evolcore 0.0.32 → 0.0.34

package/dist/core/message/response-engine.js

@@ -3,25 +3,29 @@ import path from 'path';
 import fs from 'fs';
 import os from 'os';
 import crypto from 'crypto';
+import { MAIN_CLI_BIN } from '../../product.js';
 import { BaseagentRunnerUnavailableError, hasCompact, autoCompactWindowForModel, isClaudeContextUsageModel, numericToken, formatAsyncQuestionAnswer, parseAsyncUserQuestions, } from '../../agents/runner-types.js';
 import { loadedBaseagentIds } from '../../agents/baseagent-availability.js';
 import { isDiagnosticSessionActive } from '../command/diag-service.js';
 import { evaluateInboundAdmissionPreflight, evaluateOrdinaryInboundAdmission } from './message-admission.js';
 import { authorizeAccess, authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
 import { buildTaskRuntimeEnv, ensureRuntimeLockDir, ensureSessionRuntimeDir } from '../../cli/task-context.js';
-import { memorySessionPolicyHook } from '../memory/memory-session-policy.js';
+import { BUILTIN_SESSION_PATH_GRANTS, mergeRuntimeGrantsForSession, resolveGrantedReadRoots, } from '../permission/session-path-grants.js';
+import { buildSystemSessionContext, getSystemSessionModule, isSystemSessionType, readSystemSessionMarker } from '../system-session/registry.js';
 import { IMRenderer } from './im-renderer.js';
+import { projectSubtaskStarted, projectSubtaskTerminal } from './subtask-tool-projection.js';
 import { TaskActivityStore } from '../task/task-activity-store.js';
 import { createSendFileMarkerPattern } from './file-markers.js';
 import { createDecisionInferenceProvider, createTextInferenceProvider } from '../inference/text-inference.js';
 import { StreamIdleMonitor } from './stream-idle-monitor.js';
 import { logger } from '../../utils/logger.js';
 import { isHostChinese } from '../../utils/locale.js';
-import { ExecutionTimeoutError, OrphanedTargetSessionError, isExecutionFailure, getErrorMessage, classifyError, ErrorType, ERROR_PREFIX, isInfraError, isAbortTerminalReason, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
+import { ExecutionTimeoutError, OrphanedTargetSessionError, isExecutionFailure, getErrorMessage, getErrorRawText, getToolResultErrorText, classifyError, normalizeCoreErrorReason, normalizeCoreErrorSubtype, ErrorType, ERROR_PREFIX, isInfraError, isAbortTerminalReason, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
 import { readEvolcoreRuntimeFlavor, tagErrorTextWithEvolcoreVersion } from '../../utils/evolcore-version.js';
-import { describeProactiveSendCommandFailure, isExactEvolcoreSendCommandForSession } from '../permission/ec-command-parser.js';
+import { describeProactiveSendCommandFailure, isExactEvolcoreSendCommandForSession, isThreadRoutedEvolcoreSendCommand, parseCodexToolCommand, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from '../permission/ec-command-parser.js';
+import { resolveThreadRouteTarget } from '../thread/thread-route.js';
 import { summarizeToolInputForDisplay } from '../../utils/tool-summary.js';
-import { agentDataDir, agentDir as resolveAgentDir, agentMdPath, getPackageRoot, resolveRoot, resolvePaths } from '../../paths.js';
+import { agentDataDir, agentDir as resolveAgentDir, agentMdPath, getPackageRoot, resolveRoot, resolvePaths, debugSessionsDir } from '../../paths.js';
 import { renderKitSections, resolveSessionManifest, DEFAULT_MANIFEST_FILE } from '../../eck/kit-renderer.js';
 import { renderMessageBody } from '../../eck/message-renderer.js';
 import { syncGroupRulesContext } from '../../eck/group-rules-sync.js';
@@ -67,6 +71,10 @@ import { auditFullAccessEvent } from '../auth/authorization-audit.js';
 import { TaskRecoveryService, isTaskRecoveryCurrent } from '../task/task-recovery-service.js';
 const QUESTION_TTL_MS = 24 * 60 * 60 * 1000;
 /** Pending async questions outlive the originating turn, but never change its backend binding. */
+/** 带 --thread 的跨话题发送：话题存在于本端索引且目标一致时视为合法发送。 */
+function isThreadRoutedSendForSelf(toolName, toolInput, selfAid) {
+    return isThreadRoutedEvolcoreSendCommand(toolName, toolInput, selfAid, (scope, threadId, target) => !!selfAid && !!resolveThreadRouteTarget(selfAid, threadId, scope, target));
+}
 export class AsyncQuestionService {
     deps;
     registered = new Map();
@@ -408,6 +416,381 @@ export class PauseController {
 function isShowActivitiesMode(value) {
     return value === 'all' || value === 'text' || value === 'none';
 }
+const TOOL_INPUT_DIAGNOSTIC_MAX_LENGTH = 96_000;
+const TOOL_INPUT_DIAGNOSTIC_MAX_FINDINGS = 3;
+const TOOL_INPUT_DIAGNOSTIC_TIMEOUT_MS = 1_000;
+function isToolResultFailure(event) {
+    return event.isError === true
+        || event.executionState === 'failed'
+        || event.executionState === 'blocked'
+        || event.decision === 'deny'
+        || event.decision === 'error'
+        || (typeof event.exitCode === 'number' && Number.isFinite(event.exitCode) && event.exitCode !== 0);
+}
+function isStringArgv(value) {
+    return Array.isArray(value) && value.every(item => typeof item === 'string');
+}
+function boundedDiagnosticInput(value) {
+    return value.length <= TOOL_INPUT_DIAGNOSTIC_MAX_LENGTH;
+}
+function findApplyPatchArgumentsOffset(value) {
+    const match = value.trimStart().match(/^(?:"([^"\r\n]+)"|'([^'\r\n]+)'|([^\s;&|<>"']+))(?=\s|[;&|<>]|$)/u);
+    const executable = match?.[1] ?? match?.[2] ?? match?.[3];
+    if (!executable)
+        return -1;
+    const basename = executable.replaceAll('\\', '/').split('/').at(-1)?.toLowerCase();
+    if (basename !== 'apply_patch' && basename !== 'apply_patch.exe')
+        return -1;
+    return value.length - value.trimStart().length + match[0].length;
+}
+function findUnquotedDiagnosticText(value, needle, startOffset) {
+    let quote = null;
+    let escaped = false;
+    for (let index = startOffset; index < value.length; index++) {
+        const char = value[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '\\')
+                escaped = true;
+            else if (char === '"')
+                quote = null;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (value.startsWith(needle, index))
+            return index;
+    }
+    return -1;
+}
+function diagnosticLineEnd(value, startOffset) {
+    const newline = value.indexOf('\n', startOffset);
+    return newline < 0 ? value.length : newline;
+}
+function parseDiagnosticHeredoc(value, argumentsOffset) {
+    const openOffset = findUnquotedDiagnosticText(value, '<<', argumentsOffset);
+    if (openOffset < 0 || openOffset >= diagnosticLineEnd(value, argumentsOffset)
+        || value[openOffset + 2] === '<')
+        return undefined;
+    let cursor = openOffset + 2;
+    const stripTabs = value[cursor] === '-';
+    if (stripTabs)
+        cursor++;
+    while (value[cursor] === ' ' || value[cursor] === '\t')
+        cursor++;
+    const quote = value[cursor] === "'" || value[cursor] === '"' ? value[cursor] : undefined;
+    if (quote)
+        cursor++;
+    const delimiterStart = cursor;
+    while (cursor < value.length) {
+        const char = value[cursor];
+        if (quote ? char === quote : char === ' ' || char === '\t' || char === '\r' || char === '\n')
+            break;
+        cursor++;
+    }
+    const delimiter = value.slice(delimiterStart, cursor);
+    if (!delimiter)
+        return undefined;
+    const firstNewline = value.indexOf('\n', cursor);
+    if (firstNewline < 0)
+        return {};
+    let lineStart = firstNewline + 1;
+    let trailing;
+    while (lineStart <= value.length) {
+        const end = diagnosticLineEnd(value, lineStart);
+        const rawLine = value.slice(lineStart, end).replace(/\r$/u, '');
+        const line = stripTabs ? rawLine.replace(/^\t+/u, '') : rawLine;
+        if (line === delimiter) {
+            let extraOffset;
+            let next = end < value.length ? end + 1 : value.length;
+            while (next < value.length) {
+                const nextEnd = diagnosticLineEnd(value, next);
+                const nextLine = value.slice(next, nextEnd).trim();
+                if (nextLine !== '' && !nextLine.startsWith('#')) {
+                    extraOffset = next;
+                    break;
+                }
+                next = nextEnd < value.length ? nextEnd + 1 : value.length;
+            }
+            return { delimiterOffset: lineStart + rawLine.length - line.length, extraOffset };
+        }
+        if (line.startsWith(delimiter) && line.length > delimiter.length) {
+            trailing ??= { trailingOffset: lineStart + rawLine.length - line.length + delimiter.length, trailingEndOffset: end };
+        }
+        if (end >= value.length)
+            break;
+        lineStart = end + 1;
+    }
+    return trailing ?? {};
+}
+function findDiagnosticShellSeparator(value, startOffset, endOffset) {
+    let quote = null;
+    let escaped = false;
+    for (let index = startOffset; index < endOffset; index++) {
+        const char = value[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '\\')
+                escaped = true;
+            else if (char === '"')
+                quote = null;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (char === ';' || char === '|' || char === '&' || char === '\n' || char === '\r')
+            return index;
+    }
+    return -1;
+}
+function diagnosticLocation(source, startOffset, endOffset = startOffset) {
+    const start = Math.max(0, Math.min(startOffset, source.value.length));
+    const end = Math.max(start, Math.min(endOffset, source.value.length));
+    const lineStart = Math.max(source.value.lastIndexOf('\n', Math.max(0, start - 1)) + 1, 0);
+    return {
+        field: source.field,
+        ...(source.argumentIndex !== undefined ? { argumentIndex: source.argumentIndex } : {}),
+        line: source.value.slice(0, start).split('\n').length,
+        column: [...source.value.slice(lineStart, start)].length + 1,
+        startOffset: start,
+        endOffset: end,
+    };
+}
+function diagnosticFinding(ruleId, title, advice, confidence, source, startOffset, endOffset) {
+    return { ruleId, title, advice, confidence, location: diagnosticLocation(source, startOffset, endOffset) };
+}
+function diagnosticCandidates(input) {
+    const candidates = [];
+    if (typeof input.command === 'string' && boundedDiagnosticInput(input.command)) {
+        const source = { field: 'command', value: input.command };
+        const carrier = resolveCodexShellCarrierString(input.command);
+        if (carrier) {
+            const commandOffset = input.command.indexOf(carrier.command);
+            candidates.push({
+                source,
+                command: carrier.command,
+                commandOffset: commandOffset >= 0 ? commandOffset : 0,
+                carrier: true,
+            });
+        }
+        else {
+            candidates.push({ source, command: input.command, commandOffset: 0, carrier: false });
+        }
+    }
+    if (isStringArgv(input.commandArgv) && input.commandArgv.every(boundedDiagnosticInput)) {
+        const carrier = resolveCodexShellCarrierArgv(input.commandArgv);
+        if (carrier) {
+            const argumentIndex = input.commandArgv.length - 1;
+            candidates.push({
+                source: { field: 'commandArgv', value: input.commandArgv[argumentIndex], argumentIndex },
+                command: carrier.command,
+                commandOffset: 0,
+                carrier: true,
+            });
+        }
+        else {
+            const argumentIndex = 0;
