evolcore 0.0.35 → 0.0.37

package/CHANGELOG.md

@@ -5,6 +5,48 @@
 
 ## Unreleased
 
+## 0.0.37 (2026-10-24)
+
+### 升级与重启稳定性
+
+- 修复升级重启过程中运行时资源版本不同步的问题，暂存运行文件时一并保留 `kits` 目录。
+- 修复 daemon Owner 通知配置异常或发送失败时可能影响重启恢复流程的问题；通知失败会保留诊断并继续执行重启。
+
+### 配置维护
+
+- 改进本地 Provider 配置文件的忽略规则，避免运行时凭据文件被误加入 Git 工作区。
+
+## 0.0.36 (2026-10-24)
+
+### Agent 创建与所有权
+
+- 默认使用一次性初始化创建 Agent，并提供独立的 Bootstrap 模式；初始化支持进度查询、超时识别和失败恢复。
+- 强化 Owner 绑定与共识确认流程，避免未完成授权的 Agent 提前激活或处理普通消息。
+- 支持创建 Agent 时上传头像，并完善创建状态、欢迎消息和多 Owner 交接。
+- AUN 私聊支持首个配置 Owner 通过纯 `/bind` 发起 ownership 绑定；系统会持续刷新待确认状态，且不影响带渠道参数的联系人绑定。
+
+### Provider 与模型
+
+- 支持按 Agent 基座类型选择 Provider 服务，并统一 Provider 配置、模型目录和备用模型处理。
+- 支持从运行环境导入 Provider 连接信息，允许在运行环境尚未配置完整时保存模型选择。
+- 改进模型不可用、连接配置和运行时切换的诊断。
+
+### 权限与运行稳定性
+
+- 按操作敏感度复用 Owner 共识缓存，并在敏感操作、Owner 变更和授权材料变化时重新核验。
+- 修复 Claude runner 未正确应用显式服务地址和 API 密钥的问题。
+- 改进 Codex 会话恢复、AUN 断线期间的 Owner 状态保留、Trigger 重试和跨话题复查。
+- 收紧受管临时路径识别和命令授权边界，提升权限拒绝原因的可读性。
+- 提升 AUN SDK 兼容要求，使用经过当前版本验证的依赖版本。
+
+### 技能与运维
+
+- 新增 `ec skill load`、`ec skill path` 和分页技能列表，支持按来源、描述和筛选条件查看技能。
+- 新增 `ec-agent-create` 技能，集中处理 Agent 创建、初始化、Bootstrap、恢复和验收流程。
+- 新增 `ec-group-collaboration` 技能，集中处理 AUN 协作群创建、邀请、规则、任务分派和验收。
+- 新增可恢复的 npm 升级任务、项目文件搜索和更完整的 EC Web 运维状态展示。
+- 改进 Windows 启动、自启动、联系人同步和基础配置诊断。
+
 ## 0.0.35 (2026-10-19)
 
 ### 权限与记忆

package/README.md

@@ -105,6 +105,12 @@ npm install -g evolcore
 
 Linux 全局安装会在 `postinstall` 阶段准备 Codex 受管运行所需的真实目录 `/etc/codex`。如果当前 npm 全局目录属于普通用户且该系统目录尚不存在，请先执行 `sudo install -d -m 0755 /etc/codex`，再重新安装。
 
+Linux 托管 Codex 在外层沙箱已遮蔽真实 `data/` 并仅重新暴露 daemon IPC socket 时，内层权限配置对这棵已遮蔽的数据树使用只读投影，避免重复 `deny` 阻断 socket 挂载或连接；这不开放真实 `data/instance/`，其中的 `control.token` 等数据仍不可见，也不需要关闭沙箱或提高关系权限。
+
+Ubuntu 24.04+ 若启用 `apparmor_restrict_unprivileged_userns=1`，Codex 受限会话启动前会运行实际 bwrap/user namespace 探针；探针失败时按 `codex_sandbox_userns_disabled_by_apparmor` fail closed，不会自动切换到全权限。请在服务实际运行环境执行 `ec diagnose --codex-sandbox`，由宿主为 EvolCore/Codex 配置最小范围的 AppArmor 允许规则，或提供等价隔离后端；不要全局关闭 AppArmor user namespace 限制。
+
+Linux 上 Claude 的沙箱执行需要可执行的 `bubblewrap`（`bwrap`）和 `socat`。安装器、npm postinstall 和 daemon 启动会检查并提醒缺失项，不会自动安装系统包或关闭沙箱；Debian/Ubuntu 可由管理员运行 `apt install bubblewrap socat`。`bwrap` 可复用 `EVOLCORE_BWRAP_PATH` 或 Codex 自带的可执行文件。安装后在服务相同的环境中运行 `ec diagnose --claude-sandbox`，同时验证依赖路径和基础命名空间启动；工具存在不代表容器的 user namespace/seccomp 配置一定可用。缺少依赖的任务不会自动恢复重试，修复后可人工 `/resume`。
+
 Windows 的 npm 安装和升级不会直接写入机器级 Codex 配置。配置使用 Codex 后，执行 `ec start` 或 `ec restart` 时会自动检测托管 Hook；缺失时自动请求 Windows 管理员授权（UAC），安装并复检成功后继续启动。已安装时直接继续，无需单独执行安装命令，详见 [Windows Codex 托管 Hook](docs/codex-windows-managed-hook.md)。
 
