evolcore 0.0.12 → 0.0.13

package/dist/core/permission/ec-command-parser.js

@@ -14,6 +14,66 @@ const EVOLCORE_COMMAND_POSITION_RE = /(?:^|[;&|()`])\s*ec(?=\s|[;&|()<>`]|$)/i;
 function trimShellSpacing(value) {
     return value.replace(/^[ \t]+|[ \t]+$/g, '');
 }
+const MANAGED_TMPDIR_TOKEN = '__EC_MANAGED_TMPDIR__';
+/**
+ * Preserve the one environment reference allowed in managed EC paths.
+ * The regular literal parser still rejects all expansion by default. The
+ * privileged EC classifier opts into this token only after the surrounding
+ * policy has validated the path against the session-owned TMPDIR.
+ */
+function substituteManagedTmpDirToken(value) {
+    let result = '';
+    let quote = null;
+    for (let index = 0; index < value.length; index++) {
+        const char = value[index];
+        if (quote === 'single') {
+            result += char;
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '\\') {
+                result += char;
+                if (index + 1 < value.length)
+                    result += value[++index];
+                continue;
+            }
+            if (char === '"') {
+                quote = null;
+                result += char;
+                continue;
+            }
+        }
+        else if (char === "'") {
+            quote = 'single';
+            result += char;
+            continue;
+        }
+        else if (char === '\\') {
+            result += char;
+            if (index + 1 < value.length)
+                result += value[++index];
+            continue;
+        }
+        if (value.startsWith('${TMPDIR}', index)) {
+            result += MANAGED_TMPDIR_TOKEN;
+            index += '${TMPDIR}'.length - 1;
+        }
+        else if (value.startsWith('$TMPDIR', index)
+            && !/[A-Za-z0-9_]/.test(value[index + '$TMPDIR'.length] ?? '')) {
+            result += MANAGED_TMPDIR_TOKEN;
+            index += '$TMPDIR'.length - 1;
+        }
+        else {
+            result += char;
+        }
+    }
+    return result;
+}
+function restoreManagedTmpDirToken(value, managedTempDir) {
+    return value.replaceAll(MANAGED_TMPDIR_TOKEN, managedTempDir ?? '$TMPDIR');
+}
 function isShellSpacing(value) {
     return value === ' ' || value === '\t';
 }
@@ -41,8 +101,10 @@ function doubleQuotedIssueAt(input, index) {
  * expansion, glob, pipeline, command substitution, redirection, or comment.
  * Anything outside this subset is never granted the privileged EC path.
  */
-export function parseLiteralShellCommand(command) {
-    const input = trimShellSpacing(command);
+export function parseLiteralShellCommand(command, options = {}) {
+    const input = trimShellSpacing(options.allowManagedTmpDir
+        ? substituteManagedTmpDirToken(command)
+        : command);
     if (!input)
         return { ok: false, issue: 'empty-command' };
     if (input.includes('\0'))
@@ -135,11 +197,16 @@ export function parseLiteralShellCommand(command) {
         return { ok: false, issue: 'invalid-quote' };
     finishToken();
     return argv.length > 0
-        ? { ok: true, argv }
+        ? {
+            ok: true,
+            argv: options.allowManagedTmpDir
+                ? argv.map(value => restoreManagedTmpDirToken(value, options.managedTempDir))
+                : argv,
+        }
         : { ok: false, issue: 'empty-command' };
 }
-export function parseLiteralShellArgv(command) {
-    const result = parseLiteralShellCommand(command);
+export function parseLiteralShellArgv(command, options = {}) {
+    const result = parseLiteralShellCommand(command, options);
     return result.ok ? result.argv : null;
 }
 /**
@@ -157,12 +224,12 @@ export function unwrapCodexShellCommandArgv(argv) {
  * Codex app-server. This does not make shell composition safe: the nested
  * command still has to pass `parseLiteralShellCommand`.
  */
-export function parseCodexShellCommandArgv(command) {
-    const outer = parseLiteralShellArgv(command);
+export function parseCodexShellCommandArgv(command, options = {}) {
+    const outer = parseLiteralShellArgv(command, options);
     if (!outer)
         return null;
     const wrapped = unwrapCodexShellCommandArgv(outer);
-    return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped);
+    return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped, options);
 }
 /**
  * Resolve a Codex command input while preserving the raw `commandArgv` form
@@ -173,10 +240,12 @@ export function parseCodexToolCommandArgv(input) {
     if (Array.isArray(input.commandArgv) && input.commandArgv.every(value => typeof value === 'string')) {
         const outer = input.commandArgv;
         const wrapped = unwrapCodexShellCommandArgv(outer);
-        return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped);
+        return wrapped === undefined
+            ? outer
+            : parseLiteralShellArgv(wrapped, { allowManagedTmpDir: true });
     }
     const command = typeof input.command === 'string' ? input.command : '';
-    return parseCodexShellCommandArgv(command);
+    return parseCodexShellCommandArgv(command, { allowManagedTmpDir: true });
 }
 function scanBoundedOutputOperators(command) {
     const operators = [];
@@ -290,7 +359,7 @@ function parseStdinOnlyHeadArgs(segment) {
  * optional stderr merge, one bounded `head`, and one create-only output path.
  */
 export function parseBoundedOutputShellCommand(command) {
-    const input = trimShellSpacing(command);
+    const input = trimShellSpacing(substituteManagedTmpDirToken(command));
     if (!input)
         return null;
     const operators = scanBoundedOutputOperators(input);
@@ -311,6 +380,10 @@ export function parseBoundedOutputShellCommand(command) {
     const argv = parseLiteralShellArgv(sourceText);
     if (!argv)
         return null;
+    // `$TMPDIR` is a transport-level path reference, never an argument
+    // expansion for the privileged command itself.
+    if (argv.some(value => value.includes(MANAGED_TMPDIR_TOKEN)))
+        return null;
     let mergeStderr = false;
     let pipe;
     let redirect;
@@ -345,7 +418,12 @@ export function parseBoundedOutputShellCommand(command) {
         const outputArgv = parseLiteralShellArgv(trimShellSpacing(input.slice(redirect.end)));
         if (!outputArgv || outputArgv.length !== 1)
             return null;
-        outputPath = outputArgv[0];
+        // A single-quoted or escaped `$TMPDIR` is literal shell text, not the
+        // managed directory reference. Do not reinterpret it as a route to the
+        // session temp root.
+        if (outputArgv[0].includes('$') && !outputArgv[0].includes(MANAGED_TMPDIR_TOKEN))
+            return null;
+        outputPath = restoreManagedTmpDirToken(outputArgv[0]);
     }
     return { argv, mergeStderr, ...(headArgs ? { headArgs } : {}), ...(outputPath ? { outputPath } : {}) };
 }
@@ -355,13 +433,14 @@ export function parseBoundedOutputShellCommand(command) {
  * invocation may leave the sandbox, while shell composition may not.
  */
 export function classifyEvolcoreShellCommand(command) {
-    const literal = parseLiteralShellCommand(command);
+    const parseOptions = { allowManagedTmpDir: true };
+    const literal = parseLiteralShellCommand(command, parseOptions);
     if (literal.ok) {
         if (literal.argv[0] === 'ec')
             return { kind: 'literal' };
         const wrapped = unwrapCodexShellCommandArgv(literal.argv);
         if (wrapped !== undefined) {
-            const nested = parseLiteralShellCommand(wrapped);
+            const nested = parseLiteralShellCommand(wrapped, parseOptions);
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
             if (!nested.ok && EVOLCORE_COMMAND_POSITION_RE.test(wrapped)) {

