evolcore 0.0.32 → 0.0.34

package/dist/agents/codex-runner.js

@@ -1,9 +1,10 @@
 import { getRunnerCatalog, catalogEfforts, assertCatalogSelectable } from '../core/model/model-catalog.js';
 // Codex/OpenAI API 不认识 Claude Code SDK 的窗口后缀，必须传入基础模型 ID。
-import { stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
+import { parseModelId, stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
 import { formatAsyncQuestionAnswer, hasTrustedFullAccessContext, parseAsyncUserQuestions, unsettledInterruptError, withInterruptDeadline } from './runner-types.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
+import { isShellToolName } from '../core/permission/tool-canonical.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { assertWindowsCodexFilesystemRuleBudget, buildCodexProtectedFilesystemRules, getExistingRelationAttachmentDirs, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
 import { CODEX_THREAD_ACTIVE_WRITER, CodexAppServerClient, } from './codex/app-server-client.js';
@@ -11,7 +12,7 @@ import { resolveOpenaiConfig, resolveCodexCliPath, resolveCodexPowerShellShimPat
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { auditCodexApprovalDecision, auditPermissionLifecycle, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
-import { classifyError, ErrorType, isOutputTokenLimitError, isRetryableError } from '../utils/error-utils.js';
+import { classifyError, ErrorType, getToolResultErrorText, isOutputTokenLimitError, isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
@@ -20,6 +21,7 @@ import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-envi
 import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, containsUnresolvedManagedTmpDirReference, hasCodexCmdCarrierEcIntent, hasPowerShellCredentialAssignment, normalizeEvolcoreCommandArgv, canonicalizeEvolcoreCommandArgv, parseCodexToolCommand, parseCodexCarrierCommand, parseLiteralShellCommand, parseCodexShellCommandArgv, resolveCodexShellCarrierArgv, parseShellApplyPatchInvocation, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { agentCodexTokenPath, resolvePaths, resolveRoot } from '../paths.js';
+import { findModelSpec } from '../stats/billing.js';
 import { ensureSessionRuntimeDir, getManagedTaskTempDir } from '../cli/task-context.js';
 import { buildTranscriptTurns } from '../core/session/session-transcript.js';
 import { CodexSessionFileAdapter } from '../core/session/adapters/codex-session-file-adapter.js';
@@ -128,6 +130,24 @@ function codexItemErrorFields(item) {
     const errorDetailCode = normalizeToolErrorDetailCode(rawCode);
     return errorDetailCode ? { errorDetailCode } : {};
 }
+function waitForCodexOperation(operation, signal) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            signal.removeEventListener('abort', onAbort);
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        operation.then(value => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, error => {
+            signal.removeEventListener('abort', onAbort);
+            reject(error);
+        });
+        if (signal.aborted)
+            onAbort();
+    });
+}
 function isCodexReasoningNotification(method) {
     return method === 'item/reasoning/textDelta'
         || method === 'item/reasoning/summaryTextDelta'
@@ -177,10 +197,10 @@ function parseManagedPreToolUseDenial(value) {
         reason = 'EvolCore PreToolUse policy denied this tool call';
     const policyCode = /当前汇报命令(?:未通过规范解析|不符合当前会话)/.test(reason)
         ? 'proactive_send_invalid'
-        : /工具调用已达到\s*\d+\s*次/.test(reason)
-            ? 'proactive_tool_report_required'
-            : /请先用\s+ec\s+(?:group\s+send|msg\s+send)/.test(reason)
-                ? 'proactive_first_send_required'
+        : /连续违规\s*\d+\s*次，任务已中断/.test(reason)
+            ? 'proactive_circuit_break'
+            : /未包含意图表达，本轮只允许\s+ec\s+(?:group\s+send|msg\s+send)/.test(reason)
+                ? 'proactive_intent_required'
                 : 'managed_pre_tool_use_denied';
     return { policyCode, reason };
 }
@@ -335,6 +355,11 @@ export async function getCodexAppServerAvailabilityAsync() {
     }
     let version;
     try {
+        // Each probe is a full Codex CLI launch (~0.3-0.45s on Windows). Run the
+        // app-server probe concurrently; its result is only consulted after the
+        // version gate passes, so the decision order is unchanged.
