evolcore 0.0.10 → 0.0.12

package/dist/core/permission/tool-policy.js

@@ -3,8 +3,9 @@ import path from 'path';
 import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
-import { containsHClassReference, containsLClassReference, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, } from '../protected-paths.js';
-import { classifyEvolcoreShellCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, } from './ec-command-parser.js';
+import { containsHClassReference, containsLClassReference, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, } from '../protected-paths.js';
+import { classifyEvolcoreShellCommand, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from './ec-command-parser.js';
+import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 // 绝对禁止命令（所有角色、所有权限模式下都禁止，不可授权）
 // 这些是系统级破坏操作，任何情况下都不应该允许
 const ABSOLUTE_FORBIDDEN = [
@@ -14,19 +15,6 @@ const ABSOLUTE_FORBIDDEN = [
     /\bformat\s+[a-zA-Z]:/i, // format C: (格式化磁盘)
     /\bdd\s+if=.*of=\/dev/, // dd 写入磁盘设备（读取操作允许）
 ];
-const READONLY_SHELL_EXECUTABLES = new Set([
-    'ls', '/bin/ls', '/usr/bin/ls',
-    'cat', '/bin/cat', '/usr/bin/cat',
-]);
-const L_CLASS_READONLY_SHELL_EXECUTABLES = new Set([
-    ...READONLY_SHELL_EXECUTABLES,
-    'grep', '/bin/grep', '/usr/bin/grep',
-    'rg', '/bin/rg', '/usr/bin/rg',
-    'find', '/bin/find', '/usr/bin/find',
-    'sed', '/bin/sed', '/usr/bin/sed',
-]);
-const FIND_MUTATING_PRIMARY_RE = /^-(?:delete|exec|execdir|ok|okdir|fprint|fprint0|fprintf|fls)$/;
-const RG_PROCESS_SPAWNING_OPTION_RE = /^--pre(?:=|$)|^--pre-glob(?:=|$)/;
 // 危险操作（需要用户审批才能执行）
 // 这些操作有合理使用场景，但需要用户明确授权
 const DANGEROUS_PATTERNS = [
@@ -331,19 +319,163 @@ function containsNetStopCommand(command, depth = 0) {
             && containsNetStopCommand(parsed.args.slice(commandIndex + 1).join(' '), depth + 1);
     });
 }
+function queryPathOperands(analysis) {
+    return analysis.kind === 'proven-readonly' ? analysis.ir.pathOperands : [];
+}
+function shellOperandMatchesClass(operand, className, options) {
+    const reference = className === 'h' ? containsHClassReference(operand.value) : containsLClassReference(operand.value);
+    if (reference)
+        return true;
+    if (operand.access === 'recursive') {
+        return className === 'h'
+            ? hClassReadScopeIncludesProtectedPath(operand.value, options)
+            : lClassGrantIncludesProtectedPath(operand.value, options);
+    }
+    return className === 'h'
+        ? isHClassPath(operand.value, options)
+        : isLClassPath(operand.value, options);
+}
 /**
- * 只读模式检查（用于 PreToolUse hook 和 canUseTool callback）
- * 显式读工具自动允许；写工具和未知工具拒绝。
- * Bash 默认拒绝；只允许由严格字面量解析器证明为 ls/cat 的只读命令。
- * 通过 EC Shell 边界分类的整条字面量调用应由 runner 在调用本函数前放行。
+ * A read-only recursive query only needs to cover H-class targets that exist
+ * now. This deliberately differs from a filesystem *grant*: a grant below
+ * any directory could later create a protected backup name, while a proven
+ * query cannot write and should still be able to inspect an ordinary logs/
+ * directory.
