evolcore 0.0.11 → 0.0.13

package/dist/core/message/stream-debouncer.js

@@ -56,9 +56,10 @@ export class StreamDebouncer {
      * 如果窗口只剩这一条，整个窗口取消。
      * @returns true 如果找到并移除
      */
-    cancel(messageId) {
+    cancel(messageId, selfAID) {
         for (const [key, win] of this.pending) {
-            const idx = win.entries.findIndex(e => e.messageId === messageId);
+            const idx = win.entries.findIndex(e => e.messageId === messageId
+                && (selfAID === undefined || e.rest.selfAID === selfAID));
             if (idx === -1)
                 continue;
             // resolve 被撤回的那条（静默完成，不报错）
@@ -89,8 +90,13 @@ export class StreamDebouncer {
         const contents = [];
         const sourceMessageIds = [];
         const seenSourceMessageIds = new Set();
+        let receivedAt;
         for (const e of entries) {
             contents.push(e.content);
+            const entryReceivedAt = e.rest.receivedAt ?? e.rest.timestamp;
+            if (entryReceivedAt !== undefined) {
+                receivedAt = receivedAt === undefined ? entryReceivedAt : Math.min(receivedAt, entryReceivedAt);
+            }
             if (e.images)
                 allImages.push(...e.images);
             if (e.mentions)
@@ -119,6 +125,8 @@ export class StreamDebouncer {
             replyContext: last.replyContext,
             messageId: latestMessageId,
             sourceMessageIds: sourceMessageIds.length > 0 ? sourceMessageIds : undefined,
+            receivedAt,
+            timestamp: receivedAt ?? last.rest.timestamp,
         };
         const resolves = entries.map(e => e.resolve);
         const rejects = entries.map(e => e.reject);

package/dist/core/permission/approval-gateway.js

@@ -566,6 +566,7 @@ export class PermissionGateway {
             return decisionPromise;
         }
         const ownerReplyContext = {
+            delivery: { chatType: 'private' },
             metadata: {
                 source: 'handoff',
                 chatmode: 'interactive',

