evolcore 0.0.11 → 0.0.13

package/dist/core/permission/sandbox-runtime.js

@@ -4,6 +4,27 @@ import { resolveCommandPath } from '../../utils/cross-platform.js';
 import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from '../protected-paths.js';
 import { resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
+export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
+/** Recognize sandbox bootstrap failures independently of localized stderr. */
+export function isSandboxInitializationFailure(error, stderr = []) {
+    const text = [error instanceof Error ? error.message : String(error ?? ''), ...stderr]
+        .join('\n')
+        .toLowerCase();
+    return text.includes(SANDBOX_INITIALIZATION_FAILED)
+        || /(?:apply-seccomp|seccomp)[\s\S]*(?:uid_map|gid_map|operation not permitted)/.test(text)
+        || /(?:uid_map|gid_map)[\s\S]*(?:operation not permitted|permission denied)/.test(text)
+        || /user namespace[\s\S]*(?:not permitted|unavailable|failed)/.test(text)
+        || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text);
+}
+export function createSandboxInitializationError(error, stderr = []) {
+    const detail = error instanceof Error ? error.message : String(error ?? 'sandbox bootstrap failed');
+    const wrapped = new Error(`${SANDBOX_INITIALIZATION_FAILED}: ${detail}`);
+    wrapped.name = 'SandboxInitializationError';
+    wrapped.code = SANDBOX_INITIALIZATION_FAILED;
+    if (stderr.length > 0)
+        wrapped.stderr = [...stderr].slice(-20);
+    return wrapped;
+}
 /**
  * Claude Agent SDK's native sandbox is unavailable on Windows. WSL2 reports
  * itself as Linux, so it remains fail-closed there together with macOS/Linux.
@@ -210,7 +231,7 @@ function appendLClassReadOnlyBinds(args, root) {
         args.push('--ro-bind', target.path, target.path);
     }
 }
-export function buildHClassGuardCommand(executable, executableArgs, root = resolveRoot()) {
+export function buildHClassGuardCommand(executable, executableArgs, root = resolveRoot(), options = {}) {
     const bubblewrapPath = resolveBubblewrapPath();
     if (!bubblewrapPath)
         return undefined;
@@ -224,6 +245,27 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
     ];
     appendLClassReadOnlyBinds(args, path.resolve(root));
     appendHClassMasks(args, path.resolve(root), true);
+    if (options.managedCodexRequirements) {
+        const requirements = path.resolve(options.managedCodexRequirements);
+        if (!fs.statSync(requirements).isFile()) {
+            throw new Error(`Codex managed requirements is not a file: ${requirements}`);
+        }
+        const managedDirectory = path.dirname(requirements);
+        // Keep the copied hook immutable even when a session uses bypass mode.
+        args.push('--ro-bind', managedDirectory, managedDirectory);
+        // A host may not have /etc/codex yet. Overlay /etc inside this namespace so
+        // Bubblewrap can create the mountpoint without modifying the host, while
+        // retaining the complete host /etc as the read-only lower layer.
+        args.push('--overlay-src', '/etc');
+        args.push('--tmp-overlay', '/etc');
+        args.push('--dir', '/etc/codex');
+        // Replace the complete Codex system-config directory inside this app-server
+        // namespace so host system hooks cannot join EvolCore's managed hook set.
+        args.push('--tmpfs', '/etc/codex');
+        args.push('--ro-bind', requirements, '/etc/codex/requirements.toml');
+        args.push('--remount-ro', '/etc/codex');
+        args.push('--remount-ro', '/etc');
+    }
     args.push('--', executable, ...executableArgs);
     return { command: bubblewrapPath, args };
 }

package/dist/core/permission/tool-policy.js

@@ -3,9 +3,94 @@ import path from 'path';
 import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
-import { containsHClassReference, containsLClassReference, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, } from '../protected-paths.js';
-import { classifyEvolcoreShellCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, } from './ec-command-parser.js';
+import { containsHClassReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from '../protected-paths.js';
+import { classifyEvolcoreShellCommand, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
+/** Resolve the session-owned temporary root supplied by the execution host. */
+export function resolveManagedTempDir(env = process.env) {
+    const raw = typeof env.TMPDIR === 'string' ? env.TMPDIR.trim() : '';
+    if (!raw || !path.isAbsolute(raw))
+        return undefined;
+    const resolved = resolveProtectedCandidate(raw);
+    // A process-wide shared temporary root is not a session capability. The
+    // runner must register a private subdirectory before `$TMPDIR` is trusted.