 如果取消 UAC 或安装失败，本次启动或重启会停止；重启检查发生在停止旧服务之前。已有策略异常或安装位置变化需要管理员核对，自动安装不会覆盖这些状态。

package/bin/install-codex-managed-hooks.mjs

@@ -649,10 +649,27 @@ export function provisionManagedFiles(options, acl = windowsAcl) {
   }
 }
 
-function main() {
+async function checkClaudeSandboxDependencies() {
+  try {
+    const runtime = await import('../dist/core/permission/sandbox-runtime.js');
+    const check = runtime.inspectClaudeSandboxDependencies();
+    if (check.status === 'missing' || hasArgument('--check-claude-sandbox')) {
+      process.stderr.write(`[evolcore] ${runtime.formatClaudeSandboxDependencies(check)}\n`);
+    }
+  } catch (error) {
+    process.stderr.write(`[evolcore] Claude sandbox dependency check unavailable: ${error.message}. Run ec diagnose before using sandbox-required Claude sessions.\n`);
+  }
+}
+
+async function main() {
+  if (hasArgument('--check-claude-sandbox')) {
+    await checkClaudeSandboxDependencies();
+    return;
+  }
   // An explicit package root selects provisioning, even if the elevated
   // child inherited npm lifecycle variables. Ordinary postinstall skips it.
   if (!argument('--package-root') && (lifecycleEvent() === 'postinstall' || isGlobalInstall())) {
+    await checkClaudeSandboxDependencies();
     runLinuxPostinstall();
     windowsPostinstallNotice();
     return;
@@ -697,7 +714,7 @@ if (process.argv[1] && pathToFileURL(fs.realpathSync(process.argv[1])).href ===
   const earlyRequirements = argument('--requirements')
     ? path.resolve(argument('--requirements'))
     : path.join(process.env.ProgramData || path.join(os.homedir(), 'ProgramData'), 'OpenAI', 'Codex', 'requirements.toml');
-  try { main(); } catch (error) {
+  void main().catch(error => {
     fail(error instanceof Error ? error.message : String(error), earlyRequirements);
-  }
+  });
 }

package/dist/agents/baseagent-availability.js

@@ -131,6 +131,6 @@ export async function getBaseagentSnapshot(options = {}) {
     }
     const detections = options.probe === false
         ? null
-        : (await import('./baseagent-availability.js')).detectBaseagentDetails();
+        : detectBaseagentDetails();
     return buildBaseagentSnapshot(config ?? {}, detections, options.loaded);
 }