+            if (findApplyPatchArgumentsOffset(input.commandArgv[argumentIndex] ?? '') >= 0) {
+                candidates.push({
+                    source: { field: 'commandArgv', value: input.commandArgv[argumentIndex], argumentIndex },
+                    command: input.commandArgv[argumentIndex],
+                    commandOffset: 0,
+                    carrier: false,
+                });
+            }
+        }
+    }
+    return candidates;
+}
+function addHeredocDiagnosticFindings(findings, candidate) {
+    const argumentsOffset = findApplyPatchArgumentsOffset(candidate.command);
+    if (argumentsOffset < 0)
+        return;
+    const heredoc = parseDiagnosticHeredoc(candidate.command, argumentsOffset);
+    if (!heredoc)
+        return;
+    const map = (offset) => candidate.commandOffset + offset;
+    if (heredoc.trailingOffset !== undefined) {
+        findings.push(diagnosticFinding('heredoc-terminator-trailing-characters', 'heredoc 结束标记行包含尾随字符', '让结束标记单独占一行，不要在标记后追加引号、命令或其它字符。', '高', candidate.source, map(heredoc.trailingOffset), map(heredoc.trailingEndOffset ?? heredoc.trailingOffset)));
+    }
+    else if (heredoc.delimiterOffset === undefined) {
+        findings.push(diagnosticFinding('heredoc-terminator-missing', '未找到匹配的 heredoc 结束标记', '补上与起始标记完全一致、且单独占一行的结束标记。', '高', candidate.source, map(candidate.command.length), map(candidate.command.length)));
+    }
+    else if (heredoc.extraOffset !== undefined) {
+        findings.push(diagnosticFinding('heredoc-extra-command', 'heredoc 结束标记后仍有额外命令或文本', '将 apply_patch 与测试或其它命令拆成两次工具调用。', '高', candidate.source, map(heredoc.extraOffset), map(heredoc.extraOffset)));
+    }
+}
+function addApplyPatchCompositionFinding(findings, candidate) {
+    const argumentsOffset = findApplyPatchArgumentsOffset(candidate.command);
+    if (argumentsOffset < 0 || candidate.carrier)
+        return;
+    const executableMatch = candidate.command.trimStart().match(/^(?:"([^"]+)"|'([^']+)'|([^\s]+))/u);
+    const executable = executableMatch?.[1] ?? executableMatch?.[2] ?? executableMatch?.[3] ?? '';
+    const basename = executable.replaceAll('\\', '/').split('/').at(-1)?.toLowerCase();
+    if (basename !== 'apply_patch' && basename !== 'apply_patch.exe')
+        return;
+    const heredocOffset = findUnquotedDiagnosticText(candidate.command, '<<', argumentsOffset);
+    const endOffset = heredocOffset >= 0 ? heredocOffset : candidate.command.length;
+    const separator = findDiagnosticShellSeparator(candidate.command, argumentsOffset, endOffset);
+    if (separator < 0)
+        return;
+    findings.push(diagnosticFinding('apply-patch-composed-command', 'apply_patch 与其它 Shell 命令组合提交', '一次工具调用只提交完整的 apply_patch；测试、检查或其它命令另行调用。', '高', candidate.source, candidate.commandOffset + separator, candidate.commandOffset + separator + 1));
+}
+function addNestedShellDiagnosticFinding(findings, candidate) {
+    if (!candidate.carrier || findApplyPatchArgumentsOffset(candidate.command) < 0)
+        return;
+    findings.push(diagnosticFinding('nested-shell-escaping-risk', '命令包含嵌套 Shell 包装层', '尽量直接提交单层 Shell 命令；需要 heredoc 或 JSON 时，减少外层转义和包装。', '中', candidate.source, candidate.commandOffset, candidate.commandOffset + candidate.command.length));
+}
+function addJsonArrayDiagnosticFinding(findings, input) {
+    const rawArgv = isStringArgv(input.commandArgv) ? input.commandArgv : undefined;
+    const parsedArgv = rawArgv ?? (typeof input.command === 'string'
+        ? (() => {
+            const parsed = parseCodexToolCommand({ command: input.command });
+            return parsed.ok ? parsed.argv : undefined;
+        })()
+        : undefined);
+    if (!parsedArgv || parsedArgv.length < 6)
+        return;
+    if (parsedArgv[0].toLowerCase() !== MAIN_CLI_BIN || parsedArgv[1].toLowerCase() !== 'aid'
+        || parsedArgv[2].toLowerCase() !== 'agentmd' || parsedArgv[3].toLowerCase() !== 'set'
+        || parsedArgv[5].toLowerCase() !== 'tags')
+        return;
+    const value = parsedArgv[6];
+    const source = rawArgv
+        ? { field: 'commandArgv', value: rawArgv[6] ?? '', argumentIndex: 6 }
+        : { field: 'command', value: typeof input.command === 'string' ? input.command : '' };
+    if (value === undefined) {
+        findings.push(diagnosticFinding('json-array-argument-missing', 'tags 参数缺少完整 JSON 数组值', '将 tags 作为一个完整参数传入，例如 PowerShell 使用单引号包住 ["DSH","AUN"]。', '高', source, source.value.length));
+        return;
+    }
+    let valid = false;
+    try {
+        const decoded = JSON.parse(value);
+        valid = Array.isArray(decoded) && decoded.every(item => typeof item === 'string');
+    }
+    catch {
+        valid = false;
+    }
+    if (valid)
+        return;
+    const split = rawArgv !== undefined && rawArgv.length > 7 && !rawArgv[7].startsWith('--')
+        && (value.startsWith('[') || value.endsWith(','));
+    findings.push(diagnosticFinding(split ? 'json-array-argument-splitting' : 'json-array-argument-invalid', split ? 'tags 的 JSON 数组疑似被拆成多个参数' : 'tags 参数不是可解析的 JSON 字符串数组', '保证整个 JSON 数组位于同一个参数中；PowerShell 普通单引号字符串内不要再添加反斜杠转义。', split ? '中' : '高', source, split ? source.value.length : 0, source.value.length));
+}
+function addCommandArgvMismatchFinding(findings, input) {
+    if (typeof input.command !== 'string' || !isStringArgv(input.commandArgv))
+        return;
+    const commandArgv = input.commandArgv;
+    if (!boundedDiagnosticInput(input.command) || commandArgv.some(value => !boundedDiagnosticInput(value)))
+        return;
+    if (resolveCodexShellCarrierArgv(commandArgv) || resolveCodexShellCarrierString(input.command))
+        return;
+    const parsed = parseCodexToolCommand({ command: input.command });
+    if (!parsed.ok || parsed.argv.length === commandArgv.length
+        && parsed.argv.every((value, index) => value === commandArgv[index]))
+        return;
+    findings.push(diagnosticFinding('command-argv-mismatch', 'command 与 commandArgv 的解析结果不一致', '以执行器提供的结构化 commandArgv 为准，避免在外层重新拼接或改写命令文本。', '中', { field: 'command', value: input.command }, 0, input.command.length));
+}
+function deduplicateDiagnosticFindings(findings) {
+    const seen = new Set();
+    return findings.filter(item => {
+        const key = `${item.ruleId}:${item.location.field}:${item.location.argumentIndex ?? ''}:${item.location.startOffset}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    }).slice(0, TOOL_INPUT_DIAGNOSTIC_MAX_FINDINGS);
+}
+function diagnoseToolInput(original, event, deadline) {
+    if (!isToolResultFailure(event) || !original.input || typeof original.input !== 'object')
+        return undefined;
+    const input = original.input;
+    if (typeof input.command === 'string' && !boundedDiagnosticInput(input.command))
+        return undefined;
+    if (Array.isArray(input.commandArgv)) {
+        if (input.commandArgv.length > 1_024 || !isStringArgv(input.commandArgv)
+            || input.commandArgv.reduce((length, value) => length + value.length, 0) > TOOL_INPUT_DIAGNOSTIC_MAX_LENGTH) {
+            return undefined;
+        }
+    }
+    const candidates = diagnosticCandidates(input);
+    if (Date.now() > deadline)
+        return undefined;
+    const findings = [];
+    for (const candidate of candidates) {
+        if (Date.now() > deadline)
+            return undefined;
+        addHeredocDiagnosticFindings(findings, candidate);
+        addApplyPatchCompositionFinding(findings, candidate);
+        addNestedShellDiagnosticFinding(findings, candidate);
+    }
+    if (Date.now() <= deadline)
+        addJsonArrayDiagnosticFinding(findings, input);
+    if (Date.now() <= deadline)
+        addCommandArgvMismatchFinding(findings, input);
+    if (Date.now() > deadline)
+        return undefined;
+    const deduplicated = deduplicateDiagnosticFindings(findings);
+    return deduplicated.length > 0 ? { findings: deduplicated } : undefined;
+}
+export function diagnoseToolInputAfterFailure(original, event) {
+    if (!original)
+        return undefined;
+    try {
+        return diagnoseToolInput(original, event, Date.now() + TOOL_INPUT_DIAGNOSTIC_TIMEOUT_MS);
+    }
+    catch {
+        return undefined;
+    }
+}
+function formatToolInputDiagnosticLocation(location) {
+    const field = location.argumentIndex === undefined
+        ? location.field
+        : `${location.field}[${location.argumentIndex}]`;
+    return `${field}，第 ${location.line} 行第 ${location.column} 列，UTF-16 偏移 ${location.startOffset}-${location.endOffset}`;
+}
+export function formatToolInputDiagnostics(report) {
+    if (!report || report.findings.length === 0)
+        return '';
+    const lines = report.findings.map(item => `- [${item.confidence}] ${item.title}（${formatToolInputDiagnosticLocation(item.location)}）\n  建议：${item.advice}`);
+    return `\n\n输入核验（辅助）：\n${lines.join('\n')}`;
+}
 function approvalActorRevision(actor, owners = [], admins = [], selfAid) {
     if (!actor)
         return undefined;
@@ -526,8 +909,10 @@ function markRetryHealthRecorded(error) {
 function wasRetryHealthRecorded(error) {
     return !!(error && typeof error === 'object' && error[RETRY_HEALTH_RECORDED_MARK] === true);
 }
-function markModelFallbackExhausted(error, message) {
+function markModelFallbackExhausted(error, message, cause) {
     error[MODEL_FALLBACK_EXHAUSTED_MARK] = message;
+    if (cause !== undefined)
+        error.cause = cause;
     return error;
 }
 function getModelFallbackExhaustedMessage(error) {
@@ -548,7 +933,7 @@ function wasRetryInputAlreadySubmitted(error) {
     return !!(error && typeof error === 'object' && error[RETRY_INPUT_ALREADY_SUBMITTED_MARK] === true);
 }
 function formatRetryInputAlreadySubmittedMessage(error) {
-    const reason = getErrorMessage(error, undefined, false) || 'Codex 暂时不可用';
+    const reason = getErrorRawText(error) || 'Codex 暂时不可用';
     return `⚠️ Codex 已接收本次消息，但本轮未能确认完成。为避免在会话中重复写入同一消息，系统未自动重试。请检查会话状态后重新发送。\n原因：${reason}`;
 }
 function isNonErrorInterruptReason(reason) {
@@ -561,7 +946,7 @@ function isExpectedTerminalInterrupt(reason) {
     return isAbortTerminalReason(reason);
 }
 function formatRetryableErrorFinalMessage(error, retries) {
-    const reason = getErrorMessage(error, undefined, false) || 'API 暂时不可用';
+    const reason = getErrorRawText(error) || 'API 暂时不可用';
     return `❌ API 暂时不可用，已自动重试 ${retries} 次仍失败，任务已停止。\n原因：${reason}`;
 }
 /**
@@ -672,17 +1057,23 @@ function getStreamErrorText(result) {
     }
     return parts.join('\n');
 }
+function getStreamRawErrorText(result, fallback) {
+    const fullText = result.fullText.trim();
+    const fullTextLooksLikeDiagnostic = fullText.length > 0 && (isRetryableError(new Error(fullText))
+        || isContextTooLongText(fullText));
+    const fallbackLooksLikeDiagnostic = typeof fallback === 'string' && fallback.trim().length > 0 && (isRetryableError(new Error(fallback))
+        || isContextTooLongText(fallback));
+    const candidates = [
+        result.syntheticDiagnosticText,
+        result.errors?.join('\n'),
+        fullTextLooksLikeDiagnostic ? fullText : undefined,
+        fallbackLooksLikeDiagnostic ? fallback : undefined,
+    ];
+    return candidates.find((part) => typeof part === 'string' && part.trim().length > 0)?.trim();
+}
 function getStreamErrorMessage(result, includeEmoji = false) {
-    const raw = getStreamErrorText(result) || '任务执行失败';
-    const mapped = getErrorMessage(new Error(raw), result.terminalReason, includeEmoji);
-    const generic = includeEmoji ? '❌ 处理消息时出错，请稍后重试' : '处理消息时出错，请稍后重试';
-    // Unknown runner-specific terminal reasons do not have a friendly mapping.