+    if (['/tmp', '/var/tmp', '/dev/shm'].includes(resolved))
+        return undefined;
+    return resolved;
+}
+function substituteTmpDir(value, root) {
+    if (!root)
+        return value;
+    return value
+        .replace(/\$\{TMPDIR\}/g, root)
+        .replace(/\$TMPDIR\b/g, root);
+}
+/**
+ * A temp path is valid only when its canonical existing ancestor remains below
+ * the current session's TMPDIR. This also closes symlink and `..` escapes.
+ */
+export function isManagedTempPath(value, options = {}) {
+    const root = resolveManagedTempDir(options.env);
+    if (!root || typeof value !== 'string' || !value.trim())
+        return false;
+    const candidate = resolveProtectedCandidate(substituteTmpDir(value, root), options.cwd);
+    return isSameOrDescendant(candidate, root);
+}
+export function expandManagedTempPath(value, options = {}) {
+    return substituteTmpDir(value, resolveManagedTempDir(options.env));
+}
+const WRITE_INTENT_RE = /(?:^|[\s;&|])(?:mkdir|mktemp|touch|tee|cp|mv|install|chmod|chown|ln|rm)(?:[\s;&|]|$)|(?:^|[\s])(?:\d>>?|>>?)\s*/i;
+const TEMP_TOKEN_RE = /(?:\$TMPDIR|\$\{TMPDIR\}|\/tmp(?:\/|$)|\/var\/tmp(?:\/|$)|\/dev\/shm(?:\/|$))[^\s'";&|<>)]*/g;
+/**
+ * Inspect shell write targets that look like temporary paths. Ordinary
+ * project writes are left to the existing workspace/H-class policy; any
+ * explicit /tmp-style target must be contained by TMPDIR.
+ */
+export function checkManagedTempShellCommand(command, options = {}) {
+    if (!WRITE_INTENT_RE.test(command))
+        return { kind: 'none' };
+    const root = resolveManagedTempDir(options.env);
+    const normalized = substituteTmpDir(command, root);
+    const candidates = [...normalized.matchAll(TEMP_TOKEN_RE)].map(match => match[0].replace(/[.,:]+$/, ''));
+    if (candidates.length === 0)
+        return { kind: 'none' };
+    if (!root) {
+        return { kind: 'deny', paths: candidates, reason: 'TMPDIR is unset or not an absolute managed path' };
+    }
+    const outside = candidates.filter(candidate => !isManagedTempPath(candidate, {
+        ...options,
+        env: { ...(options.env ?? process.env), TMPDIR: root },
+    }));
+    if (outside.length > 0) {
+        return { kind: 'deny', paths: outside, reason: 'temporary write target is outside the session-managed TMPDIR' };
+    }
+    return { kind: 'allow', paths: candidates };
+}
+/**
+ * Replace only already-validated temporary path operands before a second
+ * policy pass. This prevents a harmless `$TMPDIR/CA/root` name from looking
+ * like the real EvolCore CA directory while preserving any unrelated H-class
+ * operand in the same command.
