evolcore 0.0.10 → 0.0.11

package/dist/core/permission/tool-policy.js

@@ -3,8 +3,9 @@ import path from 'path';
 import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
-import { containsHClassReference, containsLClassReference, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, } from '../protected-paths.js';
+import { containsHClassReference, containsLClassReference, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, } from '../protected-paths.js';
 import { classifyEvolcoreShellCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, } from './ec-command-parser.js';
+import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 // 绝对禁止命令（所有角色、所有权限模式下都禁止，不可授权）
 // 这些是系统级破坏操作，任何情况下都不应该允许
 const ABSOLUTE_FORBIDDEN = [
@@ -14,19 +15,6 @@ const ABSOLUTE_FORBIDDEN = [
     /\bformat\s+[a-zA-Z]:/i, // format C: (格式化磁盘)
     /\bdd\s+if=.*of=\/dev/, // dd 写入磁盘设备（读取操作允许）
 ];
-const READONLY_SHELL_EXECUTABLES = new Set([
-    'ls', '/bin/ls', '/usr/bin/ls',
-    'cat', '/bin/cat', '/usr/bin/cat',
-]);
-const L_CLASS_READONLY_SHELL_EXECUTABLES = new Set([
-    ...READONLY_SHELL_EXECUTABLES,
-    'grep', '/bin/grep', '/usr/bin/grep',
-    'rg', '/bin/rg', '/usr/bin/rg',
-    'find', '/bin/find', '/usr/bin/find',
-    'sed', '/bin/sed', '/usr/bin/sed',
-]);
-const FIND_MUTATING_PRIMARY_RE = /^-(?:delete|exec|execdir|ok|okdir|fprint|fprint0|fprintf|fls)$/;
-const RG_PROCESS_SPAWNING_OPTION_RE = /^--pre(?:=|$)|^--pre-glob(?:=|$)/;
 // 危险操作（需要用户审批才能执行）
 // 这些操作有合理使用场景，但需要用户明确授权
 const DANGEROUS_PATTERNS = [
@@ -331,19 +319,163 @@ function containsNetStopCommand(command, depth = 0) {
             && containsNetStopCommand(parsed.args.slice(commandIndex + 1).join(' '), depth + 1);
     });
 }
+function queryPathOperands(analysis) {
+    return analysis.kind === 'proven-readonly' ? analysis.ir.pathOperands : [];
+}
+function shellOperandMatchesClass(operand, className, options) {
+    const reference = className === 'h' ? containsHClassReference(operand.value) : containsLClassReference(operand.value);
+    if (reference)
+        return true;
+    if (operand.access === 'recursive') {
+        return className === 'h'
+            ? hClassReadScopeIncludesProtectedPath(operand.value, options)
+            : lClassGrantIncludesProtectedPath(operand.value, options);
+    }
+    return className === 'h'
+        ? isHClassPath(operand.value, options)
+        : isLClassPath(operand.value, options);
+}
 /**
- * 只读模式检查（用于 PreToolUse hook 和 canUseTool callback）
- * 显式读工具自动允许；写工具和未知工具拒绝。
- * Bash 默认拒绝；只允许由严格字面量解析器证明为 ls/cat 的只读命令。
- * 通过 EC Shell 边界分类的整条字面量调用应由 runner 在调用本函数前放行。
+ * A read-only recursive query only needs to cover H-class targets that exist
+ * now. This deliberately differs from a filesystem *grant*: a grant below
+ * any directory could later create a protected backup name, while a proven
+ * query cannot write and should still be able to inspect an ordinary logs/
+ * directory.