-    // Preserve their diagnostic text instead of collapsing it to the generic
-    // "处理消息时出错" message.
-    if (raw && mapped === generic) {
-        return includeEmoji ? `❌ ${raw}` : raw;
-    }
-    return mapped;
+    const raw = getStreamErrorText(result);
+    return getErrorMessage(new Error(raw), result.terminalReason, includeEmoji);
 }
 function streamHitContextLimit(result) {
     return result.terminalReason === 'prompt_too_long' ||
@@ -826,6 +1217,8 @@ export class ResponseEngine {
     activeMonitors = new Map();
     /** sessionId → 当前正在处理任务的运行时上下文，供 in-task CLI 通过 IPC 查询。 */
     activeTaskRuntimeContexts = new Map();
+    /** sessionId → 本轮最近一次 runQuery 请求的模型；仅在任务活跃时对外可见（见 getOutboundDebug）。 */
+    activeRunnerModels = new Map();
     /** task.run started 后立即登记，覆盖运行时上下文尚未建立的 shutdown 窗口。 */
     activeTaskSpans = new Map();
     /** sessionId → 尚未收到 runner:task-notification 的子任务。 */
@@ -993,7 +1386,7 @@ export class ResponseEngine {
                 // revocation for legacy events without a taskId.
                 const interruptedTaskId = eventTaskId;
                 if (interruptedTaskId && activeTask?.taskId === interruptedTaskId) {
-                    this.agentDelegationRegistry?.revokeTask(event.sessionId, interruptedTaskId);
+                    this.agentDelegationRegistry?.revokeTask(event.sessionId, interruptedTaskId, 'interrupted');
                 }
             }
         });
@@ -1337,7 +1730,8 @@ export class ResponseEngine {
                 || this.isPauseRequested(sessionId) || this.retryDelayWaiters.has(sessionId))
                 return { state: 'live', ...identity };
             const runner = this.getAgent(session.metadata?.channelKey || session.channel, session.baseagent, selfAid);
-            return { state: runner.hasActiveStream(sessionId) ? 'live' : 'missing', ...identity,
+            const owned = runner.hasActiveOperation?.(sessionId, active.taskId) ?? runner.hasActiveStream(sessionId);
+            return { state: owned ? 'live' : 'missing', ...identity,
                 hasTerminalOwner: this.activeTimeoutHandlers.has(sessionId) };
         }
         // Never adopt or interrupt a newer task to clean up an older attempt.
@@ -1380,6 +1774,14 @@ export class ResponseEngine {
         const interruptedTaskId = interruptedTurn?.active?.taskId;
         this.interruptedSessions.set(sessionId, effectiveReason);
         this.messageQueue?.markActiveTerminal?.(sessionId, effectiveReason);
+        const channelKey = session.metadata?.channelKey || session.channel;
+        const agent = this.getAgent(channelKey, session.baseagent, session.selfAID);
+        const cancelledQueuedTurn = interruptedTurn?.active
+            ? agent.cancelQueuedTurn?.(sessionId, {
+                taskId: interruptedTurn.active.taskId,
+                generation: interruptedTurn.active.generation,
+            }) ?? false
+            : false;
         // 终态必须先于渠道发送和 runner I/O 落盘。否则任一外部调用卡住时，
         // shutdown 超时退出会再次留下 started/interrupting 的悬空任务。
         const runtimeContext = this.activeTaskRuntimeContexts.get(sessionId);
@@ -1404,13 +1806,12 @@ export class ResponseEngine {
             this.sessionManager.clearProcessingIfTask(sessionId, taskId);
             if (this.activeTaskRuntimeContexts.get(sessionId)?.taskId === taskId) {
                 this.activeTaskRuntimeContexts.delete(sessionId);
+                this.activeRunnerModels.delete(sessionId);
             }
-            this.agentDelegationRegistry?.revokeTask(sessionId, taskId);
+            this.agentDelegationRegistry?.revokeTask(sessionId, taskId, 'interrupted');
         }
         this.closeActiveRunnerTasks(sessionId, effectiveReason, taskSpan?.causation ?? runtimeContext?.causation);
         await this.interactionRouter?.cancelAll(sessionId, effectiveReason);
-        const channelKey = session.metadata?.channelKey || session.channel;
-        const agent = this.getAgent(channelKey, session.baseagent, session.selfAID);
         const terminalStatus = (() => {
             // TimeoutController owns timeout delivery (including user-facing timeout
             // details) and already guarantees a single terminal status. Sending it
@@ -1441,7 +1842,9 @@ export class ResponseEngine {
                 logger.debug(`[ResponseEngine] interrupt terminal status failure: session=${sessionId} task=${interruptedTaskId} error=${error instanceof Error ? error.message : String(error)}`);
             });
         })();
-        const runnerInterrupt = agent.interrupt(sessionId).catch(error => {
+        const runnerInterrupt = (cancelledQueuedTurn
+            ? Promise.resolve()
+            : agent.interrupt(sessionId)).catch(error => {
             logger.debug(`[ResponseEngine] interrupt barrier runner failure: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
             if (strict)
                 throw error;
@@ -1482,6 +1885,64 @@ export class ResponseEngine {
     getTaskRuntimeContext(sessionId) {
         return this.activeTaskRuntimeContexts.get(sessionId) ?? null;
     }
+    /** debug 模式下写/删 debug-sessions 临时文件 */
+    debugWriteSessionSnapshot(sessionId, ctx) {
+        if (process.env.EVOLCORE_DEBUG_MODE !== '1')
+            return;
+        try {
+            const dir = debugSessionsDir();
+            if (!fs.existsSync(dir))
+                fs.mkdirSync(dir, { recursive: true });
+            const snapshot = {
+                schemaVersion: 1,
+                sessionId,
+                selfAid: ctx.selfAid ?? '',
+                channel: ctx.channel ?? '',
+                channelKey: ctx.channelKey ?? '',
+                channelId: ctx.channelId ?? '',
+                peerKey: ctx.peerKey ?? '',
+                chatType: ctx.chatType ?? 'private',
+                threadId: ctx.threadId ?? '',
+                sessionType: ctx.sessionType ?? 'main',
+                baseagent: ctx.baseagent ?? '',
+                writtenAt: Date.now(),
+            };
+            fs.writeFileSync(`${dir}/${sessionId}.json`, JSON.stringify(snapshot), 'utf-8');
+        }
+        catch (err) {
+            logger.debug(`[Debug] failed to write debug session snapshot for ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    debugDeleteSessionSnapshot(sessionId) {
+        if (process.env.EVOLCORE_DEBUG_MODE !== '1')
+            return;
+        try {
+            const snapshotPath = `${debugSessionsDir()}/${sessionId}.json`;
+            if (fs.existsSync(snapshotPath))
+                fs.rmSync(snapshotPath, { force: true });
+        }
+        catch (err) {
+            logger.debug(`[Debug] failed to delete debug session snapshot for ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    /**
+     * 出站 payload.debug 的会话侧字段（不含 sentAt，由发送方盖戳）。
+     * 供 agent 经 CLI（ec msg send / ec group send）委托发送的路径使用，
+     * 与 IMRenderer 回复路径写入的 debug 同构。会话不存在返回 undefined。
+     */
+    async getOutboundDebug(sessionId) {
+        const session = await this.sessionManager.getSessionById(sessionId);
+        if (!session)
+            return undefined;
+        const model = this.activeTaskRuntimeContexts.has(sessionId)
+            ? this.activeRunnerModels.get(sessionId)
+            : undefined;
+        return {
+            sessionId: session.id,
+            ...(session.agentSessionId ? { agentSessionId: session.agentSessionId } : {}),
+            ...(model ? { model } : {}),
+        };
+    }
     setAgentDelegationRegistry(registry) {
         this.agentDelegationRegistry = registry;
     }
@@ -1700,9 +2161,15 @@ export class ResponseEngine {
         if (this.turnCoordinator.isCurrent(turnLease))
             return false;
         logger.info(`[ResponseEngine] Stale turn detected after agent.runQuery start; cancelling unconsumed stream: session=${sessionId} task=${taskId}`);
-        await agent.interrupt(sessionId).catch(interruptError => {
-            logger.warn(`[ResponseEngine] Failed to cancel stale runner start: session=${sessionId} task=${taskId} error=${interruptError instanceof Error ? interruptError.message : String(interruptError)}`);
-        });
+        const cancelledQueuedTurn = agent.cancelQueuedTurn?.(sessionId, {
+            taskId: turnLease.taskId,
+            generation: turnLease.generation,
+        }) ?? false;
+        if (!cancelledQueuedTurn) {
+            await agent.interrupt(sessionId).catch(interruptError => {
+                logger.warn(`[ResponseEngine] Failed to cancel stale runner start: session=${sessionId} task=${taskId} error=${interruptError instanceof Error ? interruptError.message : String(interruptError)}`);
+            });
+        }
         agent.cleanupStream(streamKey);
         return true;
     }
@@ -1796,6 +2263,71 @@ export class ResponseEngine {
             && message.source === 'trigger'
             && !!message.triggerMeta?.triggerId;
     }
+    isTrustedBgSession(message) {
+        return message.channel === 'daemon'
+            && message.source === 'bg-session'
+            && !!message.bgSessionMeta?.runId;
+    }
+    bgSessionTerminalMessages = new WeakSet();
+    claimBgSessionTerminal(message) {
+        const meta = message.bgSessionMeta;
+        if (message.source !== 'bg-session' || !meta?.runId || this.bgSessionTerminalMessages.has(message)) {
+            return undefined;
+        }
+        this.bgSessionTerminalMessages.add(message);
+        return { meta, runId: meta.runId };
+    }
+    publishBgSessionError(message, error, opts = {}) {