+        const appServerProbe = probeCli('codex', ['app-server', '--help'], options);
+        appServerProbe.catch(() => { });
         version = parseCodexCliVersion(await probeCli('codex', ['--version'], options)) ?? undefined;
         if (!version)
             return { available: false, reason: '无法读取 Codex CLI 版本。' };
@@ -342,7 +367,7 @@ export async function getCodexAppServerAvailabilityAsync() {
             return { available: false, version, requiresUpgrade: true,
                 reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。请升级 Codex CLI：npm install -g @openai/codex@latest` };
         }
-        await probeCli('codex', ['app-server', '--help'], options);
+        await appServerProbe;
         return { available: true, version };
     }
     catch (error) {
@@ -359,6 +384,7 @@ export class CodexRunner {
     retryInputSemantics = 'at_most_once';
     capabilities;
     model;
+    modelContextId;
     effort;
     activeAbortControllers = new Map();
     activeStreams = new Map();
@@ -378,6 +404,7 @@ export class CodexRunner {
     unconfirmedInterrupts = new Map();
     steeringTails = new Map();
     threadOperationLocks = new Map();
+    queryOperations = new Map();
     activeOperationReleases = new Map();
     /** Last app-server client that loaded each thread, including unsubscribed threads. */
     threadSubscriptions = new Map();
@@ -431,7 +458,8 @@ export class CodexRunner {
             fileRewind: 'git-head',
             fullaccess: true,
         };
-        this.model = stripContextWindowSuffix(this.resolvedConfig.model);
+        this.modelContextId = this.resolvedConfig.model;
+        this.model = stripContextWindowSuffix(this.modelContextId);
         if (this.resolvedConfig.effort)
             this.effort = this.resolvedConfig.effort;
         this.onSessionIdUpdate = callbacks.onSessionIdUpdate;
@@ -1179,7 +1207,11 @@ export class CodexRunner {
         }
     }
     // ── ModelSwitcher ──
-    setModel(model) { this.model = stripContextWindowSuffix(model); this.resetAppServerClient(); }
+    setModel(model) {
+        this.modelContextId = model;
+        this.model = stripContextWindowSuffix(model);
+        this.resetAppServerClient();
+    }
     getModel() { return this.model; }
     getModelCatalog() {
         return getRunnerCatalog('codex', this.resolvedConfig.agentAid, this.resolvedConfig);
@@ -1222,6 +1254,16 @@ export class CodexRunner {
         const digest = createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
         return `__evolcore_${label}_${digest}_hclass_v1`;
     }
+    /**
+     * 系统会话的写入洞：只对模块声明的可写文件逐个开 write 规则，不开目录、不开 glob。
+     * 声明为空（缺批次目录等）时返回空表，沙箱保持 :read-only。
+     */
+    resolveSystemSessionWriteRules(sessionId) {
+        const writeFiles = this.permissionContexts.get(sessionId)?.systemSessionGrants?.writeFiles ?? [];
+        return Object.fromEntries(writeFiles
+            .filter(file => path.isAbsolute(file))
+            .map(file => [path.resolve(file), 'write']));
+    }
     resolveGitMetadataWriteRules(projectPath, mode) {
         if (mode === 'readonly')
             return {};
@@ -1298,6 +1340,7 @@ export class CodexRunner {
                 expandLClassReadDeny: process.platform !== 'linux',
             }),
             ...this.resolveGitMetadataWriteRules(projectPath, mode),
+            ...this.resolveSystemSessionWriteRules(sessionId),
             ...(bootstrapAgentMdPath ? {
                 [path.resolve(bootstrapAgentMdPath)]: mode === 'readonly' ? 'read' : 'write',
             } : {}),
@@ -1330,12 +1373,18 @@ export class CodexRunner {
     }
     buildExecutionSandboxOptions(sessionId, mode, projectPath, bootstrapAgentMdPath, personalMdPath, permissionContext = this.permissionContexts.get(sessionId) ?? {}) {
