evolcore 0.0.33 → 0.0.34

package/dist/core/message/response-engine.js

@@ -3,13 +3,15 @@ import path from 'path';
 import fs from 'fs';
 import os from 'os';
 import crypto from 'crypto';
+import { MAIN_CLI_BIN } from '../../product.js';
 import { BaseagentRunnerUnavailableError, hasCompact, autoCompactWindowForModel, isClaudeContextUsageModel, numericToken, formatAsyncQuestionAnswer, parseAsyncUserQuestions, } from '../../agents/runner-types.js';
 import { loadedBaseagentIds } from '../../agents/baseagent-availability.js';
 import { isDiagnosticSessionActive } from '../command/diag-service.js';
 import { evaluateInboundAdmissionPreflight, evaluateOrdinaryInboundAdmission } from './message-admission.js';
 import { authorizeAccess, authorizeOperation, buildAuthSubject } from '../auth/auth-gateway.js';
 import { buildTaskRuntimeEnv, ensureRuntimeLockDir, ensureSessionRuntimeDir } from '../../cli/task-context.js';
-import { memorySessionPolicyHook } from '../memory/memory-session-policy.js';
+import { BUILTIN_SESSION_PATH_GRANTS, mergeRuntimeGrantsForSession, resolveGrantedReadRoots, } from '../permission/session-path-grants.js';
+import { buildSystemSessionContext, getSystemSessionModule, isSystemSessionType, readSystemSessionMarker } from '../system-session/registry.js';
 import { IMRenderer } from './im-renderer.js';
 import { projectSubtaskStarted, projectSubtaskTerminal } from './subtask-tool-projection.js';
 import { TaskActivityStore } from '../task/task-activity-store.js';
@@ -18,9 +20,9 @@ import { createDecisionInferenceProvider, createTextInferenceProvider } from '..
 import { StreamIdleMonitor } from './stream-idle-monitor.js';
 import { logger } from '../../utils/logger.js';
 import { isHostChinese } from '../../utils/locale.js';
-import { ExecutionTimeoutError, OrphanedTargetSessionError, isExecutionFailure, getErrorMessage, classifyError, ErrorType, ERROR_PREFIX, isInfraError, isAbortTerminalReason, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
+import { ExecutionTimeoutError, OrphanedTargetSessionError, isExecutionFailure, getErrorMessage, getErrorRawText, getToolResultErrorText, classifyError, normalizeCoreErrorReason, normalizeCoreErrorSubtype, ErrorType, ERROR_PREFIX, isInfraError, isAbortTerminalReason, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
 import { readEvolcoreRuntimeFlavor, tagErrorTextWithEvolcoreVersion } from '../../utils/evolcore-version.js';
-import { describeProactiveSendCommandFailure, isExactEvolcoreSendCommandForSession, isThreadRoutedEvolcoreSendCommand } from '../permission/ec-command-parser.js';
+import { describeProactiveSendCommandFailure, isExactEvolcoreSendCommandForSession, isThreadRoutedEvolcoreSendCommand, parseCodexToolCommand, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from '../permission/ec-command-parser.js';
 import { resolveThreadRouteTarget } from '../thread/thread-route.js';
 import { summarizeToolInputForDisplay } from '../../utils/tool-summary.js';
 import { agentDataDir, agentDir as resolveAgentDir, agentMdPath, getPackageRoot, resolveRoot, resolvePaths, debugSessionsDir } from '../../paths.js';
@@ -414,6 +416,381 @@ export class PauseController {
 function isShowActivitiesMode(value) {
     return value === 'all' || value === 'text' || value === 'none';
 }
+const TOOL_INPUT_DIAGNOSTIC_MAX_LENGTH = 96_000;
+const TOOL_INPUT_DIAGNOSTIC_MAX_FINDINGS = 3;
+const TOOL_INPUT_DIAGNOSTIC_TIMEOUT_MS = 1_000;
+function isToolResultFailure(event) {
+    return event.isError === true
+        || event.executionState === 'failed'
+        || event.executionState === 'blocked'
+        || event.decision === 'deny'
+        || event.decision === 'error'
+        || (typeof event.exitCode === 'number' && Number.isFinite(event.exitCode) && event.exitCode !== 0);
+}
+function isStringArgv(value) {
+    return Array.isArray(value) && value.every(item => typeof item === 'string');
+}
+function boundedDiagnosticInput(value) {
+    return value.length <= TOOL_INPUT_DIAGNOSTIC_MAX_LENGTH;
+}
+function findApplyPatchArgumentsOffset(value) {
+    const match = value.trimStart().match(/^(?:"([^"\r\n]+)"|'([^'\r\n]+)'|([^\s;&|<>"']+))(?=\s|[;&|<>]|$)/u);
+    const executable = match?.[1] ?? match?.[2] ?? match?.[3];
+    if (!executable)
+        return -1;
+    const basename = executable.replaceAll('\\', '/').split('/').at(-1)?.toLowerCase();
+    if (basename !== 'apply_patch' && basename !== 'apply_patch.exe')
+        return -1;
+    return value.length - value.trimStart().length + match[0].length;
+}
+function findUnquotedDiagnosticText(value, needle, startOffset) {
+    let quote = null;
+    let escaped = false;
+    for (let index = startOffset; index < value.length; index++) {
+        const char = value[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '\\')
+                escaped = true;
+            else if (char === '"')
+                quote = null;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (value.startsWith(needle, index))
+            return index;
+    }
+    return -1;
+}
+function diagnosticLineEnd(value, startOffset) {
+    const newline = value.indexOf('\n', startOffset);
+    return newline < 0 ? value.length : newline;
+}
+function parseDiagnosticHeredoc(value, argumentsOffset) {
+    const openOffset = findUnquotedDiagnosticText(value, '<<', argumentsOffset);
+    if (openOffset < 0 || openOffset >= diagnosticLineEnd(value, argumentsOffset)
+        || value[openOffset + 2] === '<')
+        return undefined;
+    let cursor = openOffset + 2;
+    const stripTabs = value[cursor] === '-';
+    if (stripTabs)
+        cursor++;
+    while (value[cursor] === ' ' || value[cursor] === '\t')
+        cursor++;
+    const quote = value[cursor] === "'" || value[cursor] === '"' ? value[cursor] : undefined;
