evolcore 0.0.1 → 0.0.3

package/dist/core/permission/tool-policy.js

@@ -0,0 +1,1019 @@
+import fs from 'fs';
+import path from 'path';
+import { randomUUID } from 'crypto';
+import { logger } from '../../utils/logger.js';
+import { resolveRoot } from '../../paths.js';
+import { containsHClassReference, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, } from '../protected-paths.js';
+import { classifyEvolcoreShellCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, } from './ec-command-parser.js';
+// 绝对禁止命令（所有角色、所有权限模式下都禁止，不可授权）
+// 这些是系统级破坏操作，任何情况下都不应该允许
+const ABSOLUTE_FORBIDDEN = [
+    /\bshutdown\b/, // 关机
+    /\breboot\b/, // 重启
+    /\bmkfs\b/, // mkfs (格式化文件系统)
+    /\bformat\s+[a-zA-Z]:/i, // format C: (格式化磁盘)
+    /\bdd\s+if=.*of=\/dev/, // dd 写入磁盘设备（读取操作允许）
+];
+const READONLY_SHELL_EXECUTABLES = new Set([
+    'ls', '/bin/ls', '/usr/bin/ls',
+    'cat', '/bin/cat', '/usr/bin/cat',
+]);
+// 危险操作（需要用户审批才能执行）
+// 这些操作有合理使用场景，但需要用户明确授权
+const DANGEROUS_PATTERNS = [
+    {
+        kind: 'rm-rf',
+        pattern: /\brm\b(?=[^;&|\r\n]*\s(?:-[A-Za-z]*r[A-Za-z]*|--recursive)(?:\s|=|$))(?=[^;&|\r\n]*\s(?:-[A-Za-z]*f[A-Za-z]*|--force)(?:\s|=|$))[^;&|\r\n]*/,
+        reason: '递归删除文件/目录，操作不可逆',
+        approvalScope: 'request',
+    },
+    { kind: 'sudo', pattern: /\bsudo\b/, reason: '以超级用户权限执行命令', approvalScope: 'request' },
+    { kind: 'chmod-777', pattern: /\bchmod\s+777/, reason: '设置文件为完全开放权限（安全风险）', approvalScope: 'request' },
+    { kind: 'device-redirect', pattern: />\s*\/dev\/(?!null\b)/, reason: '写入设备文件（可能影响系统）', approvalScope: 'request' },
+    { kind: 'windows-rd', pattern: /\brd\s+\/s/i, reason: '递归删除目录，操作不可逆', approvalScope: 'request' },
+    { kind: 'windows-del', pattern: /\bdel\s+\/[sfq]/i, reason: '强制/递归删除文件，操作不可逆', approvalScope: 'request' },
+    { kind: 'reg-delete', pattern: /\breg\s+delete/i, reason: '删除注册表项（Windows 系统配置）', approvalScope: 'request' },
+];
+function splitShellCommandSegments(command) {
+    const segments = [];
+    let segment = '';
+    let quote = null;
+    let escaped = false;
+    let substitutionDepth = 0;
+    const finish = () => {
+        if (segment.trim())
+            segments.push(segment.trim());
+        segment = '';
+    };
+    for (let index = 0; index < command.length; index++) {
+        const char = command[index];
+        if (escaped) {
+            segment += char;
+            escaped = false;
+            continue;
+        }
+        if (char === '\\' && quote !== 'single') {
+            segment += char;
+            escaped = true;
+            continue;
+        }
+        if (quote === 'single') {
+            segment += char;
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            segment += char;
+            if (char === '"')
+                quote = null;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char === "'" ? 'single' : 'double';
+            segment += char;
+            continue;
+        }
+        if (char === '$' && command[index + 1] === '(') {
+            substitutionDepth++;
+            segment += '$(';
+            index++;
+            continue;
+        }
+        if (char === ')' && substitutionDepth > 0) {
+            substitutionDepth--;
+            segment += char;
+            continue;
+        }
+        if (substitutionDepth === 0 && (char === ';' || char === '\n' || char === '|' || char === '&')) {
+            finish();
+            if ((char === '|' || char === '&') && command[index + 1] === char)
+                index++;
+            continue;
+        }
+        segment += char;
+    }
+    finish();
+    return segments;
+}
+function parseShellWords(segment) {
+    const words = [];
+    let word = '';
+    let started = false;
+    let quote = null;
+    let escaped = false;
+    const finish = () => {
+        if (started)
+            words.push(word);
+        word = '';
+        started = false;
+    };
+    for (const char of segment) {
+        if (escaped) {
+            word += char;
+            started = true;
+            escaped = false;
+            continue;
+        }
+        if (char === '\\' && quote !== 'single') {
+            escaped = true;
+            started = true;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = null;
+            else
+                word += char;
+            started = true;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"')
+                quote = null;
+            else
+                word += char;
+            started = true;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char === "'" ? 'single' : 'double';
+            started = true;
+            continue;
+        }
+        if (/\s/.test(char)) {
+            finish();
+            continue;
+        }
+        word += char;
+        started = true;
+    }
+    finish();
+    return words;
+}
+function commandName(value) {
+    return path.basename((value ?? '').replace(/^[({]+|[)}]+$/g, '')).toLowerCase();
+}
+function isOwnerOrAdminRole(role) {
+    return role === 'owner' || role === 'admin';
+}
+function hasNodeProcessTarget(command) {
+    return /\bnode(?:js|\.exe)?\b/i.test(command);
+}
+function classifyHostProcessArgv(argv) {
+    const executable = commandName(argv[0]);
+    if (['ps', 'pgrep', 'pidof'].includes(executable)) {
+        return { kind: 'process-read' };
+    }
+    if (['kill', 'pkill', 'killall'].includes(executable)) {
+        if (argv.some(hasNodeProcessTarget))
+            return undefined;
+        return { kind: 'process-signal' };
+    }
+    return undefined;
+}
+function classifyHostProcessCommand(command) {
+    const argv = parseLiteralShellArgv(command);
+    return argv ? classifyHostProcessArgv(argv) : undefined;
+}
+function skipCommandOptions(words, index, optionsWithValues) {
