@orion-agents/orion-code 0.1.2 → 0.1.4-2

package/dist/tools/index.js

@@ -10,9 +10,43 @@
  *
  * 使用 buildTool() 工厂模式。
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_SANDBOX_OPTIONS = exports.wrapForSandbox = exports.assessCommandSecurity = exports.isPotentiallyDestructive = exports.checkDangerousCommand = exports.isReadOnlyCommand = exports.POTENTIALLY_DESTRUCTIVE_PATTERNS = exports.DANGEROUS_PATTERNS = exports.READ_ONLY_COMMANDS = exports.TOOLS = exports.BATCH_READ_MAX_STEPS = exports.BATCH_READ_ALLOWED_TOOLS = void 0;
+exports.findDestructiveRmTarget = exports.assessCommandSecurity = exports.isPotentiallyDestructive = exports.checkDangerousCommand = exports.isReadOnlyCommand = exports.POTENTIALLY_DESTRUCTIVE_PATTERNS = exports.DANGEROUS_PATTERNS = exports.READ_ONLY_COMMANDS = exports.TOOLS = exports.BATCH_READ_MAX_STEPS = exports.BATCH_READ_ALLOWED_TOOLS = void 0;
 exports.getRuntimeTools = getRuntimeTools;
+exports.validateRegexPattern = validateRegexPattern;
 exports.executeTool = executeTool;
 exports.getToolNames = getToolNames;
 const child_process_1 = require("child_process");
@@ -20,12 +54,13 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 const readline_1 = require("readline");
 const tool_1 = require("../framework/tool");
+const tool_scheduler_1 = require("../framework/tool-scheduler");
 const external_assertion_1 = require("../framework/external-assertion");
 const tool_state_1 = require("../framework/tool-state");
 const tool_artifacts_1 = require("../core/tool-artifacts");
 const environment_1 = require("../product/environment");
-const memory_1 = require("../memory");
-const semantic_search_1 = require("../memory/semantic-search");
+const storage_1 = require("../memory/storage");
+const semantic_config_1 = require("../memory/semantic-config");
 const session_storage_1 = require("../services/session-storage");
 const web_1 = require("./web");
 const mcp_1 = require("./mcp");
@@ -35,6 +70,9 @@ const git_1 = require("./git");
 const lsp_1 = require("./lsp");
 const tools_1 = require("../runtime/goals/tools");
 const bash_security_1 = require("./bash_security");
+const debug_log_1 = require("../utils/debug-log");
+const errors_1 = require("../utils/errors");
+const sandbox_1 = require("./sandbox");
 exports.BATCH_READ_ALLOWED_TOOLS = new Set([
     'git_status',
     'list_files',
@@ -163,8 +201,8 @@ exports.TOOLS = [
             return writeFileSync_(path, content, context.cwd);
         },
         isDestructive: () => true,
+        isFileEdit: () => true,
         checkPermissions: (_args, _context) => {
-            // Destructive operation - ask for confirmation in default mode
             return { behavior: 'ask', reason: 'Write operation may modify existing files' };
         },
         userFacingName: args => `Write ${args.path}`,
@@ -250,7 +288,7 @@ exports.TOOLS = [
             const cmd = args.command || '';
             return /(rm\s+-rf|mkfs|dd\s)/.test(cmd);
         },
-        checkPermissions: (args, _context) => {
+        checkPermissions: (args, context) => {
             const cmd = args.command || '';
             // Use the bash_security module for comprehensive checks
             const security = (0, bash_security_1.assessCommandSecurity)(cmd);
@@ -260,14 +298,32 @@ exports.TOOLS = [
                     reason: security.reason || `Command blocked by safety policy: ${cmd.slice(0, 50)}`,
                 };
             }
+            // v0.1.3-2 §1.2: a configured-but-unusable sandbox is a hard deny, decided
+            // here so the user sees the reason instead of an opaque execution failure.
