * 探测内置 claude.exe 的版本。检测层与执行层共用同一份二进制，所以这里探到的
+ * 版本就是会话真正会跑的那个版本，可与 SDK 锁定的 claudeCodeVersion 对照。
+ */
+export function probeBundledClaudeVersion() {
+    const executable = resolveBundledClaudeExecutable();
+    if (!executable)
+        return undefined;
+    try {
+        const raw = execFileSync(executable, ['--version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        return raw.trim().split(/\s+/)[0] || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
 // Built-in tools execute inside the Claude runtime and are covered by the
 // runner's filesystem/shell policy. MCP and future unknown tools can perform
@@ -494,19 +511,28 @@ async function refreshGatewayPricing(baseUrl, apiKey, requestHeaders) {
  *
  * 若网关把窗口变体作为独立条目下发（目录里同时有 `claude-opus-5` 与
  * `claude-opus-5[1m]`），裸 ID 就是用户明确选的非 1M 变体，不能擅自升级，
- * 否则两条列表项的实际效果无法区分。只有目录未提供任何窗口变体时，才沿用
- * 按本地名单补 `[1m]` 的旧行为。
+ * 否则两条列表项的实际效果无法区分。只有目录未提供任何窗口变体时，才按已解析的
+ * 模型参数（缺失时才回退本地名单）补 `[1m]`。
  */
-function applyContextWindow(modelId, catalog) {
+function applyContextWindow(modelId, contextWindow, catalog) {
     if (hasContextWindowSuffix(modelId))
         return modelId; // 窗口已显式指定
     const variantListed = catalog?.models.some(m => hasContextWindowSuffix(m.id) && stripContextWindowSuffix(m.id) === modelId);
     if (variantListed)
         return modelId;
-    if (isOneMillionContextModel(modelId))
+    if (contextWindow === 1_000_000)
         return `${modelId}[1m]`;
     return modelId;
 }
+function resolveClaudeModelContext(modelId, catalog) {
+    const modelSpec = resolveModelSpec(resolvePaths().root, modelId, undefined, {
+        context_window: realContextWindowForModel(modelId),
+    });
+    return {
+        sdkModel: applyContextWindow(modelId, modelSpec.context_window, catalog),
+        contextWindow: modelSpec.context_window,
+    };
+}
 class MessageStream {
     queue = [];
     waiting = null;
@@ -586,6 +612,8 @@ export class AgentRunner {
     permissionGateway;
     sendPromptFn;
     permissionContexts = new Map();
+    /** tool_use_id → 模型返回序号（turnCount），供 PreToolUse 钩子把 turn 传给 policyHook */
+    toolTurnByCallId = new Map();
     claudeExecutablePath;
     /** 每个 session 最近的子进程 stderr 行（环形缓冲），用于子进程崩溃时还原真正原因 */
     recentStderr = new Map();
@@ -714,6 +742,9 @@ export class AgentRunner {
             ANTHROPIC_API_KEY: this.apiKey,
             PATH: process.env.PATH,
             DISABLE_AUTOUPDATER: '1',
+            // 记忆只走 EvolCore（ec memory）：关闭 Claude Code 原生 auto-memory 的
+            // 读写，避免两套记忆并存污染上下文。
+            CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1',
             ...(anthropicBaseUrl ? { ANTHROPIC_BASE_URL: anthropicBaseUrl } : {}),
             ...(this.customHeaders
                 ? { ANTHROPIC_CUSTOM_HEADERS: Object.entries(this.customHeaders).map(([name, value]) => `${name}: ${value}`).join('\n') }
@@ -779,6 +810,9 @@ export class AgentRunner {
             settings: {
                 ...settings,
                 skillOverrides: { ...skillOverrides, eclink: 'off' },
+                // 记忆只走 EvolCore（ec memory）：关闭 Claude Code 原生 auto-memory，
+                // 与 getAgentEnv 的 CLAUDE_CODE_DISABLE_AUTO_MEMORY 双保险。
+                autoMemoryEnabled: false,
             },
         };
     }
@@ -1447,7 +1481,7 @@ export class AgentRunner {
      * SDK 原始事件 → 标准 AgentEvent 转换
      * 所有 SDK 特有的事件类型引用封装在此方法内
      */
-    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false, recoverySessionId) {
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false, recoverySessionId, resolvedContextWindow) {
         let lastSessionId;
         let pendingSessionId;
         let hasTurnActivity = false;
@@ -1765,6 +1799,8 @@ export class AgentRunner {
                         if (content.type === 'tool_use') {
                             if (content.id)
                                 toolUseNames.set(content.id, content.name);
+                            if (content.id)
+                                this.toolTurnByCallId.set(content.id, turnCount);
