evolcore 0.0.33 → 0.0.35-test.0

package/CHANGELOG.md

@@ -5,6 +5,65 @@
 
 ## Unreleased
 
+## 0.0.35 (2026-10-19)
+
+### 权限与记忆
+
+- 规范 Claude Code 与 ecagent 的 Bash 调用说明，要求明确命令目标并标注低、中、高风险等级；缺失或格式错误时提供具体提示，避免权限模式不同导致调用说明不一致。
+- agent 级记忆整理会扫描所有关系记忆并按关系归类，避免遗漏其他对端的过期记忆。
+- 首次设定尚未完成时阻止记忆整理会话启动，避免记忆被提前认领后无法正常处理。
+- 细化只读 Shell 操作的拒绝原因，提升受限命令的诊断可读性。
+
+### Codex 与运行稳定性
+
+- 保留 Codex 模型服务重连进度，并在最终失败时展示实际重试次数，避免只显示笼统的请求失败。
+- 统一 Codex managed hook 的包根目录与安装器解析，升级监视器暂存运行文件时同步携带 `bin` 目录，提升升级和重启过程的一致性。
+- 补充生命周期启动失败时的 stderr 诊断输出，便于定位启动异常。
+- 修复 `agent.md` 显示名解析，改用 YAML 结构化解析以正确处理引号和特殊字符。
+- 修复话题摘要写入时的游标竞态，确保 `coveredThroughTs` 在追加摘要前读取。
+
+### 消息与依赖兼容
+
+- 规范 AUN 原始错误展示，截断错误响应中附带的 HTML 页面，保留有用的错误信息并减少无关输出。
+- 将 AUN SDK 最低运行版本提升至 `0.5.20`，使用经过当前版本验证的 SDK 依赖。
+
+## 0.0.34 (2026-10-18)
+
+### 模型与上下文
+
+- 统一 Claude Code、Codex 和 ecagent 的模型参数解析与上下文窗口统计，减少执行窗口、压缩阈值和用量展示之间的不一致。
+- Claude Code 和 ecagent 按模型参数表应用上下文窗口与输出上限；Codex 优先使用 app-server 提供的实时窗口，缺失时仅补充统计信息，不虚构执行窗口。
+- 统一模型窗口后缀、模型参数覆盖和查询/压缩路径的处理，支持新模型参数在不修改 runner 代码的情况下生效。
+
+### 会话与工具
+
+- 完善 Codex 排队任务取消及中断后的状态核验，避免停止操作影响错误轮次。
+- 改进 Shell 工具结果处理，分别保留实际退出码、原始输出和错误摘要，避免将普通输出误当作失败原因。
+- 新增任务授权与会话凭据生命周期诊断，提供可追踪的失效原因和事件信息。
+- 闲置巡检覆盖私聊与群聊，开启前校验必要配置，仅针对未完成且停滞的事项推进或提醒。
+- 补充任务运行结果的结构化错误类型、终止原因和原始诊断信息，区分超时、输出上限、协议不完整及目标会话丢失等终态。
+
+### 错误反馈与运行稳定性
+
+- 细化 AUN 错误反馈展示，保留原始错误详情并避免将未知 403 错误套用无差别的重试或“API 访问受限”提示。
+- 对客户端过旧、积分不足、团队上下文超限等已知 403 原因提供针对性提示；未知原因保留诊断信息并停止自动猜测。
+- 支持目标会话丢失、触发器超时和输出上限等错误在消息协议中携带稳定的 `subtype` 与 `reason`。
+- 抑制 CLI 子进程的 Node.js 实验性 SQLite 警告，减少正常命令输出噪声。
+- 支持创建 AID 时明确登记主体类型，避免身份类型缺失。
+
+### 管理与发布
+
+- 支持同时具备目标 Agent Owner 与 Daemon Owner 身份的用户，通过菜单配置 Agent Fullaccess。
+- Trigger 创建支持填写说明，并在列表和详情中展示。
+- 优化 Windows 进程探测与启动、停止速度，修正 Node 路径识别，并统一 Claude 可用性检测与实际执行程序。
+- 统一列表类命令参数的解析，减少 PowerShell 下逗号分隔参数与审批校验不一致的问题。
+- 升级 AUN SDK 至 `0.5.20`，并收紧 npm 包发布内容，避免将内部文件完整性写入模块打入发行包。
+
+### 兼容性调整
+
+- 首次设定的协作交接统一写入 `persona.md`；`personal.md` 不再自动注入上下文。
+- 移除 `ec memory feedback` 命令，整理反馈改由专用会话按任务要求写入反馈文件。
+
 ## 0.0.33 (2026-10-15)
 