package/dist/agents/baseagent.js

@@ -16,6 +16,7 @@ import { buildCliLaunchCommand, commandExists, isWindows, resolvePowerShellShimP
 import { execFileSync } from 'child_process';
 import { parse as parseToml } from 'smol-toml';
 import { readRuntimeEnvironmentVariable } from '../config/runtime-env.js';
+import { resolveProviderServiceForBaseagent, resolveProviderService } from '../config/providers.js';
 /** Resolve the installed Codex CLI entrypoint, including npm shims on Windows. */
 export function resolveCodexCliPath() {
     return resolveProbePath('codex');
@@ -138,6 +139,12 @@ function loadClaudeSettings() {
  * across Agent config, the process environment, and Claude Code settings.
  */
 export function resolveAnthropicDirectConfig(override, runtime) {
+    if (override?.provider !== undefined) {
+        const provider = resolveProviderService(override.provider, 'claude');
+        if (!provider.apiKey)
+            throw new Error(`Provider ${provider.providerId} has no API key`);
+        return { ...provider, apiKey: provider.apiKey };
+    }
     const explicit = directInferencePair(override?.apiKey, override?.baseUrl);
     if (explicit) {
         return {
@@ -163,6 +170,22 @@ export function resolveAnthropicDirectConfig(override, runtime) {
 }
 export function resolveAnthropicConfig(config, override, runtime) {
     const settings = loadClaudeSettings();
+    const providerId = override?.provider ?? config.agents?.claude?.provider;
+    if (providerId !== undefined) {
+        const provider = resolveProviderService(providerId, 'claude');
+        if (!provider.apiKey)
+            throw new Error(`Provider ${providerId} has no API key`);
+        return {
+            apiKey: provider.apiKey,
+            baseUrl: provider.baseUrl,
+            providerId,
+            headers: provider.headers,
+            queryParams: provider.queryParams,
+            model: override?.model || config.agents?.claude?.model || settings.model || 'sonnet',
+            effort: override?.effort || config.agents?.claude?.effort || settings.effortLevel || undefined,
+            pathToClaudeCodeExecutable: override?.pathToClaudeCodeExecutable || config.agents?.claude?.pathToClaudeCodeExecutable,
+        };
+    }
     const isPlaceholder = (v) => !v || v.includes('your-') || v.includes('placeholder');
     const resolveGatewayReference = (value) => {
         const name = value?.match(/^\$\{(ANTHROPIC_BASE_URL|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_API_KEY)\}$/u)?.[1];
@@ -276,6 +299,12 @@ export function loadCodexSettings() {
  * never combined with a partial Agent or process-environment configuration.
  */
 export function resolveOpenaiDirectConfig(override) {
+    if (override?.provider !== undefined) {
+        const provider = resolveProviderService(override.provider, 'codex');
+        if (!provider.apiKey)
+            throw new Error(`Provider ${provider.providerId} has no API key`);
+        return { ...provider, apiKey: provider.apiKey };
+    }
     const explicit = directInferencePair(override?.apiKey, override?.baseUrl);
     if (explicit) {
         return {
@@ -310,6 +339,28 @@ export function resolveOpenaiDirectConfig(override) {
 }
 export function resolveOpenaiConfig(config, override, runtime) {
     const codexSettings = loadCodexSettings();
+    const providerId = override?.provider ?? config.agents?.codex?.provider;
+    if (providerId !== undefined) {
+        const provider = resolveProviderService(providerId, 'codex');
+        if (!provider.apiKey)
+            throw new Error(`Provider ${providerId} has no API key`);
+        return {
+            apiKey: provider.apiKey,
+            authType: 'apiKey',
+            authSource: 'agent-config',
+            baseUrl: provider.baseUrl,
+            provider: providerId,
+            providerId,
+            headers: provider.headers,
+            queryParams: provider.queryParams,