+            const workdir = context?.cwd ?? process.cwd();
+            const sandboxSettings = (0, sandbox_1.resolveSandboxSettings)(workdir);
+            let sandboxNote = '';
+            if ((sandboxSettings.profile ?? 'none') !== 'none') {
+                const plan = (0, sandbox_1.planSandboxedCommand)(cmd, { cwd: workdir, settings: sandboxSettings });
+                if (!plan.ok) {
+                    return {
+                        behavior: 'deny',
+                        reason: `sandbox profile "${plan.profile}" is configured but cannot be applied — ${plan.reason}`,
+                    };
+                }
+                sandboxNote = ` [${(0, sandbox_1.describeSandboxPlan)(plan)}]`;
+            }
             if (security.level === 'safe' && security.isReadOnly) {
                 return { behavior: 'allow' };
             }
             if (security.level === 'caution') {
-                return { behavior: 'ask', reason: security.reason || 'Command requires confirmation' };
+                return {
+                    behavior: 'ask',
+                    reason: (security.reason || 'Command requires confirmation') + sandboxNote,
+                };
             }
             // Default: ask for confirmation
-            return { behavior: 'ask', reason: 'Command requires confirmation' };
+            return { behavior: 'ask', reason: 'Command requires confirmation' + sandboxNote };
         },
         isReadOnly: args => {
             const cmd = args.command || '';
@@ -350,6 +406,7 @@ exports.TOOLS = [
             return editFile_(path, old_string, new_string, args.replace_all, args.fuzzy_match, args.preview, context.cwd);
         },
         isDestructive: () => true,
+        isFileEdit: () => true,
         checkPermissions: (_args, _context) => {
             return { behavior: 'ask', reason: 'Edit operation modifies file contents' };
         },
@@ -537,17 +594,18 @@ exports.TOOLS = [
                     createdAt: Date.now(),
                     updatedAt: Date.now(),
                 };
-                if ((0, semantic_search_1.isSemanticEnabled)()) {
+                if ((0, semantic_config_1.isSemanticEnabled)()) {
                     // saveAndIndex internally calls saveMemory + vectorStore.upsert
-                    await (0, semantic_search_1.getSemanticSearchService)().saveAndIndex(entry, projectPath);
+                    const { getSemanticSearchService } = await Promise.resolve().then(() => __importStar(require('../memory/semantic-search')));
+                    await getSemanticSearchService().saveAndIndex(entry, projectPath);
                 }
                 else {
-                    (0, memory_1.saveMemory)(entry, projectPath);
+                    (0, storage_1.saveMemory)(entry, projectPath);
                 }
                 return { success: true, output: `Saved memory: ${name} (${type})` };
             }
             catch (err) {
-                return { success: false, output: '', error: err.message };
+                return { success: false, output: '', error: (0, errors_1.errorMessage)(err) };
             }
         },
         isReadOnly: () => false,
@@ -584,11 +642,12 @@ exports.TOOLS = [
                 const query = args.query || '';
                 const type = args.type;
                 let memories;
-                if (query && (0, semantic_search_1.isSemanticEnabled)()) {
+                if (query && (0, semantic_config_1.isSemanticEnabled)()) {
                     // Semantic path: ask the vector store, then fall back to keywords if it
                     // returns nothing (e.g. embedding provider unreachable, empty index)
                     try {
-                        const result = await (0, semantic_search_1.getSemanticSearchService)().search({
+                        const { getSemanticSearchService } = await Promise.resolve().then(() => __importStar(require('../memory/semantic-search')));
+                        const result = await getSemanticSearchService().search({
                             query,
                             projectPath,
                             type,
@@ -602,25 +661,26 @@ exports.TOOLS = [
                             updatedAt: m.createdAt,
                         }));
                         if (memories.length === 0) {
-                            memories = (0, memory_1.searchMemories)(query, projectPath);
+                            memories = (0, storage_1.searchMemories)(query, projectPath);
                             if (type)
                                 memories = memories.filter(m => m.type === type);
                         }
                     }
-                    catch {
-                        memories = (0, memory_1.searchMemories)(query, projectPath);
+                    catch (error) {