+ */
+export function maskManagedTempShellPaths(command, options = {}) {
+    const check = checkManagedTempShellCommand(command, options);
+    if (check.kind !== 'allow')
+        return command;
+    const root = resolveManagedTempDir(options.env);
+    const normalized = substituteTmpDir(command, root);
+    let index = 0;
+    return normalized.replace(TEMP_TOKEN_RE, token => {
+        const candidate = token.replace(/[.,:]+$/, '');
+        if (!check.paths.includes(candidate) || !isManagedTempPath(candidate, {
+            ...options,
+            env: { ...(options.env ?? process.env), TMPDIR: root },
+        })) {
+            return token;
+        }
+        index += 1;
+        return `__managed_tmp_${index}__`;
+    });
+}
 // 绝对禁止命令（所有角色、所有权限模式下都禁止，不可授权）
 // 这些是系统级破坏操作，任何情况下都不应该允许
 const ABSOLUTE_FORBIDDEN = [
@@ -320,9 +405,50 @@ function containsNetStopCommand(command, depth = 0) {
     });
 }
 function queryPathOperands(analysis) {
-    return analysis.kind === 'proven-readonly' ? analysis.ir.pathOperands : [];
+    if (analysis.kind !== 'proven-readonly')
+        return [];
+    return analysis.ir.pipelines.flatMap(pipeline => pipeline.flatMap(command => command.pathOperands.map(operand => ({
+        operand,
+        accessKind: command.accessKind ?? (operand.access === 'recursive' ? 'enumerate' : 'content'),
+    }))));
 }
-function shellOperandMatchesClass(operand, className, options) {
+function shellOperandMatchesClass(operand, className, options, accessKind = operand.access === 'recursive' ? 'enumerate' : 'content') {
+    // `$TMPDIR` is a private session namespace, so names such as `CA` or
+    // `config.json` inside it are ordinary temporary data rather than paths in
+    // the EvolCore root. Resolve the candidate first so a symlink escape does
+    // not inherit this exception.
+    if (options.managedTempDir) {
+        const managedTemp = resolveProtectedCandidate(options.managedTempDir);
+        const candidate = accessKind === 'metadata' && operand.access === 'exact'
+            ? resolveProtectedCandidateWithoutFinalSymlink(operand.value, options.cwd)
+            : resolveProtectedCandidate(operand.value, options.cwd);
+        const workspace = options.cwd ? resolveProtectedCandidate(options.cwd) : undefined;
+        if (isSameOrDescendant(candidate, managedTemp)
+            && (!workspace || !isSameOrDescendant(candidate, workspace))) {
+            return false;
+        }
+    }
+    if (className === 'h' && accessKind === 'metadata' && operand.access === 'exact') {
+        // Filesystem sandboxes currently expose only path-wide H-class deny
+        // rules. A runner that cannot provide an action-aware metadata channel
+        // must keep the policy decision aligned with that lower-level boundary,
+        // but ordinary workspace metadata remains safe and should stay usable.
+        const metadata = checkProtectedPathAccess(operand.value, 'metadata', {
+            ...options,
+            // stat/lstat must inspect the final symlink itself, never its target.
+            followFinalSymlink: false,
+        });
+        if (options.allowProtectedMetadata === false) {
+            return metadata.pathClass === 'h-file' || metadata.pathClass === 'h-directory';
+        }
+        // The no-follow decision is authoritative for metadata. In particular,
+        // an ordinary symlink whose target is H-class must remain inspectable as a
+        // link; falling through to isHClassPath() would follow it and reject the
+        // otherwise safe lstat/stat operation.
+        if (metadata.pathClass !== 'unknown' && metadata.allowed) {
+            return false;
+        }
+    }
     const reference = className === 'h' ? containsHClassReference(operand.value) : containsLClassReference(operand.value);
     if (reference)
         return true;
@@ -352,7 +478,7 @@ function hClassReadScopeIncludesProtectedPath(value, options) {
     return getExistingHClassMaskTargets(root).some(target => isSameOrDescendant(target.path, scope));
 }
 function analyzeShellProtectedOperands(command, options) {
-    const analysis = analyzeReadonlyShellQuery(command);
+    const analysis = analyzeReadonlyShellQuery(command, { managedTempDir: options.managedTempDir });
     if (analysis.kind === 'unproven') {