         const decision = resolvePhaseOneExecutionSandbox(mode, permissionContext.role);
+        // 系统会话明确声明不要沙箱：Codex 的 permission profile 以项目目录为中心，
+        // 而系统会话的读写边界（$EVOLCORE_HOME 下的批次目录与记忆目录）与 cwd 无关，
+        // 硬套 profile 只会 fail closed。边界改由 systemSessionCheck 逐次调用判定。
+        const sessionSandboxOff = this.permissionContexts.get(sessionId)?.systemSessionSandbox === 'off';
+        const sandboxOff = decision.state === 'off' || sessionSandboxOff;
         return {
             decision,
-            permissionProfileConfig: decision.state === 'active'
-                ? this.buildPermissionProfileConfig(sessionId, decision.permissionMode, projectPath, bootstrapAgentMdPath, personalMdPath)
-                : undefined,
-            sandbox: decision.state === 'off' ? 'danger-full-access' : undefined,
+            permissionProfileConfig: sandboxOff
+                ? undefined
+                : this.buildPermissionProfileConfig(sessionId, decision.permissionMode, projectPath, bootstrapAgentMdPath, personalMdPath),
+            sandbox: sandboxOff ? 'danger-full-access' : undefined,
+            sessionSandboxOff,
         };
     }
     isTrustedFullAccessSession(sessionKey) {
@@ -1465,7 +1514,7 @@ export class CodexRunner {
         const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
             ? toolInput
             : {};
-        const isShellTool = toolName === 'Bash' || toolName === 'Shell' || toolName === 'exec_command';
+        const isShellTool = isShellToolName(toolName); // canonical normalisation via tool-canonical.ts
         const recordPreToolUseDenial = async (policyCode, reason) => {
             const summary = summarizeToolInputForAudit(toolName, normalizedInput).slice(0, 512);
             auditToolPreflightDenial({
@@ -1533,6 +1582,14 @@ export class CodexRunner {
                 return { ok: true, applicable: true, decision: 'deny', reason };
             }
         }
+        // 系统会话：模块判定即最终结论，不进入 preflight / 角色 / permissionMode 分支
+        if (context.systemSessionCheck) {
+            const decision = context.systemSessionCheck(isShellTool ? 'Bash' : toolName, normalizedInput);
+            if (decision.allow)
+                return { ok: true, applicable: true, decision: 'allow' };
+            await recordPreToolUseDenial(decision.code, decision.reason);
+            return { ok: true, applicable: true, decision: 'deny', reason: decision.reason };
+        }
         if ((this.chatModes.get(sessionKey) ?? this.currentMode) === 'fullaccess') {
             if (this.isTrustedFullAccessSession(sessionKey))
                 return { ok: true, applicable: true, decision: 'allow' };
@@ -1623,6 +1680,19 @@ export class CodexRunner {
     hasActiveStream(key) {
         return this.activeStreams.has(key) || this.activeAbortControllers.has(key) || this.activeTurns.has(key);
     }
+    hasActiveOperation(sessionId, taskId) {
+        const operations = this.queryOperations.get(sessionId);
+        return !!operations && [...operations].some(operation => !taskId || operation.taskId === taskId);
+    }
+    cancelQueuedTurn(sessionId, identity) {
+        const operation = [...(this.queryOperations.get(sessionId) ?? [])].find(candidate => !candidate.lockAcquired
+            && candidate.taskId === identity.taskId
+            && candidate.generation === identity.generation);
+        if (!operation)
+            return false;
+        operation.controller.abort(Object.assign(new Error('Codex queued operation cancelled'), { name: 'AbortError' }));
+        return true;
+    }
     threadOperationKey(threadId, sessionId) {
         // Once a thread id is known it is the shared identity, including when
         // multiple EvolCore sessions happen to address the same Codex thread.
