evolcore 0.0.10 → 0.0.12

package/dist/core/permission/readonly-shell-query.js

@@ -0,0 +1,532 @@
+import path from 'path';
+import { parseLiteralShellArgv } from './ec-command-parser.js';
+const MAX_QUERY_LISTS = 8;
+const MAX_PIPELINE_STAGES = 3;
+const SUPPORTED_EXECUTABLES = new Set([
+    'echo', 'pwd', 'ls', 'cat', 'grep', 'rg', 'find', 'sed', 'head', 'sort',
+]);
+const FIND_MUTATING_PRIMARY_RE = /^-(?:delete|exec|execdir|ok|okdir|fprint|fprint0|fprintf|fls)$/;
+const RG_PROCESS_SPAWNING_OPTION_RE = /^(?:--pre|--hostname-bin|--pre-glob|--search-zip)(?:=|$)/;
+// The fd number must be adjacent to `>` in real shell grammar. Accepting
+// `2 > /dev/null` would hide a literal file operand named `2` while actually
+// redirecting stdout rather than stderr.
+const STDERR_DEV_NULL_RE = /^(.*?)[ \t]+2>[ \t]*\/dev\/null[ \t]*$/;
+function normalizeExecutable(value) {
+    const normalized = value.replace(/\\/g, '/');
+    const executable = path.posix.basename(normalized);
+    if (!SUPPORTED_EXECUTABLES.has(executable))
+        return undefined;
+    if (normalized === executable || normalized === `/bin/${executable}` || normalized === `/usr/bin/${executable}`) {
+        return executable;
+    }
+    return undefined;
+}
+function splitQueryStructure(command) {
+    const pipelines = [];
+    let pipeline = [];
+    let segment = '';
+    let quote = null;
+    let escaped = false;
+    const finishStage = () => {
+        const trimmed = segment.trim();
+        if (!trimmed)
+            return false;
+        pipeline.push(trimmed);
+        segment = '';
+        return pipeline.length <= MAX_PIPELINE_STAGES;
+    };
+    const finishPipeline = () => {
+        if (!finishStage())
+            return false;
+        pipelines.push(pipeline);
+        pipeline = [];
+        return pipelines.length <= MAX_QUERY_LISTS;
+    };
+    for (let index = 0; index < command.length; index++) {
+        const char = command[index];
+        if (escaped) {
+            segment += char;
+            escaped = false;
+            continue;
+        }
+        if (char === '\\') {
+            segment += char;
+            escaped = true;
+            continue;
+        }
+        if (quote === 'single') {
+            segment += char;
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            segment += char;
+            if (char === '"')
+                quote = null;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char === "'" ? 'single' : 'double';
+            segment += char;
+            continue;
+        }
+        if (char === '\0' || char === '\r' || char === '\n' || char === '&' || char === '<')
+            return null;
+        if (char === '|') {
+            if (command[index + 1] === '|' || !finishStage())
+                return null;
+            continue;
+        }
+        if (char === ';') {
+            if (!finishPipeline())
+                return null;
+            continue;
+        }
+        segment += char;
+    }
+    if (escaped || quote || !finishPipeline())
+        return null;
+    return pipelines;
+}
+function parseStageArgv(segment) {
+    const redirectMatch = segment.match(STDERR_DEV_NULL_RE);
+    const withoutRedirect = redirectMatch?.[1] ?? segment;
+    if (withoutRedirect.includes('>'))
+        return null;
+    return parseLiteralShellArgv(withoutRedirect.trim());
+}
+function exact(value) {
+    return { value, access: 'exact' };
+}
+function recursive(value) {
+    return { value, access: 'recursive' };
+}
+function parseOptionsAndPaths(args, valueOptions, recursiveOptions = new Set()) {
+    const paths = [];
+    let optionsEnded = false;
+    let recursiveAccess = false;
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (!optionsEnded && argument === '--') {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && argument.startsWith('-') && argument !== '-') {
+            const option = argument.split('=', 1)[0];
+            if (recursiveOptions.has(option) || [...recursiveOptions].some(entry => entry.length === 2 && argument.startsWith('-') && !argument.startsWith('--') && argument.slice(1).includes(entry[1]))) {