         return {
             analysis,
@@ -363,8 +489,8 @@ function analyzeShellProtectedOperands(command, options) {
     const operands = queryPathOperands(analysis);
     return {
         analysis,
-        hClass: operands.some(operand => shellOperandMatchesClass(operand, 'h', options)),
-        lClass: operands.some(operand => shellOperandMatchesClass(operand, 'l', options)),
+        hClass: operands.some(({ operand, accessKind }) => shellOperandMatchesClass(operand, 'h', options, accessKind)),
+        lClass: operands.some(({ operand, accessKind }) => shellOperandMatchesClass(operand, 'l', options, accessKind)),
     };
 }
 function protectedReadToolPaths(toolName, input) {
@@ -444,11 +570,21 @@ function protectedReadToolStaysInWorkspace(toolName, input, projectPath) {
     }
     return true;
 }
-function readonlyShellStaysInWorkspace(analysis, projectPath) {
+function readonlyShellStaysInWorkspace(analysis, projectPath, managedTempDir) {
     if (analysis.kind !== 'proven-readonly')
         return false;
     const workspace = resolveProtectedCandidate(projectPath);
-    return analysis.ir.pathOperands.every(operand => isSameOrDescendant(resolveProtectedCandidate(operand.value, projectPath), workspace));
+    const managedTemp = managedTempDir ? resolveProtectedCandidate(managedTempDir) : undefined;
+    return analysis.ir.pipelines.flatMap(pipeline => pipeline.flatMap(command => command.pathOperands.map(operand => ({
+        operand,
+        accessKind: command.accessKind ?? (operand.access === 'recursive' ? 'enumerate' : 'content'),
+    })))).every(({ operand, accessKind }) => (() => {
+        const candidate = accessKind === 'metadata' && operand.access === 'exact'
+            ? resolveProtectedCandidateWithoutFinalSymlink(operand.value, projectPath)
+            : resolveProtectedCandidate(operand.value, projectPath);
+        return isSameOrDescendant(candidate, workspace)
+            || (!!managedTemp && isSameOrDescendant(candidate, managedTemp));
+    })());
 }
 /**
  * 只读模式检查（用于 PreToolUse hook 和 canUseTool callback）。普通
@@ -463,50 +599,61 @@ export function checkReadonly(toolName, input, projectPath, context) {
         const paths = protectedReadToolPaths(toolName, input);
         const pathOptions = { cwd: projectPath, root: context?.root };
         if (!protectedReadToolStaysInWorkspace(toolName, input, projectPath)) {
-            return { behavior: 'deny', message: '🔒 只读模式：文件读取范围不能越出当前项目目录' };
+            return { behavior: 'deny', message: '🔒 只读模式：文件读取范围不能越出当前项目目录', policyCode: 'readonly_workspace_escape' };
         }
         if (paths.some(filePath => containsHClassReference(filePath) || isHClassPath(filePath, pathOptions))) {
-            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径' };
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read' };
         }
         if (protectedReadToolMatchesHClass(toolName, input, pathOptions)) {
-            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径' };
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read' };
         }
         if (protectedReadToolMatchesLClass(toolName, input, pathOptions)) {
-            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径' };
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径', policyCode: 'readonly_l_class_read' };
         }
         return { behavior: 'allow' };
     }
     if (toolName === 'Write' || toolName === 'Edit' || toolName === 'NotebookEdit') {
         const filePath = (input.file_path || input.notebook_path);
         logger.warn(`[ReadonlyCheck] 🔒 File write blocked: tool=${toolName} path=${filePath} project=${projectPath} session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-        return { behavior: 'deny', message: '🔒 只读模式：禁止写入或修改文件' };
+        return { behavior: 'deny', message: '🔒 只读模式：禁止写入或修改文件', policyCode: 'readonly_file_write' };
     }
     if (toolName === 'Bash') {
         const cmd = input.command || '';
-        const protectedOperands = analyzeShellProtectedOperands(cmd, { cwd: projectPath, root: context?.root });
+        // A managed session must provide its runner-registered temp root. For
+        // direct policy callers without a session, the process TMPDIR remains a
+        // useful compatibility fallback after the shared-root check above.