+            model: override?.model || config.agents?.codex?.model || codexSettings.model || 'gpt-5.2-codex',
+            effort: override?.effort || override?.reasoning || config.agents?.codex?.effort || undefined,
+            enableRequestUserInput: override?.enableRequestUserInput ?? config.agents?.codex?.enableRequestUserInput ?? true,
+            approvalsReviewer: override?.approvalsReviewer ?? config.agents?.codex?.approvalsReviewer,
+            agentAid: runtime?.agentAid,
+            agentConfig: runtime?.agentConfig,
+        };
+    }
     const isPlaceholder = (v) => !v || v.includes('your-') || v.includes('placeholder');
     const overrideApiKey = isPlaceholder(override?.apiKey) ? undefined : override?.apiKey;
     const globalApiKey = isPlaceholder(config.agents?.codex?.apiKey) ? undefined : config.agents?.codex?.apiKey;
@@ -388,6 +439,17 @@ export function resolveGoogleConfig(config, override) {
         cliPath = commandExists('gemini') ? 'gemini' : '';
     }
     const model = override?.model || googleCfg?.model || 'gemini-2.5-flash';
+    const providerId = override?.provider ?? googleCfg?.provider;
+    if (providerId !== undefined) {
+        const provider = resolveProviderService(providerId, 'gemini');
+        if (!provider.apiKey)
+            throw new Error(`Provider ${providerId} has no API key`);
+        if (provider.queryParams && Object.keys(provider.queryParams).length > 0) {
+            throw new Error(`Provider ${providerId} gemini service queryParams are unsupported by the Gemini CLI runtime`);
+        }
+        return { cliPath, model, apiKey: provider.apiKey, providerId, baseUrl: provider.baseUrl, headers: provider.headers,
+            queryParams: provider.queryParams, mode: override?.mode || googleCfg?.mode || 'cli', useVertex: false };
+    }
     const overrideApiKey = isPlaceholder(override?.apiKey) ? undefined : override?.apiKey;
     const globalApiKey = isPlaceholder(googleCfg?.apiKey) ? undefined : googleCfg?.apiKey;
     const apiKey = overrideApiKey
@@ -409,6 +471,32 @@ export const DEFAULT_ECAGENT_MAX_RETRIES = 2;
 export const DEFAULT_ECAGENT_MAX_RETRY_DELAY_MS = 4_000;
 export function resolveEcagentConfig(config, override) {
     const configured = config.agents?.ecagent;
+    const providerId = override?.provider ?? configured?.provider;
+    if (providerId !== undefined) {
+        const providerServiceType = override?.providerServiceType ?? configured?.providerServiceType;
+        const provider = resolveProviderServiceForBaseagent(providerId, 'ecagent', providerServiceType);
+        if (provider.style !== 'openai-compatible') {
+            throw new Error(`Provider ${providerId} uses unsupported ecagent style: ${provider.style}`);
+        }
+        if (!provider.apiKey)
+            throw new Error(`Provider ${providerId} has no API key`);
+        const numberOr = (value, fallback) => (typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : fallback);
+        return {
+            apiKey: provider.apiKey,
+            baseUrl: provider.baseUrl,
+            headers: provider.headers,
+            queryParams: provider.queryParams,
+            model: override?.model || configured?.model || DEFAULT_ECAGENT_MODEL,
+            effort: override?.effort ?? configured?.effort,
+            timeoutMs: numberOr(override?.timeoutMs ?? configured?.timeoutMs, DEFAULT_ECAGENT_TIMEOUT_MS),
+            maxRetries: numberOr(override?.maxRetries ?? configured?.maxRetries, DEFAULT_ECAGENT_MAX_RETRIES),
+            maxRetryDelayMs: numberOr(override?.maxRetryDelayMs ?? configured?.maxRetryDelayMs, DEFAULT_ECAGENT_MAX_RETRY_DELAY_MS),
+            providerId,
+            providerServiceType: provider.serviceType,
+            providerStyle: provider.style,
+            modelOverrides: provider.modelOverrides,
+        };
+    }
     const isPlaceholder = (value) => !value
         || value.includes('your-')
         || value.includes('placeholder');