+    if (quote)
+        cursor++;
+    const delimiterStart = cursor;
+    while (cursor < value.length) {
+        const char = value[cursor];
+        if (quote ? char === quote : char === ' ' || char === '\t' || char === '\r' || char === '\n')
+            break;
+        cursor++;
+    }
+    const delimiter = value.slice(delimiterStart, cursor);
+    if (!delimiter)
+        return undefined;
+    const firstNewline = value.indexOf('\n', cursor);
+    if (firstNewline < 0)
+        return {};
+    let lineStart = firstNewline + 1;
+    let trailing;
+    while (lineStart <= value.length) {
+        const end = diagnosticLineEnd(value, lineStart);
+        const rawLine = value.slice(lineStart, end).replace(/\r$/u, '');
+        const line = stripTabs ? rawLine.replace(/^\t+/u, '') : rawLine;
+        if (line === delimiter) {
+            let extraOffset;
+            let next = end < value.length ? end + 1 : value.length;
+            while (next < value.length) {
+                const nextEnd = diagnosticLineEnd(value, next);
+                const nextLine = value.slice(next, nextEnd).trim();
+                if (nextLine !== '' && !nextLine.startsWith('#')) {
+                    extraOffset = next;
+                    break;
+                }
+                next = nextEnd < value.length ? nextEnd + 1 : value.length;
+            }
+            return { delimiterOffset: lineStart + rawLine.length - line.length, extraOffset };
+        }
+        if (line.startsWith(delimiter) && line.length > delimiter.length) {
+            trailing ??= { trailingOffset: lineStart + rawLine.length - line.length + delimiter.length, trailingEndOffset: end };
+        }
+        if (end >= value.length)
+            break;
+        lineStart = end + 1;
+    }
+    return trailing ?? {};
+}
+function findDiagnosticShellSeparator(value, startOffset, endOffset) {
+    let quote = null;
+    let escaped = false;
+    for (let index = startOffset; index < endOffset; index++) {
+        const char = value[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '\\')
+                escaped = true;
+            else if (char === '"')
+                quote = null;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (char === ';' || char === '|' || char === '&' || char === '\n' || char === '\r')
+            return index;
+    }
+    return -1;
+}
+function diagnosticLocation(source, startOffset, endOffset = startOffset) {
+    const start = Math.max(0, Math.min(startOffset, source.value.length));
+    const end = Math.max(start, Math.min(endOffset, source.value.length));
+    const lineStart = Math.max(source.value.lastIndexOf('\n', Math.max(0, start - 1)) + 1, 0);
+    return {
+        field: source.field,
+        ...(source.argumentIndex !== undefined ? { argumentIndex: source.argumentIndex } : {}),
+        line: source.value.slice(0, start).split('\n').length,
+        column: [...source.value.slice(lineStart, start)].length + 1,
+        startOffset: start,
+        endOffset: end,
+    };
+}
+function diagnosticFinding(ruleId, title, advice, confidence, source, startOffset, endOffset) {
+    return { ruleId, title, advice, confidence, location: diagnosticLocation(source, startOffset, endOffset) };
+}
+function diagnosticCandidates(input) {
+    const candidates = [];
+    if (typeof input.command === 'string' && boundedDiagnosticInput(input.command)) {
+        const source = { field: 'command', value: input.command };
+        const carrier = resolveCodexShellCarrierString(input.command);
+        if (carrier) {
+            const commandOffset = input.command.indexOf(carrier.command);
+            candidates.push({
+                source,
+                command: carrier.command,
+                commandOffset: commandOffset >= 0 ? commandOffset : 0,
+                carrier: true,
+            });
+        }
+        else {
+            candidates.push({ source, command: input.command, commandOffset: 0, carrier: false });
+        }
+    }
+    if (isStringArgv(input.commandArgv) && input.commandArgv.every(boundedDiagnosticInput)) {
+        const carrier = resolveCodexShellCarrierArgv(input.commandArgv);
+        if (carrier) {
+            const argumentIndex = input.commandArgv.length - 1;
+            candidates.push({
+                source: { field: 'commandArgv', value: input.commandArgv[argumentIndex], argumentIndex },
+                command: carrier.command,
+                commandOffset: 0,
+                carrier: true,
+            });
+        }
+        else {
+            const argumentIndex = 0;
+            if (findApplyPatchArgumentsOffset(input.commandArgv[argumentIndex] ?? '') >= 0) {
+                candidates.push({
+                    source: { field: 'commandArgv', value: input.commandArgv[argumentIndex], argumentIndex },
+                    command: input.commandArgv[argumentIndex],
+                    commandOffset: 0,
+                    carrier: false,
+                });
+            }
+        }
+    }
+    return candidates;
+}
+function addHeredocDiagnosticFindings(findings, candidate) {
+    const argumentsOffset = findApplyPatchArgumentsOffset(candidate.command);
+    if (argumentsOffset < 0)
+        return;
+    const heredoc = parseDiagnosticHeredoc(candidate.command, argumentsOffset);
+    if (!heredoc)
+        return;
+    const map = (offset) => candidate.commandOffset + offset;
+    if (heredoc.trailingOffset !== undefined) {
+        findings.push(diagnosticFinding('heredoc-terminator-trailing-characters', 'heredoc 结束标记行包含尾随字符', '让结束标记单独占一行，不要在标记后追加引号、命令或其它字符。', '高', candidate.source, map(heredoc.trailingOffset), map(heredoc.trailingEndOffset ?? heredoc.trailingOffset)));
+    }
+    else if (heredoc.delimiterOffset === undefined) {