 ### 话题与会话

package/bin/ec.js

@@ -11,6 +11,7 @@ const repoRoot = path.resolve(here, '..');
 const srcEntry = path.join(repoRoot, 'src', 'cli', 'index.ts');
 const distEntry = path.join(repoRoot, 'dist', 'cli', 'index.js');
 const args = process.argv.slice(2);
+const nodeOptions = ['--no-warnings=ExperimentalWarning'];
 
 // tsx derives its cache directory from `process.geteuid()` on POSIX and
 // `os.userInfo()` on Windows. In managed Windows sessions the latter can
@@ -26,13 +27,13 @@ if (fs.existsSync(srcEntry)) {
     const imports = tsxWindowsCompatImport
       ? ['--import', tsxWindowsCompatImport, '--import', tsxImport]
       : ['--import', tsxImport];
-    const result = spawnSync(process.execPath, [...imports, srcEntry, ...args], { stdio: 'inherit' });
+    const result = spawnSync(process.execPath, [...nodeOptions, ...imports, srcEntry, ...args], { stdio: 'inherit' });
     process.exit(result.status ?? (result.error ? 1 : 0));
   } catch {}
 }
 
 if (fs.existsSync(distEntry)) {
-  const result = spawnSync(process.execPath, [distEntry, ...args], { stdio: 'inherit' });
+  const result = spawnSync(process.execPath, [...nodeOptions, distEntry, ...args], { stdio: 'inherit' });
   process.exit(result.status ?? (result.error ? 1 : 0));
 }
 

package/bin/install-codex-managed-hooks.mjs

@@ -22,7 +22,25 @@ function hasArgument(name) {
   return process.argv.includes(name);
 }
 
-function fail(message) {
+/** Path where the elevated installer writes a structured failure record for the non-elevated parent. */
+function installerFailurePath(requirements) {
+  const configDir = requirements
+    ? path.dirname(path.resolve(requirements))
+    : path.join(process.env.ProgramData || path.join(os.homedir(), 'ProgramData'), 'OpenAI', 'Codex');
+  return path.join(configDir, '.evolcore-install-failure.json');
+}
+
+function writeFailureRecord(requirements, message) {
+  try {
+    const record = { time: new Date().toISOString(), message };
+    fs.writeFileSync(installerFailurePath(requirements), JSON.stringify(record) + '\n', { mode: 0o644 });
+  } catch {
+    // Best-effort; parent falls back to "installer exited with code 1" if missing.
+  }
+}
+
+function fail(message, requirements) {
+  writeFailureRecord(requirements, message);
   process.stderr.write(`[evolcore] ${message}\n`);
   process.exit(1);
 }
@@ -285,6 +303,17 @@ export function samePackageRoot(embedded, expected) {
   return normalize(embedded) === normalize(expected) || resolved(embedded) === resolved(expected);
 }
 