+                recursiveAccess = true;
+            }
+            if (!argument.includes('=') && valueOptions.has(option)) {
+                if (++index >= args.length)
+                    return null;
+            }
+            continue;
+        }
+        if (argument !== '-')
+            paths.push(argument);
+    }
+    return { paths, recursive: recursiveAccess };
+}
+function analyzeLs(args) {
+    if (args.some(argument => argument === '--dereference'
+        || (!argument.startsWith('--') && /^-[^-]*L/.test(argument))))
+        return null;
+    const parsed = parseOptionsAndPaths(args, new Set([
+        '-I', '-T', '-w', '--block-size', '--color', '--format', '--hide', '--ignore',
+        '--indicator-style', '--quoting-style', '--sort', '--tabsize', '--time', '--time-style',
+    ]), new Set(['-R', '--recursive']));
+    if (!parsed)
+        return null;
+    const values = parsed.paths.length > 0 ? parsed.paths : ['.'];
+    return values.map(value => parsed.recursive ? recursive(value) : exact(value));
+}
+function analyzeCat(args) {
+    const parsed = parseOptionsAndPaths(args, new Set());
+    return parsed?.paths.map(exact) ?? null;
+}
+function consumeOptionValue(args, index, inline) {
+    if (inline)
+        return index;
+    return index + 1 < args.length ? index + 1 : null;
+}
+function analyzeGrep(args) {
+    const paths = [];
+    let optionsEnded = false;
+    let hasExplicitPattern = false;
+    let implicitPatternSeen = false;
+    let inputOperandSeen = false;
+    let recursiveAccess = false;
+    const textValueOptions = new Set([
+        '-A', '-B', '-C', '-m', '--after-context', '--before-context', '--binary-files',
+        '--color', '--context', '--directories', '--exclude', '--exclude-dir', '--group-separator',
+        '--include', '--label', '--max-count',
+    ]);
+    const patternFileOptions = new Set(['-f', '--file']);
+    const auxiliaryFileOptions = new Set(['--exclude-from']);
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (!optionsEnded && argument === '--') {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && argument.startsWith('-') && argument !== '-') {
+            const shortBody = argument.startsWith('--') ? '' : argument.slice(1);
+            const inlineValueOption = shortBody.length > 1 && ['d', 'e', 'f'].includes(shortBody[0]);
+            if (!inlineValueOption && /[def]/.test(shortBody.slice(1)))
+                return null;
+            if (argument === '-R' || argument === '--dereference-recursive'
+                || (!inlineValueOption && shortBody.includes('R')))
+                return null;
+            if (argument === '-r' || argument === '--recursive'
+                || (!inlineValueOption && shortBody.includes('r'))) {
+                recursiveAccess = true;
+            }
+            const option = argument.split('=', 1)[0];
+            if (option === '--directories' || argument === '-d' || (!argument.startsWith('--') && argument.startsWith('-d'))) {
+                const inline = argument.includes('=') || (!argument.startsWith('--') && argument.length > 2);
+                const consumed = consumeOptionValue(args, index, inline);
+                if (consumed === null)
+                    return null;
+                const value = argument.includes('=')
+                    ? argument.slice(argument.indexOf('=') + 1)
+                    : inline
+                        ? argument.slice(2)
+                        : args[consumed];
+                if (value === 'recurse')
+                    recursiveAccess = true;
+                index = consumed;
+                continue;
+            }
+            const inline = argument.includes('=') || (!argument.startsWith('--') && argument.length > 2
+                && (argument[1] === 'e' || argument[1] === 'f'));
+            if (option === '-e' || option === '--regexp' || (!argument.startsWith('--') && argument.startsWith('-e'))) {
+                const consumed = consumeOptionValue(args, index, inline);
+                if (consumed === null)