+        const managedTempDir = context?.sessionId
+            ? context.managedTempDir
+            : context?.managedTempDir ?? resolveManagedTempDir();
+        const protectedOperands = analyzeShellProtectedOperands(cmd, {
+            cwd: projectPath,
+            root: context?.root,
+            managedTempDir,
+            allowProtectedMetadata: context?.allowProtectedMetadata,
+        });
         if (protectedOperands.analysis.kind === 'proven-readonly'
             && !protectedOperands.hClass
             && !protectedOperands.lClass
-            && readonlyShellStaysInWorkspace(protectedOperands.analysis, projectPath)) {
+            && readonlyShellStaysInWorkspace(protectedOperands.analysis, projectPath, managedTempDir)) {
             return { behavior: 'allow' };
         }
         if (protectedOperands.hClass) {
             logger.warn(`[ReadonlyCheck] 🔒 H-class path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径' };
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read' };
         }
         if (protectedOperands.lClass) {
             logger.warn(`[ReadonlyCheck] 🔒 L-class path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径' };
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径', policyCode: 'readonly_l_class_read' };
         }
         if (protectedOperands.analysis.kind === 'proven-readonly') {
-            return { behavior: 'deny', message: '🔒 只读模式：Shell 查询范围不能越出当前项目目录' };
+            return { behavior: 'deny', message: '🔒 只读模式：Shell 查询范围不能越出当前项目目录', policyCode: 'readonly_workspace_escape' };
         }
         const cmdPreview = cmd.length > 80 ? cmd.substring(0, 80) + '...' : cmd;
         logger.warn(`[ReadonlyCheck] 🔒 Bash blocked by default: cmd="${cmdPreview}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-        return { behavior: 'deny', message: '🔒 只读模式：Shell 仅允许受限、可证明只读的普通路径查询' };
+        return { behavior: 'deny', message: '🔒 只读模式：Shell 仅允许受限、可证明只读的普通路径查询', policyCode: 'readonly_shell_unproven' };
     }
     logger.warn(`[ReadonlyCheck] 🔒 Unknown tool blocked: tool=${toolName} session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-    return { behavior: 'deny', message: `🔒 只读模式：未声明为只读的工具 ${toolName} 已拒绝执行` };
+    return { behavior: 'deny', message: `🔒 只读模式：未声明为只读的工具 ${toolName} 已拒绝执行`, policyCode: 'readonly_tool_unavailable' };
 }
 const NON_FILESYSTEM_METADATA_TOOLS = new Set([
     'Agent',
@@ -752,9 +899,35 @@ export function checkHClassWrite(toolName, input, context) {
     }
     else if (toolName === 'Bash') {
         const command = typeof input.command === 'string' ? input.command : '';
-        const protectedOperands = analyzeShellProtectedOperands(command, {
+        // Keep this H-class pass aligned with the shared preflight pass. A
+        // managed session must not fall back to the daemon's process-wide TMPDIR;
+        // without a registered root, explicit temporary paths fail closed.
+        const tempOptions = {
+            cwd: context?.projectPath,
+            env: context?.sessionId
+                ? { ...process.env, TMPDIR: context.managedTempDir ?? '' }
+                : context?.managedTempDir !== undefined
+                    ? { ...process.env, TMPDIR: context.managedTempDir }
+                    : process.env,
+        };
+        const tempCheck = checkManagedTempShellCommand(command, tempOptions);
+        if (tempCheck.kind === 'deny') {
+            return {
+                behavior: 'deny',
+                message: '🔒 临时文件必须位于当前会话的 $TMPDIR 内',
+            };
+        }
+        // A managed temp write is intentionally allowed to contain names such as
+        // CA/root, but only that validated operand is masked. Any other protected
+        // operand in a mixed command must still be rejected.
+        const policyCommand = tempCheck.kind === 'allow'
+            ? maskManagedTempShellPaths(command, tempOptions)
+            : command;
+        const protectedOperands = analyzeShellProtectedOperands(policyCommand, {
             cwd: context?.projectPath,
             root: context?.root,
+            managedTempDir: context?.managedTempDir,
+            allowProtectedMetadata: context?.allowProtectedMetadata,
         });
         if (protectedOperands.hClass) {
             logger.warn(`[H-Class Protection] 🔒 Protected filesystem operand in shell command: tool=${toolName} ` +
@@ -905,7 +1078,10 @@ export function checkLClassWrite(toolName, input, context) {
     else if (toolName === 'Bash') {
         const command = typeof input.command === 'string' ? input.command : '';
         const pathOptions = { cwd: context?.projectPath, root: context?.root };
-        const protectedOperands = analyzeShellProtectedOperands(command, pathOptions);
+        const protectedOperands = analyzeShellProtectedOperands(command, {
+            ...pathOptions,
+            managedTempDir: context?.managedTempDir,
+        });
         const lClassDenied = protectedOperands.lClass
             && (context?.permissionMode === 'readonly' || protectedOperands.analysis.kind === 'unproven');
         if (lClassDenied) {
@@ -992,14 +1168,46 @@ export function checkBlacklist(toolName, input) {
     // 默认允许
     return { behavior: 'allow', updatedInput: input };
 }
+function managedTempOptions(context) {
+    return {
+        cwd: context.projectPath,
+        // A managed session must never inherit the daemon's unrelated TMPDIR.