                             if (content.id && content.name === 'Bash' && content.input?.dangerouslyDisableSandbox !== true
                                 && resolvePhaseOneExecutionSandbox(permissionMode, this.permissionContexts.get(sessionId)?.role).state !== 'off') {
                                 sandboxedBashCalls.add(content.id);
@@ -1772,7 +1808,9 @@ export class AgentRunner {
                             yield { type: 'tool_use', name: content.name, input: content.input, callId: content.id, turn: turnCount, outputTokens: turnOutputChars, assistantUuid: event.uuid };
                         }
                         else if (content.type === 'text' && content.text) {
-                            yield { type: 'text', text: content.text, outputTokens: turnOutputChars, turn: turnCount, assistantUuid: event.uuid };
+                            // 携带出身标记：`<synthetic>` assistant 是 API/传输故障的错误回显，
+                            // 消费端据此把它与模型正文区分开，不必靠字符串或计数猜。
+                            yield { type: 'text', text: content.text, outputTokens: turnOutputChars, turn: turnCount, assistantUuid: event.uuid, synthetic: isSyntheticAssistant || undefined };
                         }
                     }
                 }
@@ -1787,6 +1825,8 @@ export class AgentRunner {
                                 : block.content != null ? JSON.stringify(block.content) : '';
                             if (block.tool_use_id)
                                 emittedToolResultIds.add(block.tool_use_id);
+                            if (block.tool_use_id)
+                                this.toolTurnByCallId.delete(block.tool_use_id);
                             if (sandboxedBashCalls.delete(block.tool_use_id) && block.is_error === true
                                 && isSandboxInitializationToolResult(block.content)) {
                                 const { detail } = await this.recordSandboxInfrastructureFailure(sessionId, block.tool_use_id, permissionMode, new Error(resultContent), [], 'session');
@@ -1876,7 +1916,7 @@ export class AgentRunner {
                     const effectiveModel = callModel ?? this.model;
                     const isClaudeModel = isClaudeContextUsageModel(effectiveModel);
                     const totalTokens = contextTokensForUsage(u, !!isClaudeModel);
-                    const contextWindowTokens = realContextWindowForModel(sdkModel);
+                    const contextWindowTokens = resolvedContextWindow ?? realContextWindowForModel(sdkModel);
                     const autoCompactTokens = autoCompactWindowForModel(sdkModel);
                     const aggregateContextUsage = totalTokens > 0 ? {
                         totalTokens,
@@ -2186,7 +2226,17 @@ export class AgentRunner {
         if (callPermissionMode === 'fullaccess' && !hasTrustedFullAccessContext(runPermissionContext)) {
             throw new Error('Claude fullaccess requires a trusted per-call execution authorization');
         }
-        const executionSandbox = resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
+        // 系统会话明确声明不要沙箱时，直接按「沙箱关闭」处理。SDK 沙箱以项目目录为中心，
+        // 而系统会话的读写边界（$EVOLCORE_HOME 下的批次目录与记忆目录）与 cwd 无关，
+        // 启用之后只会把声明内的路径也挡在外面。边界由 systemSessionCheck 逐次判定。
+        const executionSandbox = runPermissionContext?.systemSessionSandbox === 'off'
+            ? {
+                permissionMode: normalizeExecutionPermissionMode(callPermissionMode),
+                role: runPermissionContext?.role,
+                state: 'off',
+                reason: 'phase-one-required',
+            }
+            : resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
         const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
         if (executionSandbox.state !== 'off') {
             const activeSandboxFailure = getActiveSandboxInitializationFailure(undefined, undefined, sessionId);
@@ -2341,6 +2391,19 @@ export class AgentRunner {
                 delete toolInput.pages;
             }
             let updatedInput = toolInput === originalInput ? undefined : toolInput;