+                    return null;
+                index = consumed;
+                hasExplicitPattern = true;
+                continue;
+            }
+            const patternFileOption = patternFileOptions.has(option)
+                || (!argument.startsWith('--') && argument.startsWith('-f'));
+            const pathOption = patternFileOption || auxiliaryFileOptions.has(option);
+            if (pathOption) {
+                const consumed = consumeOptionValue(args, index, inline);
+                if (consumed === null)
+                    return null;
+                if (inline) {
+                    const value = argument.includes('=') ? argument.slice(argument.indexOf('=') + 1) : argument.slice(2);
+                    if (value)
+                        paths.push(exact(value));
+                }
+                else {
+                    paths.push(exact(args[consumed]));
+                }
+                index = consumed;
+                if (patternFileOption)
+                    hasExplicitPattern = true;
+                continue;
+            }
+            if (textValueOptions.has(option)) {
+                const consumed = consumeOptionValue(args, index, argument.includes('='));
+                if (consumed === null)
+                    return null;
+                index = consumed;
+            }
+            continue;
+        }
+        if (!hasExplicitPattern && !implicitPatternSeen) {
+            implicitPatternSeen = true;
+            continue;
+        }
+        inputOperandSeen = true;
+        if (argument !== '-')
+            paths.push(recursiveAccess ? recursive(argument) : exact(argument));
+    }
+    if (!hasExplicitPattern && !implicitPatternSeen)
+        return null;
+    if (recursiveAccess && !inputOperandSeen)
+        paths.push(recursive('.'));
+    return paths;
+}
+function analyzeRg(args) {
+    if (args.some(argument => RG_PROCESS_SPAWNING_OPTION_RE.test(argument)
+        || argument === '--follow'
+        // `-z` is the short form of `--search-zip`; it may also appear in a
+        // short-option cluster such as `-nz`. Once -e/-f/-g starts an attached
+        // value, later letters belong to that value rather than the option set.
+        || (argument.startsWith('-') && !argument.startsWith('--') && (() => {
+            const body = argument.slice(1);
+            if (body.length > 1 && ['e', 'f', 'g'].includes(body[0]))
+                return false;
+            if (/[efg]/.test(body.slice(1)))
+                return true;
+            return /[Lz]/.test(body);
+        })())))
+        return null;
+    const paths = [];
+    let optionsEnded = false;
+    let hasExplicitPattern = false;
+    let implicitPatternSeen = false;
+    let filesMode = false;
+    let inputOperandSeen = false;
+    const textValueOptions = new Set([
+        '-A', '-B', '-C', '-E', '-M', '-g', '-j', '-m', '-r', '-t', '-T',
+        '--after-context', '--before-context', '--color', '--colors', '--context', '--context-separator',
+        '--dfa-size-limit', '--encoding', '--engine', '--field-context-separator', '--field-match-separator',
+        '--glob', '--iglob', '--max-columns', '--max-count', '--max-depth', '--max-filesize', '--path-separator',
+        '--regex-size-limit', '--replace', '--sort', '--sortr', '--type', '--type-add', '--type-clear', '--type-not',
+    ]);
+    const patternFileOptions = new Set(['-f', '--file']);
+    const auxiliaryFileOptions = new Set(['--ignore-file']);
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (!optionsEnded && argument === '--') {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && argument.startsWith('-') && argument !== '-') {
+            const option = argument.split('=', 1)[0];
+            if (['--files', '--files-with-matches', '--files-without-match', '--type-list'].includes(option))
+                filesMode = true;
+            const inlineShort = !argument.startsWith('--') && argument.length > 2
+                && (argument[1] === 'e' || argument[1] === 'f' || argument[1] === 'g');
