evolcore 0.0.35 → 0.0.37

package/dist/agents/codex-runner.js

@@ -10,6 +10,8 @@ import { assertWindowsCodexFilesystemRuleBudget, buildCodexProtectedFilesystemRu
 import { CODEX_THREAD_ACTIVE_WRITER, CodexAppServerClient, } from './codex/app-server-client.js';
 import { resolveOpenaiConfig, resolveCodexCliPath, resolveCodexPowerShellShimPath, } from './baseagent.js';
 import { logger } from '../utils/logger.js';
+import { resolveProviderService } from '../config/providers.js';
+import { catalogHash } from '../core/model/catalog-service.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
 import { auditCodexApprovalDecision, auditPermissionLifecycle, auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { classifyError, ErrorType, getToolResultErrorText, isOutputTokenLimitError, isRetryableError } from '../utils/error-utils.js';
@@ -31,12 +33,19 @@ import { createHash, randomBytes } from 'crypto';
 import { buildModelRequestHeaders } from './request-identity.js';
 import { normalizeToolErrorClassification, normalizeToolErrorCode, normalizeToolErrorDetailCode, } from '../core/permission/tool-error-code.js';
 import fs from 'fs';
+import { assertOwnershipAuthorization } from '../core/ownership/owner-resolver.js';
 import path from 'path';
 import os from 'os';
 const APPROVAL_LOG_SUMMARY_MAX_LENGTH = 256;
 const CODEX_INTERRUPT_TIMEOUT_MS = 5_000;
 function toAgentErrorType(message) {
-    switch (classifyError(new Error(message))) {
+    // Forgetting the provider thread is the only remedy for a missing model.
+    // classifyError must keep returning MODEL_UNAVAILABLE for it, but the runner
+    // must not present it as a generic unknown failure.
+    const classification = classifyError(new Error(message));
+    if (classification === ErrorType.MODEL_UNAVAILABLE)
+        return ErrorType.MODEL_UNAVAILABLE;
+    switch (classification) {
         case ErrorType.CONTEXT_TOO_LONG: return 'context_too_long';
         case ErrorType.AUTH_ERROR: return 'auth';
         case ErrorType.API_ERROR:
@@ -172,6 +181,13 @@ function isCodexReasoningNotification(method) {
         || method === 'item/reasoning/summaryPartAdded';
 }
 const CODEX_THREAD_HANDOFF_TIMEOUT_MS = 2_000;
+/**
+ * A turn/start that never reached the backend leaves the previous writer being
+ * released asynchronously. The next resume in that same window is rejected with
+ * "already has an active writer"; retrying the resume — never the input — is safe
+ * because the failed turn consumed nothing.
+ */
+const CODEX_RESUME_WRITER_RETRY_DELAYS_MS = [150, 500, 1_000];
 function stableSecurityValue(value) {
     if (value === undefined)
         return 'undefined';
@@ -430,6 +446,8 @@ export class CodexRunner {
     appServerClient = null;
     /** Trusted fullaccess calls use a separate unmasked app-server process. */
     fullAccessAppServerClient = null;
+    retiredProviderClients = new Set();
+    providerClientRevisions = new WeakMap();
     onSessionIdUpdate;
     onCompactStart;
     permissionGateway;
@@ -483,18 +501,27 @@ export class CodexRunner {
         this.onSessionIdUpdate = callbacks.onSessionIdUpdate;
         this.codexVersion = runtime?.codexVersion;
     }
-    getAppServerClient(fullAccess = false) {
+    getAppServerClient(fullAccess = false, providerOverride) {
         const existing = fullAccess ? this.fullAccessAppServerClient : this.appServerClient;
-        if (existing)
+        const connection = this.currentProviderConfig(providerOverride);
+        const revision = connection.providerId ? catalogHash({
+            providerId: connection.providerId,
+            baseUrl: connection.baseUrl, apiKey: connection.apiKey,
+            headers: connection.headers, queryParams: connection.queryParams,
+        }) : undefined;
+        if (existing && (!revision || this.providerClientRevisions.get(existing) === revision))
             return existing;
+        if (existing)
+            this.retiredProviderClients.add(existing);
         const client = new CodexAppServerClient({
-            apiKey: this.resolvedConfig.apiKey,
+            apiKey: connection.apiKey,
             codexVersion: this.codexVersion,
-            authType: this.resolvedConfig.authType,
-            baseUrl: this.resolvedConfig.baseUrl,
-            provider: this.resolvedConfig.provider,
-            headers: this.resolvedConfig.headers,
-            queryParams: this.resolvedConfig.queryParams,
+            authType: connection.authType,
+            baseUrl: connection.baseUrl,
+            provider: connection.providerId ? `evolcore_registry_${catalogHash(connection.providerId).slice(0, 20)}` : connection.provider,
+            isolatedProvider: connection.providerId !== undefined,
+            headers: connection.headers,
+            queryParams: connection.queryParams,
             model: this.model,
             effort: this.effort,
             enableRequestUserInput: this.resolvedConfig.enableRequestUserInput,
@@ -506,6 +533,8 @@ export class CodexRunner {
             // until the cross-client archive fallback runs.