+            // 系统会话：模块判定即最终结论，不进入下面任何按角色 / permissionMode 的分支
+            const systemSessionCheck = this.permissionContexts.get(sessionId)?.systemSessionCheck;
+            if (systemSessionCheck) {
+                const decision = systemSessionCheck(toolName, toolInput);
+                if (!decision.allow) {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, decision.code);
+                    return hookDecision('deny', decision.reason, updatedInput);
+                }
+                // ec 命令与普通托管 ec 命令一样在沙箱外执行（需要连 daemon IPC）；只读查询留在沙箱内
+                return hookDecision('allow', undefined, decision.ecCommand
+                    ? { ...toolInput, dangerouslyDisableSandbox: true }
+                    : updatedInput);
+            }
             if (callPermissionMode === 'fullaccess') {
                 if (!hasTrustedFullAccessContext(this.permissionContexts.get(sessionId))) {
                     return hookDecision('deny', 'fullaccess execution authorization is no longer active', updatedInput);
@@ -2359,7 +2422,20 @@ export class AgentRunner {
                 });
             }
             // proactive 模式行为策略（首次工具调用必须是 ec msg send）
-            const policyResult = this.permissionContexts.get(sessionId)?.policyHook?.(toolName, toolInput);
+            const sessionPolicyHook = this.permissionContexts.get(sessionId)?.policyHook;
+            let policyResult;
+            if (sessionPolicyHook) {
+                // 钩子可能先于流里的 tool_use 事件到达：按 tool_use_id 取模型返回序号，取不到短等（最多 200ms）
+                const policyCallId = (input.tool_use_id ?? input.toolUseID);
+                let policyTurn = policyCallId ? this.toolTurnByCallId.get(policyCallId) : undefined;
+                for (let waited = 0; policyCallId && policyTurn === undefined && waited < 200; waited += 20) {
+                    await new Promise(resolve => setTimeout(resolve, 20));
+                    policyTurn = this.toolTurnByCallId.get(policyCallId);
+                }
+                if (policyCallId)
+                    this.toolTurnByCallId.delete(policyCallId);
+                policyResult = sessionPolicyHook(toolName, toolInput, { turn: policyTurn });
+            }
             if (policyResult?.block) {
                 await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, policyResult.policyCode ?? 'session_policy_hook');
                 return hookDecision('deny', policyResult.reason || '当前会话策略拒绝此工具调用', updatedInput);
@@ -2408,6 +2484,7 @@ export class AgentRunner {
                 const readonlyContext = {
                     sessionId,
                     managedTempDir: permCtx?.managedTempDir,
+                    grantedReadRoots: permCtx?.grantedReadRoots,
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
@@ -2471,6 +2548,20 @@ export class AgentRunner {
         // SDK-level canUseTool 回调：接入 PermissionGateway 的用户审批入口
         // 黑名单已在 PreToolUse hook 拦截，危险命令在此处进入审批流程
         const canUseToolCallback = async (toolName, input, options) => {
+            // 系统会话：与 PreToolUse 同一判定，SDK 若仍走到这里也不进入交互 / 角色分支
+            const systemSessionCheck = this.permissionContexts.get(sessionId)?.systemSessionCheck;
+            if (systemSessionCheck) {
+                const decision = systemSessionCheck(toolName, input);
+                if (!decision.allow) {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, decision.code);
+                    return { behavior: 'deny', message: decision.reason, decisionClassification: 'user_reject' };
+                }
+                return {
+                    behavior: 'allow',
+                    updatedInput: decision.ecCommand ? { ...input, dangerouslyDisableSandbox: true } : input,
+                    decisionClassification: 'user_permanent',
+                };
+            }
             // 特殊处理：AskUserQuestion 工具（SDK 内置的用户交互工具）
             // 这不是权限审批，而是收集用户答案，需要构造表单卡片
             if (toolName === 'AskUserQuestion') {
@@ -2585,6 +2676,7 @@ export class AgentRunner {
                 const readonlyContext = {
                     sessionId,