+                        (0, debug_log_1.debugError)('tools.memory.semanticSearch', error, query);
+                        memories = (0, storage_1.searchMemories)(query, projectPath);
                         if (type)
                             memories = memories.filter(m => m.type === type);
                     }
                 }
                 else if (type) {
-                    memories = (0, memory_1.loadAllMemories)(projectPath).filter(m => m.type === type);
+                    memories = (0, storage_1.loadAllMemories)(projectPath).filter(m => m.type === type);
                 }
                 else if (query) {
-                    memories = (0, memory_1.searchMemories)(query, projectPath);
+                    memories = (0, storage_1.searchMemories)(query, projectPath);
                 }
                 else {
-                    memories = (0, memory_1.loadAllMemories)(projectPath);
+                    memories = (0, storage_1.loadAllMemories)(projectPath);
                 }
                 if (memories.length === 0) {
                     return { success: true, output: 'No memories found' };
@@ -635,7 +695,7 @@ exports.TOOLS = [
                 return { success: true, output: lines.join('\n') };
             }
             catch (err) {
-                return { success: false, output: '', error: err.message };
+                return { success: false, output: '', error: (0, errors_1.errorMessage)(err) };
             }
         },
         isReadOnly: () => true,
@@ -670,24 +730,26 @@ exports.TOOLS = [
             }
             try {
                 const projectPath = context?.cwd || process.cwd();
-                const existing = (0, memory_1.loadMemory)(name, projectPath);
+                const existing = (0, storage_1.loadMemory)(name, projectPath);
                 if (!existing) {
                     return { success: false, output: '', error: `Memory not found: ${name}` };
                 }
-                (0, memory_1.deleteMemory)(name, projectPath);
-                if ((0, semantic_search_1.isSemanticEnabled)()) {
+                (0, storage_1.deleteMemory)(name, projectPath);
+                if ((0, semantic_config_1.isSemanticEnabled)()) {
                     try {
                         const { getVectorStore } = require('../memory/vector-store');
                         getVectorStore().delete(name, projectPath);
                     }
-                    catch {
-                        // Vector store cleanup is best-effort
+                    catch (error) {
+                        // Vector store cleanup is best-effort, but a failure leaves an
+                        // orphaned embedding that keeps surfacing a deleted memory.
+                        (0, debug_log_1.debugError)('tools.memory.vectorDelete', error, name);
                     }
                 }
                 return { success: true, output: `Deleted memory: ${name}` };
             }
             catch (err) {
-                return { success: false, output: '', error: err.message };
+                return { success: false, output: '', error: (0, errors_1.errorMessage)(err) };
             }
         },
         isReadOnly: () => false,
@@ -782,7 +844,7 @@ exports.TOOLS = [
                 return { success: true, output: lines.join('\n') };
             }
             catch (err) {
-                return { success: false, output: '', error: err.message };
+                return { success: false, output: '', error: (0, errors_1.errorMessage)(err) };
             }
         },
         isReadOnly: () => true,
@@ -837,7 +899,9 @@ function normalizeToolPath(input) {
         try {
             return decodeURIComponent(new URL(value).pathname);
         }
-        catch {
+        catch (error) {
+            // Malformed URL or bad percent-encoding: strip the scheme so the path
+            // still reaches the caller's own validation instead of vanishing.
             return value.replace(/^file:\/\//u, '');
         }
     }
@@ -877,7 +941,10 @@ function safeReadFileSync(resolved) {
             return null;
         return (0, fs_1.readFileSync)(resolved, 'utf-8');
     }
-    catch {
+    catch (error) {
+        // Permission denied or a binary that is not valid UTF-8; callers treat null
+        // as "no content", which otherwise hides a real read failure.
+        (0, debug_log_1.debugError)('tools.safeReadFile', error, resolved);
         return null;
     }
 }
@@ -885,6 +952,56 @@ function safeReadFileSync(resolved) {
 function safePath(input, cwd = process.cwd()) {
     return (0, path_1.resolve)(cwd, normalizeToolPath(input));
 }
+/**
+ * Return true when `p` resolves (after following symlinks) to a location at or
+ * under `rootReal`. Used to enforce that a realpath is still inside the
+ * workspace even when directories along the path are themselves symlinks.