@@ -1659,6 +1729,7 @@ export class CodexRunner {
                 merged.then(() => {
                     if (primary.tail === merged)
                         primary.tail = undefined;
+                    this.pruneThreadOperationLocks();
                 });
             }
             for (const alias of other.aliases) {
@@ -1694,7 +1765,8 @@ export class CodexRunner {
             lock.aliases.delete(key);
         }
     }
-    async acquireThreadOperation(key, operation) {
+    async acquireThreadOperation(key, operation, signal) {
+        signal?.throwIfAborted();
         const lock = this.getThreadOperationLock(key);
         const previous = lock.tail;
         let releaseCurrent;
@@ -1702,12 +1774,8 @@ export class CodexRunner {
             releaseCurrent = resolve;
         });
         lock.tail = current;
-        if (previous) {
-            logger.info(`[CodexRunner] queued ${operation} behind an active operation: ${key}`);
-            await previous;
-        }
         let released = false;
-        return () => {
+        const release = () => {
             if (released)
                 return;
             released = true;
@@ -1716,6 +1784,21 @@ export class CodexRunner {
             releaseCurrent();
             this.pruneThreadOperationLocks();
         };
+        try {
+            if (previous) {
+                logger.info(`[CodexRunner] queued ${operation} behind an active operation: ${key}`);
+                await (signal ? waitForCodexOperation(previous, signal) : previous);
+            }
+            signal?.throwIfAborted();
+            return release;
+        }
+        catch (error) {
+            if (signal?.aborted && previous)
+                void previous.then(release);
+            else
+                release();
+            throw error;
+        }
     }
     async *holdThreadOperation(stream, sessionId, release) {
         try {
@@ -1747,11 +1830,29 @@ export class CodexRunner {
             ? this.cachedThreadForTopic(sessionId, topicAgentSessionId)
             : initialAgentSessionId || this.activeSessions.get(sessionId);
         const operationKey = this.threadOperationKey(modelOverride?.recovery?.agentSessionId || knownThreadId, sessionId);
-        await this.assertInterruptSettled(sessionId, modelOverride?.recovery?.agentSessionId || knownThreadId);
-        const release = await this.acquireThreadOperation(operationKey, 'thread/resume+turn/start');
+        const operation = {
+            controller: new AbortController(),
+            taskId: modelOverride?.turn?.taskId ?? this.permissionContexts.get(sessionId)?.taskId,
+            generation: modelOverride?.turn?.generation,
+            lockAcquired: false,
+        };
+        const operations = this.queryOperations.get(sessionId) ?? new Set();
+        operations.add(operation);
+        this.queryOperations.set(sessionId, operations);
+        let releaseLock;
+        const release = () => {
+            operations.delete(operation);
+            if (this.queryOperations.get(sessionId) === operations && operations.size === 0) {
+                this.queryOperations.delete(sessionId);
+            }
+            releaseLock?.();
+        };
         try {
-            await this.assertInterruptSettled(sessionId, modelOverride?.recovery?.agentSessionId || knownThreadId);
-            const stream = await this.runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv);
+            await waitForCodexOperation(this.assertInterruptSettled(sessionId, modelOverride?.recovery?.agentSessionId || knownThreadId), operation.controller.signal);
+            releaseLock = await this.acquireThreadOperation(operationKey, 'thread/resume+turn/start', operation.controller.signal);
+            operation.lockAcquired = true;
+            await waitForCodexOperation(this.assertInterruptSettled(sessionId, modelOverride?.recovery?.agentSessionId || knownThreadId), operation.controller.signal);
+            const stream = await this.runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv, operation.controller);
             this.activeOperationReleases.set(sessionId, release);
             return this.holdThreadOperation(stream, sessionId, release);
         }
@@ -1760,7 +1861,7 @@ export class CodexRunner {
             throw error;
         }
     }
-    async runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
+    async runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv, operationController) {
         // A daemon-managed task must never fall back to the app-server's
         // process-wide TMPDIR if its session namespace disappeared.
         getManagedTaskTempDir(runtimeEnv);
@@ -1789,7 +1890,8 @@ export class CodexRunner {
         }
         await this.assertInterruptSettled(sessionId, agentSessionId);
         let resumingThread = !!agentSessionId;
-        const callModel = stripContextWindowSuffix(modelOverride?.model || this.model);
+        const modelContextId = modelOverride?.model || this.modelContextId;
+        const callModel = stripContextWindowSuffix(modelContextId);
         const callEffort = modelOverride?.effortMode === 'model_default'
             ? undefined
             : modelOverride?.effort ?? this.effort;
@@ -1901,6 +2003,7 @@ export class CodexRunner {
         if (!resumingThread && this.ensureThreadCredential(threadId, threadSessionToken) !== threadSessionToken) {
             throw new Error('Codex thread session credential could not be bound');