+    while (index < words.length) {
+        const word = words[index];
+        if (word === '--')
+            return index + 1;
+        if (!word.startsWith('-'))
+            return index;
+        const option = word.split('=', 1)[0];
+        index++;
+        if (!word.includes('=') && optionsWithValues.has(option))
+            index++;
+    }
+    return index;
+}
+function parseEffectiveCommand(segment) {
+    const words = parseShellWords(segment);
+    let index = 0;
+    while (index < words.length && ['if', 'then', 'do', 'while', 'until', '!'].includes(commandName(words[index])))
+        index++;
+    while (index < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[index]))
+        index++;
+    while (index < words.length) {
+        const executable = commandName(words[index]);
+        if (executable === 'env') {
+            index = skipCommandOptions(words, index + 1, new Set(['-u', '--unset', '-C', '--chdir', '-S', '--split-string']));
+            while (index < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[index]))
+                index++;
+            continue;
+        }
+        if (executable === 'sudo') {
+            index = skipCommandOptions(words, index + 1, new Set([
+                '-u', '--user', '-g', '--group', '-h', '--host', '-p', '--prompt', '-C', '--chdir', '-R', '--chroot', '-T', '--command-timeout',
+            ]));
+            continue;
+        }
+        if (['command', 'builtin', 'exec', 'nohup', 'time'].includes(executable)) {
+            index = skipCommandOptions(words, index + 1, new Set());
+            continue;
+        }
+        return executable ? { executable, args: words.slice(index + 1), raw: segment } : undefined;
+    }
+    return undefined;
+}
+function gitSubcommand(args) {
+    const optionsWithValues = new Set([
+        '-C', '-c', '--git-dir', '--work-tree', '--namespace', '--exec-path', '--config-env', '--super-prefix',
+    ]);
+    let index = 0;
+    while (index < args.length) {
+        const word = args[index];
+        if (word === '--') {
+            index++;
+            break;
+        }
+        if (!word.startsWith('-'))
+            break;
+        const option = word.split('=', 1)[0];
+        index++;
+        if (!word.includes('=') && optionsWithValues.has(option))
+            index++;
+    }
+    return { name: args[index]?.toLowerCase(), args: args.slice(index + 1) };
+}
+function classifyStructuredCommand(command, depth = 0) {
+    const matches = [];
+    for (const segment of splitShellCommandSegments(command)) {
+        const parsed = parseEffectiveCommand(segment);
+        if (!parsed)
+            continue;
+        if (parsed.executable === 'git') {
+            const subcommand = gitSubcommand(parsed.args);
+            if (['reset', 'clean', 'restore', 'rm', 'prune'].includes(subcommand.name ?? '')) {
+                matches.push({
+                    kind: 'git-destructive',
+                    reason: 'Git 破坏性子命令可能不可逆地丢弃本地变更',
+                    approvalScope: 'all',
+                });
+            }
+            else if (subcommand.name === 'checkout') {
+                matches.push({ kind: 'git-destructive', reason: 'Git checkout 可能覆盖工作区或切换本地状态', approvalScope: 'all' });
+            }
+            else if (subcommand.name === 'branch' && subcommand.args.includes('-D')) {
+                matches.push({ kind: 'git-destructive', reason: 'Git branch -D 会强制删除分支', approvalScope: 'all' });
+            }
+            else if (subcommand.name === 'update-ref') {
+                matches.push({ kind: 'git-destructive', reason: 'Git update-ref 会修改本地引用状态', approvalScope: 'all' });
+            }
+            else if (subcommand.name === 'reflog') {
+                matches.push({ kind: 'git-destructive', reason: 'Git reflog 可能修改或删除本地恢复记录', approvalScope: 'all' });
+            }
+            else if (subcommand.name === 'push') {
+                matches.push({ kind: 'git-push', reason: 'Git push 会修改远端仓库', approvalScope: 'request' });
+            }
+        }
+        if (['kill', 'pkill', 'killall'].includes(parsed.executable) && hasNodeProcessTarget(parsed.raw)) {
+            matches.push({ kind: 'process-kill', reason: '终止 Node.js 运行时进程', approvalScope: 'request' });
+        }
+        if (depth < 2 && ['bash', 'sh', 'zsh', 'dash', 'cmd', 'cmd.exe'].includes(parsed.executable)) {
+            const commandFlag = parsed.executable.startsWith('cmd') ? '/c' : '-c';
+            const commandIndex = parsed.args.findIndex(arg => arg.toLowerCase() === commandFlag);
+            if (commandIndex >= 0 && parsed.args[commandIndex + 1]) {
+                const nested = classifyStructuredCommand(parsed.args.slice(commandIndex + 1).join(' '), depth + 1);
+                if (nested)
+                    matches.push(nested);
+            }
+        }
+    }
+    return matches.find(match => match.approvalScope === 'all') ?? matches[0];
+}
+function containsNetStopCommand(command, depth = 0) {
+    return splitShellCommandSegments(command).some(segment => {
+        const parsed = parseEffectiveCommand(segment);
+        if (!parsed)
+            return false;
+        if ((parsed.executable === 'net' || parsed.executable === 'net.exe')
+            && parsed.args[0]?.toLowerCase() === 'stop') {
+            return true;
+        }
+        if (depth >= 2 || !['bash', 'sh', 'zsh', 'dash', 'cmd', 'cmd.exe'].includes(parsed.executable)) {
+            return false;
+        }
+        const commandFlag = parsed.executable.startsWith('cmd') ? '/c' : '-c';
+        const commandIndex = parsed.args.findIndex(arg => arg.toLowerCase() === commandFlag);
+        return commandIndex >= 0
+            && !!parsed.args[commandIndex + 1]