             onServerRequest: request => this.handleAppServerRequest(request),
         });
+        if (revision)
+            this.providerClientRevisions.set(client, revision);
         client.onNotification(notification => {
             this.trackApprovalItemNotification(notification);
             if (notification.method !== 'thread/closed')
@@ -529,6 +558,21 @@ export class CodexRunner {
         }
         return client;
     }
+    currentProviderConfig(providerOverride) {
+        const providerId = providerOverride ?? this.resolvedConfig.providerId;
+        if (!providerId)
+            return this.resolvedConfig;
+        const provider = resolveProviderService(providerId, 'codex');
+        if (!provider.apiKey)
+            throw new Error(`Provider ${provider.providerId} has no API key`);
+        return {
+            ...this.resolvedConfig,
+            ...provider,
+            apiKey: provider.apiKey,
+            headers: buildModelRequestHeaders({ baseagent: 'codex', baseUrl: provider.baseUrl,
+                agentAid: this.resolvedConfig.agentAid, configuredHeaders: provider.headers }),
+        };
+    }
     getAppServerClientForThread(threadId) {
         const subscribed = this.threadSubscriptions.get(threadId);
         if (subscribed)
@@ -612,6 +656,43 @@ export class CodexRunner {
         });
         return await releasePromise;
     }
+    /**
+     * Resume a thread whose previous writer may still be releasing. Unlike the
+     * cross-client handoff, this only covers the same connection: the owner is
+     * unsubscribed (and awaited) once before the bounded retries, and any other
+     * active-writer rejection is released to the caller unchanged.
+     */
+    async resumeThreadAllowingWriterRelease(appServer, threadId, projectPath, threadOptions, previousAppServer) {
+        try {
+            return await appServer.threadResume(threadId, projectPath, threadOptions);
+        }
+        catch (error) {
+            if (!isCodexActiveWriterError(error) || (previousAppServer && previousAppServer !== appServer))
+                throw error;
+        }
+        const subscription = this.threadSubscriptions.get(threadId);
+        if (subscription?.client === appServer && subscription.state === 'subscribed') {
+            await this.releaseThreadSubscription(appServer, threadId, 'writer-release-wait', {
+                waitForClose: true,
+                timeoutMs: CODEX_THREAD_HANDOFF_TIMEOUT_MS,
+            });
+        }
+        for (const delayMs of CODEX_RESUME_WRITER_RETRY_DELAYS_MS) {
+            await new Promise(resolve => {
+                const timer = setTimeout(resolve, delayMs);
+                timer.unref?.();
+            });
+            try {
+                return await appServer.threadResume(threadId, projectPath, threadOptions);
+            }
+            catch (error) {
+                if (!isCodexActiveWriterError(error))
+                    throw error;
+                logger.warn(`[CodexRunner] Thread writer still active after ${delayMs}ms: thread=${threadId}`);
+            }
+        }
+        return await appServer.threadResume(threadId, projectPath, threadOptions);
+    }
     async prepareThreadSubscription(client, threadId) {
         const existing = this.threadSubscriptions.get(threadId);
         if (!existing)
@@ -860,7 +941,7 @@ export class CodexRunner {
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
         return classifyEvolcoreShellCommand(command).kind !== 'none';
     }
-    armApprovedDelegationCommand(sessionId, argv) {
+    armApprovedDelegationCommand(sessionId, argv, approvalId) {