+ */
+function hClassReadScopeIncludesProtectedPath(value, options) {
+    const root = resolveProtectedCandidate(options.root ?? resolveRoot());
+    const scope = resolveProtectedCandidate(value, options.cwd);
+    if (isSameOrDescendant(root, scope))
+        return true;
+    if (!isSameOrDescendant(scope, root))
+        return false;
+    return getExistingHClassMaskTargets(root).some(target => isSameOrDescendant(target.path, scope));
+}
+function analyzeShellProtectedOperands(command, options) {
+    const analysis = analyzeReadonlyShellQuery(command);
+    if (analysis.kind === 'unproven') {
+        return {
+            analysis,
+            hClass: containsHClassReference(command),
+            lClass: containsLClassReference(command),
+        };
+    }
+    const operands = queryPathOperands(analysis);
+    return {
+        analysis,
+        hClass: operands.some(operand => shellOperandMatchesClass(operand, 'h', options)),
+        lClass: operands.some(operand => shellOperandMatchesClass(operand, 'l', options)),
+    };
+}
+function protectedReadToolPaths(toolName, input) {
+    if (toolName === 'Read') {
+        return typeof input.file_path === 'string' ? [input.file_path] : [];
+    }
+    if (toolName === 'Glob') {
+        return [input.pattern, input.path].filter((value) => typeof value === 'string' && value.length > 0);
+    }
+    if (toolName === 'Grep') {
+        return typeof input.path === 'string' ? [input.path] : [];
+    }
+    return [];
+}
+function protectedReadToolMatchesLClass(toolName, input, options) {
+    const paths = protectedReadToolPaths(toolName, input);
+    if (paths.some(filePath => containsLClassReference(filePath) || isLClassPath(filePath, options))) {
+        return true;
+    }
+    if (toolName === 'Grep') {
+        const scope = typeof input.path === 'string' && input.path ? input.path : '.';
+        return lClassGrantIncludesProtectedPath(scope, options);
+    }
+    if (toolName === 'Glob') {
+        const scope = globReadScope(input, options);
+        return lClassGrantIncludesProtectedPath(scope, { root: options.root });
+    }
+    return false;
+}
+function protectedReadToolMatchesHClass(toolName, input, options) {
+    const paths = protectedReadToolPaths(toolName, input);
+    if (paths.some(filePath => containsHClassReference(filePath) || isHClassPath(filePath, options))) {
+        return true;
+    }
+    if (toolName === 'Grep') {
+        const scope = typeof input.path === 'string' && input.path ? input.path : '.';
+        return hClassReadScopeIncludesProtectedPath(scope, options);
+    }
+    if (toolName === 'Glob') {
+        const scope = globReadScope(input, options);
+        return hClassReadScopeIncludesProtectedPath(scope, options);
+    }
+    return false;
+}
+function globLiteralPrefix(pattern) {
+    const normalized = pattern.replace(/\\/g, '/');
+    const globIndex = normalized.search(/[*?[{]/);
+    return globIndex < 0 ? normalized : normalized.slice(0, globIndex).replace(/\/+$/, '');
+}
+function globReadScope(input, options) {
+    const pattern = typeof input.pattern === 'string' && input.pattern ? input.pattern : '**/*';
+    const baseValue = typeof input.path === 'string' && input.path ? input.path : '.';
+    const base = resolveProtectedCandidate(baseValue, options.cwd);
+    const prefix = globLiteralPrefix(pattern);
+    return path.isAbsolute(pattern)
+        ? resolveProtectedCandidate(prefix || path.parse(pattern).root)
+        : resolveProtectedCandidate(prefix || '.', base);
+}
+function protectedReadToolStaysInWorkspace(toolName, input, projectPath) {
+    const workspace = resolveProtectedCandidate(projectPath);
+    if (toolName === 'Read') {
+        if (typeof input.file_path !== 'string' || !input.file_path)
+            return false;
+        return isSameOrDescendant(resolveProtectedCandidate(input.file_path, projectPath), workspace);
+    }
+    if (toolName === 'Grep') {
+        const scope = typeof input.path === 'string' && input.path ? input.path : '.';
+        return isSameOrDescendant(resolveProtectedCandidate(scope, projectPath), workspace);
+    }
+    if (toolName === 'Glob') {
+        const baseValue = typeof input.path === 'string' && input.path ? input.path : '.';
+        const base = resolveProtectedCandidate(baseValue, projectPath);
+        if (!isSameOrDescendant(base, workspace))
+            return false;
+        const scope = globReadScope(input, { cwd: projectPath });
+        return isSameOrDescendant(scope, workspace);
+    }
+    return true;
+}
+function readonlyShellStaysInWorkspace(analysis, projectPath) {
+    if (analysis.kind !== 'proven-readonly')
+        return false;
+    const workspace = resolveProtectedCandidate(projectPath);
+    return analysis.ir.pathOperands.every(operand => isSameOrDescendant(resolveProtectedCandidate(operand.value, projectPath), workspace));
+}
+/**
+ * 只读模式检查（用于 PreToolUse hook 和 canUseTool callback）。普通
+ * 路径上的受限查询 Bash 可自动执行；H/L-class 和未建模 Shell 仍拒绝。