+            if (option === '-e' || option === '--regexp' || (!argument.startsWith('--') && argument.startsWith('-e'))) {
+                const consumed = consumeOptionValue(args, index, argument.includes('=') || inlineShort);
+                if (consumed === null)
+                    return null;
+                index = consumed;
+                hasExplicitPattern = true;
+                continue;
+            }
+            const patternFileOption = patternFileOptions.has(option)
+                || (!argument.startsWith('--') && argument.startsWith('-f'));
+            const pathOption = patternFileOption || auxiliaryFileOptions.has(option);
+            if (pathOption) {
+                const inline = argument.includes('=') || inlineShort;
+                const consumed = consumeOptionValue(args, index, inline);
+                if (consumed === null)
+                    return null;
+                if (inline) {
+                    const value = argument.includes('=') ? argument.slice(argument.indexOf('=') + 1) : argument.slice(2);
+                    if (value)
+                        paths.push(exact(value));
+                }
+                else {
+                    paths.push(exact(args[consumed]));
+                }
+                index = consumed;
+                if (patternFileOption)
+                    hasExplicitPattern = true;
+                continue;
+            }
+            if (textValueOptions.has(option) || (!argument.startsWith('--') && argument.startsWith('-g'))) {
+                const consumed = consumeOptionValue(args, index, argument.includes('=') || inlineShort);
+                if (consumed === null)
+                    return null;
+                index = consumed;
+            }
+            continue;
+        }
+        if (!filesMode && !hasExplicitPattern && !implicitPatternSeen) {
+            implicitPatternSeen = true;
+            continue;
+        }
+        inputOperandSeen = true;
+        if (argument !== '-')
+            paths.push(recursive(argument));
+    }
+    if (!filesMode && !hasExplicitPattern && !implicitPatternSeen)
+        return null;
+    if (!inputOperandSeen)
+        paths.push(recursive('.'));
+    return paths;
+}
+function analyzeFind(args) {
+    if (args.some(argument => FIND_MUTATING_PRIMARY_RE.test(argument)))
+        return null;
+    if (args.includes('-L') || args.includes('-H') || args.includes('-follow'))
+        return null;
+    const paths = [];
+    let index = 0;
+    while (index < args.length && (args[index] === '-P' || args[index].startsWith('-O') || args[index] === '-D')) {
+        if (args[index] === '-D') {
+            if (++index >= args.length)
+                return null;
+        }
+        index++;
+    }
+    while (index < args.length && !args[index].startsWith('-') && !['!', '(', ')'].includes(args[index])) {
+        paths.push(recursive(args[index++]));
+    }
+    if (paths.length === 0)
+        paths.push(recursive('.'));
+    const noValue = new Set([
+        '!', '(', ')', '-a', '-and', '-d', '-daystart', '-depth', '-empty', '-executable', '-false',
+        '-help', '--help', '-ignore_readdir_race', '-ls', '-mount', '-noignore_readdir_race', '-noleaf',
+        '-not', '-o', '-or', '-print', '-print0', '-prune', '-quit', '-readable', '-true', '-version',
+        '--version', '-writable', '-xdev',
+    ]);
+    const textValue = new Set([
+        '-amin', '-atime', '-cmin', '-ctime', '-fstype', '-gid', '-group', '-ilname', '-iname', '-inum',
+        '-ipath', '-iregex', '-iwholename', '-links', '-lname', '-maxdepth', '-mindepth', '-mmin', '-mtime',
+        '-name', '-path', '-perm', '-printf', '-regex', '-regextype', '-size', '-type', '-uid', '-used',
+        '-user', '-wholename', '-xtype',
+    ]);
+    const pathValue = new Set(['-anewer', '-cnewer', '-newer', '-samefile']);
+    while (index < args.length) {
+        const argument = args[index++];
+        // The file contents become additional starting points, so their protected
+        // path semantics cannot be proven from argv alone.