         const threadId = this.activeSessions.get(sessionId) ?? this.provisionalSessions.get(sessionId);
         const sessionToken = threadId ? this.ensureThreadCredentialLoaded(threadId) : undefined;
         const commandHash = hashDelegatedCommandArgv(argv);
@@ -868,7 +949,7 @@ export class CodexRunner {
         if (!sessionToken || !commandHash || !arm)
             return false;
         try {
-            return arm(sessionToken, commandHash);
+            return arm(sessionToken, commandHash, approvalId);
         }
         catch (error) {
             logger.warn(`[CodexRunner] delegation arm callback failed: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
@@ -959,8 +1040,9 @@ export class CodexRunner {
         this.pruneThreadOperationLocks();
     }
     resetAppServerClient() {
-        const clients = [this.appServerClient, this.fullAccessAppServerClient]
+        const clients = [...this.retiredProviderClients, this.appServerClient, this.fullAccessAppServerClient]
             .filter((client) => !!client);
+        this.retiredProviderClients.clear();
         this.appServerClient = null;
         this.fullAccessAppServerClient = null;
         this.threadSubscriptions.clear();
@@ -1232,7 +1314,7 @@ export class CodexRunner {
     }
     getModel() { return this.model; }
     getModelCatalog() {
-        return getRunnerCatalog('codex', this.resolvedConfig.agentAid, this.resolvedConfig);
+        return getRunnerCatalog('codex', this.resolvedConfig.agentAid, this.currentProviderConfig());
     }
     async listModels() {
         const catalog = await this.getModelCatalog();
@@ -1356,6 +1438,7 @@ export class CodexRunner {
                 // nested mount namespace; it can fail while creating a missing
                 // target such as triggers/history.jsonl.
                 expandLClassReadDeny: process.platform !== 'linux',
+                outerHClassGuard: process.platform === 'linux',
             }),
             ...this.resolveGitMetadataWriteRules(projectPath, mode),
             ...this.resolveSystemSessionWriteRules(sessionId),
@@ -1532,6 +1615,12 @@ export class CodexRunner {
         const normalizedInput = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput)
             ? toolInput
             : {};
+        try {
+            await assertOwnershipAuthorization(context);
+        }
+        catch (error) {
+            return { ok: true, applicable: true, decision: 'deny', reason: error instanceof Error ? error.message : String(error) };
+        }
         const isShellTool = isShellToolName(toolName); // canonical normalisation via tool-canonical.ts
         const recordPreToolUseDenial = async (policyCode, reason) => {
             const summary = summarizeToolInputForAudit(toolName, normalizedInput).slice(0, 512);
@@ -1924,7 +2013,7 @@ export class CodexRunner {
         this.chatModes.set(sessionId, callMode);
         const callApprovalPolicy = this.toApprovalPolicy(callMode);
         const executionSandbox = this.buildExecutionSandboxOptions(sessionId, callMode, projectPath, modelOverride?.bootstrapAgentMdPath, modelOverride?.personalMdPath, undefined);
-        const appServer = this.getAppServerClient(callMode === 'fullaccess');
+        const appServer = this.getAppServerClient(callMode === 'fullaccess', modelOverride?.provider);
         this.dropExpiredPendingInterrupt(sessionId);
         const effectiveApprovalPolicy = callApprovalPolicy;
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
@@ -1965,7 +2054,7 @@ export class CodexRunner {
             // Release that one thread before asking this client to resume it.