+ */
+function hClassReadScopeIncludesProtectedPath(value, options) {
+    const root = resolveProtectedCandidate(options.root ?? resolveRoot());
+    const scope = resolveProtectedCandidate(value, options.cwd);
+    if (isSameOrDescendant(root, scope))
+        return true;
+    if (!isSameOrDescendant(scope, root))
+        return false;
+    return getExistingHClassMaskTargets(root).some(target => isSameOrDescendant(target.path, scope));
+}
+function analyzeShellProtectedOperands(command, options) {
+    const analysis = analyzeReadonlyShellQuery(command);
+    if (analysis.kind === 'unproven') {
+        return {
+            analysis,
+            hClass: containsHClassReference(command),
+            lClass: containsLClassReference(command),
+        };
+    }
+    const operands = queryPathOperands(analysis);
+    return {
+        analysis,
+        hClass: operands.some(operand => shellOperandMatchesClass(operand, 'h', options)),
+        lClass: operands.some(operand => shellOperandMatchesClass(operand, 'l', options)),
+    };
+}
+function protectedReadToolPaths(toolName, input) {
+    if (toolName === 'Read') {
+        return typeof input.file_path === 'string' ? [input.file_path] : [];
+    }
+    if (toolName === 'Glob') {
+        return [input.pattern, input.path].filter((value) => typeof value === 'string' && value.length > 0);
+    }
+    if (toolName === 'Grep') {
+        return typeof input.path === 'string' ? [input.path] : [];
+    }
+    return [];
+}
+function protectedReadToolMatchesLClass(toolName, input, options) {
+    const paths = protectedReadToolPaths(toolName, input);
+    if (paths.some(filePath => containsLClassReference(filePath) || isLClassPath(filePath, options))) {
+        return true;
+    }
+    if (toolName === 'Grep') {
+        const scope = typeof input.path === 'string' && input.path ? input.path : '.';
+        return lClassGrantIncludesProtectedPath(scope, options);
+    }
+    if (toolName === 'Glob') {
+        const scope = globReadScope(input, options);
+        return lClassGrantIncludesProtectedPath(scope, { root: options.root });
+    }
+    return false;
+}
+function protectedReadToolMatchesHClass(toolName, input, options) {
+    const paths = protectedReadToolPaths(toolName, input);
+    if (paths.some(filePath => containsHClassReference(filePath) || isHClassPath(filePath, options))) {
+        return true;
+    }
+    if (toolName === 'Grep') {
+        const scope = typeof input.path === 'string' && input.path ? input.path : '.';
+        return hClassReadScopeIncludesProtectedPath(scope, options);
+    }
+    if (toolName === 'Glob') {
+        const scope = globReadScope(input, options);
+        return hClassReadScopeIncludesProtectedPath(scope, options);
+    }
+    return false;
+}
+function globLiteralPrefix(pattern) {
+    const normalized = pattern.replace(/\\/g, '/');
+    const globIndex = normalized.search(/[*?[{]/);
+    return globIndex < 0 ? normalized : normalized.slice(0, globIndex).replace(/\/+$/, '');
+}
+function globReadScope(input, options) {
+    const pattern = typeof input.pattern === 'string' && input.pattern ? input.pattern : '**/*';
+    const baseValue = typeof input.path === 'string' && input.path ? input.path : '.';
+    const base = resolveProtectedCandidate(baseValue, options.cwd);
+    const prefix = globLiteralPrefix(pattern);
+    return path.isAbsolute(pattern)
+        ? resolveProtectedCandidate(prefix || path.parse(pattern).root)
+        : resolveProtectedCandidate(prefix || '.', base);
+}
+function protectedReadToolStaysInWorkspace(toolName, input, projectPath) {
+    const workspace = resolveProtectedCandidate(projectPath);
+    if (toolName === 'Read') {
+        if (typeof input.file_path !== 'string' || !input.file_path)
+            return false;
+        return isSameOrDescendant(resolveProtectedCandidate(input.file_path, projectPath), workspace);
+    }
+    if (toolName === 'Grep') {
+        const scope = typeof input.path === 'string' && input.path ? input.path : '.';
+        return isSameOrDescendant(resolveProtectedCandidate(scope, projectPath), workspace);
+    }
+    if (toolName === 'Glob') {
+        const baseValue = typeof input.path === 'string' && input.path ? input.path : '.';
+        const base = resolveProtectedCandidate(baseValue, projectPath);
+        if (!isSameOrDescendant(base, workspace))
+            return false;
+        const scope = globReadScope(input, { cwd: projectPath });
+        return isSameOrDescendant(scope, workspace);
+    }
+    return true;
+}
+function readonlyShellStaysInWorkspace(analysis, projectPath) {
+    if (analysis.kind !== 'proven-readonly')
+        return false;
+    const workspace = resolveProtectedCandidate(projectPath);
+    return analysis.ir.pathOperands.every(operand => isSameOrDescendant(resolveProtectedCandidate(operand.value, projectPath), workspace));
+}
+/**
+ * 只读模式检查（用于 PreToolUse hook 和 canUseTool callback）。普通
+ * 路径上的受限查询 Bash 可自动执行；H/L-class 和未建模 Shell 仍拒绝。