         }
+        this.permissionContexts.get(sessionId)?.bindSessionCredential?.(threadSessionToken, threadId);
         const turn = modelOverride?.turn;
         if (!resumingThread) {
             // Keep a newly-created backend private to this runner until turn/start
@@ -1930,7 +2033,7 @@ export class CodexRunner {
         }
         this.threadProjectPaths.set(threadId, path.resolve(projectPath));
         this.bindExternalToolBoundary(threadId, externalToolConfig);
-        const controller = new AbortController();
+        const controller = operationController ?? new AbortController();
         this.activeAbortControllers.set(sessionId, controller);
         const answer = modelOverride?.asyncQuestionAnswer;
         if (answer && answer.providerThreadId !== threadId) {
@@ -1944,6 +2047,7 @@ export class CodexRunner {
             sessionId,
             projectPath,
             model: callModel,
+            modelContextId,
             committed: resumingThread,
             persistenceFinalized: resumingThread,
             streamedAgentMessageIds: new Set(),
@@ -1957,6 +2061,11 @@ export class CodexRunner {
             inputId: turn?.inputId,
             inputAcceptedEmitted: false,
         };
+        let startupInterrupt;
+        const interruptStartedTurn = (turnId) => {
+            startupInterrupt ??= this.interruptAppServerTurn(threadId, turnId);
+            return startupInterrupt;
+        };
         const unsubscribe = appServer.onNotification(notification => {
             // 仅从 turn/started 锁定权威 turnId — resume 时会有上一轮 turn 的残留通知
             // （如 thread/tokenUsage/updated）先于新 turn 到达，不能用它们 latch turnId
@@ -2000,8 +2109,8 @@ export class CodexRunner {
                 if (startedTurnId && !state.turnId) {
                     state.turnId = startedTurnId;
                     this.activeTurns.set(sessionId, { threadId, turnId: startedTurnId });
-                    if (this.consumePendingInterrupt(sessionId)) {
-                        this.interruptAppServerTurn(threadId, startedTurnId).catch(() => { });
+                    if (controller.signal.aborted || this.consumePendingInterrupt(sessionId)) {
+                        void interruptStartedTurn(startedTurnId);
                         this.activeTurns.delete(sessionId);
                     }
                 }
@@ -2018,8 +2127,9 @@ export class CodexRunner {
                 this.endAppServerQueueWhenSubagentsDone(queue, state);
             }
         });
-        if (this.consumePendingInterrupt(sessionId)) {
+        if (controller.signal.aborted || this.consumePendingInterrupt(sessionId)) {
             controller.abort('User interrupt');
+            queue.end();
             this.activeAbortControllers.delete(sessionId);
             this.activeStreams.delete(sessionId);
             if (!resumingThread)
@@ -2086,8 +2196,10 @@ export class CodexRunner {
                 // the short settle window below.
                 await state.confirmProvisional?.(0);
             }
-            if (turnId && this.consumePendingInterrupt(sessionId)) {
-                await this.interruptAppServerTurn(threadId, turnId);
+            if (turnId && (controller.signal.aborted || this.consumePendingInterrupt(sessionId))) {
+                if (!state.turnCompleted && !['completed', 'failed', 'interrupted'].includes(turnResponse.turn?.status)) {
+                    await interruptStartedTurn(turnId);
+                }
                 controller.abort('User interrupt');
                 this.activeAbortControllers.delete(sessionId);
                 this.activeStreams.delete(sessionId);
@@ -2116,14 +2228,21 @@ export class CodexRunner {
     // ── Interrupt ──
     async interrupt(sessionKey) {
         this.permissionContexts.get(sessionKey)?.pauseController?.cancel();
+        const operations = this.queryOperations.get(sessionKey);
+        for (const operation of operations ?? []) {
+            if (operation.lockAcquired) {
+                operation.controller.abort(Object.assign(new Error('Codex operation interrupted'), { name: 'AbortError' }));
+            }
+        }
         const controller = this.activeAbortControllers.get(sessionKey);
         const activeTurn = this.activeTurns.get(sessionKey);
-        const hadActiveState = !!controller || !!activeTurn || this.activeStreams.has(sessionKey);
+        const hadActiveState = !!controller || !!activeTurn || this.activeStreams.has(sessionKey)
+            || [...(operations ?? [])].some(operation => operation.lockAcquired);
         const interruptTurn = activeTurn
             ? this.interruptAppServerTurn(activeTurn.threadId, activeTurn.turnId)
             : Promise.resolve();
         const interruptSubagents = this.interruptSubagentTurns(sessionKey);
-        if (!activeTurn)
+        if (!activeTurn && !operations?.size)
             this.rememberPendingInterrupt(sessionKey);
         if (controller)
             controller.abort('User interrupt');
@@ -2206,12 +2325,21 @@ export class CodexRunner {
         const pending = [...this.unconfirmedInterrupts.entries()].filter(([, record]) => record.sessionId === sessionId || (threadId && record.threadId === threadId));
         await Promise.all(pending.map(async ([key, record]) => {
             try {
-                // Local stream closure and unsubscribe do not prove the backend turn
-                // stopped. Check its exact identity before allowing another writer.