             previousAppServer = await this.prepareThreadSubscription(appServer, agentSessionId);
             try {
-                threadResponse = await appServer.threadResume(agentSessionId, projectPath, threadOptions);
+                threadResponse = await this.resumeThreadAllowingWriterRelease(appServer, agentSessionId, projectPath, threadOptions, previousAppServer);
             }
             catch (error) {
                 if (isCodexActiveWriterError(error) && previousAppServer && previousAppServer !== appServer) {
@@ -2075,6 +2164,7 @@ export class CodexRunner {
             completedTurnIds: new Set(),
             openToolCalls: new Map(),
             activeSubagentThreads: new Set(),
+            subagentUsage: new Map(),
             turnCompleted: false,
             inputId: turn?.inputId,
             inputAcceptedEmitted: false,
@@ -2088,7 +2178,14 @@ export class CodexRunner {
             // 仅从 turn/started 锁定权威 turnId — resume 时会有上一轮 turn 的残留通知
             // （如 thread/tokenUsage/updated）先于新 turn 到达，不能用它们 latch turnId
             const params = notification.params || {};
-            const notifThreadId = params.threadId ?? params.thread_id;
+            const notifThreadId = params.threadId ?? params.thread_id ?? params.thread?.id;
+            const spawnedBy = params.thread?.source?.subAgent?.thread_spawn?.parent_thread_id;
+            if (notification.method === 'thread/started' && typeof notifThreadId === 'string'
+                && (spawnedBy === threadId || this.childThreadSessions.get(notifThreadId) === sessionId)) {
+                const usage = state.subagentUsage.get(notifThreadId) ?? {};
+                usage.model = typeof params.thread?.model === 'string' ? params.thread.model : usage.model;
+                state.subagentUsage.set(notifThreadId, usage);
+            }
             const item = params.item && typeof params.item === 'object' ? params.item : undefined;
             const emittedByChild = typeof notifThreadId === 'string'
                 && this.childThreadSessions.get(notifThreadId) === sessionId;
@@ -2097,6 +2194,23 @@ export class CodexRunner {
             this.trackSubagentLifecycle(notification, state, appServer);
             if (emittedByChild && notifThreadId !== threadId) {
                 const childTurnId = this.extractTurnId(notification);
+                if (notification.method === 'thread/tokenUsage/updated') {
+                    const activeTurn = this.activeSubagentTurns.get(notifThreadId);
+                    if (childTurnId && activeTurn?.turnId === childTurnId) {
+                        this.recordSubagentUsage(state, notifThreadId, childTurnId, params.tokenUsage);
+                    }
+                }
+                if (notification.method === 'turn/completed') {
+                    const terminalUsage = params.turn?.tokenUsage ?? params.turn?.usage;
+                    if (terminalUsage && childTurnId && !state.subagentUsage?.get(notifThreadId)?.seenTurns?.has(childTurnId)) {
+                        this.recordSubagentUsage(state, notifThreadId, childTurnId, terminalUsage);
+                    }
+                }
+                if (notification.method === 'model/rerouted' && typeof params.toModel === 'string') {
+                    const childUsage = state.subagentUsage.get(notifThreadId) ?? {};
+                    childUsage.model = params.toModel;
+                    state.subagentUsage.set(notifThreadId, childUsage);
+                }
                 if (notification.method === 'turn/started' && childTurnId) {
                     this.activeSubagentTurns.set(notifThreadId, {
                         sessionId,
@@ -3010,6 +3124,7 @@ export class CodexRunner {
             return;
         }
         if (notification.method === 'item/completed' && key) {
+            this.revokeApprovalForItem(threadId, itemId);
             this.trackedApprovalItems.delete(key);
             return;
         }
@@ -3021,6 +3136,7 @@ export class CodexRunner {
                     : undefined;
             for (const [trackedKey, tracked] of this.trackedApprovalItems) {
                 if (tracked.threadId === threadId && (!completedTurnId || tracked.turnId === completedTurnId)) {
+                    this.revokeApprovalForItem(threadId, tracked.itemId);
                     this.trackedApprovalItems.delete(trackedKey);
                 }
             }
@@ -3043,6 +3159,14 @@ export class CodexRunner {
             ? conversationIdValue
             : undefined;
     }
+    revokeApprovalForItem(threadId, itemId) {
+        if (!threadId || typeof itemId !== 'string' || !itemId)
+            return;
+        const sessionId = this.findSessionKeyByThread(threadId);
+        if (!sessionId)
+            return;
+        this.permissionContexts.get(sessionId)?.revokeApprovedDelegationCommand?.(itemId);
+    }
     clearPendingToolDenialsForTurn(threadId, turnId) {
         for (const key of this.pendingToolDenials.keys()) {
             let parsed;
@@ -3311,12 +3435,14 @@ export class CodexRunner {
         logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${logSummary}`);
         const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
             || request.method === 'execCommandApproval';
-        const managedEcIntent = isCommandApproval && this.isManagedEvolcoreCommandIntent(toolInput);
         const sessionCredential = this.sessionTokenForSession(sessionKey, typeof params.threadId === 'string' ? params.threadId : undefined);
         const canonicalEcApproval = isCommandApproval
             ? this.resolveCanonicalEcApproval(toolInput, this.getManagedTempDir(sessionKey), sessionCredential)
             : undefined;
         const approvedCommand = canonicalEcApproval?.argv;
+        // Canonical parsing is authoritative. Intent classification remains a
+        // fail-closed signal for malformed EC-shaped commands that cannot be armed.