+ */
+function isUnderRealRoot(p, rootReal) {
+    const rel = (0, path_1.relative)(rootReal, p);
+    return rel === '' || (!rel.startsWith('..') && !(0, path_1.isAbsolute)(rel));
+}
+/**
+ * Contain a tool-resolved path inside the workspace root (cwd).
+ *
+ * Blocks `../` traversal and absolute paths outside the workspace, which would
+ * otherwise let `write_file`/`edit_file` scribble over `~/.bashrc`, SSH config
+ * or other projects — especially dangerous under `acceptEdits` auto-approval,
+ * where the write runs without a confirmation prompt (issue #65).
+ *
+ * Containment is lexical first, then re-checked after resolving symlinks
+ * (issue #99): a workspace symlink that points outside the workspace must not
+ * be followed into an arbitrary write target. We resolve the realpath of the
+ * parent directory (which also collapses any intermediate symlinked dirs) and,
+ * if the target already exists, the target itself; if either escapes the
+ * workspace we refuse. The workspace root is also realpath-resolved so a
+ * symlinked cwd does not produce false rejections. Fail-closed on any
+ * filesystem error.
+ */
+function isWithinWorkspace(resolved, cwd) {
+    const root = (0, path_1.resolve)(cwd);
+    const rel = (0, path_1.relative)(root, resolved);
+    if (!(rel === '' || (!rel.startsWith('..') && !(0, path_1.isAbsolute)(rel))))
+        return false;
+    try {
+        const rootReal = (0, fs_1.realpathSync)(root);
+        const realParent = (0, fs_1.realpathSync)((0, path_1.dirname)(resolved));
+        if (!isUnderRealRoot(realParent, rootReal))
+            return false;
+        // Only the existing target needs its own realpath check; a brand-new file
+        // inherits the (already-validated) containment of its parent directory.
+        if ((0, fs_1.existsSync)(resolved)) {
+            const realTarget = (0, fs_1.realpathSync)(resolved);
+            if (!isUnderRealRoot(realTarget, rootReal))
+                return false;
+        }
+    }
+    catch {
+        // A missing/unknowable realpath means we cannot prove containment — refuse.
+        return false;
+    }
+    return true;
+}
 /**
  * Truncate text to at most maxBytes UTF-8 bytes, cutting on a character
  * boundary (never inside a multi-byte sequence or surrogate pair). Returns the
@@ -977,13 +1094,21 @@ async function readFileSync_(path, maxLines, offset, cwd) {
         return { success: true, output: selected };
     }
     catch (err) {
-        return { success: false, output: '', error: String(err.message) };
+        return { success: false, output: '', error: (0, errors_1.errorMessage)(err) };
     }
 }
 async function writeFileSync_(path, content, cwd) {
     try {
         const normalizedPath = normalizeToolPath(path);
         const resolved = safePath(path, cwd);
+        const workspaceRoot = cwd ?? process.cwd();
+        if (!isWithinWorkspace(resolved, workspaceRoot)) {
+            return {
+                success: false,
+                output: '',
+                error: `Refusing to write outside the workspace: ${normalizedPath}`,
+            };
+        }
         (0, fs_1.writeFileSync)(resolved, content, 'utf-8');
         return {
             success: true,
@@ -991,7 +1116,7 @@ async function writeFileSync_(path, content, cwd) {
         };
     }
     catch (err) {
-        return { success: false, output: '', error: String(err.message) };
+        return { success: false, output: '', error: (0, errors_1.errorMessage)(err) };
     }
 }
 async function listFiles_(path, maxDepth, cwd) {
@@ -1038,17 +1163,50 @@ async function listFiles_(path, maxDepth, cwd) {
     return { success: true, output };
 }
 // Issue #32 #3.2: execCommand_ 支持 abortSignal
-async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseCwd) {
+async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseCwd, sandbox) {
+    const workdir = cwd ? safePath(cwd, baseCwd) : (baseCwd ?? process.cwd());
+    // v0.1.3-2 §1.2: plan the (possibly sandboxed) argv before spawning. A
+    // configured sandbox that cannot be honoured must refuse the command rather
+    // than silently degrade into an unsandboxed run.