+            && containsNetStopCommand(parsed.args.slice(commandIndex + 1).join(' '), depth + 1);
+    });
+}
+/**
+ * 只读模式检查（用于 PreToolUse hook 和 canUseTool callback）
+ * 显式读工具自动允许；写工具和未知工具拒绝。
+ * Bash 默认拒绝；只允许由严格字面量解析器证明为 ls/cat 的只读命令。
+ * 通过 EC Shell 边界分类的整条字面量调用应由 runner 在调用本函数前放行。
+ */
+export function checkReadonly(toolName, input, projectPath, context) {
+    const readOnlyTools = new Set([
+        'Read', 'Glob', 'Grep', 'WebSearch', 'WebFetch',
+        'TaskList', 'TaskGet', 'ToolSearch',
+    ]);
+    if (readOnlyTools.has(toolName))
+        return { behavior: 'allow' };
+    if (toolName === 'Write' || toolName === 'Edit' || toolName === 'NotebookEdit') {
+        const filePath = (input.file_path || input.notebook_path);
+        logger.warn(`[ReadonlyCheck] 🔒 File write blocked: tool=${toolName} path=${filePath} project=${projectPath} session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+        return { behavior: 'deny', message: '🔒 只读模式：禁止写入或修改文件' };
+    }
+    if (toolName === 'Bash') {
+        const cmd = input.command || '';
+        const argv = parseLiteralShellArgv(cmd);
+        const executable = argv?.[0];
+        const readonlyExecutable = executable && READONLY_SHELL_EXECUTABLES.has(executable);
+        if (context?.allowLiteralReadShell === true && argv && readonlyExecutable) {
+            const protectedOperand = argv.slice(1).some(argument => {
+                if (argument === '-' || argument === '--' || argument.startsWith('-'))
+                    return false;
+                return containsHClassReference(argument)
+                    || isHClassPath(argument, { cwd: projectPath });
+            });
+            if (!containsHClassReference(cmd) && !protectedOperand) {
+                return { behavior: 'allow' };
+            }
+            logger.warn(`[ReadonlyCheck] 🔒 Protected path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            return { behavior: 'deny', message: '🔒 只读模式：ls/cat 不允许读取 H 类受保护路径' };
+        }
+        const cmdPreview = cmd.length > 80 ? cmd.substring(0, 80) + '...' : cmd;
+        logger.warn(`[ReadonlyCheck] 🔒 Bash blocked by default: cmd="${cmdPreview}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+        return { behavior: 'deny', message: '🔒 只读模式：Shell 仅允许单个字面量 ls/cat 命令' };
+    }
+    logger.warn(`[ReadonlyCheck] 🔒 Unknown tool blocked: tool=${toolName} session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+    return { behavior: 'deny', message: `🔒 只读模式：未声明为只读的工具 ${toolName} 已拒绝执行` };
+}
+const NON_FILESYSTEM_METADATA_TOOLS = new Set([
+    'Agent',
+    'AskUserQuestion',
+    'CronCreate',
+    'CronDelete',
+    'CronList',
+    'EnterPlanMode',
+    'ExitPlanMode',
+    'SendMessage',
+    'Skill',
+    'Task',
+    'TaskCreate',
+    'TaskGet',
+    'TaskList',
+    'TaskOutput',
+    'TaskStop',
+    'TaskUpdate',
+    'TeamCreate',
+    'TeamDelete',
+    'TodoWrite',
+    'ToolSearch',
+    'WebFetch',
+    'WebSearch',
+]);
+function collectOpaqueToolStrings(value, output) {
+    if (typeof value === 'string') {
+        if (value.trim())
+            output.push(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            collectOpaqueToolStrings(entry, output);
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    for (const entry of Object.values(value)) {
+        collectOpaqueToolStrings(entry, output);
+    }
+}
+function collectPermissionPathSpec(value, output, projectRootSubpaths) {
+    if (typeof value === 'string') {
+        output.push(value);
+        return;
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return;
+    const record = value;
+    if (typeof record.path === 'string')
+        output.push(record.path);
+    if (typeof record.pattern === 'string')
+        output.push(record.pattern);
+    if (record.type === 'special' && record.value && typeof record.value === 'object') {
+        const special = record.value;
+        const kind = special.kind;
+        if (kind === 'project_roots') {
+            const subpath = typeof special.subpath === 'string' && special.subpath ? special.subpath : '.';
+            if (projectRootSubpaths)
+                projectRootSubpaths.push(subpath);
+            else
+                output.push(subpath);
+        }
+        else if (kind === 'unknown' && typeof special.path === 'string' && special.path) {
+            const unknownPath = special.path;
+            const subpath = typeof special.subpath === 'string' && special.subpath ? special.subpath : undefined;
+            output.push(subpath
+                ? (path.isAbsolute(subpath) ? subpath : path.join(unknownPath, subpath))
+                : unknownPath);
+        }
+    }
+}
+function collectFilesystemGrantPaths(value, output, projectRootSubpaths) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return;
+    const profile = value;
+    const fileSystem = profile.fileSystem ?? profile.filesystem;
+    if (!fileSystem || typeof fileSystem !== 'object' || Array.isArray(fileSystem))
+        return;
+    const fsProfile = fileSystem;
+    for (const key of ['read', 'write']) {
+        const paths = fsProfile[key];
+        if (Array.isArray(paths)) {
+            for (const candidate of paths)
+                collectPermissionPathSpec(candidate, output, projectRootSubpaths);
+        }
+    }
+    if (Array.isArray(fsProfile.entries)) {
+        for (const entry of fsProfile.entries) {
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+                continue;
+            const record = entry;
+            if (record.access === 'deny')
+                continue;
+            collectPermissionPathSpec(record.path, output, projectRootSubpaths);
+        }
+    }
+    // Named-profile shaped overlays use path keys with read/write/deny values.
