@bjoernrochel/sevro 0.1.0-rc.10 → 0.1.0-rc.11

package/docs/codex-host.md

@@ -37,7 +37,24 @@ partial, as do failed, malformed, or incomplete recognized reads. Direct
 exact `cat` wrapped by `lean-ctx -c` is accepted only when its reported output
 still contains the full body; a compressed summary cannot prove the read.
 The same exact-body check accepts a literal read followed by one literal `rg`
-command, separated by a semicolon or newline. It also accepts a chain of literal
+command, separated by a semicolon or newline. It also accepts a single-file
+literal `cat` of the skill followed by one or more literal `cat` reads of
+non-skill files, then one literal `rg` command, with the same separators. For
+example:
+
+```sh
+cat .agents/skills/darrow-guide/SKILL.md; cat docs/specs/repository-guide.md; rg -n -i 'offline|\bsla\b|service.level|guarantee|deployment' --glob '*.md' --glob '!docs/research/**' --glob '!**/SKILL.md' .
+```
+
+This sequence uses the shared stream and native read check. Quoted separators
+remain part of their literal operand. The initial skill body must match the
+beginning of the retained output, so later documentation or search output cannot
+replace an altered or incomplete initial read. Subsequent reads must not name
+another `SKILL.md` or resolve to a mounted or receipt-bound skill through an alias.
+The 64-operand bound applies across all reads in the sequence. Shell expansions,
+including unquoted glob and tilde operands, are unsupported in this form.
+
+The check also accepts a chain of literal
 `cat` fallbacks with `2>/dev/null` and `||`, ending in `true` followed by a newline
 and one literal `rg` discovery command. A fallback chain must resolve to one
 canonical file across all its read operands; absent alternate targets do not

package/docs/installing.md

@@ -22,10 +22,10 @@ Local installation records the selected version in the project lockfile.
 
 ## Current release
 
-The current release is `0.1.0-rc.10`. Install this exact version:
+The current release is `0.1.0-rc.11`. Install this exact version:
 
 ```sh
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.10
+bun add --exact @bjoernrochel/sevro@0.1.0-rc.11
 ```
 
 <!-- sevro-current-release:end -->

package/docs/runtime-v1.md

@@ -289,6 +289,15 @@ instead of being skipped. The wrapper denies network access and protected
 roots and owns asynchronous hook cleanup. Native timeout/cancellation stops
 owned hook descendants before private state is removed.
 
+Prepared native plugin projections live outside the fixture in the current
+host request's private native state. Curated hook read grants validate the
+canonical projection layout, ownership, private state permissions, and binding
+to that request. Only the selected plugin subtree is readable; it stays
+read-only, and credentials, private siblings, and peer requests remain denied.
+Ordinary filesystem declarations cannot select this exception. Codex still
+validates and filters installed plugins with a runtime policy when hooks are
+disabled. Projections are removed with their owning host request.
+
 Auxiliary `.mcp.json` and `.lsp.json` files and plugin mods are unsupported under
 hook authority. Manifest MCP/LSP declarations are removed from curated mounts.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bjoernrochel/sevro",
-  "version": "0.1.0-rc.10",
+  "version": "0.1.0-rc.11",
   "license": "SEE LICENSE IN LICENSE",
   "description": "A standalone evaluation runner for agentic coding capabilities",
   "type": "module",

package/src/hosts/codex-skill-reads.ts

@@ -38,6 +38,7 @@ function shellPayload(command: string): string {
 interface DirectRead {
   path: string;
   fallbackPaths?: string[];
+  documentationPaths?: string[];
   operandCount?: number;
   firstLine?: number;
   lastLine?: number;
@@ -68,9 +69,11 @@ function sedRead(payload: string, path: string): DirectRead | null {
   return { path: capturedReadPath(sed, 3), firstLine, lastLine };
 }
 function directRead(command: string): DirectRead | null {
-  const payload = compoundReadPayload(shellPayload(command).trim());
+  const shell = shellPayload(command).trim();
+  const payload = compoundReadPayload(shell);
   const path = "(?:\"([^\"]+)\"|'([^']+)'|([^\\s'\"`$;&|<>]+))";
   return (
+    sequentialRead(shell, path) ??
     catRead(payload, path) ??
     sedRead(payload, path) ??
     fallbackRead(payload, path)
@@ -79,6 +82,65 @@ function directRead(command: string): DirectRead | null {
 