+        env: context.sessionId
+            ? { ...process.env, TMPDIR: context.managedTempDir ?? '' }
+            : context.managedTempDir !== undefined
+                ? { ...process.env, TMPDIR: context.managedTempDir }
+                : process.env,
+    };
+}
 function validateBoundedOutputPath(command, context) {
     const outputPath = command.outputPath;
     if (!outputPath)
         return undefined;
     if (context.permissionMode === 'readonly')
         return '🔒 只读模式：禁止将命令输出写入文件';
-    if (path.isAbsolute(outputPath))
-        return '🔒 输出文件必须使用项目目录内的相对路径';
+    const tempOptions = managedTempOptions(context);
+    const expandedOutputPath = expandManagedTempPath(outputPath, tempOptions);
+    if (path.isAbsolute(expandedOutputPath)) {
+        // A literal `/tmp/...` path is not proof that the caller is using this
+        // session's managed workspace. Only an explicit `$TMPDIR` reference may
+        // opt into the absolute temporary-path branch; the runner owns the value
+        // of TMPDIR and validates its containment below.
+        const explicitManagedTemp = /^\$(?:\{TMPDIR\}|TMPDIR)(?:[\\/]|$)/.test(outputPath);
+        if (!explicitManagedTemp || !isManagedTempPath(outputPath, tempOptions)) {
+            return '🔒 输出文件必须使用项目目录内的相对路径，或当前会话的 $TMPDIR';
+        }
+        const tempTarget = resolveProtectedCandidate(expandedOutputPath);
+        if (fs.existsSync(tempTarget))
+            return '🔒 临时安全输出只允许创建新文件，不能覆盖或追加现有文件';
+        try {
+            if (!fs.statSync(path.dirname(tempTarget)).isDirectory())
+                return '🔒 临时输出文件的父目录无效';
+        }
+        catch {
+            return '🔒 临时输出文件的父目录必须已经存在';
+        }
+        return undefined;
+    }
     const workspace = resolveProtectedCandidate(context.workspacePath ?? context.projectPath);
     const cwd = resolveProtectedCandidate(context.projectPath);
     if (!isSameOrDescendant(cwd, workspace))
@@ -1033,7 +1241,7 @@ function quotePosixShellArg(value) {
 function prepareBoundedOutputInput(input, command, kind, context) {
     const validationError = validateBoundedOutputPath(command, context);
     if (validationError)
-        return { behavior: 'deny', input, message: validationError };
+        return { behavior: 'deny', input, message: validationError, policyCode: 'bounded_output_invalid' };
     const helperPath = context.safeOutputHelperPath;
     if (!helperPath) {
         return {
@@ -1047,7 +1255,7 @@ function prepareBoundedOutputInput(input, command, kind, context) {
             throw new Error('not a file');
     }
     catch {
-        return { behavior: 'deny', input, message: '🔒 安全输出 helper 不可用，命令已拒绝' };
+        return { behavior: 'deny', input, message: '🔒 安全输出 helper 不可用，命令已拒绝', policyCode: 'bounded_output_helper_unavailable' };
     }
     const payload = Buffer.from(JSON.stringify({
         v: 1,
@@ -1058,7 +1266,9 @@ function prepareBoundedOutputInput(input, command, kind, context) {
         argv: command.argv,
         mergeStderr: command.mergeStderr,
         ...(command.headArgs ? { headArgs: command.headArgs } : {}),
-        ...(command.outputPath ? { outputPath: command.outputPath } : {}),
+        ...(command.outputPath
+            ? { outputPath: expandManagedTempPath(command.outputPath, managedTempOptions(context)) }
+            : {}),
     }), 'utf8').toString('base64url');
     const rewrittenCommand = `${quotePosixShellArg(process.execPath)} ${quotePosixShellArg(helperPath)} ${quotePosixShellArg(payload)}`;
     return {
@@ -1071,30 +1281,66 @@ function prepareBoundedOutputInput(input, command, kind, context) {
 export function evaluateToolPreflight(toolName, input, context) {
     if (toolName === 'Bash') {
         const command = typeof input.command === 'string' ? input.command : '';
-        if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(command)) {
+        const tempCheck = checkManagedTempShellCommand(command, managedTempOptions(context));
+        if (tempCheck.kind === 'deny') {
+            return {
+                behavior: 'deny',
+                input,
+                message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内：${tempCheck.reason}`,
+                policyCode: 'temporary_path_outside_tmpdir',
+            };
+        }
+        const explicitCommandArgv = Array.isArray(input.commandArgv)
+            && input.commandArgv.every(value => typeof value === 'string')
+            ? input.commandArgv
+            : undefined;