+        const terminal = this.claimBgSessionTerminal(message);
+        if (!terminal)
+            return;
+        const { meta, runId } = terminal;
+        this.eventBus.publish({
+            type: 'bg-session:error',
+            kind: meta.kind,
+            runId,
+            sessionId: meta.boundSessionId ?? '',
+            messageId: opts.messageId ?? message.messageId ?? runId,
+            error,
+            targetChannel: message.channel,
+            targetChannelId: message.channelId,
+            causation: opts.causation ?? message.causation,
+        });
+    }
+    publishBgSessionInterrupted(message, reason, causation) {
+        const terminal = this.claimBgSessionTerminal(message);
+        if (!terminal)
+            return;
+        const { meta, runId } = terminal;
+        this.eventBus.publish({
+            type: 'bg-session:interrupted',
+            kind: meta.kind,
+            runId,
+            sessionId: meta.boundSessionId ?? '',
+            messageId: message.messageId ?? runId,
+            reason,
+            targetChannel: message.channel,
+            targetChannelId: message.channelId,
+            causation: causation ?? message.causation,
+        });
+    }
+    publishBgSessionCompleted(message, messageId, durationMs, causation) {
+        const terminal = this.claimBgSessionTerminal(message);
+        if (!terminal)
+            return;
+        const { meta, runId } = terminal;
+        this.eventBus.publish({
+            type: 'bg-session:completed',
+            kind: meta.kind,
+            runId,
+            sessionId: meta.boundSessionId ?? '',
+            messageId,
+            durationMs,
+            targetChannel: message.channel,
+            targetChannelId: message.channelId,
+            causation: causation ?? message.causation,
+        });
+    }
     /**
      * A fullaccess Trigger may run with no current relation access for its
      * origin actor, but only after its persisted owner provenance still
@@ -1859,6 +2391,8 @@ export class ResponseEngine {
         if (!selfAid || !actorId || !channelType || !originChannelKey)
             return undefined;
         const chatType = message.triggerMeta.originChatType ?? 'private';
+        if (chatType === 'group' && !message.triggerMeta.originConversationId)
+            return undefined;
         const conversationId = message.triggerMeta.originConversationId ?? actorId;
         const control = message.triggerMeta.originControl === true;
         let actor;
@@ -1889,6 +2423,7 @@ export class ResponseEngine {
             actorId,
             channelType,
             originChannelKey,
+            conversationId: chatType === 'group' ? conversationId : actorId,
             control,
             peerKey: formatPeerKey(channelType, chatType === 'group' ? conversationId : actorId),
         };
@@ -1958,8 +2493,11 @@ export class ResponseEngine {
     /** Publish a terminal outcome before an early return from Trigger execution. */
     publishTriggerExecutionFailure(message, error, opts = {}) {
         const terminal = this.claimTriggerTerminal(message);
-        if (!terminal)
+        if (!terminal) {
+            // bg-session 路径：trigger terminal 不匹配时尝试 bg-session
+            this.publishBgSessionError(message, error, { messageId: opts.messageId, causation: opts.causation });
             return;
+        }
         const { trigger, runId } = terminal;
         const attemptId = trigger.attemptId;
         this.eventBus.publish({
@@ -1980,8 +2518,11 @@ export class ResponseEngine {
     }
     publishTriggerExecutionSkipped(message, reason, causation, interruption) {
         const terminal = this.claimTriggerTerminal(message);
-        if (!terminal)
+        if (!terminal) {
+            // bg-session 路径
+            this.publishBgSessionInterrupted(message, reason, causation);
             return;
+        }
         const { trigger, runId } = terminal;
         this.eventBus.publish({
             type: 'trigger:skipped',
@@ -2017,6 +2558,14 @@ export class ResponseEngine {
                 logger.warn(`[ResponseEngine] Failed to close interrupted Trigger run=${message.triggerMeta?.runId ?? '<unknown>'}: ${error instanceof Error ? error.message : String(error)}`);
             });
         }
+        else if (this.isTrustedBgSession(message)) {
+            await adapter.send(envelope, {
+                kind: 'status.interrupted',
+                metadata: { reason },
+            }).catch(error => {
+                logger.warn(`[ResponseEngine] Failed to close interrupted bg-session run=${message.bgSessionMeta?.runId ?? '<unknown>'}: ${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
         this.publishTriggerExecutionSkipped(message, reason, causation, interruption);
     }
     publishTriggerExecutionCompleted(message, messageId, durationMs, causation) {
@@ -2888,8 +3437,12 @@ export class ResponseEngine {
                     ? { kind: 'restartResume', groupId: message.groupId, threadId: message.threadId }
                     : undefined,
             previousTurnState: this.turnCoordinator.current(session),
-            isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, chatType, selfAid),
-            describeSendCommandFailure: describeProactiveSendCommandFailure,
+            isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, chatType, selfAid) || isThreadRoutedSendForSelf(toolName, toolInput, selfAid),
+            describeSendCommandFailure: (toolName, toolInput) => describeProactiveSendCommandFailure(toolName, toolInput, {
+                selfAid,
+                channelId: session.channelId,
+                chatType: chatType,
+            }),
             logger,
         } : null;
         if (resolvedMode?.mode.beforeProcess && modeProcessCtx) {
@@ -2952,8 +3505,9 @@ export class ResponseEngine {
                 this.sessionManager.clearProcessingIfTask(session.id, taskId);
                 if (this.activeTaskRuntimeContexts.get(session.id)?.taskId === taskId) {
                     this.activeTaskRuntimeContexts.delete(session.id);
+                    this.activeRunnerModels.delete(session.id); // F1修复
                 }
-                this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                this.agentDelegationRegistry?.revokeTask(session.id, taskId, 'interrupted');
                 const daemonTrigger = this.isTrustedDaemonTrigger(message);
                 if (!daemonTrigger) {
                     await adapter.send(envelope, statusPayload).catch(() => { });
@@ -2961,7 +3515,11 @@ export class ResponseEngine {
                 await adapter.send(envelope, {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: isExecutionFailure(timeoutError) ? timeoutError.reason : isTotalExecutionTimeout ? 'total_execution_timeout' : 'timeout',
+                    ...(getErrorRawText(timeoutError) ? { raw: getErrorRawText(timeoutError) } : {}),
+                    subtype: normalizeCoreErrorSubtype(timeoutError, undefined, isTotalExecutionTimeout ? 'timeout' : 'timeout'),
+                    reason: isExecutionFailure(timeoutError)
+                        ? normalizeCoreErrorReason(timeoutError.reason)
+                        : 'timeout',
                 }).catch(() => { });
                 if (daemonTrigger) {
                     await adapter.send(envelope, statusPayload).catch(() => { });
@@ -3301,9 +3859,9 @@ export class ResponseEngine {
                 await adapter.send(withEnvelopeReplyContext(envelope, capturedReplyContext), { kind: 'result.text', text, isFinal: false });
             };
             const authChatType = configChatType;
-            const authConversationId = authChatType === 'group'
+            const authConversationId = triggerExecutionIdentity?.conversationId ?? (authChatType === 'group'
                 ? (session.metadata?.groupId || session.channelId || capturedChannelId)
-                : configActorId;
+                : configActorId);
             const authPeerKey = configChannelType && authConversationId
                 ? formatPeerKey(configChannelType, authConversationId)
                 : undefined;
@@ -3429,11 +3987,53 @@ export class ResponseEngine {
                 ? resolvedMode.mode.configureRun(modeProcessCtx)
                 : undefined;
             const modePolicyHook = runModeConfig?.policyHook;
-            // 整理会话：写工具全拦、Bash 只放行 ec memory create|update|archive，先于模式策略判定
-            const isMemorySession = (session.sessionType ?? session.metadata?.sessionType) === 'memory';
-            const pureSessionPolicyHook = isMemorySession
-                ? (toolName, toolInput) => memorySessionPolicyHook(toolName, toolInput) ?? modePolicyHook?.(toolName, toolInput)
-                : modePolicyHook;
+            // 系统会话：路径 / 工具由 system-session 模块判定，与角色体系无关。
+            // 有标记就只走模块，不挂模式策略、不算授权表、不并 runtime grant。
+            const sessionMetadata = session.metadata;
+            const declaredSessionType = session.sessionType ?? (typeof sessionMetadata?.sessionType === 'string' ? sessionMetadata.sessionType : undefined);
+            const systemSessionMarker = readSystemSessionMarker(sessionMetadata);
+            if (isSystemSessionType(declaredSessionType) && !systemSessionMarker) {
+                throw new Error(`系统会话 ${declaredSessionType} 缺少有效 systemSession 标记`);
+            }
+            if (systemSessionMarker && declaredSessionType && declaredSessionType !== systemSessionMarker.type) {