  */
 export function checkReadonly(toolName, input, projectPath, context) {
     const readOnlyTools = new Set([
         'Read', 'Glob', 'Grep', 'WebSearch', 'WebFetch',
         'TaskList', 'TaskGet', 'ToolSearch',
     ]);
-    if (readOnlyTools.has(toolName))
+    if (readOnlyTools.has(toolName)) {
+        const paths = protectedReadToolPaths(toolName, input);
+        const pathOptions = { cwd: projectPath, root: context?.root };
+        if (!protectedReadToolStaysInWorkspace(toolName, input, projectPath)) {
+            return { behavior: 'deny', message: '🔒 只读模式：文件读取范围不能越出当前项目目录' };
+        }
+        if (paths.some(filePath => containsHClassReference(filePath) || isHClassPath(filePath, pathOptions))) {
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径' };
+        }
+        if (protectedReadToolMatchesHClass(toolName, input, pathOptions)) {
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径' };
+        }
+        if (protectedReadToolMatchesLClass(toolName, input, pathOptions)) {
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径' };
+        }
         return { behavior: 'allow' };
+    }
     if (toolName === 'Write' || toolName === 'Edit' || toolName === 'NotebookEdit') {
         const filePath = (input.file_path || input.notebook_path);
         logger.warn(`[ReadonlyCheck] 🔒 File write blocked: tool=${toolName} path=${filePath} project=${projectPath} session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
@@ -351,25 +483,27 @@ export function checkReadonly(toolName, input, projectPath, context) {
     }
     if (toolName === 'Bash') {
         const cmd = input.command || '';
-        const argv = parseLiteralShellArgv(cmd);
-        const executable = argv?.[0];
-        const readonlyExecutable = executable && READONLY_SHELL_EXECUTABLES.has(executable);
-        if (context?.allowLiteralReadShell === true && argv && readonlyExecutable) {
-            const protectedOperand = argv.slice(1).some(argument => {
-                if (argument === '-' || argument === '--' || argument.startsWith('-'))
-                    return false;
-                return containsHClassReference(argument)
-                    || isHClassPath(argument, { cwd: projectPath });
-            });
-            if (!containsHClassReference(cmd) && !protectedOperand) {
-                return { behavior: 'allow' };
-            }
-            logger.warn(`[ReadonlyCheck] 🔒 Protected path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-            return { behavior: 'deny', message: '🔒 只读模式：ls/cat 不允许读取 H 类受保护路径' };
+        const protectedOperands = analyzeShellProtectedOperands(cmd, { cwd: projectPath, root: context?.root });
+        if (protectedOperands.analysis.kind === 'proven-readonly'
+            && !protectedOperands.hClass
+            && !protectedOperands.lClass
+            && readonlyShellStaysInWorkspace(protectedOperands.analysis, projectPath)) {
+            return { behavior: 'allow' };
+        }
+        if (protectedOperands.hClass) {
+            logger.warn(`[ReadonlyCheck] 🔒 H-class path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径' };
+        }
+        if (protectedOperands.lClass) {
+            logger.warn(`[ReadonlyCheck] 🔒 L-class path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径' };
+        }
+        if (protectedOperands.analysis.kind === 'proven-readonly') {
+            return { behavior: 'deny', message: '🔒 只读模式：Shell 查询范围不能越出当前项目目录' };
         }
         const cmdPreview = cmd.length > 80 ? cmd.substring(0, 80) + '...' : cmd;
         logger.warn(`[ReadonlyCheck] 🔒 Bash blocked by default: cmd="${cmdPreview}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-        return { behavior: 'deny', message: '🔒 只读模式：Shell 仅允许单个字面量 ls/cat 命令' };
+        return { behavior: 'deny', message: '🔒 只读模式：Shell 仅允许受限、可证明只读的普通路径查询' };
     }
     logger.warn(`[ReadonlyCheck] 🔒 Unknown tool blocked: tool=${toolName} session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
     return { behavior: 'deny', message: `🔒 只读模式：未声明为只读的工具 ${toolName} 已拒绝执行` };
@@ -577,53 +711,6 @@ function collectFileChangePaths(value, output) {
         }
     }
 }
-function shellCommandReferencesLClass(command, options) {
-    const normalized = command.replace(/\\/g, '/');
-    if (containsLClassReference(normalized))
-        return true;
-    const argv = parseLiteralShellArgv(command);
-    return argv?.slice(1).some(argument => {
-        if (argument === '-' || argument === '--' || argument.startsWith('-'))
-            return false;
-        return isLClassPath(argument, options);
-    }) ?? false;
-}
-function isVerifiedLClassReadOnlyShellCommand(command) {
-    const argv = parseLiteralShellArgv(command);
-    if (!argv || !L_CLASS_READONLY_SHELL_EXECUTABLES.has(argv[0]))
-        return false;
-    switch (argv[0].replace(/^.*\//, '')) {
-        case 'grep':
-            // grep never mutates its operands. Shell composition is rejected by the
-            // literal parser before this point.