+// Windows accepts an executable path without its `.exe` suffix. Keep an older
+// `...\\node` binding from being treated as a different runtime than
+// `...\\node.exe` during installer verification.
+function sameRuntimePath(embedded, expected) {
+  if (samePackageRoot(embedded, expected)) return true;
+  if (process.platform !== 'win32' || !embedded) return false;
+  const appendExe = value => path.extname(value) ? value : `${value}.exe`;
+  return samePackageRoot(appendExe(embedded), expected)
+    || samePackageRoot(embedded, appendExe(expected));
+}
+
 function normalizedPath(value) {
   return path.normalize(String(value || '')).replace(/[\\/]+$/, '').toLowerCase();
 }
@@ -391,7 +420,7 @@ export function inspectManagedHookInstallation({ requirements, managedDir, packa
     }
     const { embeddedPackageRoot, managedNodePath } = binding;
     const packageMatches = samePackageRoot(embeddedPackageRoot, path.resolve(packageRoot || process.cwd()));
-    const nodeMatches = samePackageRoot(managedNodePath, nodePath);
+    const nodeMatches = sameRuntimePath(managedNodePath, nodePath);
     const state = {
       requirements: canonicalRequirements, managedDir: canonicalManagedDir, hookPath,
       managedPackageRoot: embeddedPackageRoot, managedNodePath,
@@ -642,7 +671,7 @@ function main() {
   const hookPath = path.join(targetDirectory, 'pre-tool-use.mjs');
   const sourceHook = path.join(packageRoot, 'bin', 'codex-managed-hook.mjs');
   for (const file of [sourceHook, nodePath]) {
-    if (!fs.statSync(file).isFile()) fail(`Required Hook runtime file was not found: ${file}`);
+    if (!fs.statSync(file).isFile()) fail(`Required Hook runtime file was not found: ${file}`, requirements);
   }
   if (hasArgument('--repair')) {
     const result = repairManagedHookInstallation({
@@ -663,7 +692,12 @@ function main() {
 }
 
 if (process.argv[1] && pathToFileURL(fs.realpathSync(process.argv[1])).href === import.meta.url) {
+  // Resolve requirements now so writeFailureRecord has a path even if main()
+  // throws before the local `requirements` variable is assigned.
+  const earlyRequirements = argument('--requirements')
+    ? path.resolve(argument('--requirements'))
+    : path.join(process.env.ProgramData || path.join(os.homedir(), 'ProgramData'), 'OpenAI', 'Codex', 'requirements.toml');
   try { main(); } catch (error) {
-    fail(error instanceof Error ? error.message : String(error));
+    fail(error instanceof Error ? error.message : String(error), earlyRequirements);
   }
 }