+        const managedEcIntent = isCommandApproval && (approvedCommand?.[0] === 'ec' || this.isManagedEvolcoreCommandIntent(toolInput));
         const denyInfrastructure = async (policyCode, message, errorDetailCode) => {
             logger.warn(`[CodexRunner] ${message}: session=${sessionKey} requestId=${request.id ?? '<missing>'}`);
             try {
@@ -3395,7 +3521,7 @@ export class CodexRunner {
                     return await denyInfrastructure('delegation_token_mismatch', 'EC command approval contains a delegation token different from the active thread credential');
                 }
                 if ((hasSessionCredential || canArmDelegation)
-                    && !this.armApprovedDelegationCommand(sessionKey, approvedCommand)) {
+                    && !this.armApprovedDelegationCommand(sessionKey, approvedCommand, approvalCallId ?? approvalRequestId)) {
                     return await denyInfrastructure('delegation_not_armed', 'EC command approval failed to arm delegation');
                 }
             }
@@ -4084,6 +4210,12 @@ export class CodexRunner {
     }
     async resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath = process.cwd(), operationCwd = workspacePath, requestId, callId) {
         const permissionContext = this.permissionContexts.get(sessionKey);
+        try {
+            await assertOwnershipAuthorization(permissionContext);
+        }
+        catch {
+            return 'deny';
+        }
         // 系统会话：审批路径同样只看模块判定（FileChange / PermissionGrant 一律被模块拒绝）
         if (permissionContext?.systemSessionCheck) {
             const decision = permissionContext.systemSessionCheck(toolName, toolInput);
@@ -4267,7 +4399,7 @@ export class CodexRunner {
             if (policyToolName === 'FileChange') {
                 return resolveRuntimeApproval(await this.permissionGateway.requestPermission(sessionKey, policyToolName, policyInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope, undefined, { fileChangeCwd: workspacePath }));
             }
-            return resolveRuntimeApproval(await this.permissionGateway.requestPermission(sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope));
+            return resolveRuntimeApproval(await this.permissionGateway.requestPermission(sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope, undefined, toolName === 'PermissionGrant' ? { filesystemCwd: operationCwd, workspacePath } : undefined));
         }
         if (mode === 'request' || mode === 'bypass') {
             const dangerous = await requestDangerousCommandPermission(this.permissionGateway, sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), grantScope, mode);
@@ -4735,8 +4867,16 @@ export class CodexRunner {
         }
     }
     trackSubagentLifecycle(notification, state, appServer) {
+        const subagentUsage = state.subagentUsage ?? (state.subagentUsage = new Map());
         const params = (notification.params || {});
         const item = params.item && typeof params.item === 'object' ? params.item : undefined;
+        if (item?.type === 'collabAgentToolCall' && typeof item.model === 'string') {
+            for (const childThreadId of Array.isArray(item.receiverThreadIds) ? item.receiverThreadIds : []) {
+                if (typeof childThreadId !== 'string')
+                    continue;
+                subagentUsage.set(childThreadId, { ...subagentUsage.get(childThreadId), model: item.model });
+            }
+        }
         if (!this.isSubagentActivityItem(item))
             return;
         const childThreadId = this.subagentThreadId(item);
@@ -4745,18 +4885,29 @@ export class CodexRunner {
         const kind = typeof item.kind === 'string' ? item.kind.toLowerCase() : '';
         if (kind === 'started') {
             state.activeSubagentThreads.add(childThreadId);
+            subagentUsage.set(childThreadId, {
+                ...subagentUsage.get(childThreadId),
+                subagentType: this.subagentType(item),
+                status: 'started',
+            });
             this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
             if (appServer)
                 this.markThreadSubscribed(appServer, childThreadId);
         }
         if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
             state.activeSubagentThreads.delete(childThreadId);
+            subagentUsage.set(childThreadId, {
+                ...subagentUsage.get(childThreadId),
+                subagentType: this.subagentType(item),
+                status: kind,
+            });
             if (appServer)
                 void this.releaseThreadSubscription(appServer, childThreadId, 'subagent-finished');
