evolcore 0.0.10 → 0.0.12

package/dist/core/permission/ec-command-parser.js

@@ -1,4 +1,11 @@
 const HEAD_EXECUTABLES = new Set(['head', '/bin/head', '/usr/bin/head']);
+// Codex app-server sends command executions through a fixed shell carrier.
+// Treat the carrier as syntax only after parsing it as literal argv; never
+// accept an arbitrary `sh -c` string or unwrap shell composition here.
+const CODEX_SHELL_EXECUTABLES = new Set([
+    'bash', '/bin/bash', '/usr/bin/bash',
+    'sh', '/bin/sh', '/usr/bin/sh',
+]);
 const SHELL_UNQUOTED_META = new Set([
     ';', '&', '|', '`', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#',
 ]);
@@ -135,6 +142,42 @@ export function parseLiteralShellArgv(command) {
     const result = parseLiteralShellCommand(command);
     return result.ok ? result.argv : null;
 }
+/**
+ * Return the command string carried by Codex's literal `/bin/bash -lc ...`
+ * wrapper. The wrapper is accepted only in its exact three-argv form and the
+ * caller must parse the returned string with the literal shell parser again.
+ */
+export function unwrapCodexShellCommandArgv(argv) {
+    if (argv.length !== 3 || argv[1] !== '-lc')
+        return undefined;
+    return CODEX_SHELL_EXECUTABLES.has(argv[0]) ? argv[2] : undefined;
+}
+/**
+ * Parse either a bare literal command or the exact shell carrier emitted by
+ * Codex app-server. This does not make shell composition safe: the nested
+ * command still has to pass `parseLiteralShellCommand`.
+ */
+export function parseCodexShellCommandArgv(command) {
+    const outer = parseLiteralShellArgv(command);
+    if (!outer)
+        return null;
+    const wrapped = unwrapCodexShellCommandArgv(outer);
+    return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped);
+}
+/**
+ * Resolve a Codex command input while preserving the raw `commandArgv` form
+ * supplied by app-server. Joining that argv with spaces loses the quoting of
+ * the inner `-lc` command and was the source of a false proactive denial.
+ */
+export function parseCodexToolCommandArgv(input) {
+    if (Array.isArray(input.commandArgv) && input.commandArgv.every(value => typeof value === 'string')) {
+        const outer = input.commandArgv;
+        const wrapped = unwrapCodexShellCommandArgv(outer);
+        return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped);
+    }
+    const command = typeof input.command === 'string' ? input.command : '';
+    return parseCodexShellCommandArgv(command);
+}
 function scanBoundedOutputOperators(command) {
     const operators = [];
     let quote = null;
@@ -314,9 +357,18 @@ export function parseBoundedOutputShellCommand(command) {
 export function classifyEvolcoreShellCommand(command) {
     const literal = parseLiteralShellCommand(command);
     if (literal.ok) {
-        return literal.argv[0] === 'ec'
-            ? { kind: 'literal' }
-            : { kind: 'none' };
+        if (literal.argv[0] === 'ec')
+            return { kind: 'literal' };
+        const wrapped = unwrapCodexShellCommandArgv(literal.argv);
+        if (wrapped !== undefined) {
+            const nested = parseLiteralShellCommand(wrapped);
+            if (nested.ok && nested.argv[0] === 'ec')
+                return { kind: 'literal' };
+            if (!nested.ok && EVOLCORE_COMMAND_POSITION_RE.test(wrapped)) {
+                return { kind: 'composite', issue: nested.issue };
+            }
+        }
+        return { kind: 'none' };
     }
     const boundedOutput = parseBoundedOutputShellCommand(command);
     if (boundedOutput && boundedOutput.argv[0] === 'ec') {
@@ -350,8 +402,81 @@ function findSingleFileOption(argv, startIndex) {
         ? { path: filePath, invalid: false }
         : { invalid: true };
 }
-export function parseEvolcoreSendCommand(command) {
-    const argv = parseLiteralShellArgv(command);
+const PROACTIVE_SEND_VALUE_FLAGS = new Set([
+    '--format', '--app', '--file', '--text-from-file', '--link', '--payload',
+    '--title', '--description', '--text', '--transcript', '--as',
+    '--content-type', '--mention', '--aun-path', '--thread', '--return',
+]);
+const PROACTIVE_SEND_BOOLEAN_FLAGS = new Set([
+    '--encrypt', '--no-encrypt', '--mention-all',
+]);
+function hasExecutableProactiveSendPayload(argv, scope) {
+    if (!argv || argv[0] !== 'ec' || argv[1] !== scope || argv[2] !== 'send')
+        return false;
+    const positionals = [];
+    const modes = new Map();
+    let endOfOptions = false;
+    for (let index = 5; index < argv.length; index++) {
+        const value = argv[index];
+        if (endOfOptions) {
+            positionals.push(value);