+                throw new Error(`系统会话标记类型 ${systemSessionMarker.type} 与 sessionType ${declaredSessionType} 不一致`);
+            }
+            const systemSessionModule = systemSessionMarker
+                ? getSystemSessionModule(systemSessionMarker.type)
+                : undefined;
+            const systemSessionContext = systemSessionModule && systemSessionMarker
+                ? buildSystemSessionContext({
+                    marker: systemSessionMarker,
+                    sessionId: session.id,
+                    selfAid: selfAid || session.selfAID || '',
+                    projectPath: absoluteProjectPath,
+                    managedTempDir: sessionRuntimeDir,
+                    metadata: sessionMetadata,
+                })
+                : undefined;
+            const systemSessionCheck = systemSessionModule && systemSessionContext
+                ? (toolName, toolInput) => systemSessionModule.checkTool(toolName, toolInput, systemSessionContext)
+                : undefined;
+            // 沙箱声明与 runner 有关，但当前所有 runner 共用同一个结论；仍按 runner 问一次，
+            // 以便将来某个 runner 需要不同取舍时只改模块。
+            const systemSessionSandbox = systemSessionModule && systemSessionContext
+                ? systemSessionModule.runnerLaunch(normalizeBaseagent(agent.name).canonical, systemSessionContext).sandbox
+                : undefined;
+            const pureSessionPolicyHook = systemSessionMarker ? undefined : modePolicyHook;
+            // 路径授权（仅用户会话）：身份就是角色名；运行时授予（ec ctl path grant）按 sessionId 再并一层。
+            const pathGrantIdentity = systemSessionMarker ? undefined : (peerRole || undefined);
+            const grantedReadRoots = (() => {
+                if (!pathGrantIdentity)
+                    return [];
+                const table = mergeRuntimeGrantsForSession(BUILTIN_SESSION_PATH_GRANTS, session.id, pathGrantIdentity);
+                return resolveGrantedReadRoots(table, {
+                    selfAid,
+                    peerKey: authPeerKey,
+                    projectPath: absoluteProjectPath,
+                    identity: pathGrantIdentity,
+                    permissionMode: effectivePermissionMode,
+                });
+            })();
             // 设置权限审批的交互上下文（支持交互卡片）
             const permissionContext = {
                 sendPrompt: permissionPromptForOrigin,
@@ -3447,10 +4047,12 @@ export class ResponseEngine {
                 agentName: agentNameForStats,
                 taskId,
                 chatmode: isProactive ? 'proactive' : 'interactive',
-                role: peerRole,
+                // 系统会话没有角色
+                role: systemSessionMarker ? undefined : peerRole,
                 chatType: authChatType,
                 selfAid,
                 managedTempDir: sessionRuntimeDir,
+                grantedReadRoots,
                 allowReadonlySourceDiagnostics: effectiveAgentConfig?.readonlySourceDiagnostics === true,
                 peerKey: authPeerKey,
                 causation: taskCausation,
@@ -3460,6 +4062,13 @@ export class ResponseEngine {
                 recordExecutionAnomaly,
                 pauseController: taskPauseController,
                 preToolUsePolicyHook: pureSessionPolicyHook,
+                systemSessionCheck,
+                ...(systemSessionModule && systemSessionContext
+                    ? {
+                        systemSessionGrants: systemSessionModule.grants(systemSessionContext),
+                        ...(systemSessionSandbox ? { systemSessionSandbox } : {}),
+                    }
+                    : {}),
                 armApprovedDelegationCommand: this.agentDelegationRegistry
                     ? (sessionToken, commandHash) => this.agentDelegationRegistry.armApprovedCommand({
                         sessionToken,
@@ -3468,6 +4077,11 @@ export class ResponseEngine {
                         commandHash,
                     })
                     : undefined,
+                bindSessionCredential: this.agentDelegationRegistry
+                    ? (sessionToken, threadId) => this.agentDelegationRegistry.registerSessionCredential({
+                        sessionToken, threadId, sessionId: session.id, taskId,
+                    })
+                    : undefined,
                 turn: {
                     sessionId: turnLease.sessionId,
                     taskId,
@@ -3552,16 +4166,31 @@ export class ResponseEngine {
                     const pluginHook = pureSessionPolicyHook;
                     if (!pluginHook)
                         return undefined;
-                    return (toolName, toolInput) => {
+                    return (toolName, toolInput, meta) => {
                         const stBefore = modeState.get('proactive');
                         const wasFirstPending = stBefore && !stBefore.firstToolDone;
-                        const result = pluginHook(toolName, toolInput);
+                        const result = pluginHook(toolName, toolInput, meta);
                         // 整理会话的拦截原因已经写清楚怎么改，不套 proactive 违规提醒
                         if (result?.block && result.policyCode?.startsWith('memory_session_'))
                             return result;
                         if (result?.block) {
                             // 拦截事件（首工具非表态 / 工具进展汇报未完成）
                             snapshot.set(session.id, taskId, { policyHook: { triggered: true, blocked: true, toolName } });
+                            // 问题1/2修复：熔断码表示连续违规已超阈值，停止注入提醒，直接中断任务。
+                            // F5修复：向渠道发一条人类可读的错误说明，避免静默中断。
+                            if (result.policyCode === 'proactive_circuit_break') {
+                                void adapter.send(withEnvelopeReplyContext(envelope, capturedReplyContext), {
+                                    kind: 'result.text',
+                                    text: '⚠️ 任务执行遇到循环障碍，已自动中断。请重新描述你的需求。',
+                                    isFinal: true,
+                                }).catch(err => {
+                                    logger.warn(`[ResponseEngine] circuit break channel send failed: session=${session.id} error=${err instanceof Error ? err.message : String(err)}`);
+                                });
+                                void agent.interrupt(session.id).catch(error => {
+                                    logger.debug(`[ResponseEngine] circuit break interrupt failed: session=${session.id} error=${error instanceof Error ? error.message : String(error)}`);
+                                });
+                                return result;
+                            }
                             const errorMsg = `⚠️ proactive 模式违规：${result.reason ?? '请先发送必要说明'}。请重新执行正确的命令。`;
                             agent.injectUserMessage?.(session.id, errorMsg);
                             return result;
@@ -3605,6 +4234,8 @@ export class ResponseEngine {
             let previousFallbackState;
             let agentModel;
             let v2HandoffIds = [];
+            /** T3: 本次注入的 Thread Context 条目（渲染后据此清空 inbox）。 */
+            let threadContextItems = [];
             let v2HandoffResultRefs = [];
             let v2HandoffDirection;
             let handoffPromptRendered = false;
@@ -3634,7 +4265,15 @@ export class ResponseEngine {
                 const triggerPermissionModeOverride = message.triggerMeta?.permissionModeOverride;
                 const commandFullAccess = message.executionPermissionOverride;
                 const triggerFullAccess = triggerPermissionModeOverride === 'fullaccess';
-                if (commandFullAccess || triggerFullAccess) {
+                if (systemSessionMarker) {
+                    // 系统会话不走角色 / trigger override / fullaccess：runner 模式由模块固定
+                    if (commandFullAccess || triggerFullAccess) {
+                        throw new Error('系统会话不支持 fullaccess');
+                    }
+                    effectivePermissionMode = systemSessionModule
+                        .runnerLaunch(normalizedBaseagent.canonical, systemSessionContext).runnerMode;
+                }
+                else if (commandFullAccess || triggerFullAccess) {
                     if (commandFullAccess) {
                         if (commandFullAccess.permissionMode !== 'fullaccess'
                             || commandFullAccess.processRole !== 'fullaccess-run'
@@ -3848,10 +4487,13 @@ export class ResponseEngine {
                         bootstrapAgentMdPath: agentMdPath(selfAid),
                     };
                 }
+                // persona.md 是唯一的人格/交接文件（personal.md 已废弃并入）。
+                // 该白名单让 owner 会话可直接用文件工具分段更新 `## Bootstrap 交接`，
+                // 避免把长 Markdown 交接摘要塞进 `ec agent persona --text` 的 shell 转义。
                 if (selfAid && peerRole === 'owner' && effectivePermissionMode !== 'readonly') {
                     modelOverride = {
                         ...(modelOverride || {}),
-                        personalMdPath: path.join(resolveRoot(), 'agents', selfAid, 'personal', 'personal.md'),
+                        personalMdPath: path.join(resolveRoot(), 'agents', selfAid, 'personal', 'persona.md'),
                     };
                 }
                 if (normalizedBaseagent.canonical === 'claude') {
@@ -4095,9 +4737,12 @@ export class ResponseEngine {
                 // Bootstrap always uses the lifecycle-gated main manifest. A custom
                 // session manifest (for example the auxiliary manifest with `always`
                 // sections) must not reintroduce normal rules or command context.