package/dist/core/permission/ec-command-parser.js

@@ -1,4 +1,11 @@
 const HEAD_EXECUTABLES = new Set(['head', '/bin/head', '/usr/bin/head']);
+// Codex app-server sends command executions through a fixed shell carrier.
+// Treat the carrier as syntax only after parsing it as literal argv; never
+// accept an arbitrary `sh -c` string or unwrap shell composition here.
+const CODEX_SHELL_EXECUTABLES = new Set([
+    'bash', '/bin/bash', '/usr/bin/bash',
+    'sh', '/bin/sh', '/usr/bin/sh',
+]);
 const SHELL_UNQUOTED_META = new Set([
     ';', '&', '|', '`', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#',
 ]);
@@ -7,6 +14,66 @@ const EVOLCORE_COMMAND_POSITION_RE = /(?:^|[;&|()`])\s*ec(?=\s|[;&|()<>`]|$)/i;
 function trimShellSpacing(value) {
     return value.replace(/^[ \t]+|[ \t]+$/g, '');
 }
+const MANAGED_TMPDIR_TOKEN = '__EC_MANAGED_TMPDIR__';
+/**
+ * Preserve the one environment reference allowed in managed EC paths.
+ * The regular literal parser still rejects all expansion by default. The
+ * privileged EC classifier opts into this token only after the surrounding
+ * policy has validated the path against the session-owned TMPDIR.
+ */
+function substituteManagedTmpDirToken(value) {
+    let result = '';
+    let quote = null;
+    for (let index = 0; index < value.length; index++) {
+        const char = value[index];
+        if (quote === 'single') {
+            result += char;
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '\\') {
+                result += char;
+                if (index + 1 < value.length)
+                    result += value[++index];
+                continue;
+            }
+            if (char === '"') {
+                quote = null;
+                result += char;
+                continue;
+            }
+        }
+        else if (char === "'") {
+            quote = 'single';
+            result += char;
+            continue;
+        }
+        else if (char === '\\') {
+            result += char;
+            if (index + 1 < value.length)
+                result += value[++index];
+            continue;
+        }
+        if (value.startsWith('${TMPDIR}', index)) {
+            result += MANAGED_TMPDIR_TOKEN;
+            index += '${TMPDIR}'.length - 1;
+        }
+        else if (value.startsWith('$TMPDIR', index)
+            && !/[A-Za-z0-9_]/.test(value[index + '$TMPDIR'.length] ?? '')) {
+            result += MANAGED_TMPDIR_TOKEN;
+            index += '$TMPDIR'.length - 1;
+        }
+        else {
+            result += char;
+        }
+    }
+    return result;
+}
+function restoreManagedTmpDirToken(value, managedTempDir) {
+    return value.replaceAll(MANAGED_TMPDIR_TOKEN, managedTempDir ?? '$TMPDIR');
+}
 function isShellSpacing(value) {
     return value === ' ' || value === '\t';
 }
@@ -34,8 +101,10 @@ function doubleQuotedIssueAt(input, index) {
  * expansion, glob, pipeline, command substitution, redirection, or comment.
  * Anything outside this subset is never granted the privileged EC path.
  */
-export function parseLiteralShellCommand(command) {
-    const input = trimShellSpacing(command);
+export function parseLiteralShellCommand(command, options = {}) {
+    const input = trimShellSpacing(options.allowManagedTmpDir
+        ? substituteManagedTmpDirToken(command)
+        : command);
     if (!input)
         return { ok: false, issue: 'empty-command' };
     if (input.includes('\0'))
@@ -128,13 +197,56 @@ export function parseLiteralShellCommand(command) {
         return { ok: false, issue: 'invalid-quote' };
     finishToken();
     return argv.length > 0
-        ? { ok: true, argv }
+        ? {
+            ok: true,
+            argv: options.allowManagedTmpDir
+                ? argv.map(value => restoreManagedTmpDirToken(value, options.managedTempDir))
+                : argv,
+        }
         : { ok: false, issue: 'empty-command' };
 }
-export function parseLiteralShellArgv(command) {
-    const result = parseLiteralShellCommand(command);
+export function parseLiteralShellArgv(command, options = {}) {
+    const result = parseLiteralShellCommand(command, options);
     return result.ok ? result.argv : null;
 }
+/**
+ * Return the command string carried by Codex's literal `/bin/bash -lc ...`
+ * wrapper. The wrapper is accepted only in its exact three-argv form and the
+ * caller must parse the returned string with the literal shell parser again.
+ */
+export function unwrapCodexShellCommandArgv(argv) {
+    if (argv.length !== 3 || argv[1] !== '-lc')
+        return undefined;
+    return CODEX_SHELL_EXECUTABLES.has(argv[0]) ? argv[2] : undefined;
+}
+/**
+ * Parse either a bare literal command or the exact shell carrier emitted by
+ * Codex app-server. This does not make shell composition safe: the nested