+        findings.push(diagnosticFinding('heredoc-terminator-missing', '未找到匹配的 heredoc 结束标记', '补上与起始标记完全一致、且单独占一行的结束标记。', '高', candidate.source, map(candidate.command.length), map(candidate.command.length)));
+    }
+    else if (heredoc.extraOffset !== undefined) {
+        findings.push(diagnosticFinding('heredoc-extra-command', 'heredoc 结束标记后仍有额外命令或文本', '将 apply_patch 与测试或其它命令拆成两次工具调用。', '高', candidate.source, map(heredoc.extraOffset), map(heredoc.extraOffset)));
+    }
+}
+function addApplyPatchCompositionFinding(findings, candidate) {
+    const argumentsOffset = findApplyPatchArgumentsOffset(candidate.command);
+    if (argumentsOffset < 0 || candidate.carrier)
+        return;
+    const executableMatch = candidate.command.trimStart().match(/^(?:"([^"]+)"|'([^']+)'|([^\s]+))/u);
+    const executable = executableMatch?.[1] ?? executableMatch?.[2] ?? executableMatch?.[3] ?? '';
+    const basename = executable.replaceAll('\\', '/').split('/').at(-1)?.toLowerCase();
+    if (basename !== 'apply_patch' && basename !== 'apply_patch.exe')
+        return;
+    const heredocOffset = findUnquotedDiagnosticText(candidate.command, '<<', argumentsOffset);
+    const endOffset = heredocOffset >= 0 ? heredocOffset : candidate.command.length;
+    const separator = findDiagnosticShellSeparator(candidate.command, argumentsOffset, endOffset);
+    if (separator < 0)
+        return;
+    findings.push(diagnosticFinding('apply-patch-composed-command', 'apply_patch 与其它 Shell 命令组合提交', '一次工具调用只提交完整的 apply_patch；测试、检查或其它命令另行调用。', '高', candidate.source, candidate.commandOffset + separator, candidate.commandOffset + separator + 1));
+}
+function addNestedShellDiagnosticFinding(findings, candidate) {
+    if (!candidate.carrier || findApplyPatchArgumentsOffset(candidate.command) < 0)
+        return;
+    findings.push(diagnosticFinding('nested-shell-escaping-risk', '命令包含嵌套 Shell 包装层', '尽量直接提交单层 Shell 命令；需要 heredoc 或 JSON 时，减少外层转义和包装。', '中', candidate.source, candidate.commandOffset, candidate.commandOffset + candidate.command.length));
+}
+function addJsonArrayDiagnosticFinding(findings, input) {
+    const rawArgv = isStringArgv(input.commandArgv) ? input.commandArgv : undefined;
+    const parsedArgv = rawArgv ?? (typeof input.command === 'string'
+        ? (() => {
+            const parsed = parseCodexToolCommand({ command: input.command });
+            return parsed.ok ? parsed.argv : undefined;
+        })()
+        : undefined);
+    if (!parsedArgv || parsedArgv.length < 6)
+        return;
+    if (parsedArgv[0].toLowerCase() !== MAIN_CLI_BIN || parsedArgv[1].toLowerCase() !== 'aid'
+        || parsedArgv[2].toLowerCase() !== 'agentmd' || parsedArgv[3].toLowerCase() !== 'set'
+        || parsedArgv[5].toLowerCase() !== 'tags')
+        return;
+    const value = parsedArgv[6];
+    const source = rawArgv
+        ? { field: 'commandArgv', value: rawArgv[6] ?? '', argumentIndex: 6 }
+        : { field: 'command', value: typeof input.command === 'string' ? input.command : '' };
+    if (value === undefined) {
+        findings.push(diagnosticFinding('json-array-argument-missing', 'tags 参数缺少完整 JSON 数组值', '将 tags 作为一个完整参数传入，例如 PowerShell 使用单引号包住 ["DSH","AUN"]。', '高', source, source.value.length));
+        return;
+    }
+    let valid = false;
+    try {
+        const decoded = JSON.parse(value);
+        valid = Array.isArray(decoded) && decoded.every(item => typeof item === 'string');
+    }
+    catch {
+        valid = false;
+    }
+    if (valid)
+        return;
+    const split = rawArgv !== undefined && rawArgv.length > 7 && !rawArgv[7].startsWith('--')
+        && (value.startsWith('[') || value.endsWith(','));
+    findings.push(diagnosticFinding(split ? 'json-array-argument-splitting' : 'json-array-argument-invalid', split ? 'tags 的 JSON 数组疑似被拆成多个参数' : 'tags 参数不是可解析的 JSON 字符串数组', '保证整个 JSON 数组位于同一个参数中；PowerShell 普通单引号字符串内不要再添加反斜杠转义。', split ? '中' : '高', source, split ? source.value.length : 0, source.value.length));
+}
+function addCommandArgvMismatchFinding(findings, input) {
+    if (typeof input.command !== 'string' || !isStringArgv(input.commandArgv))
+        return;
+    const commandArgv = input.commandArgv;
+    if (!boundedDiagnosticInput(input.command) || commandArgv.some(value => !boundedDiagnosticInput(value)))
+        return;
+    if (resolveCodexShellCarrierArgv(commandArgv) || resolveCodexShellCarrierString(input.command))
+        return;
+    const parsed = parseCodexToolCommand({ command: input.command });
+    if (!parsed.ok || parsed.argv.length === commandArgv.length
+        && parsed.argv.every((value, index) => value === commandArgv[index]))
+        return;
+    findings.push(diagnosticFinding('command-argv-mismatch', 'command 与 commandArgv 的解析结果不一致', '以执行器提供的结构化 commandArgv 为准，避免在外层重新拼接或改写命令文本。', '中', { field: 'command', value: input.command }, 0, input.command.length));
+}
+function deduplicateDiagnosticFindings(findings) {
+    const seen = new Set();
+    return findings.filter(item => {
+        const key = `${item.ruleId}:${item.location.field}:${item.location.argumentIndex ?? ''}:${item.location.startOffset}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    }).slice(0, TOOL_INPUT_DIAGNOSTIC_MAX_FINDINGS);
+}
+function diagnoseToolInput(original, event, deadline) {
+    if (!isToolResultFailure(event) || !original.input || typeof original.input !== 'object')
+        return undefined;
+    const input = original.input;
+    if (typeof input.command === 'string' && !boundedDiagnosticInput(input.command))
+        return undefined;
+    if (Array.isArray(input.commandArgv)) {
+        if (input.commandArgv.length > 1_024 || !isStringArgv(input.commandArgv)