+                // 系统会话：manifest 由模块按 type/subtype 决定，不读 config
                 const manifestFile = isBootstrapping
                     ? DEFAULT_MANIFEST_FILE
-                    : resolveSessionManifest(sessionType, sessionManifests);
+                    : systemSessionMarker
+                        ? getSystemSessionModule(systemSessionMarker.type).manifest(systemSessionMarker.subtype)
+                        : resolveSessionManifest(sessionType, sessionManifests);
                 const kitContext = renderKitSections(kitCtx, manifestFile);
                 effectiveSystemPrompt = [options?.systemPromptAppend, kitContext].filter(Boolean).join('\n') || undefined;
                 // ── Stats: context_breakdown 旁路采集（各段估算 token 数，字符数/4 近似） ──
@@ -4137,6 +4782,16 @@ export class ResponseEngine {
                     const rawPeerItems = message.source === 'owner-inject' ? [] : message.items && message.items.length > 0
                         ? message.items
                         : [{
+                                // T9.5/T10: trigger 消息填充专属 kind + triggerInfo（含 labels），走 msg-trigger-session/thread-check 渲染
+                                ...(message.source === 'trigger' && message.triggerMeta?.triggerId ? {
+                                    kind: 'trigger',
+                                    triggerInfo: {
+                                        triggerId: message.triggerMeta.triggerId,
+                                        triggerName: message.triggerMeta.triggerName,
+                                        fireTime: message.triggerMeta.fireTime,
+                                        labels: message.triggerMeta.labels,
+                                    },
+                                } : {}),
                                 peerId: message.peerId, peerName: peerName || undefined,
                                 peerType: message.peerType,
                                 peerRole: message.batchRole || session.identity?.role || 'none',
@@ -4147,6 +4802,34 @@ export class ResponseEngine {
                                 mentions: message.mentions,
                                 mentionAids: message.mentionAids,
                             }];
+                    // T3.2: 读取 Thread Context inbox —— 跨话题发送留在本端的注入提醒。
+                    // 注入一次后立即删除整个文件（T3.3），不依赖任何消费标记。
+                    threadContextItems = [];
+                    if (selfAid && message.source !== 'owner-inject') {
+                        try {
+                            const { ThreadService } = await import('../thread/index.js');
+                            const inbox = ThreadService.readInbox(selfAid, session.id);
+                            threadContextItems = inbox.map(entry => ({
+                                kind: 'thread-context',
+                                peerId: entry.originPeer,
+                                peerType: 'agent',
+                                peerRole: 'none',
+                                content: entry.content,
+                                timestamp: entry.timestamp,
+                                threadContext: {
+                                    messageId: entry.messageId,
+                                    originThreadId: entry.originThreadId,
+                                    originPeer: entry.originPeer,
+                                    originSessionId: entry.originSessionId,
+                                    ...(entry.triggerId ? { triggerId: entry.triggerId } : {}),
+                                    gapDetection: entry.gapDetection,
+                                },
+                            }));
+                        }
+                        catch (e) {
+                            logger.warn(`[ResponseEngine] ThreadContext inbox 读取失败: ${e?.message ?? e}`);
+                        }
+                    }
                     const peerItems = (() => {
                         if (message.handoffDelivery && this.handoffRuntime) {
                             const items = this.handoffRuntime.buildPromptItems(message, peerRole);
@@ -4156,10 +4839,10 @@ export class ResponseEngine {
                                     : (item.handoff?.handoffId ? [item.handoff.handoffId] : [])))));
                                 v2HandoffResultRefs = items.flatMap(item => item.handoff?.resultRefs ?? []);
                                 v2HandoffDirection = message.handoffDelivery.direction;
-                                return items;
+                                return [...threadContextItems, ...items];
                             }
                         }
-                        return rawPeerItems;
+                        return [...threadContextItems, ...rawPeerItems];
                     })();
                     // 将匹配的 pending hint 暂时 claim，排在真实消息之前；渲染或启动
                     // 失败时释放 claim，只有 runner 接受 prompt 后才持久化 consumed。
@@ -4263,6 +4946,16 @@ export class ResponseEngine {
                         }
                     }
                 }
+                // T3.3: 渲染成功、prompt 非空 —— 注入完成，删除 inbox（注入一次语义）。
+                if (threadContextItems.length > 0 && selfAid) {
+                    try {
+                        const { ThreadService } = await import('../thread/index.js');
+                        ThreadService.clearInbox(selfAid, session.id);
+                    }
+                    catch (e) {
+                        logger.warn(`[ResponseEngine] ThreadContext inbox 清理失败: ${e?.message ?? e}`);
+                    }
+                }
                 // Pass the stable session directory explicitly so sandboxed helper
                 // commands never fall back to a process, agent, or project directory
                 // for transient state.
@@ -4273,6 +4966,10 @@ export class ResponseEngine {
                     messageId: message.messageId,
                     baseagent: normalizedBaseagent.canonical,
                     channel: configChannelType,
+                    // 完整 channelKey（= adapter.channelName / inst.name，如 `aun#<selfAid>#main`）。
+                    // 必须与下面 issue() 的 `channel:` 用同一表达式，否则 debug 路径拿到的
+                    // origin.channelKey 会与真实任务路径不一致（见 D5）。
+                    channelKey: authorizationIdentity?.originChannelKey ?? message.channel,
                     channelId: message.channelId,
                     chatType: configChatType,
                     selfAid,
@@ -4280,7 +4977,8 @@ export class ResponseEngine {
                     peerKey,
                     peerName: peerName || undefined,
                     peerType: message.peerType || session.metadata?.peerType || undefined,
-                    peerRole,
+                    // 系统会话没有角色
+                    ...(systemSessionMarker ? {} : { peerRole }),
                     // 会话原型与整理模式：ipc 侧靠 sessionType 拦非整理会话的写命令，
                     // 靠 memoryMode 校验 --scope 是否与本模式匹配。
                     sessionType: renderedSessionType,
@@ -4304,6 +5002,7 @@ export class ResponseEngine {
                     causation: taskCausation,
                 };
                 this.activeTaskRuntimeContexts.set(session.id, taskRuntimeContext);
+                this.debugWriteSessionSnapshot(session.id, taskRuntimeContext);
                 runtimeEnv = buildTaskRuntimeEnv(taskRuntimeContext);
                 if (this.agentDelegationRegistry && configActorId && selfAid && peerKey) {
                     const delegationToken = this.agentDelegationRegistry.issue({
@@ -4316,7 +5015,8 @@ export class ResponseEngine {
                         chatType: configChatType,
                         selfAid,
                         peerKey,
-                        issuedRole: peerRole,
+                        // 系统会话与角色体系无关：带标记、不签角色
+                        ...(systemSessionMarker ? { systemSession: systemSessionMarker } : { issuedRole: peerRole }),
                         executionSource: fullAccessAuthorization?.source ?? (message.source === 'trigger' ? 'trigger' : 'user'),
                         permissionMode: effectivePermissionMode,
                         approvalInteractionPolicy,
@@ -4409,6 +5109,10 @@ export class ResponseEngine {
                             mimeType: image.mimeType,
                         }));
                         debugRunnerModel = modelOverride?.model || agentModel;
+                        if (debugRunnerModel)
+                            this.activeRunnerModels.set(session.id, debugRunnerModel);
+                        else
+                            this.activeRunnerModels.delete(session.id);
                         const stream = await agent.runQuery(session.id, effectivePrompt, absoluteProjectPath, runAgentSessionId, runnerImages, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
                         // The turn may be superseded while the runner is still creating its
                         // backend query. Replay the interrupt after runQuery resolves, when
@@ -4578,7 +5282,7 @@ export class ResponseEngine {
                             const candidateHint = fallbackCandidates.length === 0
                                 ? '未配置可用备用模型'
                                 : '备用模型均不可用';
-                            throw markModelFallbackExhausted(new Error(`model_not_found: ${primaryModel ?? 'runner_default'}`), `当前模型 ${primaryModel ?? '默认模型'} 不可用，${candidateHint}。请稍后重试；管理员可在 agents/defaults.json 的 baseagents.${normalizedBaseagent.canonical}.fallbackModels 配置同类备用模型。`);
+                            throw markModelFallbackExhausted(new Error(`model_not_found: ${primaryModel ?? 'runner_default'}`), `当前模型 ${primaryModel ?? '默认模型'} 不可用，${candidateHint}。请稍后重试；管理员可在 agents/defaults.json 的 baseagents.${normalizedBaseagent.canonical}.fallbackModels 配置同类备用模型。`, retryError);
                         }
                         if (retryAttemptTimedOut || isRetryableError(retryError)) {
                             await recordRetryHealthError(retryError);
@@ -4704,8 +5408,9 @@ export class ResponseEngine {
                     this.sessionManager.clearProcessingIfTask(session.id, taskId);
                     if (this.activeTaskRuntimeContexts.get(session.id)?.taskId === taskId) {
                         this.activeTaskRuntimeContexts.delete(session.id);
+                        this.activeRunnerModels.delete(session.id); // F1修复
                     }
-                    this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                    this.agentDelegationRegistry?.revokeTask(session.id, taskId, 'replaced');
                     logger.info(`[ResponseEngine] Stale turn stopped before publish: session=${session.id} task=${taskId}`);
                     await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_generation', taskCausation, {
                         expected: turnLease?.generation,
@@ -4719,8 +5424,9 @@ export class ResponseEngine {
                         this.sessionManager.clearProcessingIfTask(session.id, taskId);
                         if (this.activeTaskRuntimeContexts.get(session.id)?.taskId === taskId) {
                             this.activeTaskRuntimeContexts.delete(session.id);
+                            this.activeRunnerModels.delete(session.id); // F1修复
                         }
-                        this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                        this.agentDelegationRegistry?.revokeTask(session.id, taskId, 'replaced');
                         logger.info(`[ResponseEngine] Stale turn stopped before protocol rejection: session=${session.id} task=${taskId}`);
                         await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_generation', taskCausation, {
                             expected: turnLease?.generation,
@@ -4870,9 +5576,11 @@ export class ResponseEngine {
                 });
             }
             // 最终回复文本：suppressed 模式或无 text 事件时需要兜底添加
+            // 错误诊断串已通过 system.error 单独发出时置 true，下游跳过 result.error 避免重复
+            let sentErrorAsSystemError = false;
             const finalReplyText = streamResult.lastReplyText || streamResult.fullText;
             const visibleFinalReplyText = stripContextLimitErrorLines(finalReplyText);
-            const isDiagnosticFallback = streamResult.isError && !streamResult.hasReceivedText;
+            const streamRawErrorText = getStreamRawErrorText(streamResult, visibleFinalReplyText || undefined);
             const isTriggerNoop = message.source === 'trigger'
                 && typeof message.triggerMeta?.noopSentinel === 'string'
                 && message.triggerMeta.noopSentinel.length > 0
@@ -4882,16 +5590,42 @@ export class ResponseEngine {
                 this.sessionManager.clearProcessingIfTask(session.id, taskId);
                 if (this.activeTaskRuntimeContexts.get(session.id)?.taskId === taskId) {
                     this.activeTaskRuntimeContexts.delete(session.id);
+                    this.activeRunnerModels.delete(session.id); // F1修复
                 }
-                this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                this.agentDelegationRegistry?.revokeTask(session.id, taskId, 'replaced');
                 logger.info(`[ResponseEngine] Stale turn stopped before final flush: session=${session.id} task=${taskId}`);
                 await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_turn', taskCausation);
                 return;
             }
-            if (visibleFinalReplyText && !isDiagnosticFallback && !isTriggerNoop) {
+            if ((visibleFinalReplyText || streamResult.syntheticDiagnosticText) && !isTriggerNoop) {
                 // `hasReceivedText` 是任务级计数。工具调用前的文字已经显示，并不表示最后一轮
                 // （通常来自 complete.result）的文字也已显示；用本轮投影标记避免终态丢失。
-                if (shouldSuppress() || !streamResult.hasProjectedCurrentReplyText) {
+                //
+                // 终态路由按"本轮是否以错误收场"（isError）判定，不再按"有没有收到过文本"判定。
+                // 原因：上游会把错误原文当正文送进来——Claude Code 用 `<synthetic>` assistant 表达
+                // 传输/API 故障（runner 已标 synthetic，见上方 text 分支），网关也会把上下文超限错误
+                // 伪装成 text event。这两种情况下 hasReceivedText / lastReplyText 都非空，旧判据
+                // （isError && !lastReplyText）拦不住，错误串会被当成模型的最终回复发出去
+                // （2026-10-11 403「无法连接到积分服务器」案例）。
+                // 以错误收场的轮次一律走 system.error：前端收到的单条消息即可判断来源，
+                // 不需要等后续的 result.error。
+                const errorText = visibleFinalReplyText || streamResult.syntheticDiagnosticText || getStreamErrorMessage(streamResult, false);
+                if (streamResult.isError) {
+                    // 用原始诊断文本（含错误码）判断可重试性，不用已过 stripContextLimitErrorLines 的展示文本
+                    const recoverable = isRetryableError(new Error(getStreamErrorText(streamResult)));
+                    const subtype = normalizeCoreErrorSubtype(new Error(streamRawErrorText || getStreamErrorText(streamResult)), streamResult.subtype, streamResult.terminalReason);
+                    const reason = normalizeCoreErrorReason(streamResult.terminalReason);
+                    await adapter.send(envelope, {
+                        kind: 'system.error',
+                        text: errorText,
+                        ...(streamRawErrorText ? { raw: streamRawErrorText } : {}),
+                        subtype,
+                        ...(reason ? { reason } : {}),
+                        recoverable,
+                    }).catch(() => { });
+                    sentErrorAsSystemError = true;
+                }
+                else if (visibleFinalReplyText && (shouldSuppress() || !streamResult.hasProjectedCurrentReplyText)) {
                     await renderer.addText(visibleFinalReplyText, undefined, undefined, streamResult.assistantUuid);
                 }
             }
@@ -4901,8 +5635,9 @@ export class ResponseEngine {
             this.sessionManager.clearProcessingIfTask(session.id, taskId);
             if (this.activeTaskRuntimeContexts.get(session.id)?.taskId === taskId) {
                 this.activeTaskRuntimeContexts.delete(session.id);
+                this.activeRunnerModels.delete(session.id); // F1修复
             }
-            this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+            this.agentDelegationRegistry?.revokeTask(session.id, taskId, streamResult.isError ? 'failed' : 'completed');
             logger.info(`[ResponseEngine] session ${session.id} processing cleared task=${taskId}`);
             import('../../utils/msg-diag.js').then(m => m.diagLog('task_done', { aid: session.selfAID ?? '', msgId: message.messageId ?? '', taskId, text: message.content ?? '' })).catch(() => { });
             // 降级模型回复末尾追加标记（代码层硬注入，不依赖模型输出）
@@ -4971,6 +5706,10 @@ export class ResponseEngine {
                         : getStreamErrorMessage(streamResult, false);
                 const rawSubtype = streamResult.subtype || 'agent_error';
                 const errorType = prefixErrorType(ERROR_PREFIX.AGENT, rawSubtype);
+                const coreSubtype = normalizeCoreErrorSubtype(new Error(streamRawErrorText || errorSummary), rawSubtype, streamResult.terminalReason);
+                const coreReason = permissionTerminalFailure
+                    ? normalizeCoreErrorReason(permissionTerminalFailure.reason)
+                    : normalizeCoreErrorReason(streamResult.terminalReason);
                 // 用户主动打断（新消息/​/stop/​撤回）会让 SDK 流在工具调用中途被掐断，
                 // 末尾 result message 形状异常并被标记为 error（含 SDK 内部 ede_diagnostic 串）。
                 // 这不是真正的失败，不应把诊断串暴露给用户，也不计入错误统计。
@@ -4991,12 +5730,29 @@ export class ResponseEngine {
                     // DaemonChannel settles a trigger when it receives a terminal
                     // payload. Send the metadata-bearing status first so failed runs do
                     // not lose their tool counts and recovery diagnostics.