+ * command still has to pass `parseLiteralShellCommand`.
+ */
+export function parseCodexShellCommandArgv(command, options = {}) {
+    const outer = parseLiteralShellArgv(command, options);
+    if (!outer)
+        return null;
+    const wrapped = unwrapCodexShellCommandArgv(outer);
+    return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped, options);
+}
+/**
+ * Resolve a Codex command input while preserving the raw `commandArgv` form
+ * supplied by app-server. Joining that argv with spaces loses the quoting of
+ * the inner `-lc` command and was the source of a false proactive denial.
+ */
+export function parseCodexToolCommandArgv(input) {
+    if (Array.isArray(input.commandArgv) && input.commandArgv.every(value => typeof value === 'string')) {
+        const outer = input.commandArgv;
+        const wrapped = unwrapCodexShellCommandArgv(outer);
+        return wrapped === undefined
+            ? outer
+            : parseLiteralShellArgv(wrapped, { allowManagedTmpDir: true });
+    }
+    const command = typeof input.command === 'string' ? input.command : '';
+    return parseCodexShellCommandArgv(command, { allowManagedTmpDir: true });
+}
 function scanBoundedOutputOperators(command) {
     const operators = [];
     let quote = null;
@@ -247,7 +359,7 @@ function parseStdinOnlyHeadArgs(segment) {
  * optional stderr merge, one bounded `head`, and one create-only output path.
  */
 export function parseBoundedOutputShellCommand(command) {
-    const input = trimShellSpacing(command);
+    const input = trimShellSpacing(substituteManagedTmpDirToken(command));
     if (!input)
         return null;
     const operators = scanBoundedOutputOperators(input);
@@ -268,6 +380,10 @@ export function parseBoundedOutputShellCommand(command) {
     const argv = parseLiteralShellArgv(sourceText);
     if (!argv)
         return null;
+    // `$TMPDIR` is a transport-level path reference, never an argument
+    // expansion for the privileged command itself.
+    if (argv.some(value => value.includes(MANAGED_TMPDIR_TOKEN)))
+        return null;
     let mergeStderr = false;
     let pipe;
     let redirect;
@@ -302,7 +418,12 @@ export function parseBoundedOutputShellCommand(command) {
         const outputArgv = parseLiteralShellArgv(trimShellSpacing(input.slice(redirect.end)));
         if (!outputArgv || outputArgv.length !== 1)
             return null;
-        outputPath = outputArgv[0];
+        // A single-quoted or escaped `$TMPDIR` is literal shell text, not the
+        // managed directory reference. Do not reinterpret it as a route to the
+        // session temp root.
+        if (outputArgv[0].includes('$') && !outputArgv[0].includes(MANAGED_TMPDIR_TOKEN))
+            return null;
+        outputPath = restoreManagedTmpDirToken(outputArgv[0]);
     }
     return { argv, mergeStderr, ...(headArgs ? { headArgs } : {}), ...(outputPath ? { outputPath } : {}) };
 }
@@ -312,11 +433,21 @@ export function parseBoundedOutputShellCommand(command) {
  * invocation may leave the sandbox, while shell composition may not.
  */
 export function classifyEvolcoreShellCommand(command) {
-    const literal = parseLiteralShellCommand(command);
+    const parseOptions = { allowManagedTmpDir: true };
+    const literal = parseLiteralShellCommand(command, parseOptions);
     if (literal.ok) {
-        return literal.argv[0] === 'ec'
-            ? { kind: 'literal' }
-            : { kind: 'none' };
+        if (literal.argv[0] === 'ec')
+            return { kind: 'literal' };
+        const wrapped = unwrapCodexShellCommandArgv(literal.argv);
+        if (wrapped !== undefined) {
+            const nested = parseLiteralShellCommand(wrapped, parseOptions);
+            if (nested.ok && nested.argv[0] === 'ec')
+                return { kind: 'literal' };
+            if (!nested.ok && EVOLCORE_COMMAND_POSITION_RE.test(wrapped)) {
+                return { kind: 'composite', issue: nested.issue };
+            }
+        }
+        return { kind: 'none' };
     }
     const boundedOutput = parseBoundedOutputShellCommand(command);
     if (boundedOutput && boundedOutput.argv[0] === 'ec') {
@@ -350,8 +481,81 @@ function findSingleFileOption(argv, startIndex) {
         ? { path: filePath, invalid: false }
         : { invalid: true };
 }
-export function parseEvolcoreSendCommand(command) {
-    const argv = parseLiteralShellArgv(command);
+const PROACTIVE_SEND_VALUE_FLAGS = new Set([
+    '--format', '--app', '--file', '--text-from-file', '--link', '--payload',
+    '--title', '--description', '--text', '--transcript', '--as',
+    '--content-type', '--mention', '--aun-path', '--thread', '--return',
+]);
+const PROACTIVE_SEND_BOOLEAN_FLAGS = new Set([