+        if (argument === '-files0-from')
+            return null;
+        if (noValue.has(argument))
+            continue;
+        if (textValue.has(argument)) {
+            if (index >= args.length)
+                return null;
+            index++;
+            continue;
+        }
+        if (/^-newer[aBcm]?t$/.test(argument)) {
+            if (index >= args.length)
+                return null;
+            index++;
+            continue;
+        }
+        if (/^-newer[A-Za-z]{2}$/.test(argument) || pathValue.has(argument)) {
+            if (index >= args.length)
+                return null;
+            paths.push(exact(args[index++]));
+            continue;
+        }
+        return null;
+    }
+    return paths;
+}
+function analyzeSed(args) {
+    if (!['-n', '--quiet', '--silent'].includes(args[0]))
+        return null;
+    const program = args[1];
+    if (!program || !/^(?:p|(?:\d+|\$)(?:,(?:\d+|\$))?p)$/.test(program))
+        return null;
+    if (args.slice(2).some(argument => argument.startsWith('-') && argument !== '-'))
+        return null;
+    return args.slice(2).filter(argument => argument !== '-').map(exact);
+}
+function analyzeHead(args) {
+    const parsed = parseOptionsAndPaths(args, new Set(['-c', '-n', '--bytes', '--lines']));
+    return parsed?.paths.map(exact) ?? null;
+}
+function analyzeSort(args) {
+    if (args.some(argument => /^(?:-o|-T)(?:.+|$)|^(?:--output|--compress-program|--temporary-directory|--files0-from)(?:=|$)/.test(argument))) {
+        return null;
+    }
+    const paths = [];
+    let optionsEnded = false;
+    const textValueOptions = new Set([
+        '-k', '-S', '-t', '--batch-size', '--buffer-size', '--field-separator', '--key', '--parallel', '--sort',
+    ]);
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (!optionsEnded && argument === '--') {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && argument.startsWith('-') && argument !== '-') {
+            const option = argument.split('=', 1)[0];
+            if (option === '--random-source') {
+                const inline = argument.includes('=');
+                const consumed = consumeOptionValue(args, index, inline);
+                if (consumed === null)
+                    return null;
+                paths.push(exact(inline ? argument.slice(argument.indexOf('=') + 1) : args[consumed]));
+                index = consumed;
+                continue;
+            }
+            if (textValueOptions.has(option)) {
+                const consumed = consumeOptionValue(args, index, argument.includes('='));
+                if (consumed === null)
+                    return null;
+                index = consumed;
+            }
+            continue;
+        }
+        if (argument !== '-')
+            paths.push(exact(argument));
+    }
+    return paths;
+}
+function analyzeCommand(argv) {
+    const executable = normalizeExecutable(argv[0]);
+    if (!executable)
+        return null;
+    const args = argv.slice(1);
+    let pathOperands = null;
+    switch (executable) {
+        case 'echo':
+            pathOperands = [];
+            break;
+        case 'pwd':
+            pathOperands = args.every(argument => ['-L', '-P', '--help', '--version'].includes(argument)) ? [] : null;
+            break;
+        case 'ls':
+            pathOperands = analyzeLs(args);
+            break;
+        case 'cat':
+            pathOperands = analyzeCat(args);
+            break;
+        case 'grep':
+            pathOperands = analyzeGrep(args);
+            break;
+        case 'rg':
+            pathOperands = analyzeRg(args);
+            break;
+        case 'find':
+            pathOperands = analyzeFind(args);
+            break;
+        case 'sed':
+            pathOperands = analyzeSed(args);
+            break;
+        case 'head':
+            pathOperands = analyzeHead(args);
+            break;
+        case 'sort':
+            pathOperands = analyzeSort(args);
+            break;
+    }
+    if (!pathOperands)
+        return null;
+    return { command: { executable, argv, pathOperands } };
+}
+export function analyzeReadonlyShellQuery(command) {
+    const structure = splitQueryStructure(command);
+    if (!structure)
+        return { kind: 'unproven', reason: 'unsupported-shell-structure' };
+    const pipelines = [];
+    const pathOperands = [];
+    for (const stages of structure) {
+        const pipeline = [];
+        for (let index = 0; index < stages.length; index++) {