  */
 export function checkReadonly(toolName, input, projectPath, context) {
     const readOnlyTools = new Set([
         'Read', 'Glob', 'Grep', 'WebSearch', 'WebFetch',
         'TaskList', 'TaskGet', 'ToolSearch',
     ]);
-    if (readOnlyTools.has(toolName))
+    if (readOnlyTools.has(toolName)) {
+        const paths = protectedReadToolPaths(toolName, input);
+        const pathOptions = { cwd: projectPath, root: context?.root };
+        if (!protectedReadToolStaysInWorkspace(toolName, input, projectPath)) {
+            return { behavior: 'deny', message: '🔒 只读模式：文件读取范围不能越出当前项目目录' };
+        }
+        if (paths.some(filePath => containsHClassReference(filePath) || isHClassPath(filePath, pathOptions))) {
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径' };
+        }
+        if (protectedReadToolMatchesHClass(toolName, input, pathOptions)) {
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径' };
+        }
+        if (protectedReadToolMatchesLClass(toolName, input, pathOptions)) {
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径' };
+        }
         return { behavior: 'allow' };
+    }
     if (toolName === 'Write' || toolName === 'Edit' || toolName === 'NotebookEdit') {
         const filePath = (input.file_path || input.notebook_path);
         logger.warn(`[ReadonlyCheck] 🔒 File write blocked: tool=${toolName} path=${filePath} project=${projectPath} session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
@@ -351,25 +483,27 @@ export function checkReadonly(toolName, input, projectPath, context) {
     }
     if (toolName === 'Bash') {
         const cmd = input.command || '';
-        const argv = parseLiteralShellArgv(cmd);
-        const executable = argv?.[0];
-        const readonlyExecutable = executable && READONLY_SHELL_EXECUTABLES.has(executable);
-        if (context?.allowLiteralReadShell === true && argv && readonlyExecutable) {
-            const protectedOperand = argv.slice(1).some(argument => {
-                if (argument === '-' || argument === '--' || argument.startsWith('-'))
-                    return false;
-                return containsHClassReference(argument)
-                    || isHClassPath(argument, { cwd: projectPath });
-            });
-            if (!containsHClassReference(cmd) && !protectedOperand) {
-                return { behavior: 'allow' };
-            }
-            logger.warn(`[ReadonlyCheck] 🔒 Protected path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-            return { behavior: 'deny', message: '🔒 只读模式：ls/cat 不允许读取 H 类受保护路径' };
+        const protectedOperands = analyzeShellProtectedOperands(cmd, { cwd: projectPath, root: context?.root });
+        if (protectedOperands.analysis.kind === 'proven-readonly'
+            && !protectedOperands.hClass
+            && !protectedOperands.lClass
+            && readonlyShellStaysInWorkspace(protectedOperands.analysis, projectPath)) {
+            return { behavior: 'allow' };
+        }
+        if (protectedOperands.hClass) {
+            logger.warn(`[ReadonlyCheck] 🔒 H-class path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径' };
+        }
+        if (protectedOperands.lClass) {
+            logger.warn(`[ReadonlyCheck] 🔒 L-class path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径' };
+        }
+        if (protectedOperands.analysis.kind === 'proven-readonly') {
+            return { behavior: 'deny', message: '🔒 只读模式：Shell 查询范围不能越出当前项目目录' };
         }
         const cmdPreview = cmd.length > 80 ? cmd.substring(0, 80) + '...' : cmd;
         logger.warn(`[ReadonlyCheck] 🔒 Bash blocked by default: cmd="${cmdPreview}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-        return { behavior: 'deny', message: '🔒 只读模式：Shell 仅允许单个字面量 ls/cat 命令' };
+        return { behavior: 'deny', message: '🔒 只读模式：Shell 仅允许受限、可证明只读的普通路径查询' };
     }
     logger.warn(`[ReadonlyCheck] 🔒 Unknown tool blocked: tool=${toolName} session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
     return { behavior: 'deny', message: `🔒 只读模式：未声明为只读的工具 ${toolName} 已拒绝执行` };
@@ -577,53 +711,6 @@ function collectFileChangePaths(value, output) {
         }
     }
 }
-function shellCommandReferencesLClass(command, options) {
-    const normalized = command.replace(/\\/g, '/');
-    if (containsLClassReference(normalized))
-        return true;
-    const argv = parseLiteralShellArgv(command);
-    return argv?.slice(1).some(argument => {
-        if (argument === '-' || argument === '--' || argument.startsWith('-'))
-            return false;
-        return isLClassPath(argument, options);
-    }) ?? false;
-}
-function isVerifiedLClassReadOnlyShellCommand(command) {
-    const argv = parseLiteralShellArgv(command);
-    if (!argv || !L_CLASS_READONLY_SHELL_EXECUTABLES.has(argv[0]))
-        return false;
-    switch (argv[0].replace(/^.*\//, '')) {
-        case 'grep':
-            // grep never mutates its operands. Shell composition is rejected by the
-            // literal parser before this point.