-                const response = await withInterruptDeadline(record.client.threadRead(record.threadId, true, 2_000), 'Codex interrupt verification', 2_000);
-                const turn = response.thread?.turns?.find(turn => turn.id === record.turnId);
+                const response = await withInterruptDeadline(record.client.threadRead(record.threadId, false, 2_000), 'Codex interrupt verification', 2_000);
+                const threadStatus = response.thread?.status?.type;
+                if (threadStatus === 'idle' || threadStatus === 'notLoaded') {
+                    if (this.unconfirmedInterrupts.get(key) === record) {
+                        this.unconfirmedInterrupts.delete(key);
+                        record.unsubscribe?.();
+                    }
+                    return;
+                }
+                if (threadStatus !== undefined)
+                    return;
+                const history = await withInterruptDeadline(record.client.threadRead(record.threadId, true, 2_000), 'Codex interrupt history verification', 2_000);
+                const turn = history.thread?.turns?.find(turn => turn.id === record.turnId);
                 if (turn && ['completed', 'failed', 'interrupted'].includes(String(turn.status))
-                    && !response.thread?.turns?.some(turn => turn.status === 'inProgress')
+                    && !history.thread?.turns?.some(turn => turn.status === 'inProgress')
                     && this.unconfirmedInterrupts.get(key) === record) {
                     this.unconfirmedInterrupts.delete(key);
                     record.unsubscribe?.();
@@ -3219,7 +3347,7 @@ export class CodexRunner {
             return await denyInfrastructure('ec_command_not_canonical', canonicalEcApproval?.parseFailure
                 ? `EC command approval denied because canonical argv parsing failed (${canonicalEcApproval.parseFailure.issue})`
                     + (canonicalEcApproval.parseFailure.dialect === 'powershell' && canonicalEcApproval.parseFailure.issue === 'invalid-quote'
-                        ? '. PowerShell treats smart quotes as delimiters too; escape quotes for PowerShell or use --text-from-file for message text.'
+                        ? '. PowerShell treats U+2018/U+2019/U+201A/U+201B as quote delimiters too. An EC inline text argument must be ASCII single-quoted; replace any character inside it that looks like a quote with U+02BC or U+FF07, or write the text to the session TMPDIR and pass it with --text-from-file.'
                         : '')
                 : 'EC command approval denied because no canonical argv could be derived', canonicalEcApproval?.parseFailure?.issue === 'invalid-quote' ? 'INVALID_QUOTE' : undefined);
         }
@@ -3542,15 +3670,18 @@ export class CodexRunner {
             ...(trackedItem.appContext && typeof trackedItem.appContext === 'object' ? { appContext: trackedItem.appContext } : {}),
         };
         const policyResult = this.permissionContexts.get(sessionKey)?.policyHook?.(toolName, toolInput);
+        const systemSessionCheck = this.permissionContexts.get(sessionKey)?.systemSessionCheck;
         const workspacePath = this.resolvePermissionWorkspacePath(params);
         const mode = normalizeExecutionPermissionMode(this.chatModes.get(sessionKey) ?? this.currentMode);
         // MCP servers are inherited unless capability config explicitly disables
         // them. Apps retain their separate request/bypass lifecycle policy.
-        let allow = !policyResult?.block
-            && !!workspacePath
-            && (isAppCall
-                ? mode === 'request' || mode === 'bypass'
-                : mode !== 'readonly');
+        let allow = systemSessionCheck
+            ? systemSessionCheck(toolName, toolInput).allow
+            : !policyResult?.block
+                && !!workspacePath
+                && (isAppCall
+                    ? mode === 'request' || mode === 'bypass'
+                    : mode !== 'readonly');
         if (allow) {
             try {
                 for (const question of questions)
@@ -3838,6 +3969,7 @@ export class CodexRunner {
             // readonly decision. The map entry alone is stale if the directory was
             // replaced between preflight and the approval callback.