package/dist/agents/claude-runner.js

@@ -4,12 +4,15 @@ import { spawn, execFileSync } from 'child_process';
 import { createRequire } from 'module';
 import { ensureDir } from '../utils/atomic-write.js';
 import { resolveAnthropicConfig } from './baseagent.js';
+import { resolveProviderService } from '../config/providers.js';
 import { buildModelRequestHeaders } from './request-identity.js';
 import { DEFAULT_PERMISSION_MODE } from '../types.js';
 import { renderActionAsText } from '../core/interaction-router.js';
+import { sessionTopicThreadId } from '../core/thread/topic-id.js';
 import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../core/message/message-utils.js';
 import path from 'path';
 import fs from 'fs';
+import { assertOwnershipAuthorization } from '../core/ownership/owner-resolver.js';
 import os from 'os';
 import crypto from 'crypto';
 import { logger } from '../utils/logger.js';
@@ -25,7 +28,7 @@ import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
 import { normalizeExecutionPermissionMode, normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/permission/protected-paths.js';
-import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, isSandboxInitializationToolResult, recordSandboxInitializationFailure, getSandboxInitializationFailureCounters, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldEnableClaudeWeakerNestedSandbox, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createSandboxInitializationError, createClaudeSandboxDependencyError, inspectClaudeSandboxDependencies, getActiveSandboxInitializationFailure, isSandboxInitializationFailure, isSandboxInitializationToolResult, recordSandboxInitializationFailure, getSandboxInitializationFailureCounters, SANDBOX_INITIALIZATION_COOLDOWN_MS, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, shouldEnableClaudeWeakerNestedSandbox, shouldFailIfClaudeSandboxUnavailable, shouldLogSandboxCircuitNotice, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { auditToolInfrastructureFailure, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { getManagedTaskTempDir, isManagedSessionRuntimeDir } from '../cli/task-context.js';
@@ -158,7 +161,9 @@ export function probeBundledClaudeVersion() {
     if (!executable)
         return undefined;
     try {
-        const raw = execFileSync(executable, ['--version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const raw = execFileSync(executable, ['--version'], {
+            encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true, timeout: 3000,
+        });
         return raw.trim().split(/\s+/)[0] || undefined;
     }
     catch {
@@ -353,7 +358,7 @@ function inspectClaudePermissionExpansion(input, options, projectPath) {
             : input,
     };
 }
-function buildClaudeManagedLockdownSettings(capabilityOptions) {
+function buildClaudeManagedLockdownSettings(capabilityOptions, dependencies) {
     const settings = capabilityOptions?.settings;
     const rawAllowedMcpServers = settings && typeof settings === 'object' && !Array.isArray(settings)
         ? settings.allowedMcpServers
@@ -371,6 +376,7 @@ function buildClaudeManagedLockdownSettings(capabilityOptions) {
         disableSkillShellExecution: true,
         allowedHttpHookUrls: [],
         allowManagedPermissionRulesOnly: true,
+        ...(dependencies?.status === 'ready' ? { sandbox: { bwrapPath: dependencies.bwrapPath, socatPath: dependencies.socatPath } } : {}),
         ...(allowedMcpServers ? {
             allowManagedMcpServersOnly: true,
             allowedMcpServers,
@@ -700,7 +706,7 @@ export class AgentRunner {
         this.onSessionIdUpdate = onSessionIdUpdate;
         this.claudeExecutablePath = resolveBundledClaudeExecutable();
         if (config) {
-            const anthropic = resolveAnthropicConfig(this.getRuntimeGatewayConfig(), undefined, this.getRuntimeGatewayScope());
+            const anthropic = resolveAnthropicConfig(this.getRuntimeGatewayConfig(), { apiKey, baseUrl }, this.getRuntimeGatewayScope());
             this.apiKey = apiKey || anthropic.apiKey;
             this.claudeExecutablePath = anthropic.pathToClaudeCodeExecutable || this.claudeExecutablePath;
             this.customHeaders = buildModelRequestHeaders({
@@ -734,8 +740,14 @@ export class AgentRunner {
             return this.config;
         }
     }
-    getAgentEnv(runtimeEnv, evolcoreSessionId, permissionMode) {
-        const anthropicBaseUrl = appendQueryParams(this.baseUrl, this.customQueryParams);
+    getAgentEnv(runtimeEnv, evolcoreSessionId, permissionMode, providerOverride) {
+        const current = this.getRuntimeGatewayConfig();
+        const providerConfigured = providerOverride !== undefined || current.agents?.claude?.provider !== undefined;
+        const connection = providerConfigured ? resolveAnthropicConfig(current, providerOverride ? { provider: providerOverride } : undefined, this.getRuntimeGatewayScope())
+            : { baseUrl: this.baseUrl, apiKey: this.apiKey, headers: this.customHeaders, queryParams: this.customQueryParams };
+        const anthropicBaseUrl = appendQueryParams(connection.baseUrl, connection.queryParams);
+        const headers = providerConfigured ? buildModelRequestHeaders({ baseagent: 'claude', baseUrl: connection.baseUrl,
+            agentAid: this.agentAid, configuredHeaders: connection.headers }) : connection.headers;
         const env = sanitizeShellExecutionEnvironment({
             ...process.env,
             ANTHROPIC_AUTH_TOKEN: this.apiKey,
@@ -752,6 +764,12 @@ export class AgentRunner {
             ...(evolcoreSessionId ? { EVOLCORE_SESSION_ID: evolcoreSessionId } : {}),
             ...(runtimeEnv ?? {}),