-            return true;
-        case 'rg':
-            // ripgrep's --pre hooks may execute an arbitrary process.
-            return !argv.slice(1).some(argument => RG_PROCESS_SPAWNING_OPTION_RE.test(argument));
-        case 'find':
-            // Keep only the predicates/actions which cannot create, mutate, or
-            // execute files. Other find options remain fail-closed.
-            return !argv.slice(1).some(argument => FIND_MUTATING_PRIMARY_RE.test(argument));
-        case 'sed': {
-            // sed can write via -i or a `w` command. Permit only the bounded
-            // inspection form used for line-range reads: sed -n 'START[,END]p'.
-            const quiet = argv[1] === '-n' || argv[1] === '--quiet' || argv[1] === '--silent';
-            const program = quiet ? argv[2] : undefined;
-            return !!program
-                && /^(?:\d+(?:,\d+)?|\$)?p$/.test(program)
-                // GNU sed accepts options after the script as well. Reject every
-                // later option so -i/-e/-f cannot be smuggled into this read form.
-                && !argv.slice(3).some(argument => argument.startsWith('-'));
-        }
-        default:
-            return true;
-    }
-}
-function isUnverifiedLClassShellCommand(command, options) {
-    if (!shellCommandReferencesLClass(command, options))
-        return false;
-    return !isVerifiedLClassReadOnlyShellCommand(command);
-}
 function requestsFilesystemRoot(value) {
     if (Array.isArray(value))
         return value.some(requestsFilesystemRoot);
@@ -647,8 +734,11 @@ export function checkHClassWrite(toolName, input, context) {
     const paths = [];
     const grantPaths = [];
     const projectRootGrantSubpaths = [];
-    if (['Read', 'Write', 'Edit', 'NotebookEdit', 'Glob', 'Grep'].includes(toolName)) {
-        const filePath = input.file_path ?? input.notebook_path ?? input.path ?? input.pattern;
+    if (['Read', 'Glob', 'Grep'].includes(toolName)) {
+        paths.push(...protectedReadToolPaths(toolName, input));
+    }
+    else if (['Write', 'Edit', 'NotebookEdit'].includes(toolName)) {
+        const filePath = input.file_path ?? input.notebook_path ?? input.path;
         if (typeof filePath === 'string' && filePath)
             paths.push(filePath);
     }
@@ -661,9 +751,13 @@ export function checkHClassWrite(toolName, input, context) {
         collectFilesystemGrantPaths(input.permissions, grantPaths, projectRootGrantSubpaths);
     }
     else if (toolName === 'Bash') {
-        const command = typeof input.command === 'string' ? input.command.replace(/\\/g, '/') : '';
-        if (containsHClassReference(command)) {
-            logger.warn(`[H-Class Protection] 🔒 Protected path referenced by shell command: tool=${toolName} ` +
+        const command = typeof input.command === 'string' ? input.command : '';
+        const protectedOperands = analyzeShellProtectedOperands(command, {
+            cwd: context?.projectPath,
+            root: context?.root,
+        });
+        if (protectedOperands.hClass) {
+            logger.warn(`[H-Class Protection] 🔒 Protected filesystem operand in shell command: tool=${toolName} ` +
                 `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
             return {
                 behavior: 'deny',
@@ -686,6 +780,15 @@ export function checkHClassWrite(toolName, input, context) {
     // filesystem operation is checked again when it reaches Read/Write/Bash,
     // FileChange, or PermissionGrant above.
     const pathOptions = { cwd: context?.projectPath, root: context?.root };
+    if (['Read', 'Glob', 'Grep'].includes(toolName)
+        && protectedReadToolMatchesHClass(toolName, input, pathOptions)) {
+        logger.warn(`[H-Class Protection] 🔒 Protected filesystem read scope blocked: tool=${toolName} ` +
+            `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+        return {
+            behavior: 'deny',
+            message: '🔒 文件读取范围包含受保护的 H 类配置/证书/快照路径，agent 不可直接操作',
+        };
+    }
     if (requestsFilesystemRoot(input.permissions) || requestsFilesystemRoot(input.additionalPermissions)) {
         logger.warn(`[H-Class Protection] 🔒 Permission grant covers filesystem root: tool=${toolName} ` +
             `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
@@ -771,8 +874,14 @@ export function checkHClassWrite(toolName, input, context) {
  * operations may mutate, delete, move, replace, or grant write access to them.