                     managedTempDir: permCtx?.managedTempDir,
+                    grantedReadRoots: permCtx?.grantedReadRoots,
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
@@ -2673,7 +2765,8 @@ export class AgentRunner {
         else {
             logger.info(`[AgentRunner] systemPromptAppend: none`);
         }
-        const sdkModel = applyContextWindow(resolveCatalogModel(runCatalog, callModel), runCatalog);
+        const catalogModel = resolveCatalogModel(runCatalog, callModel);
+        const { sdkModel, contextWindow } = resolveClaudeModelContext(catalogModel, runCatalog);
         const capabilityOptions = await this.resolveCapabilityRunOptions(projectPath);
         const managedSettings = callPermissionMode === 'fullaccess'
             ? undefined
@@ -2760,7 +2853,7 @@ export class AgentRunner {
             ...(executionSandbox.state === 'off' && callPermissionMode !== 'fullaccess' && process.platform === 'linux' ? {
                 spawnClaudeCodeProcess: (options) => spawnClaudeWithHClassGuard(options, resolvePaths().root, handleClaudeStderr, runPermissionContext?.selfAid ?? this.agentAid),
             } : {}),
-            autoCompactWindow: sdkAutoCompactWindowForModel(sdkModel),
+            autoCompactWindow: sdkAutoCompactWindowForModel(sdkModel, contextWindow),
             advisorModel: 'haiku',
             canUseTool: canUseToolCallback,
             permissionMode: sdkPermissionMode,
@@ -2986,7 +3079,7 @@ export class AgentRunner {
             this.interruptFns.set(sessionId, () => sdkStream.interrupt());
         }
         // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
-        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding, recoverySessionId);
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding, recoverySessionId, contextWindow);
         const self = this;
         return (async function* () {
             try {
@@ -3184,11 +3277,14 @@ export class AgentRunner {
         const catalog = useModel ? await this.getModelCatalog() : undefined;
         if (catalog)
             assertCatalogSelectable(catalog);
+        const resolvedModel = catalog && callModel
+            ? resolveClaudeModelContext(resolveCatalogModel(catalog, callModel), catalog)
+            : undefined;
         return query({
             prompt,
             options: {
                 cwd: projectPath,
-                ...(catalog && callModel ? { model: applyContextWindow(resolveCatalogModel(catalog, callModel), catalog) } : {}),
+                ...(resolvedModel ? { model: resolvedModel.sdkModel } : {}),
                 resume: agentSessionId,
                 maxTurns: 1,
                 tools: [],

package/dist/agents/codex/app-server-client.js

@@ -745,6 +745,9 @@ export class CodexAppServerClient {
     }
     buildProcessArgs() {
         const args = ['app-server', '--listen', 'stdio://'];
+        // 记忆只走 EvolCore（ec memory）：显式关闭 Codex 原生 memories，
+        // 不依赖其默认值（当前 stable 默认 false，此处写死防未来翻转）。
+        args.push('--config', 'features.memories=false');
         if (this.options.enableRequestUserInput !== false) {
             args.push('--enable', 'default_mode_request_user_input');
         }

package/dist/agents/codex/diagnostics.js

@@ -2,7 +2,9 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { parse as parseToml } from 'smol-toml';
+const managedHookInstaller = await import(new URL('../../../bin/install-codex-managed-hooks.mjs', import.meta.url).href);
 export function checkCodexProjectPath(value, options = {}) {
     const configured = typeof value === 'string' ? value.trim() : '';
     if (!configured) {
@@ -63,12 +65,6 @@ function decodeProbeOutput(buffer) {
         return new TextDecoder('gb18030').decode(buffer);
     }
 }
-function windowsCommandArg(value) {
-    return '"' + value.replaceAll('"', '\\"') + '"';
-}
-function expectedWindowsHookCommand(nodePath, hookPath) {
-    return windowsCommandArg(nodePath) + ' ' + windowsCommandArg(hookPath) + ' %EVOLCORE_INSTANCE_SOCKET%';
-}
 /**
  * Run synthetic Windows shell probes for the managed Codex hook.