+            || input.commandArgv.reduce((length, value) => length + value.length, 0) > TOOL_INPUT_DIAGNOSTIC_MAX_LENGTH) {
+            return undefined;
+        }
+    }
+    const candidates = diagnosticCandidates(input);
+    if (Date.now() > deadline)
+        return undefined;
+    const findings = [];
+    for (const candidate of candidates) {
+        if (Date.now() > deadline)
+            return undefined;
+        addHeredocDiagnosticFindings(findings, candidate);
+        addApplyPatchCompositionFinding(findings, candidate);
+        addNestedShellDiagnosticFinding(findings, candidate);
+    }
+    if (Date.now() <= deadline)
+        addJsonArrayDiagnosticFinding(findings, input);
+    if (Date.now() <= deadline)
+        addCommandArgvMismatchFinding(findings, input);
+    if (Date.now() > deadline)
+        return undefined;
+    const deduplicated = deduplicateDiagnosticFindings(findings);
+    return deduplicated.length > 0 ? { findings: deduplicated } : undefined;
+}
+export function diagnoseToolInputAfterFailure(original, event) {
+    if (!original)
+        return undefined;
+    try {
+        return diagnoseToolInput(original, event, Date.now() + TOOL_INPUT_DIAGNOSTIC_TIMEOUT_MS);
+    }
+    catch {
+        return undefined;
+    }
+}
+function formatToolInputDiagnosticLocation(location) {
+    const field = location.argumentIndex === undefined
+        ? location.field
+        : `${location.field}[${location.argumentIndex}]`;
+    return `${field}，第 ${location.line} 行第 ${location.column} 列，UTF-16 偏移 ${location.startOffset}-${location.endOffset}`;
+}
+export function formatToolInputDiagnostics(report) {
+    if (!report || report.findings.length === 0)
+        return '';
+    const lines = report.findings.map(item => `- [${item.confidence}] ${item.title}（${formatToolInputDiagnosticLocation(item.location)}）\n  建议：${item.advice}`);
+    return `\n\n输入核验（辅助）：\n${lines.join('\n')}`;
+}
 function approvalActorRevision(actor, owners = [], admins = [], selfAid) {
     if (!actor)
         return undefined;
@@ -532,8 +909,10 @@ function markRetryHealthRecorded(error) {
 function wasRetryHealthRecorded(error) {
     return !!(error && typeof error === 'object' && error[RETRY_HEALTH_RECORDED_MARK] === true);
 }
-function markModelFallbackExhausted(error, message) {
+function markModelFallbackExhausted(error, message, cause) {
     error[MODEL_FALLBACK_EXHAUSTED_MARK] = message;
+    if (cause !== undefined)
+        error.cause = cause;
     return error;
 }
 function getModelFallbackExhaustedMessage(error) {
@@ -554,7 +933,7 @@ function wasRetryInputAlreadySubmitted(error) {
     return !!(error && typeof error === 'object' && error[RETRY_INPUT_ALREADY_SUBMITTED_MARK] === true);
 }
 function formatRetryInputAlreadySubmittedMessage(error) {
-    const reason = getErrorMessage(error, undefined, false) || 'Codex 暂时不可用';
+    const reason = getErrorRawText(error) || 'Codex 暂时不可用';
     return `⚠️ Codex 已接收本次消息，但本轮未能确认完成。为避免在会话中重复写入同一消息，系统未自动重试。请检查会话状态后重新发送。\n原因：${reason}`;
 }
 function isNonErrorInterruptReason(reason) {
@@ -567,7 +946,7 @@ function isExpectedTerminalInterrupt(reason) {
     return isAbortTerminalReason(reason);
 }
 function formatRetryableErrorFinalMessage(error, retries) {
-    const reason = getErrorMessage(error, undefined, false) || 'API 暂时不可用';
+    const reason = getErrorRawText(error) || 'API 暂时不可用';
     return `❌ API 暂时不可用，已自动重试 ${retries} 次仍失败，任务已停止。\n原因：${reason}`;
 }
 /**
@@ -678,6 +1057,20 @@ function getStreamErrorText(result) {
     }
     return parts.join('\n');
 }
+function getStreamRawErrorText(result, fallback) {
+    const fullText = result.fullText.trim();
+    const fullTextLooksLikeDiagnostic = fullText.length > 0 && (isRetryableError(new Error(fullText))
+        || isContextTooLongText(fullText));
+    const fallbackLooksLikeDiagnostic = typeof fallback === 'string' && fallback.trim().length > 0 && (isRetryableError(new Error(fallback))
+        || isContextTooLongText(fallback));
+    const candidates = [
+        result.syntheticDiagnosticText,
+        result.errors?.join('\n'),
+        fullTextLooksLikeDiagnostic ? fullText : undefined,
+        fallbackLooksLikeDiagnostic ? fallback : undefined,
+    ];
+    return candidates.find((part) => typeof part === 'string' && part.trim().length > 0)?.trim();
+}
 function getStreamErrorMessage(result, includeEmoji = false) {
     const raw = getStreamErrorText(result);
     return getErrorMessage(new Error(raw), result.terminalReason, includeEmoji);
@@ -993,7 +1386,7 @@ export class ResponseEngine {
                 // revocation for legacy events without a taskId.
                 const interruptedTaskId = eventTaskId;
                 if (interruptedTaskId && activeTask?.taskId === interruptedTaskId) {
-                    this.agentDelegationRegistry?.revokeTask(event.sessionId, interruptedTaskId);
+                    this.agentDelegationRegistry?.revokeTask(event.sessionId, interruptedTaskId, 'interrupted');
                 }
             }
         });
@@ -1337,7 +1730,8 @@ export class ResponseEngine {
                 || this.isPauseRequested(sessionId) || this.retryDelayWaiters.has(sessionId))
                 return { state: 'live', ...identity };
             const runner = this.getAgent(session.metadata?.channelKey || session.channel, session.baseagent, selfAid);
-            return { state: runner.hasActiveStream(sessionId) ? 'live' : 'missing', ...identity,
+            const owned = runner.hasActiveOperation?.(sessionId, active.taskId) ?? runner.hasActiveStream(sessionId);
+            return { state: owned ? 'live' : 'missing', ...identity,
                 hasTerminalOwner: this.activeTimeoutHandlers.has(sessionId) };
         }
         // Never adopt or interrupt a newer task to clean up an older attempt.