+        const outerArgv = explicitCommandArgv ?? parseLiteralShellArgv(command) ?? undefined;
+        const wrappedCommand = outerArgv ? unwrapCodexShellCommandArgv(outerArgv) : undefined;
+        const policyCommand = wrappedCommand ?? command;
+        if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(policyCommand)) {
             return {
                 behavior: 'deny',
                 input,
                 message: '🔒 EvolCore 托管会话不需要探测 `ec` 是否存在；请不要调用 `command -v`/`which`/`type`，也不要拼接其它命令。通信必须走当前 session 的 delegated sender。',
+                policyCode: 'managed_ec_discovery_forbidden',
             };
         }
-        const argv = context.sessionId ? parseLiteralShellArgv(command) : null;
-        const isOwnAgentMdPublish = !!argv
-            && argv.length === 5
-            && argv[0] === 'ec'
-            && argv[1] === 'aid'
-            && argv[2] === 'agentmd'
-            && argv[3] === 'put'
+        const argv = context.sessionId ? parseCodexToolCommandArgv(input) : null;
+        const managedAidArgv = argv?.at(-2) === '--format' && argv.at(-1) === 'json'
+            ? argv.slice(0, -2)
+            : argv;
+        const ownAid = !!managedAidArgv
             && !!context.selfAid
-            && argv[4].replace(/^@/, '') === context.selfAid.replace(/^@/, '');
-        if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(command) && !isOwnAgentMdPublish) {
+            && managedAidArgv.at(-1)?.replace(/^@/, '') === context.selfAid.replace(/^@/, '');
+        const isSelfManagedAidRead = !!managedAidArgv
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && ownAid
+            && ((managedAidArgv.length === 4 && ['show', 'lookup'].includes(managedAidArgv[2]))
+                || (managedAidArgv.length === 5
+                    && managedAidArgv[2] === 'agentmd'
+                    && managedAidArgv[3] === 'get'));
+        const isSelfAgentMdPublish = !!managedAidArgv
+            && managedAidArgv.length === 5
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && managedAidArgv[2] === 'agentmd'
+            && managedAidArgv[3] === 'put'
+            && ownAid;
+        const canPublishSelfAgentMd = isSelfAgentMdPublish
+            && ['request', 'bypass'].includes(context.permissionMode ?? '');
+        const isAllowedManagedAidCommand = isSelfManagedAidRead || canPublishSelfAgentMd;
+        if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(policyCommand) && !isAllowedManagedAidCommand) {
             return {
                 behavior: 'deny',
                 input,
-                message: '🔒 EvolCore 托管会话仅允许通过 `ec aid agentmd put <当前 self AID>` 发布自身名片；禁止通过 `ec aid` 自行发现、切换或操作其他身份。',
+                message: isSelfAgentMdPublish && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
+                    ? `🔒 ${context.permissionMode} 模式禁止发布 agent.md；请切换到 request 或 bypass 后再执行 \`ec aid agentmd put <当前 self AID>\`。`
+                    : '🔒 EvolCore 托管会话仅允许针对当前 self AID 精确调用 `ec aid show`、`ec aid lookup` 或 `ec aid agentmd get`；`ec aid agentmd put` 还要求 request 或 bypass。可选后缀仅限 `--format json`。禁止枚举、切换或操作其他身份。',
+                policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }
-        const ecCommand = classifyEvolcoreShellCommand(command);
+        const ecCommand = classifyEvolcoreShellCommand(policyCommand);
         if (ecCommand.kind === 'literal') {
             return { behavior: 'allow', input, reason: 'ec-command' };
         }
@@ -1102,25 +1348,40 @@ export function evaluateToolPreflight(toolName, input, context) {
             return prepareBoundedOutputInput(input, ecCommand.command, 'ec', context);
         }
         if (ecCommand.kind === 'composite') {
-            if (ecCommand.issue === 'unsafe-expansion') {
-                return {
-                    behavior: 'deny',
-                    input,
-                    message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
-                };
-            }
-            if (ecCommand.issue === 'invalid-quote') {
+            // Older app-server approval callbacks may provide only the rendered
+            // `/bin/bash -lc ...` command string.  A composite inside that carrier
+            // is not eligible for a delegation ticket, but owner bypass still
+            // handles it as an ordinary shell request.  Structured `commandArgv`
+            // callbacks remain fail-closed below because their command boundary is
+            // authoritative.