-            return true;
-        case 'rg':
-            // ripgrep's --pre hooks may execute an arbitrary process.
-            return !argv.slice(1).some(argument => RG_PROCESS_SPAWNING_OPTION_RE.test(argument));
-        case 'find':
-            // Keep only the predicates/actions which cannot create, mutate, or
-            // execute files. Other find options remain fail-closed.
-            return !argv.slice(1).some(argument => FIND_MUTATING_PRIMARY_RE.test(argument));
-        case 'sed': {
-            // sed can write via -i or a `w` command. Permit only the bounded
-            // inspection form used for line-range reads: sed -n 'START[,END]p'.
-            const quiet = argv[1] === '-n' || argv[1] === '--quiet' || argv[1] === '--silent';
-            const program = quiet ? argv[2] : undefined;
-            return !!program
-                && /^(?:\d+(?:,\d+)?|\$)?p$/.test(program)
-                // GNU sed accepts options after the script as well. Reject every
-                // later option so -i/-e/-f cannot be smuggled into this read form.
-                && !argv.slice(3).some(argument => argument.startsWith('-'));
-        }
-        default:
-            return true;
-    }
-}
-function isUnverifiedLClassShellCommand(command, options) {
-    if (!shellCommandReferencesLClass(command, options))
-        return false;
-    return !isVerifiedLClassReadOnlyShellCommand(command);
-}
 function requestsFilesystemRoot(value) {
     if (Array.isArray(value))
         return value.some(requestsFilesystemRoot);
@@ -647,8 +734,11 @@ export function checkHClassWrite(toolName, input, context) {
     const paths = [];
     const grantPaths = [];
     const projectRootGrantSubpaths = [];
-    if (['Read', 'Write', 'Edit', 'NotebookEdit', 'Glob', 'Grep'].includes(toolName)) {
-        const filePath = input.file_path ?? input.notebook_path ?? input.path ?? input.pattern;
+    if (['Read', 'Glob', 'Grep'].includes(toolName)) {
+        paths.push(...protectedReadToolPaths(toolName, input));
+    }
+    else if (['Write', 'Edit', 'NotebookEdit'].includes(toolName)) {
+        const filePath = input.file_path ?? input.notebook_path ?? input.path;
         if (typeof filePath === 'string' && filePath)
             paths.push(filePath);
     }
@@ -661,9 +751,13 @@ export function checkHClassWrite(toolName, input, context) {
         collectFilesystemGrantPaths(input.permissions, grantPaths, projectRootGrantSubpaths);
     }
     else if (toolName === 'Bash') {
-        const command = typeof input.command === 'string' ? input.command.replace(/\\/g, '/') : '';
-        if (containsHClassReference(command)) {
-            logger.warn(`[H-Class Protection] 🔒 Protected path referenced by shell command: tool=${toolName} ` +
+        const command = typeof input.command === 'string' ? input.command : '';
+        const protectedOperands = analyzeShellProtectedOperands(command, {
+            cwd: context?.projectPath,
+            root: context?.root,
+        });
+        if (protectedOperands.hClass) {
+            logger.warn(`[H-Class Protection] 🔒 Protected filesystem operand in shell command: tool=${toolName} ` +
                 `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
             return {
                 behavior: 'deny',
@@ -686,6 +780,15 @@ export function checkHClassWrite(toolName, input, context) {
     // filesystem operation is checked again when it reaches Read/Write/Bash,
     // FileChange, or PermissionGrant above.