+    for (const [candidate, access] of Object.entries(fsProfile)) {
+        if (access === 'read' || access === 'write') {
+            if (candidate === ':root')
+                output.push(path.parse(process.cwd()).root);
+            else if (candidate === ':workspace_roots')
+                output.push('.');
+            else if (![':minimal', ':tmpdir', ':slash_tmp'].includes(candidate))
+                output.push(candidate);
+        }
+        if (!access || typeof access !== 'object' || Array.isArray(access))
+            continue;
+        for (const [subpath, nestedAccess] of Object.entries(access)) {
+            if (nestedAccess !== 'read' && nestedAccess !== 'write')
+                continue;
+            if (candidate === ':root')
+                output.push(path.resolve(path.parse(process.cwd()).root, subpath));
+            else if (candidate === ':workspace_roots')
+                output.push(subpath === '.' ? '.' : subpath);
+            else if (![':minimal', ':tmpdir', ':slash_tmp'].includes(candidate))
+                output.push(path.join(candidate, subpath));
+        }
+    }
+}
+function collectFilesystemWriteGrantPaths(value, output, projectRootSubpaths) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return;
+    const profile = value;
+    const fileSystem = profile.fileSystem ?? profile.filesystem;
+    if (!fileSystem || typeof fileSystem !== 'object' || Array.isArray(fileSystem))
+        return;
+    const fsProfile = fileSystem;
+    if (Array.isArray(fsProfile.write)) {
+        for (const candidate of fsProfile.write)
+            collectPermissionPathSpec(candidate, output, projectRootSubpaths);
+    }
+    if (Array.isArray(fsProfile.entries)) {
+        for (const entry of fsProfile.entries) {
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+                continue;
+            const record = entry;
+            if (record.access === 'write')
+                collectPermissionPathSpec(record.path, output, projectRootSubpaths);
+        }
+    }
+    for (const [candidate, access] of Object.entries(fsProfile)) {
+        if (access === 'write') {
+            if (candidate === ':root')
+                output.push(path.parse(process.cwd()).root);
+            else if (candidate === ':workspace_roots')
+                output.push('.');
+            else if (![':minimal', ':tmpdir', ':slash_tmp'].includes(candidate))
+                output.push(candidate);
+        }
+        if (!access || typeof access !== 'object' || Array.isArray(access))
+            continue;
+        for (const [subpath, nestedAccess] of Object.entries(access)) {
+            if (nestedAccess !== 'write')
+                continue;
+            if (candidate === ':root')
+                output.push(path.resolve(path.parse(process.cwd()).root, subpath));
+            else if (candidate === ':workspace_roots')
+                output.push(subpath === '.' ? '.' : subpath);
+            else if (![':minimal', ':tmpdir', ':slash_tmp'].includes(candidate))
+                output.push(path.join(candidate, subpath));
+        }
+    }
+}
+function collectExplicitFileChangePaths(record, output) {
+    const explicitPathKeys = ['path', 'filePath', 'file_path', 'movePath', 'move_path', 'destinationPath', 'targetPath'];
+    const hasExplicitPath = explicitPathKeys.some(key => typeof record[key] === 'string');
+    for (const key of explicitPathKeys) {
+        if (typeof record[key] === 'string' && record[key])
+            output.push(record[key]);
+    }
+    if (record.kind && typeof record.kind === 'object') {
+        collectExplicitFileChangePaths(record.kind, output);
+    }
+    return hasExplicitPath;
+}
+function collectFileChangePaths(value, output) {
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+                collectExplicitFileChangePaths(entry, output);
+            }
+        }
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    const record = value;
+    const hasExplicitPath = collectExplicitFileChangePaths(record, output);
+    // Claude-style inputs are maps keyed by path; Codex v2 uses an array of
+    // records with an explicit path field. Only treat keys as paths for the map
+    // shape so diff text and metadata never become path candidates.