+    const plan = (0, sandbox_1.planSandboxedCommand)(command, {
+        cwd: workdir,
+        settings: sandbox ?? (0, sandbox_1.resolveSandboxSettings)(baseCwd ?? process.cwd()),
+    });
+    if (!plan.ok) {
+        return {
+            success: false,
+            output: '',
+            error: `Refusing to run: sandbox profile "${plan.profile}" is configured but cannot be applied — ${plan.reason}. ` +
+                'Set sandbox.profile to "none" to run without isolation.',
+        };
+    }
     return new Promise(resolve => {
-        const workdir = cwd ? safePath(cwd, baseCwd) : (baseCwd ?? process.cwd());
         const timeoutMs = timeout ?? 30000;
         const maxBytes = maxOutput ?? 51200; // Default 50KB, Issue #28 fix
-        // Use spawn for streaming output with truncation support
+        // The docker backend bind-mounts `workdir` into the container; the host
+        // directory must exist at container-creation time or the mount fails with a
+        // confusing "nonexistent directory" error. Create it deterministically
+        // rather than relying on docker to materialise it.
+        if (plan.backend === 'docker') {
+            try {
+                (0, fs_1.mkdirSync)(workdir, { recursive: true });
+            }
+            catch {
+                // If it cannot be created we let the spawn fail with a clear error.
+            }
+        }
+        // Use spawn for streaming output with truncation support. The user command
+        // is a single argv element, so no intermediate shell re-parses it.
         const useProcessGroup = process.platform !== 'win32';
-        const child = (0, child_process_1.spawn)('sh', ['-c', command], {
+        const child = (0, child_process_1.spawn)(plan.file, plan.args, {
             cwd: workdir,
             detached: useProcessGroup,
         });
+        // Issue #53: exec_command runs a complete command as a single argv element
+        // and never pipes input into it. If stdin stays open, stdin-reading commands
+        // (cat, sort, grep, `python3 -`, ...) block waiting for EOF until the timeout.
+        // Close it immediately so the child receives EOF and can proceed.
+        child.stdin?.end();
         let stdoutData = '';
         let stderrData = '';
         let stdoutTruncated = false;
@@ -1058,6 +1216,10 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
         let stderrBytes = 0;
         let interrupted = null;
         // Issue #32 #3.2: AbortSignal 处理
+        // Declared uninitialized on purpose: `finish()` below closes over it before the
+        // `timeoutId = setTimeout(...)` assignment. `const` without an initializer is a
+        // compile error (TS1155), and inlining the assignment would put it in the closure's TDZ.
+        // eslint-disable-next-line prefer-const
         let timeoutId;
         let killTimerId;
         let settled = false;
@@ -1126,13 +1288,19 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
         child.stdout.on('data', (data) => {
             if (!stdoutTruncated) {
                 const chunk = data.toString();
-                stdoutBytes += chunk.length;
-                if (stdoutBytes > maxBytes) {
+                // Issue #30: count UTF-8 bytes, not UTF-16 code units, so CJK/emoji
+                // output is bounded by `maxBytes` (a UTF-16 count could exceed it ~2x).
+                const chunkBytes = Buffer.byteLength(chunk, 'utf8');
+                if (stdoutBytes + chunkBytes > maxBytes) {
                     stdoutTruncated = true;
-                    stdoutData += chunk.slice(0, maxBytes - stdoutData.length);
+                    const room = Math.max(0, maxBytes - stdoutBytes);
+                    // Byte-accurate truncation that respects multi-byte character boundaries.
+                    stdoutData += truncateToBytes(chunk, room).text;
+                    stdoutBytes = maxBytes;
                 }
                 else {
                     stdoutData += chunk;
+                    stdoutBytes += chunkBytes;
                 }
             }
         });
@@ -1140,13 +1308,17 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
         child.stderr.on('data', (data) => {
             if (!stderrTruncated) {
                 const chunk = data.toString();
-                stderrBytes += chunk.length;
-                if (stderrBytes > maxBytes) {
+                // Issue #30: count UTF-8 bytes, not UTF-16 code units.