+    '--encrypt', '--no-encrypt', '--mention-all',
+]);
+function hasExecutableProactiveSendPayload(argv, scope) {
+    if (!argv || argv[0] !== 'ec' || argv[1] !== scope || argv[2] !== 'send')
+        return false;
+    const positionals = [];
+    const modes = new Map();
+    let endOfOptions = false;
+    for (let index = 5; index < argv.length; index++) {
+        const value = argv[index];
+        if (endOfOptions) {
+            positionals.push(value);
+            continue;
+        }
+        if (value === '--') {
+            endOfOptions = true;
+            continue;
+        }
+        if (PROACTIVE_SEND_BOOLEAN_FLAGS.has(value))
+            continue;
+        if (!PROACTIVE_SEND_VALUE_FLAGS.has(value)) {
+            positionals.push(value);
+            continue;
+        }
+        const operand = argv[++index];
+        if (operand === undefined || operand.startsWith('--'))
+            return false;
+        if (value === '--file' || value === '--text-from-file')
+            return false;
+        if (value === '--app' || value === '--aun-path')
+            return false;
+        if (value === '--return' && operand !== 'none' && operand !== 'required')
+            return false;
+        if (value === '--format' && operand !== 'json')
+            return false;
+        if (value === '--link') {
+            if (scope !== 'msg' || modes.has('link'))
+                return false;
+            modes.set('link', operand);
+        }
+        if (value === '--payload') {
+            if (modes.has('payload'))
+                return false;
+            modes.set('payload', operand);
+        }
+    }
+    if (modes.size > 1)
+        return false;
+    if (modes.has('link')) {
+        try {
+            const url = new URL(modes.get('link'));
+            return url.protocol === 'http:' || url.protocol === 'https:';
+        }
+        catch {
+            return false;
+        }
+    }
+    if (modes.has('payload')) {
+        try {
+            const payload = JSON.parse(modes.get('payload'));
+            return !!payload && typeof payload === 'object' && !Array.isArray(payload);
+        }
+        catch {
+            return false;
+        }
+    }
+    return positionals.join(' ').length > 0;
+}
+function parseEvolcoreSendArgv(argv) {
     if (!argv || argv[0] !== 'ec')
         return null;
     if (argv[1] === 'ctl') {
@@ -380,23 +584,44 @@ export function parseEvolcoreSendCommand(command) {
     if (subcommand === 'file') {
         if (argv.length !== 6 || !isDeterministicFilePath(argv[5]))
             return null;
-        return { scope, action: 'file', targetId, filePath: argv[5] };
+        return { scope, action: 'file', sourceId: argv[3], targetId, filePath: argv[5] };
     }
     const fileOption = findSingleFileOption(argv, 5);
     if (fileOption.invalid)
         return null;
     return fileOption.path
-        ? { scope, action: 'file', targetId, filePath: fileOption.path }
-        : { scope, action: 'send', targetId };
+        ? { scope, action: 'file', sourceId: argv[3], targetId, filePath: fileOption.path }
+        : { scope, action: 'send', sourceId: argv[3], targetId };
+}
+export function parseEvolcoreSendCommand(command) {
+    const argv = parseCodexShellCommandArgv(command);
+    return argv ? parseEvolcoreSendArgv(argv) : null;
 }
 export function isEvolcoreSendCommandForSession(toolName, input, channelId) {
     if (toolName !== 'Bash')
         return false;
-    const cmd = typeof input.command === 'string' ? input.command : '';
-    const parsed = parseEvolcoreSendCommand(cmd);
+    const argv = parseCodexToolCommandArgv(input);
+    const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed)
         return false;
     if (parsed.scope === 'ctl')
         return true;
     return parsed.targetId === channelId;
 }
+/** Proactive first-send guard: exact channel kind and current target only. */
+export function isExactEvolcoreSendCommandForSession(toolName, input, channelId, chatType, selfAid) {
+    // Codex hooks use the canonical name `Bash`; the app-server event adapter
+    // exposes the same commandExecution items as `Shell` to the renderer.
+    if ((toolName !== 'Bash' && toolName !== 'Shell') || !selfAid)
+        return false;
+    const argv = parseCodexToolCommandArgv(input);
+    const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
+    if (!parsed || parsed.action !== 'send')
+        return false;
+    const expectedScope = chatType === 'group' ? 'group' : 'msg';
+    return parsed.scope === expectedScope
+        && parsed.targetId === channelId
+        && parsed.sourceId === selfAid
+        && !!argv
+        && hasExecutableProactiveSendPayload(argv, expectedScope);
+}