package/dist/agents/baseagent-availability.js

@@ -1,39 +1,17 @@
 import { normalizeBaseagent } from './baseagent.js';
 import { commandExists } from '../utils/cross-platform.js';
 import { getCodexAppServerAvailability } from './codex-runner.js';
-import { createRequire } from 'module';
-import fs from 'fs';
-import path from 'path';
-const _resolveModule = createRequire(import.meta.url);
+import { probeBundledClaudeVersion, resolveBundledClaudeExecutable } from './claude-runner.js';
 /**
- * Check whether the bundled Claude SDK native binary is present on disk.
- * This covers Windows installations where the npm global shim may be absent
- * but the SDK ships claude.exe alongside evolcore's own node_modules.
+ * Claude 的检测判据就是执行判据：会话只会在 Windows 上跑内置的、与 SDK 锁定版本
+ * 配套的 claude.exe。PATH 里的全局 claude 执行层从不使用，因此不能作为可用判据——
+ * 那个假阳性正是「检测说可用、会话全失败」持续 21 小时没被发现的成因。
  */
-function isBundledClaudeAvailable() {
-    if (process.platform !== 'win32')
-        return false;
-    const nativePackage = process.arch === 'arm64'
-        ? '@anthropic-ai/claude-agent-sdk-win32-arm64'
-        : process.arch === 'x64'
-            ? '@anthropic-ai/claude-agent-sdk-win32-x64'
-            : undefined;
-    if (!nativePackage)
-        return false;
-    try {
-        const exe = _resolveModule.resolve(`${nativePackage}/claude.exe`);
-        if (fs.existsSync(exe))
-            return true;
-    }
-    catch { /* fall through */ }
-    try {
-        const sdkEntry = _resolveModule.resolve('@anthropic-ai/claude-agent-sdk');
-        const exe = path.resolve(path.dirname(sdkEntry), '..', '@anthropic-ai', nativePackage.slice('@anthropic-ai/'.length), 'claude.exe');
-        return fs.existsSync(exe);
-    }
-    catch {
-        return false;
-    }
+function claudeExecutable() {
+    if (process.platform === 'win32')
+        return resolveBundledClaudeExecutable();
+    // 非 Windows 平台由 SDK 自己解析平台包，此处沿用命令探测。
+    return commandExists('claude') ? 'claude' : undefined;
 }
 export const BASEAGENT_CANDIDATES = ['claude', 'codex', 'gemini', 'ecagent'];
 export const AUTO_BASEAGENT_CANDIDATES = ['claude', 'codex', 'gemini'];
@@ -49,19 +27,25 @@ export function detectAvailableBaseagents(codexAvailability = getCodexAppServerA
         if (baseagent === 'codex')
             return codexAvailability.available;
         if (baseagent === 'claude')
-            return commandExists(baseagent) || isBundledClaudeAvailable();
+            return claudeExecutable() !== undefined;
         return commandExists(baseagent);
     });
 }
 export function detectBaseagentDetails(codexAvailability = getCodexAppServerAvailability()) {
-    const claude = commandExists('claude') || isBundledClaudeAvailable();
+    const claude = claudeExecutable();
+    const claudeVersion = claude ? probeBundledClaudeVersion() : undefined;
     const gemini = commandExists('gemini');
     return [
         {
             id: 'claude',
-            detected: claude,
-            detectionSource: claude ? ['PATH'] : [],
-            reason: claude ? undefined : '未检测到 Claude CLI。',
+            detected: claude !== undefined,
+            detectionSource: claude ? [process.platform === 'win32' ? 'bundled SDK binary' : 'PATH'] : [],
+            reason: claude
+                ? undefined
+                : process.platform === 'win32'
+                    ? '未找到内置 claude.exe（@anthropic-ai/claude-agent-sdk-win32-x64）。请重新安装 SDK 的平台包。'
+                    : '未检测到 Claude CLI。',
+            version: claudeVersion,
         },
         {
             id: 'codex',