             managedTempDir: permCtx?.managedTempDir ?? this.getManagedTempDir(sessionKey),
+            grantedReadRoots: permCtx?.grantedReadRoots,
             allowReadonlySourceDiagnostics: permCtx?.allowReadonlySourceDiagnostics === true,
         } : undefined;
         if (toolName === 'Bash')
@@ -3934,6 +4066,13 @@ export class CodexRunner {
     }
     async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId, callId) {
         const permissionContext = this.permissionContexts.get(sessionKey);
+        // 系统会话：审批路径同样只看模块判定（FileChange / PermissionGrant 一律被模块拒绝）
+        if (permissionContext?.systemSessionCheck) {
+            const decision = permissionContext.systemSessionCheck(toolName, toolInput);
+            return decision.allow
+                ? 'allow'
+                : { decision: 'deny', decisionSource: 'policy', policyCode: decision.code, reason: decision.reason };
+        }
         const permissionPrompt = permissionContext?.sendPrompt ?? this.sendPromptFn;
         const hasFilesystemPermissions = (toolName === 'Bash' || toolName === 'PermissionGrant')
             && this.hasFilesystemPermissionRequest(toolInput);
@@ -4336,15 +4475,37 @@ export class CodexRunner {
         let input;
         let result;
         let isError = false;
+        let executionFields = {};
         switch (type) {
-            case 'commandExecution':
+            case 'commandExecution': {
                 name = 'Shell';
                 input = { command: item.command, cwd: item.cwd };
                 result = item.aggregatedOutput ?? item.output ?? '';
                 isError = item.exitCode != null
                     ? Number(item.exitCode) !== 0
                     : item.status === 'failed' || item.status === 'declined';
+                const exitCode = typeof item.exitCode === 'number' && Number.isInteger(item.exitCode)
+                    ? item.exitCode
+                    : undefined;
+                const itemError = item.error;
+                const errorMessage = typeof itemError === 'string'
+                    ? itemError
+                    : itemError && typeof itemError === 'object' && 'message' in itemError
+                        && typeof itemError.message === 'string' ? itemError.message : undefined;
+                executionFields = {
+                    ...(exitCode !== undefined ? { exit_code: exitCode } : {}),
+                    ...(item.aggregatedOutput != null ? { output_kind: 'combined' } : {}),
+                    ...(typeof item.durationMs === 'number' ? { duration_ms: item.durationMs } : {}),
+                    ...(isError ? {
+                        error: getToolResultErrorText({
+                            name, result, exitCode,
+                            error: errorMessage,
+                            reason: item.status === 'declined' ? 'Approval declined' : undefined,
+                        }),
+                    } : {}),
+                };
                 break;
+            }
             case 'mcpToolCall':
                 name = `MCP:${item.server}/${item.tool}`;
                 input = item.arguments;
@@ -4405,6 +4566,7 @@ export class CodexRunner {
                 ...(id ? { tool_use_id: id } : {}),
                 content: result,
                 is_error: isError,
+                ...executionFields,
             },
         ];
     }
@@ -4965,17 +5127,12 @@ export class CodexRunner {
             }
             : undefined;
         const itemErrorText = outputTextForManagedHook(typeof item.error === 'string' ? item.error : item.error?.message);
-        const hookErrorText = /(?:Command|Tool call) blocked by PreToolUse hook\s*:/i.test(itemErrorText)
-            ? itemErrorText
-            : undefined;
-        const managedHookDenial = (item.status === 'failed' || item.status === 'declined' || hookErrorText)
-            ? parseManagedPreToolUseDenial([
-                item.aggregatedOutput,
-                item.output,
-                item.result,
-                hookErrorText,
-            ].filter(value => value !== undefined && value !== null).map(outputTextForManagedHook).join('\n'))
+        const hookOutput = item.type === 'commandExecution' && item.exitCode == null && !itemErrorText
+            && (item.status === 'failed' || item.status === 'declined')
+            ? [item.aggregatedOutput, item.output, item.result].map(outputTextForManagedHook).find(text => /^\s*(?:Script failed\s+)?(?:Script error:\s*)?(?:Command|Tool call) blocked by PreToolUse hook\s*:/i.test(text))
             : undefined;
+        const managedHookDenial = parseManagedPreToolUseDenial(itemErrorText)