 const LITERAL_WORD = "(?:\"[^\"$`\\\\]*\"|'[^']*'|[^\\s\"'\\\\`$;&|<>(){}#]+)";
 const LITERAL_WORDS = `${LITERAL_WORD}(?:[ \\t]+${LITERAL_WORD})*`;
+const SEQUENTIAL_WORD =
+  "(?:\"[^\"$`\\\\]*\"|'[^']*'|[^\\s\"'\\\\`$;&|<>(){}#*?\\[\\]~]+)";
+const SEQUENTIAL_WORDS = `${SEQUENTIAL_WORD}(?:[ \\t]+${SEQUENTIAL_WORD})*`;
+
+// Recognize only literal commands; quoted separators remain part of their word.
+function literalCommands(payload: string): string[] | null {
+  const clause = new RegExp(
+    `[ \\t\\r\\n]*(${SEQUENTIAL_WORDS})[ \\t]*(?:[;\\n]|$)`,
+    "gy",
+  );
+  const commands: string[] = [];
+  while (clause.lastIndex < payload.length) {
+    const match = clause.exec(payload);
+    if (!match || commands.length > MAX_NATIVE_READ_ATTEMPTS) return null;
+    commands.push(match.slice(1, 2).join(""));
+  }
+  return commands;
+}
+
+function sequentialRead(payload: string, path: string): DirectRead | null {
+  const commands = literalCommands(payload);
+  if (!commands || commands.length < 3) return null;
+  const search = commands.slice(-1).join("");
+  if (!new RegExp(`^(?:/usr/bin/)?rg[ \\t]+${LITERAL_WORDS}$`).test(search))
+    return null;
+  return sequentialCatRead(commands.slice(0, -1), path);
+}
+
+function sequentialCatRead(
+  commands: string[],
+  path: string,
+): DirectRead | null {
+  const first = singleSkillRead(commands.slice(0, 1).join(""), path);
+  if (!first) return null;
+  const operands = commands
+    .slice(1)
+    .map((command) => catOperands(command, path));
+  if (!operands.every((paths): paths is string[] => paths !== null))
+    return null;
+  const paths = operands.flat();
+  if (unsupportedDocumentationOperands(paths)) return null;
+  return {
+    ...first,
+    documentationPaths: paths,
+    operandCount: paths.length + 1,
+  };
+}
+
+function singleSkillRead(payload: string, path: string): DirectRead | null {
+  const read = catRead(payload, path);
+  return read?.operandCount === 1 ? read : null;
+}
+
+function unsupportedDocumentationOperands(paths: string[]): boolean {
+  return (
+    paths.length >= MAX_NATIVE_READ_ATTEMPTS ||
+    paths.some((path) => /(?:^|\/)SKILL\.md$/.test(path))
+  );
+}
 
 function compoundReadPayload(payload: string): string {
   const sequential = payload.match(
@@ -102,14 +164,11 @@ function fallbackRead(payload: string, path: string): DirectRead | null {
   ].map((match) => catRead(match.slice(1, 2).join(""), path));
   if (
     fallbackOperandCount(reads) > MAX_NATIVE_READ_ATTEMPTS ||
-    reads.some((read) => read === null)
+    !reads.every((read): read is DirectRead => read !== null)
   )
     return null;
-  const paths = reads.flatMap((read) => (read ? [read.path] : []));
-  const first = paths[0];
-  return first === undefined
-    ? null
-    : { path: first, fallbackPaths: paths.slice(1) };
+  const paths = reads.map((read) => read.path);
+  return { path: paths.slice(0, 1).join(""), fallbackPaths: paths.slice(1) };
 }
 
 function fallbackOperandCount(reads: Array<DirectRead | null>): number {
@@ -121,7 +180,7 @@ function unsupportedCatOptions(payload: string, paths: string[]): boolean {
   return paths.some((path) => path.startsWith("-"));
 }
 