  *
@@ -102,13 +98,20 @@ export function runCodexHookLaunchDiagnostic(options = {}) {
         throw new Error('No Windows managed hook directory configured.');
     const managedDir = path.resolve(options.managedDir || configuredDir);
     const hookPath = path.join(managedDir, 'pre-tool-use.mjs');
-    const expected = expectedWindowsHookCommand(nodePath, hookPath);
+    let expected;
     const handlers = Array.isArray(config.hooks?.PreToolUse)
         ? config.hooks.PreToolUse.flatMap((group) => group?.hooks || [])
         : [];
-    const handler = handlers.find((item) => (item?.type === 'command'
-        && (item.command_windows ?? item.commandWindows) === expected));
-    if (!handler || /[\r\n%;&|<>]/.test(nodePath + hookPath)) {
+    const handler = handlers.find((item) => {
+        if (item?.type !== 'command' || item.async === true)
+            return false;
+        const command = parseManagedCommand(item.command_windows ?? item.commandWindows, hookPath);
+        if (!command || !sameRuntimePath(command.nodePath, nodePath, options.platform ?? process.platform))
+            return false;
+        expected = item.command_windows ?? item.commandWindows;
+        return true;
+    });
+    if (!handler || !expected || /[\r\n%;&|<>]/.test(nodePath + hookPath)) {
         throw new Error('Managed command differs from the expected EvolCore command for this Node path; no hooks executed.');
     }
     fs.mkdirSync(path.dirname(output), { recursive: true, mode: 0o700 });
@@ -180,19 +183,6 @@ function realDirectoryState(directory) {
         return 'unavailable';
     }
 }
-/** Read back the package root that managedHookLauncher() embedded. */
-function launcherPackageRoot(launcher) {
-    const match = /^\s*const packageRoot = ("(?:[^"\\]|\\.)*")\s*;/m.exec(launcher);
-    if (!match)
-        return null;
-    try {
-        const value = JSON.parse(match[1]);
-        return typeof value === 'string' && value ? value : null;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * A `npm link` install reaches the package through a symlinked global path, so
  * the launcher and the running CLI legitimately spell the same package root
@@ -213,6 +203,45 @@ function samePackageRoot(embedded, expected) {
     };
     return normalize(embedded) === normalize(expected) || resolved(embedded) === resolved(expected);
 }
+/**
+ * Windows accepts an executable path without its `.exe` suffix. Older
+ * installations may therefore bind `...\\node` while the current Node
+ * process reports `...\\node.exe`; these are the same runtime and must not
+ * trigger an elevated repair on every startup.
+ */
+function sameRuntimePath(embedded, expected, platform) {
+    if (samePackageRoot(embedded, expected))
+        return true;
+    if (platform !== 'win32' || !embedded)
+        return false;
+    const appendExe = (value) => path.extname(value) ? value : `${value}.exe`;
+    return samePackageRoot(appendExe(embedded), expected)
+        || samePackageRoot(embedded, appendExe(expected));
+}
+function normalizedPath(value) {
+    return path.normalize(String(value || '')).replace(/[\\/]+$/, '').toLowerCase();
+}
+function parseManagedCommand(value, hookPath) {
+    if (typeof value !== 'string')
+        return null;
+    const match = /^"([^"\r\n]+)"\s+"([^"\r\n]+)"\s+%EVOLCORE_INSTANCE_SOCKET%$/i.exec(value.trim());
+    if (!match || !path.isAbsolute(match[1]) || /[%!]/.test(match[1] + match[2]))
+        return null;
+    if (normalizedPath(match[2]) !== normalizedPath(hookPath))
+        return null;
+    return { nodePath: match[1] };
+}
+function runtimeFileMayExist(file) {
+    try {
+        return fs.statSync(file).isFile();
+    }
+    catch (error) {
+        return !['ENOENT', 'ENOTDIR'].includes(error?.code || '');
+    }
+}
+function managedBinding(source, launcher, hookPath) {
+    return managedHookInstaller.managedBinding(source, launcher, hookPath);
+}
 /** Read-only inspection of the machine-wide Windows Codex managed hook. */
 export function inspectCodexManagedHook(options = {}) {