package/dist/agents/claude-runner.js

@@ -1,6 +1,6 @@
 import { getRunnerCatalog, peekRunnerCatalog, catalogEfforts, resolveCatalogModel, assertCatalogSelectable } from '../core/model/model-catalog.js';
 import { query, forkSession as sdkForkSession, getSessionMessages as sdkGetSessionMessages, resolveSettings as sdkResolveSettings, } from '@anthropic-ai/claude-agent-sdk';
-import { spawn } from 'child_process';
+import { spawn, execFileSync } from 'child_process';
 import { createRequire } from 'module';
 import { ensureDir } from '../utils/atomic-write.js';
 import { resolveAnthropicConfig } from './baseagent.js';
@@ -15,7 +15,7 @@ import crypto from 'crypto';
 import { logger } from '../utils/logger.js';
 import { createClaudeStartupArgumentsTooLongError, isClaudeStartupArgumentsTooLong, createClaudeCodeStartupError, isClaudeCodeStartupProcessError, } from '../utils/error-utils.js';
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
-import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
+import { checkBashDescription, checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
 import { summarizeToolInput, summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { encodePath } from '../utils/cross-platform.js';
@@ -30,7 +30,8 @@ import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-p
 import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { getManagedTaskTempDir, isManagedSessionRuntimeDir } from '../cli/task-context.js';
 import { unsettledInterruptError, withInterruptDeadline, hasTrustedFullAccessContext } from './runner-types.js';
-import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel, sdkAutoCompactWindowForModel } from './runner-types.js';
+import { resolveModelSpec } from '../stats/billing.js';
+import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, realContextWindowForModel, autoCompactWindowForModel, sdkAutoCompactWindowForModel } from './runner-types.js';
 import { hasContextWindowSuffix, stripContextWindowSuffix } from '../core/model/context-window-suffix.js';
 const resolveModule = createRequire(import.meta.url);
 const CLAUDE_INTERRUPT_TIMEOUT_MS = 5_000;
@@ -148,6 +149,22 @@ export function resolveBundledClaudeExecutable() {
         return undefined;
     }
 }
+/**
+ * 探测内置 claude.exe 的版本。检测层与执行层共用同一份二进制，所以这里探到的
+ * 版本就是会话真正会跑的那个版本，可与 SDK 锁定的 claudeCodeVersion 对照。
+ */
+export function probeBundledClaudeVersion() {
+    const executable = resolveBundledClaudeExecutable();
+    if (!executable)
+        return undefined;
+    try {
+        const raw = execFileSync(executable, ['--version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        return raw.trim().split(/\s+/)[0] || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
 // Built-in tools execute inside the Claude runtime and are covered by the
 // runner's filesystem/shell policy. MCP and future unknown tools can perform
@@ -494,19 +511,28 @@ async function refreshGatewayPricing(baseUrl, apiKey, requestHeaders) {
  *
  * 若网关把窗口变体作为独立条目下发（目录里同时有 `claude-opus-5` 与
  * `claude-opus-5[1m]`），裸 ID 就是用户明确选的非 1M 变体，不能擅自升级，
- * 否则两条列表项的实际效果无法区分。只有目录未提供任何窗口变体时，才沿用
- * 按本地名单补 `[1m]` 的旧行为。
+ * 否则两条列表项的实际效果无法区分。只有目录未提供任何窗口变体时，才按已解析的
+ * 模型参数（缺失时才回退本地名单）补 `[1m]`。
  */
-function applyContextWindow(modelId, catalog) {
+function applyContextWindow(modelId, contextWindow, catalog) {
     if (hasContextWindowSuffix(modelId))
         return modelId; // 窗口已显式指定
     const variantListed = catalog?.models.some(m => hasContextWindowSuffix(m.id) && stripContextWindowSuffix(m.id) === modelId);
     if (variantListed)
         return modelId;
-    if (isOneMillionContextModel(modelId))
+    if (contextWindow === 1_000_000)
         return `${modelId}[1m]`;
     return modelId;
 }
+function resolveClaudeModelContext(modelId, catalog) {
+    const modelSpec = resolveModelSpec(resolvePaths().root, modelId, undefined, {
+        context_window: realContextWindowForModel(modelId),
+    });
+    return {
+        sdkModel: applyContextWindow(modelId, modelSpec.context_window, catalog),
+        contextWindow: modelSpec.context_window,
+    };
+}
 class MessageStream {
     queue = [];
     waiting = null;
@@ -1455,7 +1481,7 @@ export class AgentRunner {
      * SDK 原始事件 → 标准 AgentEvent 转换
      * 所有 SDK 特有的事件类型引用封装在此方法内
      */