@@ -1380,6 +1774,14 @@ export class ResponseEngine {
         const interruptedTaskId = interruptedTurn?.active?.taskId;
         this.interruptedSessions.set(sessionId, effectiveReason);
         this.messageQueue?.markActiveTerminal?.(sessionId, effectiveReason);
+        const channelKey = session.metadata?.channelKey || session.channel;
+        const agent = this.getAgent(channelKey, session.baseagent, session.selfAID);
+        const cancelledQueuedTurn = interruptedTurn?.active
+            ? agent.cancelQueuedTurn?.(sessionId, {
+                taskId: interruptedTurn.active.taskId,
+                generation: interruptedTurn.active.generation,
+            }) ?? false
+            : false;
         // 终态必须先于渠道发送和 runner I/O 落盘。否则任一外部调用卡住时，
         // shutdown 超时退出会再次留下 started/interrupting 的悬空任务。
         const runtimeContext = this.activeTaskRuntimeContexts.get(sessionId);
@@ -1406,12 +1808,10 @@ export class ResponseEngine {
                 this.activeTaskRuntimeContexts.delete(sessionId);
                 this.activeRunnerModels.delete(sessionId);
             }
-            this.agentDelegationRegistry?.revokeTask(sessionId, taskId);
+            this.agentDelegationRegistry?.revokeTask(sessionId, taskId, 'interrupted');
         }
         this.closeActiveRunnerTasks(sessionId, effectiveReason, taskSpan?.causation ?? runtimeContext?.causation);
         await this.interactionRouter?.cancelAll(sessionId, effectiveReason);
-        const channelKey = session.metadata?.channelKey || session.channel;
-        const agent = this.getAgent(channelKey, session.baseagent, session.selfAID);
         const terminalStatus = (() => {
             // TimeoutController owns timeout delivery (including user-facing timeout
             // details) and already guarantees a single terminal status. Sending it
@@ -1442,7 +1842,9 @@ export class ResponseEngine {
                 logger.debug(`[ResponseEngine] interrupt terminal status failure: session=${sessionId} task=${interruptedTaskId} error=${error instanceof Error ? error.message : String(error)}`);
             });
         })();
-        const runnerInterrupt = agent.interrupt(sessionId).catch(error => {
+        const runnerInterrupt = (cancelledQueuedTurn
+            ? Promise.resolve()
+            : agent.interrupt(sessionId)).catch(error => {
             logger.debug(`[ResponseEngine] interrupt barrier runner failure: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
             if (strict)
                 throw error;
@@ -1759,9 +2161,15 @@ export class ResponseEngine {
         if (this.turnCoordinator.isCurrent(turnLease))
             return false;
         logger.info(`[ResponseEngine] Stale turn detected after agent.runQuery start; cancelling unconsumed stream: session=${sessionId} task=${taskId}`);
-        await agent.interrupt(sessionId).catch(interruptError => {
-            logger.warn(`[ResponseEngine] Failed to cancel stale runner start: session=${sessionId} task=${taskId} error=${interruptError instanceof Error ? interruptError.message : String(interruptError)}`);
-        });
+        const cancelledQueuedTurn = agent.cancelQueuedTurn?.(sessionId, {
+            taskId: turnLease.taskId,
+            generation: turnLease.generation,
+        }) ?? false;
+        if (!cancelledQueuedTurn) {
+            await agent.interrupt(sessionId).catch(interruptError => {
+                logger.warn(`[ResponseEngine] Failed to cancel stale runner start: session=${sessionId} task=${taskId} error=${interruptError instanceof Error ? interruptError.message : String(interruptError)}`);
+            });
+        }
         agent.cleanupStream(streamKey);
         return true;
     }
@@ -3099,7 +3507,7 @@ export class ResponseEngine {
                     this.activeTaskRuntimeContexts.delete(session.id);
                     this.activeRunnerModels.delete(session.id); // F1修复
                 }
-                this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                this.agentDelegationRegistry?.revokeTask(session.id, taskId, 'interrupted');
                 const daemonTrigger = this.isTrustedDaemonTrigger(message);
                 if (!daemonTrigger) {
                     await adapter.send(envelope, statusPayload).catch(() => { });
@@ -3107,7 +3515,11 @@ export class ResponseEngine {
                 await adapter.send(envelope, {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: isExecutionFailure(timeoutError) ? timeoutError.reason : isTotalExecutionTimeout ? 'total_execution_timeout' : 'timeout',
+                    ...(getErrorRawText(timeoutError) ? { raw: getErrorRawText(timeoutError) } : {}),
+                    subtype: normalizeCoreErrorSubtype(timeoutError, undefined, isTotalExecutionTimeout ? 'timeout' : 'timeout'),
+                    reason: isExecutionFailure(timeoutError)
+                        ? normalizeCoreErrorReason(timeoutError.reason)
+                        : 'timeout',
                 }).catch(() => { });
                 if (daemonTrigger) {
                     await adapter.send(envelope, statusPayload).catch(() => { });
@@ -3575,11 +3987,53 @@ export class ResponseEngine {
                 ? resolvedMode.mode.configureRun(modeProcessCtx)
                 : undefined;
             const modePolicyHook = runModeConfig?.policyHook;
-            // 整理会话：写工具全拦、Bash 只放行 ec memory create|update|archive，先于模式策略判定
-            const isMemorySession = (session.sessionType ?? session.metadata?.sessionType) === 'memory';
-            const pureSessionPolicyHook = isMemorySession
-                ? (toolName, toolInput) => memorySessionPolicyHook(toolName, toolInput) ?? modePolicyHook?.(toolName, toolInput)
-                : modePolicyHook;
+            // 系统会话：路径 / 工具由 system-session 模块判定，与角色体系无关。
+            // 有标记就只走模块，不挂模式策略、不算授权表、不并 runtime grant。
+            const sessionMetadata = session.metadata;
+            const declaredSessionType = session.sessionType ?? (typeof sessionMetadata?.sessionType === 'string' ? sessionMetadata.sessionType : undefined);
+            const systemSessionMarker = readSystemSessionMarker(sessionMetadata);
+            if (isSystemSessionType(declaredSessionType) && !systemSessionMarker) {
+                throw new Error(`系统会话 ${declaredSessionType} 缺少有效 systemSession 标记`);
+            }
+            if (systemSessionMarker && declaredSessionType && declaredSessionType !== systemSessionMarker.type) {
+                throw new Error(`系统会话标记类型 ${systemSessionMarker.type} 与 sessionType ${declaredSessionType} 不一致`);