+            ?? parseManagedPreToolUseDenial(hookOutput);
         const managedHookFields = !denial && managedHookDenial
             ? {
                 isError: true,
@@ -5056,9 +5213,11 @@ export class CodexRunner {
                         type: 'tool_result',
                         name: 'Shell',
                         result: item.aggregatedOutput ?? '',
+                        ...(item.aggregatedOutput != null ? { outputKind: 'combined' } : {}),
                         ...(blockedFields ?? {
                             isError,
                             ...codexItemErrorFields(item),
+                            ...(itemErrorText ? { error: itemErrorText } : {}),
                             executed: true,
                             executionState: isError ? 'failed' : 'completed',
                             ...(exitCode !== undefined ? { exitCode } : {}),
@@ -5294,15 +5453,29 @@ export class CodexRunner {
         };
         return Object.values(usage).some(value => value !== undefined) ? usage : undefined;
     }
-    mapCodexContextUsage(raw) {
+    mapCodexContextUsage(raw, fallbackModel, runtimeWindow) {
         if (!raw || typeof raw !== 'object')
             return undefined;
-        const totalTokens = this.pickNumber(raw.totalTokens, raw.total_tokens, raw.total);
-        const maxTokens = this.pickNumber(raw.maxTokens, raw.max_tokens, raw.max);
-        const model = typeof raw.model === 'string' ? raw.model : undefined;
-        if (totalTokens === undefined || maxTokens === undefined || !model)
+        const totalTokens = this.pickNumber(raw.totalTokens, raw.total_tokens, raw.total, raw.last?.totalTokens, raw.last?.total_tokens);
+        const rawModel = typeof raw.model === 'string' && raw.model.trim() ? raw.model : undefined;
+        const fallbackWindow = fallbackModel ? parseModelId(fallbackModel).contextWindow : undefined;
+        const model = fallbackWindow !== undefined ? fallbackModel : rawModel ?? fallbackModel;
+        if (totalTokens === undefined || totalTokens < 0 || !model)
+            return undefined;
+        const reportedMaxTokens = [runtimeWindow, raw.modelContextWindow, raw.model_context_window, raw.maxTokens, raw.max_tokens, raw.max]
+            .find(value => typeof value === 'number' && Number.isFinite(value) && value > 0);
+        const suffixWindow = parseModelId(model).contextWindow;
+        const maxTokens = reportedMaxTokens ?? suffixWindow ?? findModelSpec(resolveRoot(), model)?.context_window;
+        if (maxTokens === undefined || !Number.isFinite(maxTokens) || maxTokens <= 0)
             return undefined;
-        const percentage = this.pickNumber(raw.percentage) ?? Math.round((totalTokens / maxTokens) * 100);
+        const nativeWindow = [runtimeWindow, raw.modelContextWindow, raw.model_context_window]
+            .find(value => typeof value === 'number' && Number.isFinite(value) && value > 0);
+        const legacyWindow = [raw.maxTokens, raw.max_tokens, raw.max]
+            .find(value => typeof value === 'number' && Number.isFinite(value) && value > 0);
+        const percentage = (nativeWindow === undefined && (legacyWindow !== undefined || suffixWindow !== undefined)
+            ? this.pickNumber(raw.percentage)
+            : undefined)
+            ?? Math.round((totalTokens / maxTokens) * 100);
         const effort = typeof raw.effort === 'string' ? raw.effort : undefined;
         return { totalTokens, maxTokens, percentage, model, effort };
     }
@@ -5310,7 +5483,12 @@ export class CodexRunner {
         const status = turn.status || 'completed';
         const outputLimit = status === 'failed' && isOutputTokenLimitError(new Error(turn.error?.message ?? ''));
         const tokenUsage = this.mapCodexTokenUsage(state.tokenUsage?.last ?? turn.tokenUsage ?? turn.usage);
-        const contextUsage = this.mapCodexContextUsage(turn.contextUsage ?? state.tokenUsage?.contextUsage ?? state.tokenUsage?.context);
+        const terminalTokenUsage = turn.tokenUsage ?? turn.usage;
+        const contextUsage = this.mapCodexContextUsage({
+            ...state.tokenUsage,
+            ...(terminalTokenUsage && typeof terminalTokenUsage === 'object' ? terminalTokenUsage : {}),
+            ...(turn.contextUsage ?? state.tokenUsage?.contextUsage ?? state.tokenUsage?.context),
+        }, state.modelContextId ?? state.model, this.pickNumber(state.tokenUsage?.modelContextWindow, state.tokenUsage?.model_context_window, terminalTokenUsage?.modelContextWindow, terminalTokenUsage?.model_context_window));
         const terminalReason = status === 'completed'
             ? undefined
             : status === 'interrupted'