+    if (!hasExplicitPath) {
+        for (const [filePath, change] of Object.entries(record)) {
+            if (filePath !== 'kind' && filePath !== 'type')
+                output.push(filePath);
+            if (change && typeof change === 'object' && !Array.isArray(change)) {
+                collectExplicitFileChangePaths(change, output);
+            }
+        }
+    }
+}
+function shellCommandReferencesLClass(command, options) {
+    const normalized = command.replace(/\\/g, '/');
+    const root = path.resolve(options.root ?? resolveRoot()).replace(/\\/g, '/');
+    const protectedRoot = `${root.replace(/\/+$/, '')}/data/triggers`;
+    if (normalized.includes(protectedRoot))
+        return true;
+    const references = normalized.match(/(?:^|[\s"'=<>;&|()])((?:\.\.\/|\.\/)*data\/triggers(?:\/[^\s"';&|<>)]*)?)/g) ?? [];
+    return references.some(reference => {
+        const candidate = reference.replace(/^[\s"'=<>;&|()]+/, '');
+        return isLClassPath(candidate, options);
+    });
+}
+function isLClassMutatingShellCommand(command, options) {
+    if (!shellCommandReferencesLClass(command, options))
+        return false;
+    const mutationPatterns = [
+        /(?:^|[;&|]\s*)\s*(?:rm|unlink|rmdir|mv|rename|truncate|touch|chmod|chown|chgrp|mkdir)\b/i,
+        /(?:^|[;&|]\s*)\s*(?:sed\s+[^;&|]*\s-i\b|perl\s+[^;&|]*\s-pi\b)/i,
+        /(?:^|[;&|]\s*)\s*tee\b/i,
+        /\bfind\b[^;&|]*(?:-delete|-exec\s+(?:rm|mv|chmod|chown)\b)/i,
+        /\bgit\s+(?:checkout|restore|clean|reset)\b/i,
+        /(?:^|[^<])>{1,2}\s*[^;&|\r\n]*data[\\/]triggers(?:[\\/]|$)/i,
+    ];
+    return mutationPatterns.some(pattern => pattern.test(command));
+}
+function requestsFilesystemRoot(value) {
+    if (Array.isArray(value))
+        return value.some(requestsFilesystemRoot);
+    if (!value || typeof value !== 'object')
+        return false;
+    const record = value;
+    if (record.access !== 'deny') {
+        const pathSpec = record.path;
+        if (pathSpec && typeof pathSpec === 'object' && !Array.isArray(pathSpec)) {
+            const pathRecord = pathSpec;
+            const special = pathRecord.type === 'special' ? pathRecord.value : undefined;
+            if (special && typeof special === 'object' && !Array.isArray(special)) {
+                if (special.kind === 'root')
+                    return true;
+            }
+        }
+    }
+    return Object.values(record).some(requestsFilesystemRoot);
+}
+export function checkHClassWrite(toolName, input, context) {
+    const paths = [];
+    const grantPaths = [];
+    const projectRootGrantSubpaths = [];
+    if (['Read', 'Write', 'Edit', 'NotebookEdit', 'Glob', 'Grep'].includes(toolName)) {
+        const filePath = input.file_path ?? input.notebook_path ?? input.path ?? input.pattern;
+        if (typeof filePath === 'string' && filePath)
+            paths.push(filePath);
+    }
+    else if (toolName === 'FileChange' || toolName === 'PermissionGrant') {
+        const grantRoot = input.grantRoot;
+        if (typeof grantRoot === 'string' && grantRoot)
+            grantPaths.push(grantRoot);
+        const fileChanges = input.fileChanges;
+        collectFileChangePaths(fileChanges, paths);
+        collectFilesystemGrantPaths(input.permissions, grantPaths, projectRootGrantSubpaths);
+    }
+    else if (toolName === 'Bash') {
+        const command = typeof input.command === 'string' ? input.command.replace(/\\/g, '/') : '';
+        if (containsHClassReference(command)) {
+            logger.warn(`[H-Class Protection] 🔒 Protected path referenced by shell command: tool=${toolName} ` +
+                `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            return {
+                behavior: 'deny',
+                message: '🔒 Shell 命令涉及受保护的 H 类配置/证书/快照路径，agent 不可直接操作',
+            };
+        }
+        collectFilesystemGrantPaths(input.additionalPermissions, grantPaths, projectRootGrantSubpaths);
+        collectFilesystemGrantPaths(input.permissions, grantPaths, projectRootGrantSubpaths);
+    }
+    else if (!NON_FILESYSTEM_METADATA_TOOLS.has(toolName)) {
+        // Opaque external tools may run outside the Claude/Codex filesystem
+        // sandbox. Retain conservative string inspection for those tools, while
+        // excluding known orchestration tools whose payload is only metadata.
+        collectOpaqueToolStrings(input, paths);
+    }
+    // Agent/Skill/Task and other orchestration tools carry natural-language
+    // metadata, not direct filesystem operands. Treating every string in their
+    // payload as a path makes a prompt that merely mentions daemon.json or a
+    // *.json_ backup indistinguishable from an actual file access. Any nested
+    // filesystem operation is checked again when it reaches Read/Write/Bash,
+    // FileChange, or PermissionGrant above.
+    const pathOptions = { cwd: context?.projectPath, root: context?.root };
+    if (requestsFilesystemRoot(input.permissions) || requestsFilesystemRoot(input.additionalPermissions)) {
+        logger.warn(`[H-Class Protection] 🔒 Permission grant covers filesystem root: tool=${toolName} ` +
+            `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+        return {
+            behavior: 'deny',
+            message: '🔒 请求的文件系统根权限包含受保护的 H 类路径，已拒绝授权',
+        };
+    }
+    for (const grantPath of grantPaths) {
+        if (!grantPath)
+            continue;
+        if (containsHClassReference(grantPath) || hClassGrantIncludesProtectedPath(grantPath, pathOptions)) {
+            logger.warn(`[H-Class Protection] 🔒 Permission grant covers protected paths: tool=${toolName} path=${grantPath} ` +
+                `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            return {
+                behavior: 'deny',
+                message: '🔒 请求的文件系统权限范围包含受保护的 H 类路径，已拒绝授权',
+            };
+        }
+    }
+    const permissionWorkspace = context?.workspacePath ?? context?.projectPath;
+    for (const subpath of projectRootGrantSubpaths) {
+        // Codex `project_roots` is relative to the thread workspace, not to the
+        // command/permission-request cwd. Keep the two coordinate systems apart.