+            }
+            const systemSessionModule = systemSessionMarker
+                ? getSystemSessionModule(systemSessionMarker.type)
+                : undefined;
+            const systemSessionContext = systemSessionModule && systemSessionMarker
+                ? buildSystemSessionContext({
+                    marker: systemSessionMarker,
+                    sessionId: session.id,
+                    selfAid: selfAid || session.selfAID || '',
+                    projectPath: absoluteProjectPath,
+                    managedTempDir: sessionRuntimeDir,
+                    metadata: sessionMetadata,
+                })
+                : undefined;
+            const systemSessionCheck = systemSessionModule && systemSessionContext
+                ? (toolName, toolInput) => systemSessionModule.checkTool(toolName, toolInput, systemSessionContext)
+                : undefined;
+            // 沙箱声明与 runner 有关，但当前所有 runner 共用同一个结论；仍按 runner 问一次，
+            // 以便将来某个 runner 需要不同取舍时只改模块。
+            const systemSessionSandbox = systemSessionModule && systemSessionContext
+                ? systemSessionModule.runnerLaunch(normalizeBaseagent(agent.name).canonical, systemSessionContext).sandbox
+                : undefined;
+            const pureSessionPolicyHook = systemSessionMarker ? undefined : modePolicyHook;
+            // 路径授权（仅用户会话）：身份就是角色名；运行时授予（ec ctl path grant）按 sessionId 再并一层。
+            const pathGrantIdentity = systemSessionMarker ? undefined : (peerRole || undefined);
+            const grantedReadRoots = (() => {
+                if (!pathGrantIdentity)
+                    return [];
+                const table = mergeRuntimeGrantsForSession(BUILTIN_SESSION_PATH_GRANTS, session.id, pathGrantIdentity);
+                return resolveGrantedReadRoots(table, {
+                    selfAid,
+                    peerKey: authPeerKey,
+                    projectPath: absoluteProjectPath,
+                    identity: pathGrantIdentity,
+                    permissionMode: effectivePermissionMode,
+                });
+            })();
             // 设置权限审批的交互上下文（支持交互卡片）
             const permissionContext = {
                 sendPrompt: permissionPromptForOrigin,
@@ -3593,10 +4047,12 @@ export class ResponseEngine {
                 agentName: agentNameForStats,
                 taskId,
                 chatmode: isProactive ? 'proactive' : 'interactive',
-                role: peerRole,
+                // 系统会话没有角色
+                role: systemSessionMarker ? undefined : peerRole,
                 chatType: authChatType,
                 selfAid,
                 managedTempDir: sessionRuntimeDir,
+                grantedReadRoots,
                 allowReadonlySourceDiagnostics: effectiveAgentConfig?.readonlySourceDiagnostics === true,
                 peerKey: authPeerKey,
                 causation: taskCausation,
@@ -3606,6 +4062,13 @@ export class ResponseEngine {
                 recordExecutionAnomaly,
                 pauseController: taskPauseController,
                 preToolUsePolicyHook: pureSessionPolicyHook,
+                systemSessionCheck,
+                ...(systemSessionModule && systemSessionContext
+                    ? {
+                        systemSessionGrants: systemSessionModule.grants(systemSessionContext),
+                        ...(systemSessionSandbox ? { systemSessionSandbox } : {}),
+                    }
+                    : {}),
                 armApprovedDelegationCommand: this.agentDelegationRegistry
                     ? (sessionToken, commandHash) => this.agentDelegationRegistry.armApprovedCommand({
                         sessionToken,
@@ -3614,6 +4077,11 @@ export class ResponseEngine {
                         commandHash,
                     })
                     : undefined,
+                bindSessionCredential: this.agentDelegationRegistry
+                    ? (sessionToken, threadId) => this.agentDelegationRegistry.registerSessionCredential({
+                        sessionToken, threadId, sessionId: session.id, taskId,
+                    })
+                    : undefined,
                 turn: {
                     sessionId: turnLease.sessionId,
                     taskId,
@@ -3797,7 +4265,15 @@ export class ResponseEngine {
                 const triggerPermissionModeOverride = message.triggerMeta?.permissionModeOverride;
                 const commandFullAccess = message.executionPermissionOverride;
                 const triggerFullAccess = triggerPermissionModeOverride === 'fullaccess';
-                if (commandFullAccess || triggerFullAccess) {
+                if (systemSessionMarker) {
+                    // 系统会话不走角色 / trigger override / fullaccess：runner 模式由模块固定
+                    if (commandFullAccess || triggerFullAccess) {
+                        throw new Error('系统会话不支持 fullaccess');
+                    }
+                    effectivePermissionMode = systemSessionModule
+                        .runnerLaunch(normalizedBaseagent.canonical, systemSessionContext).runnerMode;
+                }
+                else if (commandFullAccess || triggerFullAccess) {
                     if (commandFullAccess) {
                         if (commandFullAccess.permissionMode !== 'fullaccess'
                             || commandFullAccess.processRole !== 'fullaccess-run'
@@ -4011,10 +4487,13 @@ export class ResponseEngine {
                         bootstrapAgentMdPath: agentMdPath(selfAid),
                     };
                 }
+                // persona.md 是唯一的人格/交接文件（personal.md 已废弃并入）。
+                // 该白名单让 owner 会话可直接用文件工具分段更新 `## Bootstrap 交接`，
+                // 避免把长 Markdown 交接摘要塞进 `ec agent persona --text` 的 shell 转义。
                 if (selfAid && peerRole === 'owner' && effectivePermissionMode !== 'readonly') {
                     modelOverride = {
                         ...(modelOverride || {}),
-                        personalMdPath: path.join(resolveRoot(), 'agents', selfAid, 'personal', 'personal.md'),
+                        personalMdPath: path.join(resolveRoot(), 'agents', selfAid, 'personal', 'persona.md'),
                     };
                 }
                 if (normalizedBaseagent.canonical === 'claude') {
@@ -4258,9 +4737,12 @@ export class ResponseEngine {
                 // Bootstrap always uses the lifecycle-gated main manifest. A custom
                 // session manifest (for example the auxiliary manifest with `always`
                 // sections) must not reintroduce normal rules or command context.