     const pathOptions = { cwd: context?.projectPath, root: context?.root };
+    if (['Read', 'Glob', 'Grep'].includes(toolName)
+        && protectedReadToolMatchesHClass(toolName, input, pathOptions)) {
+        logger.warn(`[H-Class Protection] 🔒 Protected filesystem read scope blocked: tool=${toolName} ` +
+            `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+        return {
+            behavior: 'deny',
+            message: '🔒 文件读取范围包含受保护的 H 类配置/证书/快照路径，agent 不可直接操作',
+        };
+    }
     if (requestsFilesystemRoot(input.permissions) || requestsFilesystemRoot(input.additionalPermissions)) {
         logger.warn(`[H-Class Protection] 🔒 Permission grant covers filesystem root: tool=${toolName} ` +
             `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
@@ -771,8 +874,14 @@ export function checkHClassWrite(toolName, input, context) {
  * operations may mutate, delete, move, replace, or grant write access to them.
  */
 export function checkLClassWrite(toolName, input, context) {
-    if (['Read', 'Glob', 'Grep'].includes(toolName))
+    if (['Read', 'Glob', 'Grep'].includes(toolName)) {
+        const pathOptions = { cwd: context?.projectPath, root: context?.root };
+        const lClassRead = protectedReadToolMatchesLClass(toolName, input, pathOptions);
+        if (lClassRead && context?.permissionMode === 'readonly') {
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径' };
+        }
         return { behavior: 'allow' };
+    }
     const paths = [];
     const writeGrantPaths = [];
     const projectRootWriteSubpaths = [];
@@ -794,14 +903,19 @@ export function checkLClassWrite(toolName, input, context) {
         collectFilesystemWriteGrantPaths(input.permissions, writeGrantPaths, projectRootWriteSubpaths);
     }
     else if (toolName === 'Bash') {
-        const command = typeof input.command === 'string' ? input.command.replace(/\\/g, '/') : '';
+        const command = typeof input.command === 'string' ? input.command : '';
         const pathOptions = { cwd: context?.projectPath, root: context?.root };
-        if (isUnverifiedLClassShellCommand(command, pathOptions)) {
-            logger.warn(`[L-Class Protection] Unverified L-class shell command denied: tool=${toolName} ` +
+        const protectedOperands = analyzeShellProtectedOperands(command, pathOptions);
+        const lClassDenied = protectedOperands.lClass
+            && (context?.permissionMode === 'readonly' || protectedOperands.analysis.kind === 'unproven');
+        if (lClassDenied) {
+            logger.warn(`[L-Class Protection] L-class shell access denied: tool=${toolName} ` +
                 `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
             return {
                 behavior: 'deny',
-                message: '🔒 L-class 路径仅允许单个可验证的只读命令。请拆分为单条 ls/cat/grep/rg/find 或 sed -n，或使用 Read；禁止管道、重定向、变量展开和命令拼接。修改必须通过受控的 EvolCore 命令',
+                message: context?.permissionMode === 'readonly'
+                    ? '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径'
+                    : '🔒 L-class 路径仅允许受限、可证明只读的命令；未知 Shell 语法失败关闭。修改必须通过受控的 EvolCore 命令',
             };
         }
         collectFilesystemWriteGrantPaths(input.additionalPermissions, writeGrantPaths, projectRootWriteSubpaths);
@@ -957,7 +1071,57 @@ function prepareBoundedOutputInput(input, command, kind, context) {
 export function evaluateToolPreflight(toolName, input, context) {
     if (toolName === 'Bash') {
         const command = typeof input.command === 'string' ? input.command : '';
-        const ecCommand = classifyEvolcoreShellCommand(command);
+        const explicitCommandArgv = Array.isArray(input.commandArgv)