  */
 export function checkLClassWrite(toolName, input, context) {
-    if (['Read', 'Glob', 'Grep'].includes(toolName))
+    if (['Read', 'Glob', 'Grep'].includes(toolName)) {
+        const pathOptions = { cwd: context?.projectPath, root: context?.root };
+        const lClassRead = protectedReadToolMatchesLClass(toolName, input, pathOptions);
+        if (lClassRead && context?.permissionMode === 'readonly') {
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径' };
+        }
         return { behavior: 'allow' };
+    }
     const paths = [];
     const writeGrantPaths = [];
     const projectRootWriteSubpaths = [];
@@ -794,14 +903,19 @@ export function checkLClassWrite(toolName, input, context) {
         collectFilesystemWriteGrantPaths(input.permissions, writeGrantPaths, projectRootWriteSubpaths);
     }
     else if (toolName === 'Bash') {
-        const command = typeof input.command === 'string' ? input.command.replace(/\\/g, '/') : '';
+        const command = typeof input.command === 'string' ? input.command : '';
         const pathOptions = { cwd: context?.projectPath, root: context?.root };
-        if (isUnverifiedLClassShellCommand(command, pathOptions)) {
-            logger.warn(`[L-Class Protection] Unverified L-class shell command denied: tool=${toolName} ` +
+        const protectedOperands = analyzeShellProtectedOperands(command, pathOptions);
+        const lClassDenied = protectedOperands.lClass
+            && (context?.permissionMode === 'readonly' || protectedOperands.analysis.kind === 'unproven');
+        if (lClassDenied) {
+            logger.warn(`[L-Class Protection] L-class shell access denied: tool=${toolName} ` +
                 `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
             return {
                 behavior: 'deny',
-                message: '🔒 L-class 路径仅允许单个可验证的只读命令。请拆分为单条 ls/cat/grep/rg/find 或 sed -n，或使用 Read；禁止管道、重定向、变量展开和命令拼接。修改必须通过受控的 EvolCore 命令',
+                message: context?.permissionMode === 'readonly'
+                    ? '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径'
+                    : '🔒 L-class 路径仅允许受限、可证明只读的命令；未知 Shell 语法失败关闭。修改必须通过受控的 EvolCore 命令',
             };
         }
         collectFilesystemWriteGrantPaths(input.additionalPermissions, writeGrantPaths, projectRootWriteSubpaths);
@@ -957,6 +1071,29 @@ function prepareBoundedOutputInput(input, command, kind, context) {
 export function evaluateToolPreflight(toolName, input, context) {
     if (toolName === 'Bash') {
         const command = typeof input.command === 'string' ? input.command : '';
+        if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(command)) {
+            return {
+                behavior: 'deny',
+                input,
+                message: '🔒 EvolCore 托管会话不需要探测 `ec` 是否存在；请不要调用 `command -v`/`which`/`type`，也不要拼接其它命令。通信必须走当前 session 的 delegated sender。',
+            };
+        }
+        const argv = context.sessionId ? parseLiteralShellArgv(command) : null;
+        const isOwnAgentMdPublish = !!argv
+            && argv.length === 5
+            && argv[0] === 'ec'
+            && argv[1] === 'aid'
+            && argv[2] === 'agentmd'
+            && argv[3] === 'put'
+            && !!context.selfAid
+            && argv[4].replace(/^@/, '') === context.selfAid.replace(/^@/, '');
+        if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(command) && !isOwnAgentMdPublish) {
+            return {
+                behavior: 'deny',
+                input,
+                message: '🔒 EvolCore 托管会话仅允许通过 `ec aid agentmd put <当前 self AID>` 发布自身名片；禁止通过 `ec aid` 自行发现、切换或操作其他身份。',
+            };
+        }
         const ecCommand = classifyEvolcoreShellCommand(command);
         if (ecCommand.kind === 'literal') {
             return { behavior: 'allow', input, reason: 'ec-command' };
@@ -982,7 +1119,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             return {
                 behavior: 'deny',
                 input,
-                message: '🔒 EC 命令必须作为单个字面量进程调用；请移除管道、重定向、变量展开或命令拼接',
+                message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
             };
         }
         const boundedOutput = parseBoundedOutputShellCommand(command);
@@ -1020,6 +1157,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         channel: context.channel,
         peerId: context.userId,
         role: context.role,
+        permissionMode: context.permissionMode,