         }, { lockExecutableResolution: permissionMode === 'readonly' });
+        if (providerConfigured) {
+            env.ANTHROPIC_AUTH_TOKEN = connection.apiKey;
+            env.ANTHROPIC_API_KEY = connection.apiKey;
+            env.ANTHROPIC_BASE_URL = anthropicBaseUrl;
+            env.ANTHROPIC_CUSTOM_HEADERS = Object.entries(headers ?? {}).map(([name, value]) => `${name}: ${value}`).join('\n');
+        }
         const trustedRootFullAccess = permissionMode === 'fullaccess'
             && typeof process.getuid === 'function'
             && process.getuid() === 0
@@ -766,7 +784,7 @@ export class AgentRunner {
             env.IS_SANDBOX = '1';
         else
             delete env.IS_SANDBOX;
-        const bubblewrapPath = resolveBubblewrapPath();
+        const bubblewrapPath = resolveBubblewrapPath(env);
         return bubblewrapPath
             ? prependExecutableDirectory(env, bubblewrapPath)
             : env;
@@ -817,7 +835,19 @@ export class AgentRunner {
         };
     }
     catalogConnection() {
-        return { baseUrl: this.baseUrl, apiKey: this.apiKey, headers: this.customHeaders, queryParams: this.customQueryParams };
+        const current = this.getRuntimeGatewayConfig();
+        if (current.agents?.claude?.provider !== undefined) {
+            const provider = resolveProviderService(current.agents.claude.provider, 'claude');
+            return { ...provider, headers: buildModelRequestHeaders({ baseagent: 'claude', baseUrl: provider.baseUrl,
+                    agentAid: this.agentAid, configuredHeaders: provider.headers }) };
+        }
+        return {
+            baseUrl: this.baseUrl,
+            apiKey: this.apiKey,
+            headers: this.customHeaders,
+            queryParams: this.customQueryParams,
+            providerId: this.config?.agents?.claude?.provider,
+        };
     }
     getModelCatalog() {
         return getRunnerCatalog('claude', this.agentAid, this.catalogConnection());
@@ -2357,6 +2387,12 @@ export class AgentRunner {
         const trustedSafeOutputCommands = new Set();
         // PreToolUse Hook - 黑名单检查 + input 修正（不可绕过，所有模式都走）
         const preToolUseHook = async (input, _toolUseId, hookOptions) => {
+            try {
+                await assertOwnershipAuthorization(this.permissionContexts.get(sessionId));
+            }
+            catch (error) {
+                return hookDecision('deny', error instanceof Error ? error.message : String(error));
+            }
             const pauseController = this.permissionContexts.get(sessionId)?.pauseController;
             if (pauseController) {
                 const pauseResult = await pauseController.waitAtToolBoundary(hookOptions?.signal);
@@ -2573,6 +2609,12 @@ export class AgentRunner {
                 };
             }
             // 特殊处理：AskUserQuestion 工具（SDK 内置的用户交互工具）
+            try {
+                await assertOwnershipAuthorization(this.permissionContexts.get(sessionId));
+            }
+            catch (error) {
+                return { behavior: 'deny', message: error instanceof Error ? error.message : String(error) };
+            }
             // 这不是权限审批，而是收集用户答案，需要构造表单卡片
             if (toolName === 'AskUserQuestion') {
                 return await this.handleAskUserQuestion(sessionId, input, options);
@@ -2777,10 +2819,14 @@ export class AgentRunner {
         }
         const catalogModel = resolveCatalogModel(runCatalog, callModel);
         const { sdkModel, contextWindow } = resolveClaudeModelContext(catalogModel, runCatalog);
+        const agentEnv = this.getAgentEnv(runtimeEnv, sessionId, callPermissionMode, modelOverride?.provider);
+        const dependencies = executionSandbox.state !== 'off' ? inspectClaudeSandboxDependencies(agentEnv) : undefined;
+        if (dependencies?.status === 'missing')
+            throw createClaudeSandboxDependencyError(dependencies);
         const capabilityOptions = await this.resolveCapabilityRunOptions(projectPath);
         const managedSettings = callPermissionMode === 'fullaccess'
             ? undefined
-            : buildClaudeManagedLockdownSettings(capabilityOptions);
+            : buildClaudeManagedLockdownSettings(capabilityOptions, dependencies);
         const sandboxOptions = executionSandbox.state === 'off'
             ? { enabled: false }
             : await (async () => {
@@ -2879,7 +2925,7 @@ export class AgentRunner {
             },
             ...(enableSummaries ? { agentProgressSummaries: true } : {}),
             stderr: handleClaudeStderr,
-            env: this.getAgentEnv(runtimeEnv, sessionId, callPermissionMode)
+            env: agentEnv
         };
         // Native Windows has a small CreateProcess command-line limit. The SDK
         // normally serializes `sandbox` into inline `--settings` JSON, so preserve
@@ -3001,10 +3047,11 @@ export class AgentRunner {
         if (sessionManager && agentSessionId) {
             try {
                 const currentSession = await sessionManager.getSessionById?.(sessionId);
-                if (currentSession?.threadId && topicBinding && typeof sessionManager.consumeTopicResumeAt === 'function') {
+                const currentTopicThreadId = sessionTopicThreadId(currentSession);
+                if (currentTopicThreadId && topicBinding && typeof sessionManager.consumeTopicResumeAt === 'function') {
                     resumeAt = await sessionManager.consumeTopicResumeAt({
                         sessionId,
-                        expectedThreadId: currentSession.threadId,
+                        expectedThreadId: currentTopicThreadId,
                         expectedAgentSessionId: agentSessionId,
                     });
                 }