+            && input.commandArgv.every(value => typeof value === 'string')
+            ? input.commandArgv
+            : undefined;
+        const outerArgv = explicitCommandArgv ?? parseLiteralShellArgv(command) ?? undefined;
+        const wrappedCommand = outerArgv ? unwrapCodexShellCommandArgv(outerArgv) : undefined;
+        const policyCommand = wrappedCommand ?? command;
+        if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(policyCommand)) {
+            return {
+                behavior: 'deny',
+                input,
+                message: '🔒 EvolCore 托管会话不需要探测 `ec` 是否存在；请不要调用 `command -v`/`which`/`type`，也不要拼接其它命令。通信必须走当前 session 的 delegated sender。',
+                policyCode: 'managed_ec_discovery_forbidden',
+            };
+        }
+        const argv = context.sessionId ? parseCodexToolCommandArgv(input) : null;
+        const managedAidArgv = argv?.at(-2) === '--format' && argv.at(-1) === 'json'
+            ? argv.slice(0, -2)
+            : argv;
+        const ownAid = !!managedAidArgv
+            && !!context.selfAid
+            && managedAidArgv.at(-1)?.replace(/^@/, '') === context.selfAid.replace(/^@/, '');
+        const isSelfManagedAidRead = !!managedAidArgv
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && ownAid
+            && ((managedAidArgv.length === 4 && ['show', 'lookup'].includes(managedAidArgv[2]))
+                || (managedAidArgv.length === 5
+                    && managedAidArgv[2] === 'agentmd'
+                    && managedAidArgv[3] === 'get'));
+        const isSelfAgentMdPublish = !!managedAidArgv
+            && managedAidArgv.length === 5
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && managedAidArgv[2] === 'agentmd'
+            && managedAidArgv[3] === 'put'
+            && ownAid;
+        const canPublishSelfAgentMd = isSelfAgentMdPublish
+            && ['request', 'bypass'].includes(context.permissionMode ?? '');
+        const isAllowedManagedAidCommand = isSelfManagedAidRead || canPublishSelfAgentMd;
+        if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(policyCommand) && !isAllowedManagedAidCommand) {
+            return {
+                behavior: 'deny',
+                input,
+                message: isSelfAgentMdPublish && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
+                    ? `🔒 ${context.permissionMode} 模式禁止发布 agent.md；请切换到 request 或 bypass 后再执行 \`ec aid agentmd put <当前 self AID>\`。`
+                    : '🔒 EvolCore 托管会话仅允许针对当前 self AID 精确调用 `ec aid show`、`ec aid lookup` 或 `ec aid agentmd get`；`ec aid agentmd put` 还要求 request 或 bypass。可选后缀仅限 `--format json`。禁止枚举、切换或操作其他身份。',
+                policyCode: 'managed_ec_aid_scope_forbidden',
+            };
+        }
+        const ecCommand = classifyEvolcoreShellCommand(policyCommand);
         if (ecCommand.kind === 'literal') {
             return { behavior: 'allow', input, reason: 'ec-command' };
         }
@@ -965,25 +1129,40 @@ export function evaluateToolPreflight(toolName, input, context) {
             return prepareBoundedOutputInput(input, ecCommand.command, 'ec', context);
         }
         if (ecCommand.kind === 'composite') {
-            if (ecCommand.issue === 'unsafe-expansion') {
+            // Older app-server approval callbacks may provide only the rendered
+            // `/bin/bash -lc ...` command string.  A composite inside that carrier
+            // is not eligible for a delegation ticket, but owner bypass still
+            // handles it as an ordinary shell request.  Structured `commandArgv`
+            // callbacks remain fail-closed below because their command boundary is
+            // authoritative.