-function catRead(payload: string, path: string): DirectRead | null {
+function catOperands(payload: string, path: string): string[] | null {
   const cat = payload.match(
     new RegExp(`^(?:/bin/)?cat\\s+(?:--\\s+)?(${path}(?:\\s+${path})*)$`),
   );
@@ -129,12 +188,14 @@ function catRead(payload: string, path: string): DirectRead | null {
   const paths = [
     ...cat.slice(1, 2).join("").matchAll(new RegExp(path, "g")),
   ].map((match) => capturedReadPath(match, 1));
+  return unsupportedCatOptions(payload, paths) ? null : paths;
+}
+
+function catRead(payload: string, path: string): DirectRead | null {
+  const paths = catOperands(payload, path);
+  if (!paths) return null;
   const skills = paths.filter((value) => /(?:^|\/)SKILL\.md$/.test(value));
-  if (
-    skills.length !== 1 ||
-    paths.length > MAX_NATIVE_READ_ATTEMPTS ||
-    unsupportedCatOptions(payload, paths)
-  )
+  if (skills.length !== 1 || paths.length > MAX_NATIVE_READ_ATTEMPTS)
     return null;
   return { path: skills.join(""), operandCount: paths.length };
 }
@@ -197,11 +258,26 @@ async function mountedReadPath(
   );
 }
 function readAttemptPaths(command: string): string[] {
-  const payload = compoundReadPayload(shellPayload(command).trim());
+  const shell = shellPayload(command).trim();
+  const payload = compoundReadPayload(shell);
   const path = "(?:\"([^\"]+)\"|'([^']+)'|([^\\s'\"`$;&|<>]+))";
   const fallback = fallbackRead(payload, path);
   if (fallback) return [fallback.path, ...(fallback.fallbackPaths ?? [])];
-  return literalReadAttemptPaths(payload, path);
+  const sequential = sequentialRead(shell, path);
+  if (sequential) return [sequential.path];
+  return [
+    ...literalReadAttemptPaths(payload, path),
+    ...sequentialReadAttemptPaths(shell, path),
+  ];
+}
+
+function sequentialReadAttemptPaths(payload: string, path: string): string[] {
+  const first = payload.match(
+    new RegExp(`^(${SEQUENTIAL_WORDS})[ \\t]*[;\\n]`),
+  );
+  if (!first) return [];
+  // The suffix may be unsupported. This records an attempt, never read credit.
+  return literalReadAttemptPaths(first.slice(1, 2).join(""), path);
 }
 function literalReadAttemptPaths(payload: string, path: string): string[] {
   const cat = payload.match(
@@ -323,8 +399,29 @@ async function resolvedSkillRead(
   if (skill === null) return null;
   const text = await verifiedSkillBody(actual, skill);
   if (text === null) return null;
+  if (
+    await ambiguousSequentialRead(
+      declaration.read,
+      commandCwd,
+      workspace,
+      pluginRoots,
+    )
+  )
+    return null;
   return skillReadReceipt(actual, skill, declaration, text);
 }
+
+async function ambiguousSequentialRead(
+  read: DirectRead,
+  commandCwd: string,
+  workspace: string,
+  pluginRoots: string[],
+): Promise<boolean> {
+  for (const path of read.documentationPaths ?? [])
+    if (await mountedReadPath(path, commandCwd, workspace, pluginRoots))
+      return true;
+  return false;
+}
 async function resolvedReadPath(
   read: DirectRead,
   commandCwd: string,
@@ -344,10 +441,19 @@ function skillReadReceipt(
 ): VerifiedRead | null {
   const range = readRange(text, declaration.read);
   if (range[0] === range[1]) return null;
-  if (!declaration.output.includes(text.slice(...range))) return null;
+  if (!matchesReadOutput(declaration, text.slice(...range))) return null;
   return { skill, path: actual, range, bodyLength: text.length };
 }
 
+function matchesReadOutput(
+  declaration: { read: DirectRead; output: string },
+  expected: string,
+): boolean {
+  if (declaration.read.documentationPaths !== undefined)
+    return declaration.output.startsWith(expected);
+  return declaration.output.includes(expected);
+}
+
 function fullCoverage(
   ranges: Array<[number, number]>,
   length: number,

package/src/hosts/codex-state.ts

@@ -77,7 +77,7 @@ export async function codexHookMounts(
   if (!request.runtimePolicy) return undefined;
   const hooks = await prepareHookMounts({
     workspace: request.workspace,
-    stateRoot: join(request.workspace, ".git", "sevro-runtime"),
+    stateRoot: state.stateRoot,
     privateRoot: state.codexHome,
     pluginRoots: installedPluginRoots,
     protectedRoots: state.protectedRoots,
@@ -380,7 +380,7 @@ export async function prepareCodexState(
   const shellRoot = await fixtureShellRoot(request, paths.parentHome);
   const env = codexEnvironment(paths, request, shellRoot);
   applyCodexRuntime(runtime, env, paths);
-  return { ...paths, sandboxBinary, profileId, env, protectedRoots };
+  return { ...paths, stateRoot, sandboxBinary, profileId, env, protectedRoots };
 }
 
 function requireCodexRuntimeReadRoots(

package/src/hosts/linux-sandbox.ts

@@ -54,7 +54,7 @@ export async function prepareLinuxSandboxCommand(
   requireLinuxSandbox();
   await requireNativeTranscriptViews(options.transcriptReadRoots);
   await requireCandidateArtifactRoots(options.candidateArtifactRoots);
-  await requireNativeHookRoots(options.hookReadRoots);
+  await requireNativeHookRoots(options.hookReadRoots, options.privateStateRoot);
   requireIsolationPaths(options);
   const workspace = await realpath(options.workspace);
   const roots = options.protectedRootsCanonical