package/dist/core/permission/index.js

@@ -2,6 +2,6 @@ export * from './tool-policy.js';
 export * from './ec-command-parser.js';
 export * from './readonly-shell-query.js';
 export * from './approval-gateway.js';
-export * from './execution-sandbox.js';
+export * from './mode.js';
 // Tool summaries live in utils; keep the historical permission import path compatible.
 export { summarizeToolInput } from '../../utils/tool-summary.js';

package/dist/core/permission/mode.js

@@ -22,3 +22,18 @@ export function normalizePermissionMode(value) {
         return { mode: 'readonly', workflow: 'plan', migratedFrom: 'plan' };
     return { mode: 'readonly' };
 }
+/**
+ * Phase one only disables the task execution sandbox for an authenticated
+ * owner running in bypass mode. Every other combination remains fail-closed.
+ */
+export function resolvePhaseOneExecutionSandbox(permissionMode, role) {
+    const normalizedMode = normalizePermissionMode(permissionMode).mode;
+    const normalizedRole = role ?? undefined;
+    const sandboxOff = normalizedMode === 'bypass' && normalizedRole === 'owner';
+    return {
+        permissionMode: normalizedMode,
+        role: normalizedRole,
+        state: sandboxOff ? 'off' : 'active',
+        reason: sandboxOff ? 'owner-bypass' : 'phase-one-required',
+    };
+}