     const paths = codexManagedHookPaths(options);
@@ -283,32 +312,35 @@ export function inspectCodexManagedHook(options = {}) {
     catch (error) {
         return { status: 'unavailable', requirements, managedDir, hookPath, reason: error instanceof Error ? error.message : String(error) };
     }
-    const normalized = (value) => path.normalize(String(value || '')).toLowerCase();
     const expectedPackageRoot = path.resolve(options.packageRoot || process.cwd());
-    const launcherValid = launcher.includes('EVOLCORE_MANAGED_HOOK_LAUNCHER')
-        && samePackageRoot(launcherPackageRoot(launcher), expectedPackageRoot);
-    const configuredDir = config.hooks?.windows_managed_dir ?? config.hooks?.managed_dir;
-    const groups = config.hooks?.PreToolUse;
-    const canonicalCommand = (value) => {
-        if (typeof value !== 'string' || !value || /[\r\n;&|<>]/.test(value))
-            return false;
-        const withoutSocket = value.replace(/\s+%EVOLCORE_INSTANCE_SOCKET%\s*$/i, '').trim();
-        return withoutSocket.replace(/["']+$/, '').toLowerCase().endsWith(normalized(hookPath));
-    };
-    const hookLoaded = Array.isArray(groups) && groups.some((group) => group?.matcher === '*'
-        && Array.isArray(group.hooks) && group.hooks.some((handler) => {
-        const command = typeof handler?.command === 'string' ? handler.command : '';
-        const windowsCommand = typeof handler?.command_windows === 'string' ? handler.command_windows : '';
-        return handler?.type === 'command' && handler.async !== true
-            && canonicalCommand(command) && canonicalCommand(windowsCommand);
-    }));
-    const valid = config.allow_managed_hooks_only === true
-        && config.features?.hooks === true
-        && normalized(configuredDir) === normalized(managedDir)
-        && launcherValid && hookLoaded;
-    return valid
-        ? { status: 'installed', requirements, managedDir, hookPath }
-        : { status: 'unsafe', requirements, managedDir, hookPath, reason: 'managed-hook policy is missing, altered, or points outside the canonical target' };
+    try {
+        const binding = managedBinding(source, launcher, hookPath);
+        if (!binding || config.allow_managed_hooks_only !== true || config.features?.hooks !== true
+            || normalizedPath(config.hooks?.windows_managed_dir) !== normalizedPath(managedDir)
+            || (config.hooks?.managed_dir !== undefined
+                && normalizedPath(config.hooks.managed_dir) !== normalizedPath(managedDir))) {
+            throw new Error('managed-hook policy is missing, altered, or points outside the canonical target');
+        }
+        const { embeddedPackageRoot, managedNodePath } = binding;
+        const packageMatches = samePackageRoot(embeddedPackageRoot, expectedPackageRoot);
+        const nodeMatches = sameRuntimePath(managedNodePath, options.nodePath || process.execPath, options.platform ?? process.platform);
+        const repairFingerprint = createHash('sha256').update(source).update('\0').update(launcher).digest('hex');
+        if (packageMatches && nodeMatches)
+            return { status: 'installed', requirements, managedDir, hookPath };
+        return {
+            status: 'stale', requirements, managedDir, hookPath,
+            managedPackageRoot: embeddedPackageRoot, managedNodePath, repairFingerprint,
+            repairAmbiguous: runtimeFileMayExist(path.join(embeddedPackageRoot, 'bin', 'codex-managed-hook.mjs'))
+                && runtimeFileMayExist(managedNodePath),
+            reason: !packageMatches && !nodeMatches
+                ? 'managed-hook points to a different EvolCore package root and Node runtime'
+                : !packageMatches ? 'managed-hook points to a different EvolCore package root'
+                    : 'managed-hook points to a different Node runtime',
+        };
+    }
+    catch (error) {
+        return { status: 'unsafe', requirements, managedDir, hookPath, reason: error instanceof Error ? error.message : String(error) };
+    }
 }