+                // 系统会话：manifest 由模块按 type/subtype 决定，不读 config
                 const manifestFile = isBootstrapping
                     ? DEFAULT_MANIFEST_FILE
-                    : resolveSessionManifest(sessionType, sessionManifests);
+                    : systemSessionMarker
+                        ? getSystemSessionModule(systemSessionMarker.type).manifest(systemSessionMarker.subtype)
+                        : resolveSessionManifest(sessionType, sessionManifests);
                 const kitContext = renderKitSections(kitCtx, manifestFile);
                 effectiveSystemPrompt = [options?.systemPromptAppend, kitContext].filter(Boolean).join('\n') || undefined;
                 // ── Stats: context_breakdown 旁路采集（各段估算 token 数，字符数/4 近似） ──
@@ -4495,7 +4977,8 @@ export class ResponseEngine {
                     peerKey,
                     peerName: peerName || undefined,
                     peerType: message.peerType || session.metadata?.peerType || undefined,
-                    peerRole,
+                    // 系统会话没有角色
+                    ...(systemSessionMarker ? {} : { peerRole }),
                     // 会话原型与整理模式：ipc 侧靠 sessionType 拦非整理会话的写命令，
                     // 靠 memoryMode 校验 --scope 是否与本模式匹配。
                     sessionType: renderedSessionType,
@@ -4532,7 +5015,8 @@ export class ResponseEngine {
                         chatType: configChatType,
                         selfAid,
                         peerKey,
-                        issuedRole: peerRole,
+                        // 系统会话与角色体系无关：带标记、不签角色
+                        ...(systemSessionMarker ? { systemSession: systemSessionMarker } : { issuedRole: peerRole }),
                         executionSource: fullAccessAuthorization?.source ?? (message.source === 'trigger' ? 'trigger' : 'user'),
                         permissionMode: effectivePermissionMode,
                         approvalInteractionPolicy,
@@ -4798,7 +5282,7 @@ export class ResponseEngine {
                             const candidateHint = fallbackCandidates.length === 0
                                 ? '未配置可用备用模型'
                                 : '备用模型均不可用';
-                            throw markModelFallbackExhausted(new Error(`model_not_found: ${primaryModel ?? 'runner_default'}`), `当前模型 ${primaryModel ?? '默认模型'} 不可用，${candidateHint}。请稍后重试；管理员可在 agents/defaults.json 的 baseagents.${normalizedBaseagent.canonical}.fallbackModels 配置同类备用模型。`);
+                            throw markModelFallbackExhausted(new Error(`model_not_found: ${primaryModel ?? 'runner_default'}`), `当前模型 ${primaryModel ?? '默认模型'} 不可用，${candidateHint}。请稍后重试；管理员可在 agents/defaults.json 的 baseagents.${normalizedBaseagent.canonical}.fallbackModels 配置同类备用模型。`, retryError);
                         }
                         if (retryAttemptTimedOut || isRetryableError(retryError)) {
                             await recordRetryHealthError(retryError);
@@ -4926,7 +5410,7 @@ export class ResponseEngine {
                         this.activeTaskRuntimeContexts.delete(session.id);
                         this.activeRunnerModels.delete(session.id); // F1修复
                     }
-                    this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                    this.agentDelegationRegistry?.revokeTask(session.id, taskId, 'replaced');
                     logger.info(`[ResponseEngine] Stale turn stopped before publish: session=${session.id} task=${taskId}`);
                     await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_generation', taskCausation, {
                         expected: turnLease?.generation,
@@ -4942,7 +5426,7 @@ export class ResponseEngine {
                             this.activeTaskRuntimeContexts.delete(session.id);
                             this.activeRunnerModels.delete(session.id); // F1修复
                         }
-                        this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                        this.agentDelegationRegistry?.revokeTask(session.id, taskId, 'replaced');
                         logger.info(`[ResponseEngine] Stale turn stopped before protocol rejection: session=${session.id} task=${taskId}`);
                         await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_generation', taskCausation, {
                             expected: turnLease?.generation,
@@ -5096,6 +5580,7 @@ export class ResponseEngine {
             let sentErrorAsSystemError = false;
             const finalReplyText = streamResult.lastReplyText || streamResult.fullText;
             const visibleFinalReplyText = stripContextLimitErrorLines(finalReplyText);
+            const streamRawErrorText = getStreamRawErrorText(streamResult, visibleFinalReplyText || undefined);
             const isTriggerNoop = message.source === 'trigger'
                 && typeof message.triggerMeta?.noopSentinel === 'string'
                 && message.triggerMeta.noopSentinel.length > 0
@@ -5107,7 +5592,7 @@ export class ResponseEngine {
                     this.activeTaskRuntimeContexts.delete(session.id);
                     this.activeRunnerModels.delete(session.id); // F1修复
                 }
-                this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                this.agentDelegationRegistry?.revokeTask(session.id, taskId, 'replaced');
                 logger.info(`[ResponseEngine] Stale turn stopped before final flush: session=${session.id} task=${taskId}`);
                 await this.publishTriggerExecutionInterrupted(message, adapter, envelope, 'stale_turn', taskCausation);
                 return;
@@ -5128,10 +5613,14 @@ export class ResponseEngine {
                 if (streamResult.isError) {
                     // 用原始诊断文本（含错误码）判断可重试性，不用已过 stripContextLimitErrorLines 的展示文本
                     const recoverable = isRetryableError(new Error(getStreamErrorText(streamResult)));
+                    const subtype = normalizeCoreErrorSubtype(new Error(streamRawErrorText || getStreamErrorText(streamResult)), streamResult.subtype, streamResult.terminalReason);
+                    const reason = normalizeCoreErrorReason(streamResult.terminalReason);
                     await adapter.send(envelope, {
                         kind: 'system.error',
                         text: errorText,
-                        subtype: streamResult.subtype ?? 'api_error',
+                        ...(streamRawErrorText ? { raw: streamRawErrorText } : {}),
+                        subtype,
+                        ...(reason ? { reason } : {}),
                         recoverable,
                     }).catch(() => { });
                     sentErrorAsSystemError = true;
@@ -5148,7 +5637,7 @@ export class ResponseEngine {
                 this.activeTaskRuntimeContexts.delete(session.id);
                 this.activeRunnerModels.delete(session.id); // F1修复
             }
-            this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+            this.agentDelegationRegistry?.revokeTask(session.id, taskId, streamResult.isError ? 'failed' : 'completed');
             logger.info(`[ResponseEngine] session ${session.id} processing cleared task=${taskId}`);
             import('../../utils/msg-diag.js').then(m => m.diagLog('task_done', { aid: session.selfAID ?? '', msgId: message.messageId ?? '', taskId, text: message.content ?? '' })).catch(() => { });
             // 降级模型回复末尾追加标记（代码层硬注入，不依赖模型输出）
@@ -5217,6 +5706,10 @@ export class ResponseEngine {
                         : getStreamErrorMessage(streamResult, false);
                 const rawSubtype = streamResult.subtype || 'agent_error';
                 const errorType = prefixErrorType(ERROR_PREFIX.AGENT, rawSubtype);
+                const coreSubtype = normalizeCoreErrorSubtype(new Error(streamRawErrorText || errorSummary), rawSubtype, streamResult.terminalReason);
+                const coreReason = permissionTerminalFailure
+                    ? normalizeCoreErrorReason(permissionTerminalFailure.reason)
+                    : normalizeCoreErrorReason(streamResult.terminalReason);
                 // 用户主动打断（新消息/​/stop/​撤回）会让 SDK 流在工具调用中途被掐断，
                 // 末尾 result message 形状异常并被标记为 error（含 SDK 内部 ede_diagnostic 串）。
                 // 这不是真正的失败，不应把诊断串暴露给用户，也不计入错误统计。
@@ -5241,12 +5734,24 @@ export class ResponseEngine {
                     if (this.isTrustedDaemonTrigger(message)) {