-    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false, recoverySessionId) {
+    async *transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, isResuming = false, sandboxSettingsFile, permissionMode, turn, projectPath = process.cwd(), topicBinding = false, recoverySessionId, resolvedContextWindow) {
         let lastSessionId;
         let pendingSessionId;
         let hasTurnActivity = false;
@@ -1890,7 +1916,7 @@ export class AgentRunner {
                     const effectiveModel = callModel ?? this.model;
                     const isClaudeModel = isClaudeContextUsageModel(effectiveModel);
                     const totalTokens = contextTokensForUsage(u, !!isClaudeModel);
-                    const contextWindowTokens = realContextWindowForModel(sdkModel);
+                    const contextWindowTokens = resolvedContextWindow ?? realContextWindowForModel(sdkModel);
                     const autoCompactTokens = autoCompactWindowForModel(sdkModel);
                     const aggregateContextUsage = totalTokens > 0 ? {
                         totalTokens,
@@ -2200,7 +2226,17 @@ export class AgentRunner {
         if (callPermissionMode === 'fullaccess' && !hasTrustedFullAccessContext(runPermissionContext)) {
             throw new Error('Claude fullaccess requires a trusted per-call execution authorization');
         }
-        const executionSandbox = resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
+        // 系统会话明确声明不要沙箱时，直接按「沙箱关闭」处理。SDK 沙箱以项目目录为中心，
+        // 而系统会话的读写边界（$EVOLCORE_HOME 下的批次目录与记忆目录）与 cwd 无关，
+        // 启用之后只会把声明内的路径也挡在外面。边界由 systemSessionCheck 逐次判定。
+        const executionSandbox = runPermissionContext?.systemSessionSandbox === 'off'
+            ? {
+                permissionMode: normalizeExecutionPermissionMode(callPermissionMode),
+                role: runPermissionContext?.role,
+                state: 'off',
+                reason: 'phase-one-required',
+            }
+            : resolvePhaseOneExecutionSandbox(callPermissionMode, runPermissionContext?.role);
         const inputId = modelOverride?.turn?.inputId ?? crypto.randomUUID();
         if (executionSandbox.state !== 'off') {
             const activeSandboxFailure = getActiveSandboxInitializationFailure(undefined, undefined, sessionId);
@@ -2355,6 +2391,29 @@ export class AgentRunner {
                 delete toolInput.pages;
             }
             let updatedInput = toolInput === originalInput ? undefined : toolInput;
+            // Bash description 格式约定先于一切放行分支（含系统会话与 fullaccess）。
+            // TODO(bash-description): 该约束缺少验证——实测模型被拒后不会补 description 重试，
+            // 话题链等链路会被整条堵死。在补齐测试与重试引导前先短路放行，恢复时删除本开关。
+            if (process.env.EVOLCORE_BASH_DESCRIPTION_ENFORCE === '1') {
+                const descriptionCheck = checkBashDescription(toolName, toolInput);
+                if (descriptionCheck) {
+                    await recordPreflightDenial(toolName, toolInput, descriptionCheck, input.tool_use_id ?? input.toolUseID);
+                    return hookDecision('deny', descriptionCheck.message, updatedInput);
+                }
+            }
+            // 系统会话：模块判定即最终结论，不进入下面任何按角色 / permissionMode 的分支
+            const systemSessionCheck = this.permissionContexts.get(sessionId)?.systemSessionCheck;
+            if (systemSessionCheck) {
+                const decision = systemSessionCheck(toolName, toolInput);
+                if (!decision.allow) {
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, decision.code);
+                    return hookDecision('deny', decision.reason, updatedInput);
+                }
+                // ec 命令与普通托管 ec 命令一样在沙箱外执行（需要连 daemon IPC）；只读查询留在沙箱内
+                return hookDecision('allow', undefined, decision.ecCommand
+                    ? { ...toolInput, dangerouslyDisableSandbox: true }
+                    : updatedInput);
+            }
             if (callPermissionMode === 'fullaccess') {
                 if (!hasTrustedFullAccessContext(this.permissionContexts.get(sessionId))) {
                     return hookDecision('deny', 'fullaccess execution authorization is no longer active', updatedInput);
@@ -2435,6 +2494,7 @@ export class AgentRunner {
                 const readonlyContext = {
                     sessionId,