             this.unregisterChildThread(childThreadId);
         }
     }
     primeSubagentStateFromTurn(turn, state, appServer) {
+        const subagentUsage = state.subagentUsage ?? (state.subagentUsage = new Map());
         for (const item of this.getTurnItems(turn)) {
             if (!this.isSubagentActivityItem(item))
                 continue;
@@ -4766,12 +4917,22 @@ export class CodexRunner {
                 continue;
             if (kind === 'started') {
                 state.activeSubagentThreads.add(childThreadId);
+                subagentUsage.set(childThreadId, {
+                    ...subagentUsage.get(childThreadId),
+                    subagentType: this.subagentType(item),
+                    status: 'started',
+                });
                 this.registerChildThread(state.sessionId, childThreadId, state.projectPath);
                 if (appServer)
                     this.markThreadSubscribed(appServer, childThreadId);
             }
             else if (kind === 'completed' || kind === 'failed' || kind === 'stopped' || kind === 'killed') {
                 state.activeSubagentThreads.delete(childThreadId);
+                subagentUsage.set(childThreadId, {
+                    ...subagentUsage.get(childThreadId),
+                    subagentType: this.subagentType(item),
+                    status: kind,
+                });
                 if (appServer)
                     void this.releaseThreadSubscription(appServer, childThreadId, 'subagent-finished');
                 this.unregisterChildThread(childThreadId);
@@ -4790,6 +4951,7 @@ export class CodexRunner {
     }
     async *transformAppServerStream(notifications, sessionId, state, controller, unsubscribe, appServer) {
         try {
+            let completedTurn;
             let sessionIdEmitted = state.committed;
             if (sessionIdEmitted)
                 yield { type: 'session_id', sessionId: state.threadId };
@@ -4810,8 +4972,15 @@ export class CodexRunner {
                         throw persistenceError;
                     }
                 }
-                yield* this.mapAppServerNotification(notification, sessionId, state);
+                for (const event of this.mapAppServerNotification(notification, sessionId, state)) {
+                    if (event.type === 'complete')
+                        completedTurn = notification.params?.turn ?? {};
+                    else
+                        yield event;
+                }
             }
+            if (completedTurn)
+                yield this.mapAppServerTurnComplete(completedTurn, state);
         }
         finally {
             if (!state.committed && !state.persistenceFinalized && state.confirmProvisional) {
@@ -5503,16 +5672,83 @@ export class CodexRunner {
         const effort = typeof raw.effort === 'string' ? raw.effort : undefined;
         return { totalTokens, maxTokens, percentage, model, effort };
     }
+    recordSubagentUsage(state, threadId, turnId, raw) {
+        if (threadId === state.threadId || !raw || typeof raw !== 'object')
+            return;
+        const entries = state.subagentUsage ?? (state.subagentUsage = new Map());
+        const child = entries.get(threadId) ?? {};
+        const total = this.mapCodexTokenUsage(raw.total);
+        const last = this.mapCodexTokenUsage(raw.last ?? (raw.total ? undefined : raw));
+        const fields = ['input_tokens', 'output_tokens', 'cache_read_input_tokens', 'cache_creation_input_tokens'];
+        const previous = child.total;
+        const reset = total && previous && fields.some(field => (total[field] ?? 0) < (previous[field] ?? 0));
+        const usage = total && previous && !reset
+            ? Object.fromEntries(fields.map(field => [field, Math.max(0, (total[field] ?? 0) - (previous[field] ?? 0))]))
+            : last;
+        child.tokenUsage = raw;
+        if (total)
+            child.total = total;
+        child.model = typeof raw.model === 'string' ? raw.model
+            : typeof raw.context?.model === 'string' ? raw.context.model : child.model;
+        if (usage) {
+            (child.seenTurns ??= new Set()).add(turnId);
+            if (fields.some(field => (usage[field] ?? 0) > 0)) {
+                const model = child.model || 'unknown';
+                const byModel = child.usageByModel ?? (child.usageByModel = new Map());
+                const prior = byModel.get(model);
+                byModel.set(model, Object.fromEntries(fields.map(field => [field, (prior?.[field] ?? 0) + (usage[field] ?? 0)])));
+            }
+        }
+        entries.set(threadId, child);
+    }