package/src/hosts/mac-sandbox.ts

@@ -2,7 +2,10 @@ import { randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
 import { mkdir, realpath, rm, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
-import { requireNativeTranscriptViews } from "../native-transcript-state";
+import {
+  requireNativeTranscriptViews,
+  requireNativeHookRoots,
+} from "../native-transcript-state";
 import { requireCandidateArtifactRoots } from "../candidate-artifacts";
 import { workspaceBoundaryException } from "../workspace-state";
 import {
@@ -148,6 +151,7 @@ export async function prepareMacSandboxCommand(
   requireSandboxAvailable();
   await requireNativeTranscriptViews(options.transcriptReadRoots);
   await requireCandidateArtifactRoots(options.candidateArtifactRoots);
+  await requireNativeHookRoots(options.hookReadRoots, options.privateStateRoot);
   requireIsolationPaths(options);
   const workspace = await realpath(options.workspace);
   const roots = options.protectedRootsCanonical
@@ -170,10 +174,7 @@ export async function prepareMacSandboxCommand(
       options.denyNetwork,
       readRoots,
       ownedRoot,
-      [
-        ...(options.transcriptReadRoots ?? []),
-        ...Object.values(options.candidateArtifactRoots ?? {}),
-      ],
+      curatedReadRoots(options),
       workspace,
     ),
     { flag: "wx", mode: 0o600 },
@@ -186,6 +187,14 @@ export async function prepareMacSandboxCommand(
   };
 }
 
+function curatedReadRoots(options: IsolationOptions): string[] {
+  return [
+    ...(options.transcriptReadRoots ?? []),
+    ...(options.hookReadRoots ?? []),
+    ...Object.values(options.candidateArtifactRoots ?? {}),
+  ];
+}
+
 function requireSandboxAvailable(): void {
   if (process.platform !== "darwin" || !existsSync(SANDBOX_EXEC))
     throw new HostIsolationError("macOS sandbox-exec isolation is unavailable");

package/src/native-transcript-state.ts

@@ -84,20 +84,39 @@ export async function requireNativeTranscriptViews(
 /** Curated hook copies are a separate runner-owned exception, never policy roots. */
 export async function requireNativeHookRoots(
   roots: string[] | undefined,
+  privateRoot: string,
 ): Promise<void> {
-  for (const root of roots ?? []) await requireNativeHookRoot(root);
+  for (const root of roots ?? [])
+    await requireNativeHookRoot(root, privateRoot);
 }
 
-async function requireNativeHookRoot(root: string): Promise<void> {
+async function requireNativeHookRoot(
+  root: string,
+  privateRoot: string,
+): Promise<void> {
   const parent = await nativeStateParent();
   const state = dirname(dirname(root));
   if (!nativeHookLayout(root, state, parent) || (await realpath(root)) !== root)
     throw new Error("native hook read root must be a canonical curated mount");
+  await requireNativeHookOwner(state, privateRoot);
   const info = await lstat(root);
   if (!info.isDirectory() || info.uid !== userInfo().uid)
     throw new Error("native hook read root must be owned");
 }
 
+async function requireNativeHookOwner(
+  state: string,
+  privateRoot: string,
+): Promise<void> {
+  if (
+    dirname(privateRoot) !== state ||
+    (await realpath(privateRoot)) !== privateRoot
+  )
+    throw new Error("native hook read root must belong to the current request");
+  requirePrivateNamespace(await lstat(state));
+  requirePrivateNamespace(await lstat(privateRoot));
+}
+
 function nativeHookLayout(
   root: string,
   state: string,
@@ -105,7 +124,7 @@ function nativeHookLayout(
 ): boolean {
   return (
     dirname(state) === parent &&
-    basename(state).startsWith("claude-") &&
+    /^(?:claude|codex)-/.test(basename(state)) &&
     basename(dirname(root)) === "runtime-plugins" &&
     /^plugin-[0-9]+$/.test(basename(root))
   );

package/src/runtime-hooks.ts

@@ -217,7 +217,7 @@ async function hookReadRoots(
   ];
   const curated = trusted ? [root] : [];
   requireRuntimeReadRoots(ordinary, options.protectedRoots);
-  await requireNativeHookRoots(curated);
+  await requireNativeHookRoots(curated, options.privateRoot);
   return { ordinary, curated };
 }