         projectPath: context.projectPath,
         workspacePath: context.workspacePath,
         root: context.root,

package/dist/core/protected-paths.js

@@ -293,10 +293,11 @@ export function getExistingLClassReadOnlyTargets(root = resolveRoot()) {
     catch { }
     return [...targets.values()];
 }
-export function buildClaudeProtectedFilesystem(root = resolveRoot()) {
+export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {}) {
     const hClassPaths = getExistingHClassMaskTargets(root).map(target => target.path);
     const lClassPaths = getExistingLClassReadOnlyTargets(root).map(target => target.path);
     const allPaths = [...new Set([...hClassPaths, ...lClassPaths])];
+    const denyRead = options.denyLClassRead ? allPaths : hClassPaths;
     if (allPaths.length > CLAUDE_PROTECTED_TARGET_LIMIT) {
         throw new Error(`[ClaudeSandbox] protected target limit exceeded: ${allPaths.length} > ${CLAUDE_PROTECTED_TARGET_LIMIT}`);
     }
@@ -309,7 +310,7 @@ export function buildClaudeProtectedFilesystem(root = resolveRoot()) {
         }
     }
     return {
-        denyRead: [...new Set(hClassPaths)],
+        denyRead: [...new Set(denyRead)],
         denyWrite: allPaths,
     };
 }
@@ -321,16 +322,18 @@ export function buildCodexHClassFilesystemRules(root = resolveRoot()) {
         ...Object.fromEntries(getHClassSandboxPatterns(root).map(pattern => [pattern, 'deny'])),
     };
 }
-export function buildCodexProtectedFilesystemRules(root = resolveRoot()) {
+export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options = {}) {
     const lClassRules = {};
+    const lClassAccess = options.denyLClassRead ? 'deny' : 'read';
     for (const target of getExistingLClassReadOnlyTargets(root)) {
         if (target.kind === 'directory') {
-            if (path.basename(target.path) === 'triggers')
-                lClassRules[target.path] = 'read';
-            lClassRules[path.join(target.path, '**')] = 'read';
+            if (options.denyLClassRead || path.basename(target.path) === 'triggers') {
+                lClassRules[target.path] = lClassAccess;
+            }
+            lClassRules[path.join(target.path, '**')] = lClassAccess;
         }
         else {
-            lClassRules[target.path] = 'read';
+            lClassRules[target.path] = lClassAccess;
         }
     }
     return {

package/dist/core/runner-reload-transaction.js

@@ -0,0 +1,57 @@
+export async function disposeAgentInstances(instances, onError) {
+    await Promise.allSettled(instances.map(async (instance) => {
+        try {
+            await instance.agent.dispose?.();
+        }
+        catch (error) {
+            onError?.(instance, error);
+        }
+    }));
+}
+export function createRunnerReloadTransaction(input) {
+    const prefix = `${input.aid}::`;
+    const previous = [...input.agentMap.entries()]
+        .filter(([key]) => key.startsWith(prefix))
+        .map(([key, agent]) => {
+        const split = key.lastIndexOf('::');
+        return {
+            evolagentName: key.slice(0, split),
+            baseagent: key.slice(split + 2),
+            agent,
+        };
+    });
+    let committed = false;
+    let stagedDisposed = false;
+    const disposeStaged = async () => {
+        if (stagedDisposed)
+            return;
+        stagedDisposed = true;
+        await disposeAgentInstances(input.staged, input.onDisposeError);
+    };
+    return {
+        commit() {
+            if (committed)
+                return;
+            for (const instance of previous)
+                input.agentMap.delete(`${instance.evolagentName}::${instance.baseagent}`);
+            for (const instance of input.staged)
+                input.agentMap.set(`${instance.evolagentName}::${instance.baseagent}`, instance.agent);
+            committed = true;
+        },
+        async rollback() {
+            if (committed) {
+                for (const instance of input.staged)
+                    input.agentMap.delete(`${instance.evolagentName}::${instance.baseagent}`);
+                for (const instance of previous)
+                    input.agentMap.set(`${instance.evolagentName}::${instance.baseagent}`, instance.agent);
+                committed = false;
+            }
+            await disposeStaged();
+        },
+        async finalize() {
+            if (!committed)
+                return;
+            await disposeAgentInstances(previous, input.onDisposeError);
+        },
+    };
+}