+                const chunkBytes = Buffer.byteLength(chunk, 'utf8');
+                if (stderrBytes + chunkBytes > maxBytes) {
                     stderrTruncated = true;
-                    stderrData += chunk.slice(0, maxBytes - stderrData.length);
+                    const room = Math.max(0, maxBytes - stderrBytes);
+                    stderrData += truncateToBytes(chunk, room).text;
+                    stderrBytes = maxBytes;
                 }
                 else {
                     stderrData += chunk;
+                    stderrBytes += chunkBytes;
                 }
             }
         });
@@ -1154,7 +1326,7 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
             if (interrupted === 'aborted') {
                 finish({
                     success: false,
-                    output: stdoutData.slice(0, maxBytes),
+                    output: truncateToBytes(stdoutData, maxBytes).text,
                     error: 'Command aborted by user',
                 });
                 return;
@@ -1162,7 +1334,7 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
             if (interrupted === 'timeout') {
                 finish({
                     success: false,
-                    output: stdoutData.slice(0, maxBytes),
+                    output: truncateToBytes(stdoutData, maxBytes).text,
                     error: `Command timed out after ${timeoutMs}ms`,
                 });
                 return;
@@ -1312,6 +1484,14 @@ async function editFile_(path, old_string, new_string, replace_all, fuzzy_match,
     try {
         const normalizedPath = normalizeToolPath(path);
         const resolved = safePath(path, cwd);
+        const workspaceRoot = cwd ?? process.cwd();
+        if (!isWithinWorkspace(resolved, workspaceRoot)) {
+            return {
+                success: false,
+                output: '',
+                error: `Refusing to edit outside the workspace: ${normalizedPath}`,
+            };
+        }
         if (!(0, fs_1.existsSync)(resolved)) {
             return { success: false, output: '', error: `File not found: ${normalizedPath}` };
         }
@@ -1441,13 +1621,40 @@ async function editFile_(path, old_string, new_string, replace_all, fuzzy_match,
         };
     }
     catch (err) {
-        return { success: false, output: '', error: String(err.message) };
+        return { success: false, output: '', error: (0, errors_1.errorMessage)(err) };
     }
 }
 /** Escape special regex characters for literal matching */
 function escapeRegExp(str) {
     return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+/**
+ * Validate a caller-supplied regular expression pattern before compiling it.
+ *
+ * Issue #79: `grep_` compiles user/model-supplied patterns with `new RegExp`
+ * directly. A pathological pattern with a quantified group that itself contains
+ * a quantifier (e.g. `(a+)+`, `(\d+)*`) triggers catastrophic backtracking
+ * (ReDoS) and can hang the process on adversarial input (prompt injection).
+ * Reject empty/oversized patterns and the classic nested-quantifier shapes.
+ */
+function validateRegexPattern(pattern) {
+    if (!pattern)
+        return 'pattern must not be empty';
+    if (pattern.length > 2000)
+        return 'pattern is too long (max 2000 characters)';
+    // A group containing an internal quantifier, then quantified again: the
+    // canonical exponential-backtracking construction.
+    if (/\([^()]*[*+?][^()]*\)\s*[*+?]/.test(pattern)) {
+        return 'pattern contains a quantified group with an internal quantifier — this risks catastrophic backtracking (ReDoS)';
+    }
+    try {
+        new RegExp(pattern);
+    }
+    catch {
+        return 'pattern is not a valid regular expression';
+    }
+    return null;
+}
 // ============================================================================
 // Glob/Grep 工具实现
 // ============================================================================
@@ -1538,7 +1745,7 @@ async function glob_(pattern, basePath, cwd) {
         return { success: true, output };
     }
     catch (err) {
-        return { success: false, output: '', error: String(err.message) };
+        return { success: false, output: '', error: (0, errors_1.errorMessage)(err) };
     }
 }
 /**
@@ -1551,6 +1758,10 @@ async function grep_(pattern, basePath, globPattern, contextLines, cwd) {
         if (!(0, fs_1.existsSync)(base)) {
             return { success: false, output: '', error: `Path not found: ${normalizedBasePath}` };
         }
+        const patternError = validateRegexPattern(pattern);
+        if (patternError) {
+            return { success: false, output: '', error: `Invalid grep pattern: ${patternError}` };
+        }
         const regex = new RegExp(pattern);
         const context = contextLines ?? 0;
         const results = [];
@@ -1672,7 +1883,7 @@ async function grep_(pattern, basePath, globPattern, contextLines, cwd) {
         return { success: true, output: results.slice(0, maxResults).join('\n') + symlinkWarning };
     }
     catch (err) {
-        return { success: false, output: '', error: String(err.message) };
+        return { success: false, output: '', error: (0, errors_1.errorMessage)(err) };
     }
 }
 function isRecord(value) {
@@ -1778,6 +1989,35 @@ async function executeBatchRead(args, context) {
                 },
             ], error);
         }
+        // The scheduler resolved permissions for `batch_read` itself, not for the
+        // tools it fans out to. Without re-running the gate here, a project
+        // `deny: read_file(*.env)` rule -- and the plan-mode block -- apply to the
+        // flat call but not to the batched one, so the model can read a denied path
+        // simply by wrapping it in `batch_read`.