package/dist/core/permission/index.js

@@ -2,6 +2,6 @@ export * from './tool-policy.js';
 export * from './ec-command-parser.js';
 export * from './readonly-shell-query.js';
 export * from './approval-gateway.js';
-export * from './execution-sandbox.js';
+export * from './mode.js';
 // Tool summaries live in utils; keep the historical permission import path compatible.
 export { summarizeToolInput } from '../../utils/tool-summary.js';

package/dist/core/permission/mode.js

@@ -22,3 +22,18 @@ export function normalizePermissionMode(value) {
         return { mode: 'readonly', workflow: 'plan', migratedFrom: 'plan' };
     return { mode: 'readonly' };
 }
+/**
+ * Phase one only disables the task execution sandbox for an authenticated
+ * owner running in bypass mode. Every other combination remains fail-closed.
+ */
+export function resolvePhaseOneExecutionSandbox(permissionMode, role) {
+    const normalizedMode = normalizePermissionMode(permissionMode).mode;
+    const normalizedRole = role ?? undefined;
+    const sandboxOff = normalizedMode === 'bypass' && normalizedRole === 'owner';
+    return {
+        permissionMode: normalizedMode,
+        role: normalizedRole,
+        state: sandboxOff ? 'off' : 'active',
+        reason: sandboxOff ? 'owner-bypass' : 'phase-one-required',
+    };
+}