+                    // system.error 已在 finalReplyText 分支把错误文本发给了前端，不再重复发 result.error
                     if (this.isTrustedDaemonTrigger(message)) {
                         await adapter.send(envelope, { kind: 'status.error', metadata: terminalMetadata }).catch(() => { });
-                        await adapter.send(envelope, { kind: 'result.error', text: userErrorSummary, reason: rawSubtype }).catch(() => { });
+                        if (!sentErrorAsSystemError) {
+                            await adapter.send(envelope, {
+                                kind: 'result.error',
+                                text: userErrorSummary,
+                                ...(streamRawErrorText ? { raw: streamRawErrorText } : {}),
+                                subtype: coreSubtype,
+                                ...(coreReason ? { reason: coreReason } : {}),
+                            }).catch(() => { });
+                        }
                     }
                     else {
-                        await adapter.send(envelope, { kind: 'result.error', text: userErrorSummary, reason: rawSubtype }).catch(() => { });
+                        if (!sentErrorAsSystemError) {
+                            await adapter.send(envelope, {
+                                kind: 'result.error',
+                                text: userErrorSummary,
+                                ...(streamRawErrorText ? { raw: streamRawErrorText } : {}),
+                                subtype: coreSubtype,
+                                ...(coreReason ? { reason: coreReason } : {}),
+                            }).catch(() => { });
+                        }
                         await adapter.send(envelope, { kind: 'status.error', metadata: terminalMetadata }).catch(() => { });
                     }
                     this.touchAgentActivity(channelKey);
@@ -5249,6 +6005,7 @@ export class ResponseEngine {
                 }
                 if (!interruptReason) {
                     this.publishTriggerExecutionCompleted(message, messageId, durationMs, taskCausation);
+                    this.publishBgSessionCompleted(message, messageId, durationMs, taskCausation);
                 }
                 if (!this.turnCoordinator.canPublish(turnLease))
                     return;
@@ -5338,8 +6095,9 @@ export class ResponseEngine {
                 this.sessionManager.clearProcessingIfTask(session.id, taskId);
                 if (this.activeTaskRuntimeContexts.get(session.id)?.taskId === taskId) {
                     this.activeTaskRuntimeContexts.delete(session.id);
+                    this.activeRunnerModels.delete(session.id); // F1修复
                 }
-                this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                this.agentDelegationRegistry?.revokeTask(session.id, taskId, this.interruptedSessions.has(session.id) ? 'interrupted' : 'failed');
                 logger.info(`[ResponseEngine] session ${session.id} processing cleared (on error) task=${taskId}`);
             }
             catch { }
@@ -5486,10 +6244,29 @@ export class ResponseEngine {
                     sessionId: session.id,
                     metadata: withTaskMetadata(sendOpts?.metadata),
                 };
+                const errorReason = isExecutionFailure(error)
+                    ? normalizeCoreErrorReason(error.reason)
+                    : retryExhaustedCount
+                        ? 'retry_exhausted'
+                        : retryInputAlreadySubmitted
+                            ? 'input_already_submitted'
+                            : modelFallbackExhaustedMessage
+                                ? 'fallback_exhausted'
+                                : isTotalExecutionTimeout || isTimeout
+                                    ? 'timeout'
+                                    : undefined;
+                const errorSubtype = error instanceof OrphanedTargetSessionError
+                    ? ErrorType.SESSION_UNAVAILABLE
+                    : modelFallbackExhaustedMessage
+                        ? ErrorType.MODEL_UNAVAILABLE
+                        : normalizeCoreErrorSubtype(error, undefined, isTotalExecutionTimeout || isTimeout ? 'timeout' : undefined);
+                const rawErrorText = getErrorRawText(error);
                 const errorPayload = {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: isExecutionFailure(error) ? error.reason : retryExhaustedCount ? 'retry_exhausted' : retryInputAlreadySubmitted ? 'input_already_submitted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
+                    subtype: errorSubtype,
+                    ...(rawErrorText ? { raw: rawErrorText } : {}),
+                    ...(errorReason ? { reason: errorReason } : {}),
                 };
                 if (!isUserInterrupt && daemonTrigger && procStatus === 'error') {
                     // DaemonChannel settles a trigger on the first terminal payload. Put
@@ -5889,6 +6666,9 @@ export class ResponseEngine {
         });
         // 追踪最后一轮 assistant 回复文本（tool_use 之后的纯文本）
         let lastReplyText = '';
+        // 上游合成错误帧的原文（runner 标记 synthetic 的 text）。与正文通道分开存放：
+        // 它只能作为终态错误文案的来源，不得进入 lastReplyText / 投影 / hasReceivedText。
+        let syntheticDiagnosticText = '';
         // callId → description 映射，用于 tool_result 回显描述
         const toolDescByCallId = new Map();
         const toolInputByCallId = new Map();
@@ -5922,10 +6702,11 @@ export class ResponseEngine {
                 if (event.type === 'complete') {
                     event = normalizeCompleteAgentEvent(event);
                 }
-                if (event.type === 'tool_result' && event.isError) {
+                if (event.type === 'tool_result' && isToolResultFailure(event)) {
                     const classification = normalizeToolErrorClassification(event);
                     event = {
                         ...event,
+                        isError: true,
                         errorCode: classification.errorCode,
                         errorDetailCode: classification.errorDetailCode,
                         classificationMissing: classification.classificationMissing || event.classificationMissing,
@@ -6071,7 +6852,20 @@ export class ResponseEngine {
                     logger.info(`[ResponseEngine] Event: type=${event.type}${eventDetail}`);
                 }
                 // IMRenderer 旁路：proactive 模式逐事件投影为 thought（fire-and-forget）
-                renderer.emit(event);
+                let diagnosticSuffix = '';
+                let projectedEvent = event;
+                if (event.type === 'tool_result' && isToolResultFailure(event)) {
+                    const byCallId = event.callId ? toolInputByCallId.get(event.callId) : undefined;
+                    const byCorrelationId = event.correlationId
+                        ? toolInputByCorrelationId.get(event.correlationId)
+                        : undefined;
+                    const original = event.callId && event.correlationId
+                        ? byCallId === byCorrelationId ? byCallId : undefined
+                        : byCallId ?? byCorrelationId;
+                    diagnosticSuffix = formatToolInputDiagnostics(diagnoseToolInputAfterFailure(original, event));
+                    projectedEvent = { ...event, error: getToolResultErrorText(event) + diagnosticSuffix };
+                }
+                renderer.emit(projectedEvent);
                 if (event.type === 'text_start') {
                     await renderer.sendTextStart(event.contentIndex, event.turn);
                     continue;
@@ -6113,6 +6907,7 @@ export class ResponseEngine {
                         toolUseId: event.toolUseId,
                         description: event.description,
                         subagentType: event.subagentType,
+                        taskType: event.taskType,
                         skipTranscript: event.skipTranscript,
                     });
                     this.eventBus.publish({
@@ -6131,15 +6926,21 @@ export class ResponseEngine {
                         causation,
                     });
                     if (!event.skipTranscript) {
-                        renderer.addLifecycle('started', {
-                            scope: 'runner_task',
-                            taskId: event.taskId,
-                            taskKind: event.taskKind,
-                            toolUseId: event.toolUseId,
-                            description: event.description,
-                            subagentType: event.subagentType,
-                            taskType: event.taskType,
-                        }, `${event.taskKind === 'agent' ? 'Agent' : 'Background'} task started: ${event.description}`);
+                        // 子任务就是来源工具调用的执行过程：来源卡片在本轮可见时归拢进它的 tool_result，
+                        // 不另出卡片；否则（如 Codex 子智能体无来源工具）退回合成卡片。见 subtask-tool-projection.ts。
+                        const folded = renderer.beginParentSubtask(event.toolUseId);
+                        tasks.get(event.taskId).projection = folded ? 'parent' : 'synthetic';
+                        if (!folded) {
+                            renderer.addSubtaskActivity(projectSubtaskStarted({
+                                taskId: event.taskId,
+                                taskKind: event.taskKind,
+                                description: event.description,
+                                taskType: event.taskType,
+                                subagentType: event.subagentType,
+                                toolUseId: event.toolUseId,
+                                workflowName: event.workflowName,
+                            }));
+                        }
                     }
                     continue;
                 }
@@ -6155,6 +6956,7 @@ export class ResponseEngine {
                 }
                 if (event.type === 'task_notification') {
                     const tasks = this.activeRunnerTasks.get(session.id);
+                    const started = tasks?.get(event.taskId);
                     tasks?.delete(event.taskId);
                     if (tasks?.size === 0)
                         this.activeRunnerTasks.delete(session.id);
@@ -6175,19 +6977,26 @@ export class ResponseEngine {
                         causation,
                     });
                     if (!event.skipTranscript) {
-                        const label = event.description || event.taskId;
-                        renderer.addLifecycle('completed', {
-                            scope: 'runner_task',
-                            taskId: event.taskId,
-                            taskKind: event.taskKind,
-                            toolUseId: event.toolUseId,
-                            description: event.description,
-                            subagentType: event.subagentType,
-                            status: event.status,
-                            outputFile: event.outputFile,