+            const argv = parseStageArgv(stages[index]);
+            if (!argv)
+                return { kind: 'unproven', reason: 'non-literal-command' };
+            const analyzed = analyzeCommand(argv);
+            if (!analyzed)
+                return { kind: 'unproven', reason: 'unsupported-command-or-option' };
+            if (index > 0) {
+                if (!['head', 'sort'].includes(analyzed.command.executable)) {
+                    return { kind: 'unproven', reason: 'unsupported-pipeline-filter' };
+                }
+                if (analyzed.command.pathOperands.length > 0) {
+                    return { kind: 'unproven', reason: 'pipeline-filter-must-use-stdin' };
+                }
+            }
+            pipeline.push(analyzed.command);
+            pathOperands.push(...analyzed.command.pathOperands);
+        }
+        pipelines.push(pipeline);
+    }
+    return { kind: 'proven-readonly', ir: { pipelines, pathOperands } };
+}

package/dist/core/permission/sandbox-runtime.js

@@ -210,7 +210,7 @@ function appendLClassReadOnlyBinds(args, root) {
         args.push('--ro-bind', target.path, target.path);
     }
 }
-export function buildHClassGuardCommand(executable, executableArgs, root = resolveRoot()) {
+export function buildHClassGuardCommand(executable, executableArgs, root = resolveRoot(), options = {}) {
     const bubblewrapPath = resolveBubblewrapPath();
     if (!bubblewrapPath)
         return undefined;
@@ -224,6 +224,27 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
     ];
     appendLClassReadOnlyBinds(args, path.resolve(root));
     appendHClassMasks(args, path.resolve(root), true);
+    if (options.managedCodexRequirements) {
+        const requirements = path.resolve(options.managedCodexRequirements);
+        if (!fs.statSync(requirements).isFile()) {
+            throw new Error(`Codex managed requirements is not a file: ${requirements}`);
+        }
+        const managedDirectory = path.dirname(requirements);
+        // Keep the copied hook immutable even when a session uses bypass mode.
+        args.push('--ro-bind', managedDirectory, managedDirectory);
+        // A host may not have /etc/codex yet. Overlay /etc inside this namespace so
+        // Bubblewrap can create the mountpoint without modifying the host, while
+        // retaining the complete host /etc as the read-only lower layer.
+        args.push('--overlay-src', '/etc');
+        args.push('--tmp-overlay', '/etc');
+        args.push('--dir', '/etc/codex');
+        // Replace the complete Codex system-config directory inside this app-server
+        // namespace so host system hooks cannot join EvolCore's managed hook set.
+        args.push('--tmpfs', '/etc/codex');
+        args.push('--ro-bind', requirements, '/etc/codex/requirements.toml');
+        args.push('--remount-ro', '/etc/codex');
+        args.push('--remount-ro', '/etc');
+    }
     args.push('--', executable, ...executableArgs);
     return { command: bubblewrapPath, args };
 }

package/dist/core/permission/shell-environment.js

@@ -0,0 +1,46 @@
+const SHELL_CODE_INJECTION_ENV = new Set([
+    'BASH_ENV',
+    'BASHOPTS',
+    'BASH_XTRACEFD',
+    'CDPATH',
+    'ENV',
+    'GCONV_PATH',
+    'GREP_OPTIONS',
+    'LD_AUDIT',
+    'LD_LIBRARY_PATH',
+    'LD_PRELOAD',
+    'LOCPATH',
+    'NODE_OPTIONS',
+    'NODE_PATH',
+    'PROMPT_COMMAND',
+    'PS4',
+    'RIPGREP_CONFIG_PATH',
+    'SHELLOPTS',
+    'DYLD_FRAMEWORK_PATH',
+    'DYLD_INSERT_LIBRARIES',
+    'DYLD_LIBRARY_PATH',
+]);
+const EXECUTABLE_RESOLUTION_ENV = ['PATH', 'HOME', 'SHELL'];
+export function isShellCodeInjectionEnvironmentName(name) {
+    return SHELL_CODE_INJECTION_ENV.has(name)
+        || name.startsWith('BASH_FUNC_')
+        || name.startsWith('LD_')
+        || name.startsWith('DYLD_');
+}
+export function sanitizeShellExecutionEnvironment(input, options = {}) {
+    const sanitized = { ...input };
+    for (const name of Object.keys(sanitized)) {
+        if (isShellCodeInjectionEnvironmentName(name))
+            delete sanitized[name];
+    }
+    if (options.lockExecutableResolution) {
+        const baseline = options.baseline ?? process.env;
+        for (const name of EXECUTABLE_RESOLUTION_ENV) {
+            if (baseline[name] === undefined)
+                delete sanitized[name];
+            else
+                sanitized[name] = baseline[name];
+        }
+    }
+    return sanitized;
+}