+            const legacyRenderedCarrier = !explicitCommandArgv && wrappedCommand !== undefined;
+            const allowLegacyBypassComposition = legacyRenderedCarrier
+                && context.permissionMode === 'bypass'
+                && ecCommand.issue === 'shell-composition';
+            if (!allowLegacyBypassComposition) {
+                if (ecCommand.issue === 'unsafe-expansion') {
+                    return {
+                        behavior: 'deny',
+                        input,
+                        message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
+                        policyCode: 'ec_shell_unsafe_expansion',
+                    };
+                }
+                if (ecCommand.issue === 'invalid-quote') {
+                    return {
+                        behavior: 'deny',
+                        input,
+                        message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
+                        policyCode: 'ec_shell_invalid_quote',
+                    };
+                }
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
+                    message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
+                    policyCode: 'ec_shell_composite_command',
                 };
             }
-            if (ecCommand.issue === 'invalid-quote') {
-                return {
-                    behavior: 'deny',
-                    input,
-                    message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
-                };
-            }
-            return {
-                behavior: 'deny',
-                input,
-                message: '🔒 EC 命令必须作为单个字面量进程调用；请移除管道、重定向、变量展开或命令拼接',
-            };
         }
         const boundedOutput = parseBoundedOutputShellCommand(command);
         const hostProcessCommand = boundedOutput
@@ -1000,7 +1179,7 @@ export function evaluateToolPreflight(toolName, input, context) {
     }
     const blacklist = checkBlacklist(toolName, input);
     if (blacklist.behavior === 'deny') {
-        return { behavior: 'deny', input, message: blacklist.message };
+        return { behavior: 'deny', input, message: blacklist.message, policyCode: 'tool_blacklist' };
     }
     const checkedInput = blacklist.updatedInput;
     const hClass = checkHClassWrite(toolName, checkedInput, {
@@ -1013,19 +1192,20 @@ export function evaluateToolPreflight(toolName, input, context) {
         root: context.root,
     });
     if (hClass.behavior === 'deny') {
-        return { behavior: 'deny', input: checkedInput, message: hClass.message };
+        return { behavior: 'deny', input: checkedInput, message: hClass.message, policyCode: 'h_class_protection' };
     }
     const lClass = checkLClassWrite(toolName, checkedInput, {
         sessionId: context.sessionId,
         channel: context.channel,
         peerId: context.userId,
         role: context.role,
+        permissionMode: context.permissionMode,
         projectPath: context.projectPath,
         workspacePath: context.workspacePath,
         root: context.root,
     });
     if (lClass.behavior === 'deny') {
-        return { behavior: 'deny', input: checkedInput, message: lClass.message };
+        return { behavior: 'deny', input: checkedInput, message: lClass.message, policyCode: 'l_class_protection' };
     }
     const dangerous = checkDangerousCommand(toolName, checkedInput);
     if (dangerous.isDangerous
@@ -1036,6 +1216,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             behavior: 'deny',
             input: checkedInput,
             message: '🔒 Git 破坏性操作仅允许 owner/admin 调用；当前角色无权执行',
+            policyCode: 'role_git_destructive_forbidden',
         };
     }
     return { behavior: 'continue', input: checkedInput };

package/dist/core/protected-paths.js

@@ -11,7 +11,7 @@ const H_CLASS_RELATIVE_PATTERNS = [
     /^backups\/config(?:\/|$)/,
     /^\.snapshots(?:\/|$)/,
     /^CA(?:\/|$)/,
-    /^(?:AIDs|aids)\/[^/]+\/(?:cert|keys)(?:\/|$)/,
+    /^(?:AIDs|aids)\/[^/]+\/(?:cert|keys|private)(?:\/|$)/,
     /^\.device_id$/,
     /^\.env$/,
     /^\.seed(?:\.|$)/,
@@ -33,7 +33,7 @@ const H_CLASS_RELATIVE_PATTERNS = [
 const H_CLASS_REFERENCE_PATTERNS = [
     /(?:^|[^A-Za-z0-9_.-])daemon\.json(?=$|[^A-Za-z0-9_.-])/,