+        if (!permissionWorkspace) {
+            return {
+                behavior: 'deny',
+                message: '🔒 无法确定 project_roots 权限的 thread workspace，已拒绝授权',
+            };
+        }
+        const candidate = path.isAbsolute(subpath)
+            ? subpath
+            : path.resolve(permissionWorkspace, subpath);
+        if (containsHClassReference(subpath) || hClassGrantIncludesProtectedPath(candidate, { root: context?.root })) {
+            logger.warn(`[H-Class Protection] 🔒 project_roots grant covers protected paths: tool=${toolName} path=${subpath} ` +
+                `workspace=${permissionWorkspace} session=${context?.sessionId} channel=${context?.channel} ` +
+                `peer=${context?.peerId} role=${context?.role}`);
+            return {
+                behavior: 'deny',
+                message: '🔒 请求的 project_roots 权限范围包含受保护的 H 类路径，已拒绝授权',
+            };
+        }
+    }
+    for (const filePath of paths) {
+        const normalized = filePath.replace(/\\/g, '/');
+        const matched = containsHClassReference(normalized) || isHClassPath(filePath, pathOptions);
+        if (matched) {
+            const fileBasename = path.basename(filePath);
+            logger.warn(`[H-Class Protection] 🔒 Protected file access blocked: tool=${toolName} path=${filePath} ` +
+                `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            // 根据文件类型返回不同的提示信息
+            let suggestion = '';
+            if (fileBasename === 'config.json' || fileBasename === 'defaults.json' || fileBasename === 'daemon.json') {
+                suggestion = '\n\n💡 请使用配置命令操作：\n' +
+                    '  • 查看配置：ec config show --self <aid>\n' +
+                    '  • 读取字段：ec config get <field> --self <aid>\n' +
+                    '  • 修改字段：ec config set <field> <value> --self <aid>\n' +
+                    '  • 帮助文档：ec config --help';
+            }
+            else if (normalized.includes('/backups/config/') || normalized.includes('/.snapshots/')) {
+                suggestion = '\n\n💡 快照由系统自动管理，请使用：\n' +
+                    '  • 创建快照：ec config snapshot --desc "说明"\n' +
+                    '  • 查看历史：ec config history\n' +
+                    '  • 恢复快照：ec config restore <version>';
+            }
+            else if (normalized.includes('/cert/') || normalized.includes('/keys/') || normalized.includes('/CA/')) {
+                suggestion = '\n\n💡 证书和密钥由系统自动管理，请使用：\n' +
+                    '  • 查看证书：ec aid cert show <aid>\n' +
+                    '  • 更新证书：ec aid cert renew <aid>';
+            }
+            return {
+                behavior: 'deny',
+                message: `🔒 此文件受保护，agent 不可直接写入\n\n` +
+                    `文件：${filePath}\n` +
+                    `类型：配置/快照/证书等系统关键文件${suggestion}`
+            };
+        }
+    }
+    return { behavior: 'allow' };
+}
+/**
+ * L-class protection: agents may inspect these paths, but only trusted daemon
+ * operations may mutate, delete, move, replace, or grant write access to them.
+ */
+export function checkLClassWrite(toolName, input, context) {
+    if (['Read', 'Glob', 'Grep'].includes(toolName))
+        return { behavior: 'allow' };
+    const paths = [];
+    const writeGrantPaths = [];
+    const projectRootWriteSubpaths = [];
+    if (['Write', 'Edit', 'NotebookEdit'].includes(toolName)) {
+        const filePath = input.file_path ?? input.notebook_path ?? input.path;
+        if (typeof filePath === 'string' && filePath)
+            paths.push(filePath);
+    }
+    else if (toolName === 'FileChange') {
+        const grantRoot = input.grantRoot;
+        if (typeof grantRoot === 'string' && grantRoot)
+            writeGrantPaths.push(grantRoot);
+        collectFileChangePaths(input.fileChanges, paths);
+    }
+    else if (toolName === 'PermissionGrant') {
+        const grantRoot = input.grantRoot;
+        if (typeof grantRoot === 'string' && grantRoot)
+            writeGrantPaths.push(grantRoot);
+        collectFilesystemWriteGrantPaths(input.permissions, writeGrantPaths, projectRootWriteSubpaths);
+    }
+    else if (toolName === 'Bash') {
+        const command = typeof input.command === 'string' ? input.command.replace(/\\/g, '/') : '';
+        const pathOptions = { cwd: context?.projectPath, root: context?.root };
+        if (isLClassMutatingShellCommand(command, pathOptions)) {
+            logger.warn(`[L-Class Protection] Protected path mutation requested by shell command: tool=${toolName} ` +
+                `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            return {
+                behavior: 'deny',
+                message: '🔒 Shell 命令试图修改 L-class 只读路径；读取允许，修改请使用 ec trigger',
+            };
+        }
+        collectFilesystemWriteGrantPaths(input.additionalPermissions, writeGrantPaths, projectRootWriteSubpaths);
+        collectFilesystemWriteGrantPaths(input.permissions, writeGrantPaths, projectRootWriteSubpaths);
+    }
+    else if (!NON_FILESYSTEM_METADATA_TOOLS.has(toolName)) {
+        collectOpaqueToolStrings(input, paths);
+    }
+    // Do not infer mutation targets from arbitrary orchestration-tool strings.
+    // Skills commonly pass args: "" and delegation prompts may discuss
+    // protected paths; neither is itself a filesystem mutation.