-                            summary: event.summary,
-                            usage: event.usage,
-                        }, `${event.taskKind === 'agent' ? 'Agent' : 'Background'} task ${event.status}: ${label}`);
+                        const terminal = { status: event.status, summary: event.summary, durationMs: event.usage?.durationMs };
+                        const toolUseId = event.toolUseId ?? started?.toolUseId;
+                        // 归拢的子任务：终态合并进来源工具的 tool_result（前台等真实结果、后台放出扣住的占位结果）。
+                        const merged = started?.projection === 'parent' && renderer.endParentSubtask(toolUseId, terminal);
+                        if (!merged) {
+                            // 没归拢上：开始时就是合成卡片，则终态配同一张合成卡片；
+                            // 否则来源卡片已在本轮之外，补发一条同 call_id 的终态结果更新那张卡片。
+                            // taskType/subagentType 只在 task_started 事件上，从已登记的任务元数据补齐。
+                            const toParent = started?.projection !== 'synthetic' && !!toolUseId;
+                            renderer.addSubtaskActivity(projectSubtaskTerminal({
+                                taskId: event.taskId,
+                                taskKind: event.taskKind,
+                                description: event.description ?? started?.description,
+                                taskType: started?.taskType,
+                                subagentType: event.subagentType ?? started?.subagentType,
+                                toolUseId,
+                                ...terminal,
+                                ...(toParent ? { callId: toolUseId, toolName: renderer.toolNameForCall(toolUseId) } : {}),
+                            }));
+                        }
                     }
                     continue;
                 }
@@ -6224,21 +7033,30 @@ export class ResponseEngine {
                 if (!isCurrentlyBackground) {
                     // 流式文本
                     if (event.type === 'text') {
-                        // 网关偶尔会把上下文超限错误伪装成普通 text event。不要向事件总线或
-                        // 渲染器投影错误行；lastReplyText 仍保留原文本，以便流结束后触发恢复。
-                        const visibleText = stripContextLimitErrorLines(event.text);
-                        if (visibleText) {
-                            hasReceivedText = true;
-                            if (visibleText.trim())
-                                madeProgress = true;
-                        }
-                        lastReplyText += event.text;
-                        if (visibleText) {
-                            this.eventBus.publish({ type: 'message:text', sessionId: session.id, text: visibleText, isFinal: false });
+                        // 上游合成错误帧（Claude Code 的 `<synthetic>` assistant）会把 API/传输故障的
+                        // 错误原文当成正文送进来。这段字是诊断回显，不是模型正文——出身由 runner 标注，
+                        // 不靠字符串或计数猜。不进入正文通道（lastReplyText / hasReceivedText / 投影），
+                        // 只单独留存，供终态错误分支取用。
+                        if (event.synthetic) {
+                            syntheticDiagnosticText = event.text;
                         }
-                        if (visibleText && !shouldSuppress()) {
-                            await renderer.addText(visibleText, event.outputTokens, event.turn, event.assistantUuid, event.phase);
-                            hasProjectedCurrentReplyText = true;
+                        else {
+                            // 网关偶尔会把上下文超限错误伪装成普通 text event。不要向事件总线或
+                            // 渲染器投影错误行；lastReplyText 仍保留原文本，以便流结束后触发恢复。
+                            const visibleText = stripContextLimitErrorLines(event.text);
+                            if (visibleText) {
+                                hasReceivedText = true;
+                                if (visibleText.trim())
+                                    madeProgress = true;
+                            }
+                            lastReplyText += event.text;
+                            if (visibleText) {
+                                this.eventBus.publish({ type: 'message:text', sessionId: session.id, text: visibleText, isFinal: false });
+                            }
+                            if (visibleText && !shouldSuppress()) {
+                                await renderer.addText(visibleText, event.outputTokens, event.turn, event.assistantUuid, event.phase);
+                                hasProjectedCurrentReplyText = true;
+                            }
                         }
                     }
                     // compact 完成
@@ -6330,6 +7148,7 @@ export class ResponseEngine {
                                 state: modeHooks.state,
                                 sessionState: modeHooks.sessionState,
                                 turn: turnLease,
+                                modelTurn: typeof event.turn === 'number' ? event.turn : undefined,
                                 toolName: event.name,
                                 toolInput: event.input || {},
                                 injectToModel: (text) => { agent.injectUserMessage?.(session.id, text); },
@@ -6344,7 +7163,7 @@ export class ResponseEngine {
                                     });
                                 },
                                 getQueueLength: () => this.messageQueue?.getQueueLength(session.id) ?? 0,
-                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID),
+                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID) || isThreadRoutedSendForSelf(toolName, toolInput, proactiveSelfAid || session.selfAID),
                                 logger,
                             });
                         }
@@ -6464,21 +7283,20 @@ export class ResponseEngine {
                                     });
                                 },
                                 getQueueLength: () => this.messageQueue?.getQueueLength(session.id) ?? 0,
-                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID),
+                                isSendCommand: (toolName, toolInput) => isExactEvolcoreSendCommandForSession(toolName, toolInput, session.channelId, proactiveState?.chatType === 'group' ? 'group' : 'private', proactiveSelfAid || session.selfAID) || isThreadRoutedSendForSelf(toolName, toolInput, proactiveSelfAid || session.selfAID),
                                 logger,
                             });
                         }
                         // 从 tool_use 阶段缓存的描述中回溯
                         const cachedDesc = event.callId ? toolDescByCallId.get(event.callId) : undefined;
-                        if (event.isError && !shouldSuppress()) {
+                        const toolResultFailed = isToolResultFailure(event);
+                        if (toolResultFailed && !shouldSuppress()) {
                             hasErrorResult = true;
-                            let errorMsg = event.error || (typeof event.result === 'string' ? event.result : JSON.stringify(event.result)) || '\u6267\u884c\u5931\u8d25';
-                            // 移除 XML 风格的错误标签
-                            errorMsg = errorMsg.replace(/<tool_use_error>(.*?)<\/tool_use_error>/gs, '$1');
-                            renderer.addToolResult(event.name || '\u5de5\u5177', false, undefined, errorMsg, event.callId, event.durationMs, cachedDesc, event, event.assistantUuid);
+                            const errorMsg = getToolResultErrorText(event) + diagnosticSuffix;
+                            renderer.addToolResult(event.name || '\u5de5\u5177', false, event.result, errorMsg, event.callId, event.durationMs, cachedDesc, event, event.assistantUuid);
                         }
-                        else if (!event.isError && !shouldSuppress()) {
-                            renderer.addToolResult(event.name || '\u5de5\u5177', true, event.result, undefined, event.callId, event.durationMs, cachedDesc, undefined, event.assistantUuid);
+                        else if (!toolResultFailed && !shouldSuppress()) {
+                            renderer.addToolResult(event.name || '\u5de5\u5177', true, event.result, undefined, event.callId, event.durationMs, cachedDesc, event, event.assistantUuid);
                         }
                     }
                     // 非终态运行时告警走 status notify，不进入 activity/thought 历史。
@@ -6502,6 +7320,7 @@ export class ResponseEngine {
                             errors: [event.error],
                             lastReplyText,
                             fullText: '',
+                            syntheticDiagnosticText,
                         };
                     }
                     // 完成事件
@@ -6516,7 +7335,7 @@ export class ResponseEngine {
                             logger.info(`[ResponseEngine] Auto-filled session name: ${event.sessionTitle}`);
                         }
                         // 记录完成状态 + 最后一轮回复文本（后续 complete 覆盖前序）
-                        completeResult = { isError: !!event.isError, subtype: event.subtype, errors: event.errors, terminalReason: event.terminalReason, lastReplyText, fullText: event.result || '', hasReceivedText, numTurns: event.numTurns, ttftMs: event.ttftMs, model: event.model, tokenUsage: event.tokenUsage, contextUsage: event.contextUsage, lastModelCall: event.lastModelCall, modelCalls: event.modelCalls };
+                        completeResult = { isError: !!event.isError, subtype: event.subtype, errors: event.errors, terminalReason: event.terminalReason, lastReplyText, fullText: event.result || '', hasReceivedText, numTurns: event.numTurns, ttftMs: event.ttftMs, model: event.model, tokenUsage: event.tokenUsage, contextUsage: event.contextUsage, lastModelCall: event.lastModelCall, modelCalls: event.modelCalls, syntheticDiagnosticText };
                         if (!event.isError)
                             madeProgress = true;
                         // thought jsonl 写入已下沉到 aun.ts:sendThought 成功后，
@@ -6567,7 +7386,7 @@ export class ResponseEngine {
                     logger.info(`[ResponseEngine] Auto-filled session name: ${event.sessionTitle}`);
                 }
                 // 记录完成状态
-                completeResult = { isError: !!event.isError, subtype: event.subtype, errors: event.errors, terminalReason: event.terminalReason, lastReplyText, fullText: event.result || '', hasReceivedText, numTurns: event.numTurns, ttftMs: event.ttftMs, model: event.model, tokenUsage: event.tokenUsage, contextUsage: event.contextUsage, lastModelCall: event.lastModelCall };
+                completeResult = { isError: !!event.isError, subtype: event.subtype, errors: event.errors, terminalReason: event.terminalReason, lastReplyText, fullText: event.result || '', hasReceivedText, syntheticDiagnosticText, numTurns: event.numTurns, ttftMs: event.ttftMs, model: event.model, tokenUsage: event.tokenUsage, contextUsage: event.contextUsage, lastModelCall: event.lastModelCall };
                 if (event.subtype === 'success')
                     madeProgress = true;
             }