+        const stepPermission = (0, tool_1.getToolMetadataPresence)(tool).hasPermissionCheck && tool.checkPermissions
+            ? tool.checkPermissions(step.args, context)
+            : undefined;
+        const effective = (0, tool_scheduler_1.resolveEffectivePermission)({
+            toolName: step.tool,
+            tool,
+            args: step.args,
+            permission: stepPermission,
+            permissionMode: context.permissionMode,
+            allowlist: context.toolAllowlist?.(step.tool, step.args),
+        });
+        if (effective.outcome === 'deny' || effective.outcome === 'block') {
+            const error = effective.reason || `Tool ${step.tool} is not permitted (${effective.source ?? 'policy'})`;
+            return buildBatchReadPayload(false, error, [
+                {
+                    index: i + 1,
+                    tool: step.tool,
+                    args: step.args,
+                    success: false,
+                    error,
+                    output: '',
+                },
+            ], error);
+        }
     }
     const stepResults = [];
     for (let i = 0; i < parsed.steps.length; i++) {
@@ -1804,7 +2044,7 @@ async function executeBatchRead(args, context) {
                 tool: step.tool,
                 args: step.args,
                 success: false,
-                error: err?.message || String(err),
+                error: (0, errors_1.errorMessage)(err),
                 output: '',
             });
         }
@@ -1839,6 +2079,10 @@ async function executeTool(name, args, abortSignal, toolContext) {
         abortSignal, // Issue #32 #3.2: 透传 abortSignal
         sessionId: toolContext?.sessionId,
         turnId: toolContext?.turnId,
+        // Must survive the rebuild: batch_read re-runs the permission gate on its
+        // sub-steps and reads both of these off the context.
+        permissionMode: toolContext?.permissionMode,
+        toolAllowlist: toolContext?.toolAllowlist,
     };
     const result = await tool.execute(args, context);
     // Assertions are generated by the runtime allowlist, never accepted from a
@@ -1895,6 +2139,5 @@ Object.defineProperty(exports, "isReadOnlyCommand", { enumerable: true, get: fun
 Object.defineProperty(exports, "checkDangerousCommand", { enumerable: true, get: function () { return bash_security_2.checkDangerousCommand; } });
 Object.defineProperty(exports, "isPotentiallyDestructive", { enumerable: true, get: function () { return bash_security_2.isPotentiallyDestructive; } });
 Object.defineProperty(exports, "assessCommandSecurity", { enumerable: true, get: function () { return bash_security_2.assessCommandSecurity; } });
-Object.defineProperty(exports, "wrapForSandbox", { enumerable: true, get: function () { return bash_security_2.wrapForSandbox; } });
-Object.defineProperty(exports, "DEFAULT_SANDBOX_OPTIONS", { enumerable: true, get: function () { return bash_security_2.DEFAULT_SANDBOX_OPTIONS; } });
+Object.defineProperty(exports, "findDestructiveRmTarget", { enumerable: true, get: function () { return bash_security_2.findDestructiveRmTarget; } });
 //# sourceMappingURL=index.js.map