     mapAppServerTurnComplete(turn, state) {
+        const subagentUsage = state.subagentUsage ?? (state.subagentUsage = new Map());
         const status = turn.status || 'completed';
         const outputLimit = status === 'failed' && isOutputTokenLimitError(new Error(turn.error?.message ?? ''));
-        const tokenUsage = this.mapCodexTokenUsage(state.tokenUsage?.last ?? turn.tokenUsage ?? turn.usage);
+        const parentTokenUsage = this.mapCodexTokenUsage(state.tokenUsage?.last ?? turn.tokenUsage ?? turn.usage);
+        const subagentUsages = [...subagentUsage.entries()]
+            .filter(([threadId]) => threadId !== state.threadId)
+            .flatMap(([threadId, subagent]) => [...(subagent.usageByModel ?? new Map())]
+            .map(([model, tokenUsage]) => ({ threadId, model, tokenUsage })));
+        // 窗口标识与实时窗口由 main 侧补全：优先 modelContextId，原始窗口需包含
+        // 子代理终端上报的 modelContextWindow。
         const terminalTokenUsage = turn.tokenUsage ?? turn.usage;
         const contextUsage = this.mapCodexContextUsage({
             ...state.tokenUsage,
             ...(terminalTokenUsage && typeof terminalTokenUsage === 'object' ? terminalTokenUsage : {}),
             ...(turn.contextUsage ?? state.tokenUsage?.contextUsage ?? state.tokenUsage?.context),
         }, state.modelContextId ?? state.model, this.pickNumber(state.tokenUsage?.modelContextWindow, state.tokenUsage?.model_context_window, terminalTokenUsage?.modelContextWindow, terminalTokenUsage?.model_context_window));
+        const modelCalls = [
+            ...(parentTokenUsage ? [{
+                    call_index: 0,
+                    model: state.model,
+                    source: 'turn',
+                    providerThreadId: state.threadId,
+                    tokenUsage: parentTokenUsage,
+                    contextUsage,
+                    degraded: true,
+                }] : []),
+            ...subagentUsages
+                .filter(({ tokenUsage }) => !!tokenUsage)
+                .map(({ threadId, model, tokenUsage }, index) => ({
+                call_index: (parentTokenUsage ? 1 : 0) + index,
+                model,
+                source: 'subagent',
+                providerThreadId: threadId,
+                tokenUsage: tokenUsage,
+                degraded: true,
+            })),
+        ];
+        const reportedUsages = [parentTokenUsage, ...subagentUsages.map(item => item.tokenUsage)]
+            .filter((usage) => !!usage);
+        const tokenUsage = reportedUsages.length
+            ? {
+                input_tokens: reportedUsages.reduce((sum, usage) => sum + (usage.input_tokens ?? 0), 0),
+                output_tokens: reportedUsages.reduce((sum, usage) => sum + (usage.output_tokens ?? 0), 0),
+                cache_read_input_tokens: reportedUsages.reduce((sum, usage) => sum + (usage.cache_read_input_tokens ?? 0), 0),
+                cache_creation_input_tokens: reportedUsages.reduce((sum, usage) => sum + (usage.cache_creation_input_tokens ?? 0), 0),
+            }
+            : undefined;
         const terminalReason = status === 'completed'
             ? undefined
             : status === 'interrupted'
@@ -5533,6 +5769,7 @@ export class CodexRunner {
             model: state.model,
             tokenUsage,
             contextUsage,
+            modelCalls: modelCalls.length ? modelCalls : undefined,
         };
     }
     getManagedTempDir(sessionId) {
@@ -5555,6 +5792,8 @@ export class CodexRunner {
                 set: {
                     EVOLCORE_SESSION_ID: sessionId,
                     EVOLCORE_HOME: resolveRoot(),
+                    // Let managed PowerShell resolve the native ec.ps1 shim without changing user policy.
+                    ...(process.platform === 'win32' ? { PSExecutionPolicyPreference: 'Bypass' } : {}),
                     ...(managedTempDir ? { EVOLCORE_SESSION_RUNTIME_DIR: managedTempDir } : {}),
                     ...(managedTempDir ? { EVOLCORE_RUNTIME_LOCK_DIR: path.join(managedTempDir, 'locks') } : {}),
                     ...(taskDelegationToken ? { [AGENT_DELEGATION_TOKEN_ENV]: taskDelegationToken } : {}),
@@ -5642,9 +5881,11 @@ export class CodexRunner {
         this.pruneThreadOperationLocks();
         this.threadOperationLocks.clear();
         await Promise.all([
+            ...[...this.retiredProviderClients].map(client => client.close()),
             this.appServerClient?.close(),
             this.fullAccessAppServerClient?.close(),
         ]);
+        this.retiredProviderClients.clear();
         this.codexSessionFileAdapter.close();
         this.appServerClient = null;
         this.fullAccessAppServerClient = null;