package/dist/core/permission/readonly-shell-query.js

@@ -3,7 +3,7 @@ import { parseLiteralShellArgv } from './ec-command-parser.js';
 const MAX_QUERY_LISTS = 8;
 const MAX_PIPELINE_STAGES = 3;
 const SUPPORTED_EXECUTABLES = new Set([
-    'echo', 'pwd', 'ls', 'cat', 'grep', 'rg', 'find', 'sed', 'head', 'sort',
+    'echo', 'pwd', 'ls', 'cat', 'grep', 'rg', 'find', 'sed', 'head', 'sort', 'git', 'wc', 'stat', 'lstat',
 ]);
 const FIND_MUTATING_PRIMARY_RE = /^-(?:delete|exec|execdir|ok|okdir|fprint|fprint0|fprintf|fls)$/;
 const RG_PROCESS_SPAWNING_OPTION_RE = /^(?:--pre|--hostname-bin|--pre-glob|--search-zip)(?:=|$)/;
@@ -71,8 +71,17 @@ function splitQueryStructure(command) {
             segment += char;
             continue;
         }
-        if (char === '\0' || char === '\r' || char === '\n' || char === '&' || char === '<')
+        if (char === '\0' || char === '\r' || char === '\n' || char === '<')
             return null;
+        if (char === '&') {
+            // A bounded sequence of independently proven read-only commands is
+            // safe to run in order. A single ampersand would background execution;
+            // `||` remains rejected because it introduces conditional control flow.
+            if (command[index + 1] !== '&' || !finishPipeline())
+                return null;
+            index++;
+            continue;
+        }
         if (char === '|') {
             if (command[index + 1] === '|' || !finishStage())
                 return null;
@@ -89,12 +98,14 @@ function splitQueryStructure(command) {
         return null;
     return pipelines;
 }
-function parseStageArgv(segment) {
+function parseStageArgv(segment, options) {
     const redirectMatch = segment.match(STDERR_DEV_NULL_RE);
     const withoutRedirect = redirectMatch?.[1] ?? segment;
     if (withoutRedirect.includes('>'))
         return null;
-    return parseLiteralShellArgv(withoutRedirect.trim());
+    return parseLiteralShellArgv(withoutRedirect.trim(), options.managedTempDir
+        ? { allowManagedTmpDir: true, managedTempDir: options.managedTempDir }
+        : undefined);
 }
 function exact(value) {
     return { value, access: 'exact' };
@@ -458,12 +469,118 @@ function analyzeSort(args) {
     }
     return paths;
 }
+/**
+ * Git metadata queries do not expose file contents and their output paths are
+ * controlled by the repository, not by arbitrary shell operands. Keep this
+ * deliberately small: status and read-only diff summaries are the patterns
+ * used for workspace diagnostics. Mutating subcommands and pathspecs remain
+ * unproven so the normal H-class checks still apply.
+ */
+function analyzeGit(args) {
+    if (args.length === 0)
+        return null;
+    const subcommand = args[0];
+    if (subcommand === 'status') {
+        // Keep the allow-list explicit; callers should request a bounded metadata
+        // view such as `--short` or `--branch`, rather than inheriting Git's full
+        // default output and any future options.
+        if (args.length === 1)
+            return null;
+        const allowed = new Set([
+            '--short', '--porcelain', '--porcelain=v1', '--porcelain=v2', '--branch',
+            '--untracked-files=no', '--untracked-files=normal', '--ignored=no',
+            '--ignore-submodules', '--renames', '--no-renames', '--ahead-behind',
+            '--no-ahead-behind', '--show-stash', '--no-optional-locks',
+        ]);
+        for (const arg of args.slice(1)) {
+            if (arg === '--')
+                return null;
+            if (!allowed.has(arg))
+                return null;
+        }
+        return [];
+    }
+    if (subcommand === 'diff') {
+        let sawSummary = false;
+        let optionsEnded = false;
+        const paths = [];
+        const allowedFlags = new Set([
+            '--stat', '--shortstat', '--numstat', '--name-only', '--name-status',
+            '--no-ext-diff', '--no-renames', '--no-textconv', '--no-index',
+            '--cached', '--staged', '--merge-base', '--no-color', '--color=never',
+        ]);
+        for (const arg of args.slice(1)) {
+            if (!optionsEnded && arg === '--') {
+                optionsEnded = true;
+                continue;
+            }
+            if (!optionsEnded && arg.startsWith('-')) {
+                if (arg === '--stat' || arg === '--shortstat' || arg === '--numstat'
+                    || arg === '--name-only' || arg === '--name-status')
+                    sawSummary = true;
+                if (!allowedFlags.has(arg) && !/^[0-9a-f]{7,64}$/.test(arg))
+                    return null;
+                continue;
+            }
+            // Revisions are safe literals; pathspecs after -- are bounded exact reads.
+            if (optionsEnded)
+                paths.push({ value: arg, access: 'exact' });
+            else if (!/^[0-9A-Za-z._~^/:-]+$/.test(arg))
+                return null;
+        }
+        return sawSummary ? paths : null;
+    }
+    return null;
+}
+function analyzeWc(args) {
+    const allowed = new Set(['-l', '-w', '-c', '-m', '-L', '--lines', '--words', '--bytes', '--chars', '--max-line-length']);
+    const paths = [];
+    for (const arg of args) {
+        if (arg.startsWith('-')) {
+            if (!allowed.has(arg))
+                return null;
+        }
+        else if (arg !== '-') {
+            paths.push(exact(arg));
+        }
+    }
+    return paths;
+}
+function analyzeStat(args) {
+    // GNU stat defaults to lstat semantics. Following a final symlink would
+    // let a metadata-only query reach a protected target through an alias.
+    if (args.some(argument => argument === '-L' || argument === '--dereference'))
+        return null;
+    const valueOptions = new Set(['-c', '--format', '--printf']);
+    const paths = [];
+    let optionsEnded = false;
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (!optionsEnded && argument === '--') {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && argument.startsWith('-') && argument !== '-') {
+            const option = argument.split('=', 1)[0];
+            if (valueOptions.has(option) && !argument.includes('=') && ++index >= args.length)
+                return null;
+            if (!valueOptions.has(option) && !new Set(['-f', '--file-system', '-t', '--terse', '--cached']).has(option)) {
+                return null;
+            }
+            continue;
+        }
+        if (argument !== '-')
+            paths.push(exact(argument));
+    }
+    return paths.length > 0 ? paths : null;
+}
 function analyzeCommand(argv) {
     const executable = normalizeExecutable(argv[0]);
     if (!executable)
         return null;
     const args = argv.slice(1);
     let pathOperands = null;
+    let accessKind = 'content';
     switch (executable) {
         case 'echo':
             pathOperands = [];
@@ -495,12 +612,35 @@ function analyzeCommand(argv) {
         case 'sort':
             pathOperands = analyzeSort(args);
             break;
+        case 'git':
+            pathOperands = analyzeGit(args);
+            break;
+        case 'wc':
+            pathOperands = analyzeWc(args);
+            break;
+        case 'stat':
+        case 'lstat':
+            pathOperands = analyzeStat(args);
+            accessKind = 'metadata';
+            break;
     }
     if (!pathOperands)
         return null;
-    return { command: { executable, argv, pathOperands } };
+    if (['ls', 'find'].includes(executable))
+        accessKind = 'enumerate';
+    return {
+        command: {
+            executable,
+            argv,
+            pathOperands,
+            // Keep the established IR shape for ordinary queries. Only metadata
+            // commands need an explicit action marker; content/enumeration are
+            // derived from their operands by policy consumers.
+            ...(accessKind === 'metadata' ? { accessKind } : {}),
+        },
+    };
 }
-export function analyzeReadonlyShellQuery(command) {
+export function analyzeReadonlyShellQuery(command, options = {}) {
     const structure = splitQueryStructure(command);
     if (!structure)
         return { kind: 'unproven', reason: 'unsupported-shell-structure' };
@@ -509,14 +649,14 @@ export function analyzeReadonlyShellQuery(command) {
     for (const stages of structure) {
         const pipeline = [];
         for (let index = 0; index < stages.length; index++) {
-            const argv = parseStageArgv(stages[index]);
+            const argv = parseStageArgv(stages[index], options);
             if (!argv)
                 return { kind: 'unproven', reason: 'non-literal-command' };
             const analyzed = analyzeCommand(argv);
             if (!analyzed)
                 return { kind: 'unproven', reason: 'unsupported-command-or-option' };
             if (index > 0) {
-                if (!['head', 'sort'].includes(analyzed.command.executable)) {
+                if (!['head', 'sort', 'grep', 'wc'].includes(analyzed.command.executable)) {
                     return { kind: 'unproven', reason: 'unsupported-pipeline-filter' };
                 }
                 if (analyzed.command.pathOperands.length > 0) {