     /(?:^|[^A-Za-z0-9_.-])agents[\\/](?:defaults\.json|[^/\\\s"']+[\\/](?:(?:config|contact)\.json|contact-operations\.jsonl|relations[\\/][^/\\\s"']+[\\/]config\.json))(?=$|[\s"';&|<>)},])/,
-    /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys))(?:[\\/]|$|[\s"';&|<>)},])/,
+    /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys|private))(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])(?:\.device_id|\.env|\.seed(?:\.[^/\\\s"']*)?|\.migrated-[^/\\\s"']*|\.lock|daemon\.pid|data[\\/](?:causation-aun\.json(?:_|__)?|sessions|contact-book-audit\.jsonl|feishu-seen-[^/\\\s"']+\.jsonl|[a-z0-9_-]+-greeted-[^/\\\s"']+\.jsonl|message-queue\.json(?:_|__|\.tmp-[^/\\\s"']*)?|daemon[\\/](?:message-queue\.json(?:_|__|\.tmp-[^/\\\s"']*)?|control|migrations)|channel-state|instance[\\/]control\.token|outbox|handoff)|agents[\\/][^/\\\s"']+[\\/](?:sessions|data[\\/](?:channels|handoff|outbox\.jsonl|contact-audit\.jsonl)))(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])data[\\/]triggers(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])(?:[^/\\\s"']+\.json_|[^/\\\s"']+\.json\.migrated|defaults_\d+\.json)(?=$|[\s"';&|<>)},])/,
@@ -144,10 +144,14 @@ export function getHClassSandboxPatterns(root = resolveRoot()) {
         path.join('AIDs', '*', 'cert', '**'),
         path.join('AIDs', '*', 'keys'),
         path.join('AIDs', '*', 'keys', '**'),
+        path.join('AIDs', '*', 'private'),
+        path.join('AIDs', '*', 'private', '**'),
         path.join('aids', '*', 'cert'),
         path.join('aids', '*', 'cert', '**'),
         path.join('aids', '*', 'keys'),
         path.join('aids', '*', 'keys', '**'),
+        path.join('aids', '*', 'private'),
+        path.join('aids', '*', 'private', '**'),
         '.device_id',
         '.env',
         '.seed',
@@ -272,6 +276,7 @@ export function getExistingHClassMaskTargets(root = resolveRoot()) {
                     continue;
                 addExistingTarget(targets, path.join(aidsRoot, aid.name, 'cert'));
                 addExistingTarget(targets, path.join(aidsRoot, aid.name, 'keys'));
+                addExistingTarget(targets, path.join(aidsRoot, aid.name, 'private'));
             }
         }
         catch { }
@@ -293,10 +298,11 @@ export function getExistingLClassReadOnlyTargets(root = resolveRoot()) {
     catch { }
     return [...targets.values()];
 }
-export function buildClaudeProtectedFilesystem(root = resolveRoot()) {
+export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {}) {
     const hClassPaths = getExistingHClassMaskTargets(root).map(target => target.path);
     const lClassPaths = getExistingLClassReadOnlyTargets(root).map(target => target.path);
     const allPaths = [...new Set([...hClassPaths, ...lClassPaths])];
+    const denyRead = options.denyLClassRead ? allPaths : hClassPaths;
     if (allPaths.length > CLAUDE_PROTECTED_TARGET_LIMIT) {
         throw new Error(`[ClaudeSandbox] protected target limit exceeded: ${allPaths.length} > ${CLAUDE_PROTECTED_TARGET_LIMIT}`);
     }
@@ -309,7 +315,7 @@ export function buildClaudeProtectedFilesystem(root = resolveRoot()) {
         }
     }
     return {
-        denyRead: [...new Set(hClassPaths)],
+        denyRead: [...new Set(denyRead)],
         denyWrite: allPaths,
     };
 }
@@ -321,16 +327,18 @@ export function buildCodexHClassFilesystemRules(root = resolveRoot()) {
         ...Object.fromEntries(getHClassSandboxPatterns(root).map(pattern => [pattern, 'deny'])),
     };
 }
-export function buildCodexProtectedFilesystemRules(root = resolveRoot()) {
+export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options = {}) {
     const lClassRules = {};
+    const lClassAccess = options.denyLClassRead ? 'deny' : 'read';
     for (const target of getExistingLClassReadOnlyTargets(root)) {
         if (target.kind === 'directory') {
-            if (path.basename(target.path) === 'triggers')
-                lClassRules[target.path] = 'read';
-            lClassRules[path.join(target.path, '**')] = 'read';
+            if (options.denyLClassRead || path.basename(target.path) === 'triggers') {
+                lClassRules[target.path] = lClassAccess;
+            }
+            lClassRules[path.join(target.path, '**')] = lClassAccess;
         }
         else {
-            lClassRules[target.path] = 'read';
+            lClassRules[target.path] = lClassAccess;
         }
     }
     return {