 function powershellLiteral(value) {
     return `'${value.replaceAll("'", "''")}'`;
@@ -319,7 +351,10 @@ function windowsArgument(value) {
 }
 export function buildCodexManagedHookElevationCommand(options) {
     const argumentLine = [options.installer, '--package-root', options.packageRoot,
-        '--requirements', options.requirements, '--managed-dir', options.managedDir, '--repair']
+        '--requirements', options.requirements, '--managed-dir', options.managedDir,
+        '--node-path', options.nodePath, '--repair',
+        ...(options.expectedFingerprint ? ['--expected-fingerprint', options.expectedFingerprint] : []),
+        ...(options.confirmRebind ? ['--confirm-rebind'] : [])]
         .map(windowsArgument).join(' ');
     return [
         "$ErrorActionPreference = 'Stop'",
@@ -334,11 +369,11 @@ export function buildCodexManagedHookElevationCommand(options) {
     ].join('\n');
 }
 /**
- * Ensure the machine-wide Windows hook before starting the daemon. Missing
- * files are repaired through one UAC elevation; altered policy remains
+ * Ensure the machine-wide Windows hook before starting the daemon. Missing or
+ * stale files are repaired through one UAC elevation; altered policy remains
  * fail-closed and is never overwritten automatically.
  */
-export function ensureCodexManagedHook(options) {
+export async function ensureCodexManagedHook(options) {
     const platformName = options.platform ?? process.platform;
     const paths = codexManagedHookPaths({
         platform: platformName,
@@ -358,8 +393,27 @@ export function ensureCodexManagedHook(options) {
     let state = inspectCodexManagedHook(inspectOptions);
     if (state.status === 'installed')
         return { ...state, repaired: false };
-    if (state.status !== 'missing')
+    if (state.status !== 'missing' && state.status !== 'stale')
         return { ...state, repaired: false };
+    let confirmedRebind = false;
+    if (state.status === 'stale' && state.repairAmbiguous) {
+        try {
+            confirmedRebind = await options.repairDecision?.(state) === true;
+        }
+        catch (error) {
+            return { ...state, repaired: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    if (state.status === 'stale' && state.repairAmbiguous && !confirmedRebind) {
+        return { ...state, repaired: false, cancelled: true, error: 'managed-hook repair cancelled or requires confirmation' };
+    }
+    const rechecked = inspectCodexManagedHook(inspectOptions);
+    if (rechecked.status === 'installed')
+        return { ...rechecked, repaired: false };
+    if (rechecked.status !== state.status || rechecked.repairFingerprint !== state.repairFingerprint
+        || rechecked.repairAmbiguous !== state.repairAmbiguous) {
+        return { ...rechecked, repaired: false, error: 'managed-hook state changed during the startup check; retry to confirm the current binding' };
+    }
     const installer = path.join(path.resolve(options.packageRoot), 'bin', 'install-codex-managed-hooks.mjs');
     if (!fs.existsSync(installer)) {
         return { ...state, repaired: false, error: `managed-hook installer is missing: ${installer}` };
@@ -370,6 +424,10 @@ export function ensureCodexManagedHook(options) {
             nodePath: process.execPath, installer: script, packageRoot,
             requirements: path.resolve(inspectOptions.requirements),
             managedDir: path.resolve(inspectOptions.managedDir),
+            ...(state.status === 'stale' ? {
+                expectedFingerprint: state.repairFingerprint,
+                confirmRebind: confirmedRebind,
+            } : {}),
         });
         const result = spawnSync(powershell, [
             // Do not use -NonInteractive here: Start-Process -Verb RunAs must be
@@ -385,7 +443,7 @@ export function ensureCodexManagedHook(options) {
         }
         return { ok: true };
     });
-    options.onInstallRequired?.();
+    options.onInstallRequired?.(state);
     let elevated;
     try {
         elevated = runElevated(installer, path.resolve(options.packageRoot));