+            continue;
+        }
+        if (value === '--') {
+            endOfOptions = true;
+            continue;
+        }
+        if (PROACTIVE_SEND_BOOLEAN_FLAGS.has(value))
+            continue;
+        if (!PROACTIVE_SEND_VALUE_FLAGS.has(value)) {
+            positionals.push(value);
+            continue;
+        }
+        const operand = argv[++index];
+        if (operand === undefined || operand.startsWith('--'))
+            return false;
+        if (value === '--file' || value === '--text-from-file')
+            return false;
+        if (value === '--app' || value === '--aun-path')
+            return false;
+        if (value === '--return' && operand !== 'none' && operand !== 'required')
+            return false;
+        if (value === '--format' && operand !== 'json')
+            return false;
+        if (value === '--link') {
+            if (scope !== 'msg' || modes.has('link'))
+                return false;
+            modes.set('link', operand);
+        }
+        if (value === '--payload') {
+            if (modes.has('payload'))
+                return false;
+            modes.set('payload', operand);
+        }
+    }
+    if (modes.size > 1)
+        return false;
+    if (modes.has('link')) {
+        try {
+            const url = new URL(modes.get('link'));
+            return url.protocol === 'http:' || url.protocol === 'https:';
+        }
+        catch {
+            return false;
+        }
+    }
+    if (modes.has('payload')) {
+        try {
+            const payload = JSON.parse(modes.get('payload'));
+            return !!payload && typeof payload === 'object' && !Array.isArray(payload);
+        }
+        catch {
+            return false;
+        }
+    }
+    return positionals.join(' ').length > 0;
+}
+function parseEvolcoreSendArgv(argv) {
     if (!argv || argv[0] !== 'ec')
         return null;
     if (argv[1] === 'ctl') {
@@ -380,23 +505,44 @@ export function parseEvolcoreSendCommand(command) {
     if (subcommand === 'file') {
         if (argv.length !== 6 || !isDeterministicFilePath(argv[5]))
             return null;
-        return { scope, action: 'file', targetId, filePath: argv[5] };
+        return { scope, action: 'file', sourceId: argv[3], targetId, filePath: argv[5] };
     }
     const fileOption = findSingleFileOption(argv, 5);
     if (fileOption.invalid)
         return null;
     return fileOption.path
-        ? { scope, action: 'file', targetId, filePath: fileOption.path }
-        : { scope, action: 'send', targetId };
+        ? { scope, action: 'file', sourceId: argv[3], targetId, filePath: fileOption.path }
+        : { scope, action: 'send', sourceId: argv[3], targetId };
+}
+export function parseEvolcoreSendCommand(command) {
+    const argv = parseCodexShellCommandArgv(command);
+    return argv ? parseEvolcoreSendArgv(argv) : null;
 }
 export function isEvolcoreSendCommandForSession(toolName, input, channelId) {
     if (toolName !== 'Bash')
         return false;
-    const cmd = typeof input.command === 'string' ? input.command : '';
-    const parsed = parseEvolcoreSendCommand(cmd);
+    const argv = parseCodexToolCommandArgv(input);
+    const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed)
         return false;
     if (parsed.scope === 'ctl')
         return true;
     return parsed.targetId === channelId;
 }
+/** Proactive first-send guard: exact channel kind and current target only. */
+export function isExactEvolcoreSendCommandForSession(toolName, input, channelId, chatType, selfAid) {
+    // Codex hooks use the canonical name `Bash`; the app-server event adapter
+    // exposes the same commandExecution items as `Shell` to the renderer.
+    if ((toolName !== 'Bash' && toolName !== 'Shell') || !selfAid)
+        return false;
+    const argv = parseCodexToolCommandArgv(input);
+    const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
+    if (!parsed || parsed.action !== 'send')
+        return false;
+    const expectedScope = chatType === 'group' ? 'group' : 'msg';
+    return parsed.scope === expectedScope
+        && parsed.targetId === channelId
+        && parsed.sourceId === selfAid
+        && !!argv
+        && hasExecutableProactiveSendPayload(argv, expectedScope);
+}

package/dist/core/permission/index.js

@@ -1,5 +1,6 @@
 export * from './tool-policy.js';
 export * from './ec-command-parser.js';
+export * from './readonly-shell-query.js';
 export * from './approval-gateway.js';
 export * from './execution-sandbox.js';
 // Tool summaries live in utils; keep the historical permission import path compatible.