+    const pathOptions = { cwd: context?.projectPath, root: context?.root };
+    for (const grantPath of writeGrantPaths) {
+        if (grantPath && lClassGrantIncludesProtectedPath(grantPath, pathOptions)) {
+            logger.warn(`[L-Class Protection] Write grant covers protected paths: tool=${toolName} path=${grantPath}`);
+            return {
+                behavior: 'deny',
+                message: '🔒 请求的文件系统写权限包含 L-class 只读路径，已拒绝授权',
+            };
+        }
+    }
+    const permissionWorkspace = context?.workspacePath ?? context?.projectPath;
+    for (const subpath of projectRootWriteSubpaths) {
+        if (!permissionWorkspace) {
+            return { behavior: 'deny', message: '🔒 无法确定 L-class 写权限的 thread workspace，已拒绝授权' };
+        }
+        const candidate = path.isAbsolute(subpath) ? subpath : path.resolve(permissionWorkspace, subpath);
+        if (lClassGrantIncludesProtectedPath(candidate, { root: context?.root })) {
+            return { behavior: 'deny', message: '🔒 请求的 project_roots 写权限包含 L-class 只读路径，已拒绝授权' };
+        }
+    }
+    for (const filePath of paths) {
+        if (!lClassGrantIncludesProtectedPath(filePath, pathOptions))
+            continue;
+        logger.warn(`[L-Class Protection] Protected file mutation blocked: tool=${toolName} path=${filePath} ` +
+            `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+        return {
+            behavior: 'deny',
+            message: `🔒 L-class 路径允许读取但禁止 Agent 直接修改、删除或移动\n\n文件：${filePath}\n\n💡 请使用 ec trigger 命令修改`,
+        };
+    }
+    return { behavior: 'allow' };
+}
+/**
+ * 绝对禁止检查（用于 PreToolUse hook）
+ * 检查系统级破坏操作，这些命令任何情况下都不允许执行
+ */
+export function checkBlacklist(toolName, input) {
+    // 只检查 Bash 工具，其余工具全部放行
+    if (toolName === 'Bash') {
+        const cmd = input.command || '';
+        // 空命令直接放行
+        if (!cmd || cmd.trim() === '') {
+            return { behavior: 'allow', updatedInput: input };
+        }
+        if (containsNetStopCommand(cmd)) {
+            const cmdPreview = cmd.length > 60 ? cmd.substring(0, 60) + '...' : cmd;
+            return {
+                behavior: 'deny',
+                message: `🚫 系统级危险操作已拦截\n命令：${cmdPreview}\n\n此类操作可能导致系统损坏，任何权限模式下都不允许执行。`,
+            };
+        }
+        // 检查绝对禁止命令（系统级破坏操作）
+        for (const pattern of ABSOLUTE_FORBIDDEN) {
+            if (pattern.test(cmd)) {
+                const cmdPreview = cmd.length > 60 ? cmd.substring(0, 60) + '...' : cmd;
+                return {
+                    behavior: 'deny',
+                    message: `🚫 系统级危险操作已拦截\n命令：${cmdPreview}\n\n此类操作可能导致系统损坏，任何权限模式下都不允许执行。`
+                };
+            }
+        }
+    }
+    // 默认允许
+    return { behavior: 'allow', updatedInput: input };
+}
+function validateBoundedOutputPath(command, context) {
+    const outputPath = command.outputPath;
+    if (!outputPath)
+        return undefined;
+    if (context.permissionMode === 'readonly')
+        return '🔒 只读模式：禁止将命令输出写入文件';
+    if (path.isAbsolute(outputPath))
+        return '🔒 输出文件必须使用项目目录内的相对路径';
+    const workspace = resolveProtectedCandidate(context.workspacePath ?? context.projectPath);
+    const cwd = resolveProtectedCandidate(context.projectPath);
+    if (!isSameOrDescendant(cwd, workspace))
+        return '🔒 命令工作目录不在当前项目范围内';
+    const target = path.resolve(cwd, outputPath);
+    const canonicalTarget = resolveProtectedCandidate(target);
+    if (!isSameOrDescendant(canonicalTarget, workspace))
+        return '🔒 输出文件不能越出当前项目目录';
+    const relative = path.relative(workspace, canonicalTarget);
+    if (relative === '.git' || relative.startsWith(`.git${path.sep}`)) {
+        return '🔒 命令输出不能直接写入 Git metadata';
+    }
+    const root = context.root ?? resolveRoot();
+    if (isHClassPath(canonicalTarget, { root }) || isLClassPath(canonicalTarget, { root })) {
+        return '🔒 命令输出不能写入 EvolCore 受保护路径';
+    }
+    if (fs.existsSync(canonicalTarget))
+        return '🔒 安全输出只允许创建新文件，不能覆盖或追加现有文件';
+    try {
+        if (!fs.statSync(path.dirname(canonicalTarget)).isDirectory())
+            return '🔒 输出文件的父目录无效';
+    }
+    catch {
+        return '🔒 输出文件的父目录必须已经存在';
+    }
+    return undefined;
+}
+function quotePosixShellArg(value) {
+    return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function prepareBoundedOutputInput(input, command, kind, context) {
+    const validationError = validateBoundedOutputPath(command, context);
+    if (validationError)
+        return { behavior: 'deny', input, message: validationError };
+    const helperPath = context.safeOutputHelperPath;
+    if (!helperPath) {
+        return {
+            behavior: 'allow',
+            input,
+            reason: kind === 'ec' ? 'ec-command' : 'host-process-command',
+        };
+    }
+    try {
+        if (!fs.statSync(helperPath).isFile())
+            throw new Error('not a file');
+    }
+    catch {
+        return { behavior: 'deny', input, message: '🔒 安全输出 helper 不可用，命令已拒绝' };
+    }
+    const payload = Buffer.from(JSON.stringify({
+        v: 1,
+        nonce: randomUUID(),
+        kind,