                     managedTempDir: permCtx?.managedTempDir,
+                    grantedReadRoots: permCtx?.grantedReadRoots,
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
@@ -2498,6 +2558,20 @@ export class AgentRunner {
         // SDK-level canUseTool 回调：接入 PermissionGateway 的用户审批入口
         // 黑名单已在 PreToolUse hook 拦截，危险命令在此处进入审批流程
         const canUseToolCallback = async (toolName, input, options) => {
+            // 系统会话：与 PreToolUse 同一判定，SDK 若仍走到这里也不进入交互 / 角色分支
+            const systemSessionCheck = this.permissionContexts.get(sessionId)?.systemSessionCheck;
+            if (systemSessionCheck) {
+                const decision = systemSessionCheck(toolName, input);
+                if (!decision.allow) {
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, decision.code);
+                    return { behavior: 'deny', message: decision.reason, decisionClassification: 'user_reject' };
+                }
+                return {
+                    behavior: 'allow',
+                    updatedInput: decision.ecCommand ? { ...input, dangerouslyDisableSandbox: true } : input,
+                    decisionClassification: 'user_permanent',
+                };
+            }
             // 特殊处理：AskUserQuestion 工具（SDK 内置的用户交互工具）
             // 这不是权限审批，而是收集用户答案，需要构造表单卡片
             if (toolName === 'AskUserQuestion') {
@@ -2612,6 +2686,7 @@ export class AgentRunner {
                 const readonlyContext = {
                     sessionId,
                     managedTempDir: permCtx?.managedTempDir,
+                    grantedReadRoots: permCtx?.grantedReadRoots,
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
@@ -2700,7 +2775,8 @@ export class AgentRunner {
         else {
             logger.info(`[AgentRunner] systemPromptAppend: none`);
         }
-        const sdkModel = applyContextWindow(resolveCatalogModel(runCatalog, callModel), runCatalog);
+        const catalogModel = resolveCatalogModel(runCatalog, callModel);
+        const { sdkModel, contextWindow } = resolveClaudeModelContext(catalogModel, runCatalog);
         const capabilityOptions = await this.resolveCapabilityRunOptions(projectPath);
         const managedSettings = callPermissionMode === 'fullaccess'
             ? undefined
@@ -2787,7 +2863,7 @@ export class AgentRunner {
             ...(executionSandbox.state === 'off' && callPermissionMode !== 'fullaccess' && process.platform === 'linux' ? {
                 spawnClaudeCodeProcess: (options) => spawnClaudeWithHClassGuard(options, resolvePaths().root, handleClaudeStderr, runPermissionContext?.selfAid ?? this.agentAid),
             } : {}),
-            autoCompactWindow: sdkAutoCompactWindowForModel(sdkModel),
+            autoCompactWindow: sdkAutoCompactWindowForModel(sdkModel, contextWindow),
             advisorModel: 'haiku',
             canUseTool: canUseToolCallback,
             permissionMode: sdkPermissionMode,
@@ -3013,7 +3089,7 @@ export class AgentRunner {
             this.interruptFns.set(sessionId, () => sdkStream.interrupt());
         }
         // 返回标准 AgentEvent 流（重试由 MessageProcessor 层负责）
-        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding, recoverySessionId);
+        const transformed = this.transformStream(sdkStream, sessionId, inputId, callModel, callEffort, sdkModel, !!agentSessionId, sandboxSettingsFile, callPermissionMode, modelOverride?.turn, projectPath, topicBinding, recoverySessionId, contextWindow);
         const self = this;
         return (async function* () {
             try {
@@ -3211,11 +3287,14 @@ export class AgentRunner {
         const catalog = useModel ? await this.getModelCatalog() : undefined;
         if (catalog)
             assertCatalogSelectable(catalog);
+        const resolvedModel = catalog && callModel
+            ? resolveClaudeModelContext(resolveCatalogModel(catalog, callModel), catalog)
+            : undefined;
         return query({
             prompt,
             options: {
                 cwd: projectPath,
-                ...(catalog && callModel ? { model: applyContextWindow(resolveCatalogModel(catalog, callModel), catalog) } : {}),
+                ...(resolvedModel ? { model: resolvedModel.sdkModel } : {}),
                 resume: agentSessionId,
                 maxTurns: 1,
                 tools: [],