                         await adapter.send(envelope, { kind: 'status.error', metadata: terminalMetadata }).catch(() => { });
                         if (!sentErrorAsSystemError) {
-                            await adapter.send(envelope, { kind: 'result.error', text: userErrorSummary, reason: rawSubtype }).catch(() => { });
+                            await adapter.send(envelope, {
+                                kind: 'result.error',
+                                text: userErrorSummary,
+                                ...(streamRawErrorText ? { raw: streamRawErrorText } : {}),
+                                subtype: coreSubtype,
+                                ...(coreReason ? { reason: coreReason } : {}),
+                            }).catch(() => { });
                         }
                     }
                     else {
                         if (!sentErrorAsSystemError) {
-                            await adapter.send(envelope, { kind: 'result.error', text: userErrorSummary, reason: rawSubtype }).catch(() => { });
+                            await adapter.send(envelope, {
+                                kind: 'result.error',
+                                text: userErrorSummary,
+                                ...(streamRawErrorText ? { raw: streamRawErrorText } : {}),
+                                subtype: coreSubtype,
+                                ...(coreReason ? { reason: coreReason } : {}),
+                            }).catch(() => { });
                         }
                         await adapter.send(envelope, { kind: 'status.error', metadata: terminalMetadata }).catch(() => { });
                     }
@@ -5592,7 +6097,7 @@ export class ResponseEngine {
                     this.activeTaskRuntimeContexts.delete(session.id);
                     this.activeRunnerModels.delete(session.id); // F1修复
                 }
-                this.agentDelegationRegistry?.revokeTask(session.id, taskId);
+                this.agentDelegationRegistry?.revokeTask(session.id, taskId, this.interruptedSessions.has(session.id) ? 'interrupted' : 'failed');
                 logger.info(`[ResponseEngine] session ${session.id} processing cleared (on error) task=${taskId}`);
             }
             catch { }
@@ -5739,10 +6244,29 @@ export class ResponseEngine {
                     sessionId: session.id,
                     metadata: withTaskMetadata(sendOpts?.metadata),
                 };
+                const errorReason = isExecutionFailure(error)
+                    ? normalizeCoreErrorReason(error.reason)
+                    : retryExhaustedCount
+                        ? 'retry_exhausted'
+                        : retryInputAlreadySubmitted
+                            ? 'input_already_submitted'
+                            : modelFallbackExhaustedMessage
+                                ? 'fallback_exhausted'
+                                : isTotalExecutionTimeout || isTimeout
+                                    ? 'timeout'
+                                    : undefined;
+                const errorSubtype = error instanceof OrphanedTargetSessionError
+                    ? ErrorType.SESSION_UNAVAILABLE
+                    : modelFallbackExhaustedMessage
+                        ? ErrorType.MODEL_UNAVAILABLE
+                        : normalizeCoreErrorSubtype(error, undefined, isTotalExecutionTimeout || isTimeout ? 'timeout' : undefined);
+                const rawErrorText = getErrorRawText(error);
                 const errorPayload = {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: isExecutionFailure(error) ? error.reason : retryExhaustedCount ? 'retry_exhausted' : retryInputAlreadySubmitted ? 'input_already_submitted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
+                    subtype: errorSubtype,
+                    ...(rawErrorText ? { raw: rawErrorText } : {}),
+                    ...(errorReason ? { reason: errorReason } : {}),
                 };
                 if (!isUserInterrupt && daemonTrigger && procStatus === 'error') {
                     // DaemonChannel settles a trigger on the first terminal payload. Put
@@ -6178,10 +6702,11 @@ export class ResponseEngine {
                 if (event.type === 'complete') {
                     event = normalizeCompleteAgentEvent(event);
                 }
-                if (event.type === 'tool_result' && event.isError) {
+                if (event.type === 'tool_result' && isToolResultFailure(event)) {
                     const classification = normalizeToolErrorClassification(event);
                     event = {
                         ...event,
+                        isError: true,
                         errorCode: classification.errorCode,
                         errorDetailCode: classification.errorDetailCode,
                         classificationMissing: classification.classificationMissing || event.classificationMissing,
@@ -6327,7 +6852,20 @@ export class ResponseEngine {
                     logger.info(`[ResponseEngine] Event: type=${event.type}${eventDetail}`);
                 }
                 // IMRenderer 旁路：proactive 模式逐事件投影为 thought（fire-and-forget）
-                renderer.emit(event);
+                let diagnosticSuffix = '';
+                let projectedEvent = event;
+                if (event.type === 'tool_result' && isToolResultFailure(event)) {
+                    const byCallId = event.callId ? toolInputByCallId.get(event.callId) : undefined;
+                    const byCorrelationId = event.correlationId
+                        ? toolInputByCorrelationId.get(event.correlationId)
+                        : undefined;
+                    const original = event.callId && event.correlationId
+                        ? byCallId === byCorrelationId ? byCallId : undefined
+                        : byCallId ?? byCorrelationId;
+                    diagnosticSuffix = formatToolInputDiagnostics(diagnoseToolInputAfterFailure(original, event));
+                    projectedEvent = { ...event, error: getToolResultErrorText(event) + diagnosticSuffix };
+                }
+                renderer.emit(projectedEvent);
                 if (event.type === 'text_start') {
                     await renderer.sendTextStart(event.contentIndex, event.turn);
                     continue;
@@ -6751,15 +7289,14 @@ export class ResponseEngine {
                         }
                         // 从 tool_use 阶段缓存的描述中回溯
                         const cachedDesc = event.callId ? toolDescByCallId.get(event.callId) : undefined;
-                        if (event.isError && !shouldSuppress()) {
+                        const toolResultFailed = isToolResultFailure(event);
+                        if (toolResultFailed && !shouldSuppress()) {
                             hasErrorResult = true;
-                            let errorMsg = event.error || (typeof event.result === 'string' ? event.result : JSON.stringify(event.result)) || '\u6267\u884c\u5931\u8d25';
-                            // 移除 XML 风格的错误标签
-                            errorMsg = errorMsg.replace(/<tool_use_error>(.*?)<\/tool_use_error>/gs, '$1');
-                            renderer.addToolResult(event.name || '\u5de5\u5177', false, undefined, errorMsg, event.callId, event.durationMs, cachedDesc, event, event.assistantUuid);
+                            const errorMsg = getToolResultErrorText(event) + diagnosticSuffix;
+                            renderer.addToolResult(event.name || '\u5de5\u5177', false, event.result, errorMsg, event.callId, event.durationMs, cachedDesc, event, event.assistantUuid);
                         }
-                        else if (!event.isError && !shouldSuppress()) {
-                            renderer.addToolResult(event.name || '\u5de5\u5177', true, event.result, undefined, event.callId, event.durationMs, cachedDesc, undefined, event.assistantUuid);
+                        else if (!toolResultFailed && !shouldSuppress()) {
+                            renderer.addToolResult(event.name || '\u5de5\u5177', true, event.result, undefined, event.callId, event.durationMs, cachedDesc, event, event.assistantUuid);
                         }
                     }
                     // 非终态运行时告警走 status notify，不进入 activity/thought 历史。