+            const legacyRenderedCarrier = !explicitCommandArgv && wrappedCommand !== undefined;
+            const allowLegacyBypassComposition = legacyRenderedCarrier
+                && context.permissionMode === 'bypass'
+                && ecCommand.issue === 'shell-composition';
+            if (!allowLegacyBypassComposition) {
+                if (ecCommand.issue === 'unsafe-expansion') {
+                    return {
+                        behavior: 'deny',
+                        input,
+                        message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
+                        policyCode: 'ec_shell_unsafe_expansion',
+                    };
+                }
+                if (ecCommand.issue === 'invalid-quote') {
+                    return {
+                        behavior: 'deny',
+                        input,
+                        message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
+                        policyCode: 'ec_shell_invalid_quote',
+                    };
+                }
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
+                    message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
+                    policyCode: 'ec_shell_composite_command',
                 };
             }
-            return {
-                behavior: 'deny',
-                input,
-                message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
-            };
         }
         const boundedOutput = parseBoundedOutputShellCommand(command);
         const hostProcessCommand = boundedOutput
@@ -1137,7 +1398,7 @@ export function evaluateToolPreflight(toolName, input, context) {
     }
     const blacklist = checkBlacklist(toolName, input);
     if (blacklist.behavior === 'deny') {
-        return { behavior: 'deny', input, message: blacklist.message };
+        return { behavior: 'deny', input, message: blacklist.message, policyCode: 'tool_blacklist' };
     }
     const checkedInput = blacklist.updatedInput;
     const hClass = checkHClassWrite(toolName, checkedInput, {
@@ -1148,9 +1409,11 @@ export function evaluateToolPreflight(toolName, input, context) {
         projectPath: context.projectPath,
         workspacePath: context.workspacePath,
         root: context.root,
+        managedTempDir: context.managedTempDir,
+        allowProtectedMetadata: context.allowProtectedMetadata,
     });
     if (hClass.behavior === 'deny') {
-        return { behavior: 'deny', input: checkedInput, message: hClass.message };
+        return { behavior: 'deny', input: checkedInput, message: hClass.message, policyCode: 'h_class_protection' };
     }
     const lClass = checkLClassWrite(toolName, checkedInput, {
         sessionId: context.sessionId,
@@ -1161,9 +1424,10 @@ export function evaluateToolPreflight(toolName, input, context) {
         projectPath: context.projectPath,
         workspacePath: context.workspacePath,
         root: context.root,
+        managedTempDir: context.managedTempDir,
     });
     if (lClass.behavior === 'deny') {
-        return { behavior: 'deny', input: checkedInput, message: lClass.message };
+        return { behavior: 'deny', input: checkedInput, message: lClass.message, policyCode: 'l_class_protection' };
     }
     const dangerous = checkDangerousCommand(toolName, checkedInput);
     if (dangerous.isDangerous
@@ -1174,6 +1438,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             behavior: 'deny',
             input: checkedInput,
             message: '🔒 Git 破坏性操作仅允许 owner/admin 调用；当前角色无权执行',
+            policyCode: 'role_git_destructive_forbidden',
         };
     }
     return { behavior: 'continue', input: checkedInput };