+        workspace: path.resolve(context.workspacePath ?? context.projectPath),
+        cwd: path.resolve(context.projectPath),
+        argv: command.argv,
+        mergeStderr: command.mergeStderr,
+        ...(command.headLines ? { headLines: command.headLines } : {}),
+        ...(command.outputPath ? { outputPath: command.outputPath } : {}),
+    }), 'utf8').toString('base64url');
+    const rewrittenCommand = `${quotePosixShellArg(process.execPath)} ${quotePosixShellArg(helperPath)} ${quotePosixShellArg(payload)}`;
+    return {
+        behavior: 'allow',
+        input: { ...input, command: rewrittenCommand },
+        reason: kind === 'ec' ? 'ec-command' : 'host-process-command',
+    };
+}
+/** Shared fail-closed preflight used before runner-specific mode and approval handling. */
+export function evaluateToolPreflight(toolName, input, context) {
+    if (toolName === 'Bash') {
+        const command = typeof input.command === 'string' ? input.command : '';
+        const ecCommand = classifyEvolcoreShellCommand(command);
+        if (ecCommand.kind === 'literal') {
+            return { behavior: 'allow', input, reason: 'ec-command' };
+        }
+        if (ecCommand.kind === 'bounded-output') {
+            return prepareBoundedOutputInput(input, ecCommand.command, 'ec', context);
+        }
+        if (ecCommand.kind === 'composite') {
+            return {
+                behavior: 'deny',
+                input,
+                message: '🔒 EC 命令必须作为单个字面量进程调用；请移除管道、重定向、变量展开或命令拼接',
+            };
+        }
+        const boundedOutput = parseBoundedOutputShellCommand(command);
+        const hostProcessCommand = boundedOutput
+            ? classifyHostProcessArgv(boundedOutput.argv)
+            : classifyHostProcessCommand(command);
+        if (context.allowHostProcessCommands === true
+            && context.permissionMode !== 'readonly'
+            && isOwnerOrAdminRole(context.role)
+            && hostProcessCommand) {
+            if (boundedOutput)
+                return prepareBoundedOutputInput(input, boundedOutput, 'host-process', context);
+            return { behavior: 'allow', input, reason: 'host-process-command' };
+        }
+    }
+    const blacklist = checkBlacklist(toolName, input);
+    if (blacklist.behavior === 'deny') {
+        return { behavior: 'deny', input, message: blacklist.message };
+    }
+    const checkedInput = blacklist.updatedInput;
+    const hClass = checkHClassWrite(toolName, checkedInput, {
+        sessionId: context.sessionId,
+        channel: context.channel,
+        peerId: context.userId,
+        role: context.role,
+        projectPath: context.projectPath,
+        workspacePath: context.workspacePath,
+        root: context.root,
+    });
+    if (hClass.behavior === 'deny') {
+        return { behavior: 'deny', input: checkedInput, message: hClass.message };
+    }
+    const lClass = checkLClassWrite(toolName, checkedInput, {
+        sessionId: context.sessionId,
+        channel: context.channel,
+        peerId: context.userId,
+        role: context.role,
+        projectPath: context.projectPath,
+        workspacePath: context.workspacePath,
+        root: context.root,
+    });
+    if (lClass.behavior === 'deny') {
+        return { behavior: 'deny', input: checkedInput, message: lClass.message };
+    }
+    const dangerous = checkDangerousCommand(toolName, checkedInput);
+    if (dangerous.isDangerous
+        && dangerous.kind === 'git-destructive'
+        && context.role !== undefined
+        && !isOwnerOrAdminRole(context.role)) {
+        return {
+            behavior: 'deny',
+            input: checkedInput,
+            message: '🔒 Git 破坏性操作仅允许 owner/admin 调用；当前角色无权执行',
+        };
+    }
+    return { behavior: 'continue', input: checkedInput };
+}
+/**
+ * 危险命令检测（用于 canUseTool callback）
+ * 检测需要用户审批的危险操作，返回是否匹配及风险说明
+ */
+export function checkDangerousCommand(toolName, input) {
+    if (toolName !== 'Bash') {
+        return { isDangerous: false };
+    }
+    const cmd = input.command || '';
+    if (!cmd || cmd.trim() === '') {
+        return { isDangerous: false };
+    }
+    const structured = classifyStructuredCommand(cmd);
+    if (structured) {
+        const cmdPreview = cmd.length > 80 ? cmd.substring(0, 80) + '...' : cmd;
+        return {
+            isDangerous: true,
+            kind: structured.kind,
+            cacheKey: `dangerous:${toolName}:${structured.kind}`,
+            command: cmdPreview,
+            reason: structured.reason,
+            approvalScope: structured.approvalScope,
+        };
+    }
+    // 检查危险操作模式
+    for (const rule of DANGEROUS_PATTERNS) {
+        if (rule.pattern.test(cmd)) {
+            const cmdPreview = cmd.length > 80 ? cmd.substring(0, 80) + '...' : cmd;
+            return {
+                isDangerous: true,
+                kind: rule.kind,
+                cacheKey: `dangerous:${toolName}:${rule.kind}`,
+                command: cmdPreview,
+                reason: rule.reason,
+                approvalScope: rule.approvalScope,
+            };
+        }
+    }
+    return { isDangerous: false };
+}