package/dist/agents/codex/app-server-client.js

@@ -1,7 +1,7 @@
 import { spawn } from 'child_process';
 import readline from 'readline';
 import { logger } from '../../utils/logger.js';
-import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, } from '../../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, collectSandboxGuardDiagnostics, createCodexSandboxAvailabilityError, inspectCodexSandboxAvailability, probeCodexSandboxAvailability, summarizeBubblewrapArgsForLog, summarizeSandboxGuardDiagnostics, } from '../../core/permission/sandbox-runtime.js';
 import { resolveCodexLaunchCommand } from '../baseagent.js';
 import { createHash } from 'crypto';
 import { sanitizeShellExecutionEnvironment } from '../../core/permission/shell-environment.js';
@@ -71,6 +71,16 @@ export class CodexAppServerClient {
     constructor(options) {
         this.options = options;
     }
+    assertCodexSandboxAvailable(config, sandbox) {
+        if (process.platform !== 'linux')
+            return;
+        if (!hasPermissionProfile(config) && (!sandbox || sandbox === 'danger-full-access'))
+            return;
+        const availability = inspectCodexSandboxAvailability({ ...process.env, ...this.options.env });
+        const probe = probeCodexSandboxAvailability(availability);
+        if (!probe.ok)
+            throw createCodexSandboxAvailabilityError(probe);
+    }
     onNotification(handler) {
         this.notificationHandlers.add(handler);
         return () => this.notificationHandlers.delete(handler);
@@ -78,6 +88,7 @@ export class CodexAppServerClient {
     async threadStart(projectPath, options) {
         const effort = options?.effort ?? this.options.effort;
         const configUsesPermissionProfile = hasPermissionProfile(options?.config);
+        this.assertCodexSandboxAvailable(options?.config, options?.sandbox);
         return this.request('thread/start', {
             cwd: projectPath,
             model: options?.model ?? this.options.model ?? null,
@@ -100,6 +111,7 @@ export class CodexAppServerClient {
     async threadResume(threadId, projectPath, options) {
         const effort = options?.effort ?? this.options.effort;
         const configUsesPermissionProfile = hasPermissionProfile(options?.config);
+        this.assertCodexSandboxAvailable(options?.config, options?.sandbox);
         return this.request('thread/resume', {
             threadId,
             cwd: projectPath,
@@ -222,6 +234,7 @@ export class CodexAppServerClient {
     async threadFork(threadId, projectPath, title, options) {
         const effort = options?.effort ?? this.options.effort;
         const configUsesPermissionProfile = hasPermissionProfile(options?.config);
+        this.assertCodexSandboxAvailable(options?.config, options?.sandbox);
         const response = await this.request('thread/fork', {
             threadId,
             cwd: projectPath,
@@ -767,6 +780,10 @@ export class CodexAppServerClient {
             args.push('--config', `model_provider=${JSON.stringify(providerName)}`);
             args.push('--config', `model_providers.${provider}.name=${JSON.stringify('EvolCore runtime gateway')}`);
             args.push('--config', `model_providers.${provider}.wire_api=${JSON.stringify('responses')}`);
+            if (this.options.isolatedProvider) {
+                args.push('--config', `model_providers.${provider}.env_key=${JSON.stringify('CODEX_API_KEY')}`);
+                args.push('--config', `model_providers.${provider}.requires_openai_auth=false`);
+            }
             if (useRuntimeProvider || this.options.baseUrl) {
                 args.push('--config', `model_providers.${provider}.base_url=${JSON.stringify(this.options.baseUrl || 'https://api.openai.com/v1')}`);
             }