package/dist/core/permission/readonly-shell-query.js

@@ -3,7 +3,7 @@ import { parseLiteralShellArgv } from './ec-command-parser.js';
 const MAX_QUERY_LISTS = 8;
 const MAX_PIPELINE_STAGES = 3;
 const SUPPORTED_EXECUTABLES = new Set([
-    'echo', 'pwd', 'ls', 'cat', 'grep', 'rg', 'find', 'sed', 'head', 'sort',
+    'echo', 'pwd', 'ls', 'cat', 'grep', 'rg', 'find', 'sed', 'head', 'sort', 'git', 'wc', 'stat', 'lstat',
 ]);
 const FIND_MUTATING_PRIMARY_RE = /^-(?:delete|exec|execdir|ok|okdir|fprint|fprint0|fprintf|fls)$/;
 const RG_PROCESS_SPAWNING_OPTION_RE = /^(?:--pre|--hostname-bin|--pre-glob|--search-zip)(?:=|$)/;
@@ -71,8 +71,17 @@ function splitQueryStructure(command) {
             segment += char;
             continue;
         }
-        if (char === '\0' || char === '\r' || char === '\n' || char === '&' || char === '<')
+        if (char === '\0' || char === '\r' || char === '\n' || char === '<')
             return null;
+        if (char === '&') {
+            // A bounded sequence of independently proven read-only commands is
+            // safe to run in order. A single ampersand would background execution;
+            // `||` remains rejected because it introduces conditional control flow.
+            if (command[index + 1] !== '&' || !finishPipeline())
+                return null;
+            index++;
+            continue;
+        }
         if (char === '|') {
             if (command[index + 1] === '|' || !finishStage())
                 return null;
@@ -89,12 +98,14 @@ function splitQueryStructure(command) {
         return null;
     return pipelines;
 }
-function parseStageArgv(segment) {
+function parseStageArgv(segment, options) {
     const redirectMatch = segment.match(STDERR_DEV_NULL_RE);
     const withoutRedirect = redirectMatch?.[1] ?? segment;
     if (withoutRedirect.includes('>'))
         return null;
-    return parseLiteralShellArgv(withoutRedirect.trim());
+    return parseLiteralShellArgv(withoutRedirect.trim(), options.managedTempDir
+        ? { allowManagedTmpDir: true, managedTempDir: options.managedTempDir }
+        : undefined);
 }
 function exact(value) {
     return { value, access: 'exact' };
@@ -458,12 +469,118 @@ function analyzeSort(args) {
     }
     return paths;
 }
+/**
+ * Git metadata queries do not expose file contents and their output paths are
+ * controlled by the repository, not by arbitrary shell operands. Keep this
+ * deliberately small: status and read-only diff summaries are the patterns
+ * used for workspace diagnostics. Mutating subcommands and pathspecs remain
+ * unproven so the normal H-class checks still apply.
+ */
+function analyzeGit(args) {
+    if (args.length === 0)
+        return null;
+    const subcommand = args[0];
+    if (subcommand === 'status') {
+        // Keep the allow-list explicit; callers should request a bounded metadata
+        // view such as `--short` or `--branch`, rather than inheriting Git's full
+        // default output and any future options.
+        if (args.length === 1)
+            return null;
+        const allowed = new Set([
+            '--short', '--porcelain', '--porcelain=v1', '--porcelain=v2', '--branch',
+            '--untracked-files=no', '--untracked-files=normal', '--ignored=no',
+            '--ignore-submodules', '--renames', '--no-renames', '--ahead-behind',
+            '--no-ahead-behind', '--show-stash', '--no-optional-locks',
+        ]);
+        for (const arg of args.slice(1)) {
+            if (arg === '--')
+                return null;
+            if (!allowed.has(arg))
+                return null;
+        }
+        return [];
+    }
+    if (subcommand === 'diff') {
+        let sawSummary = false;
+        let optionsEnded = false;
+        const paths = [];
+        const allowedFlags = new Set([
+            '--stat', '--shortstat', '--numstat', '--name-only', '--name-status',
+            '--no-ext-diff', '--no-renames', '--no-textconv', '--no-index',
+            '--cached', '--staged', '--merge-base', '--no-color', '--color=never',
+        ]);
+        for (const arg of args.slice(1)) {
+            if (!optionsEnded && arg === '--') {
+                optionsEnded = true;
+                continue;
+            }
+            if (!optionsEnded && arg.startsWith('-')) {
+                if (arg === '--stat' || arg === '--shortstat' || arg === '--numstat'
+                    || arg === '--name-only' || arg === '--name-status')
+                    sawSummary = true;
+                if (!allowedFlags.has(arg) && !/^[0-9a-f]{7,64}$/.test(arg))
+                    return null;
+                continue;
+            }
+            // Revisions are safe literals; pathspecs after -- are bounded exact reads.
+            if (optionsEnded)
+                paths.push({ value: arg, access: 'exact' });
+            else if (!/^[0-9A-Za-z._~^/:-]+$/.test(arg))
+                return null;
+        }
+        return sawSummary ? paths : null;
+    }
+    return null;
+}
+function analyzeWc(args) {
+    const allowed = new Set(['-l', '-w', '-c', '-m', '-L', '--lines', '--words', '--bytes', '--chars', '--max-line-length']);
+    const paths = [];
+    for (const arg of args) {
+        if (arg.startsWith('-')) {
+            if (!allowed.has(arg))
+                return null;
+        }
+        else if (arg !== '-') {
+            paths.push(exact(arg));
+        }
+    }
+    return paths;
+}
+function analyzeStat(args) {
+    // GNU stat defaults to lstat semantics. Following a final symlink would
+    // let a metadata-only query reach a protected target through an alias.
+    if (args.some(argument => argument === '-L' || argument === '--dereference'))
+        return null;
+    const valueOptions = new Set(['-c', '--format', '--printf']);
+    const paths = [];
+    let optionsEnded = false;
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (!optionsEnded && argument === '--') {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && argument.startsWith('-') && argument !== '-') {
+            const option = argument.split('=', 1)[0];
+            if (valueOptions.has(option) && !argument.includes('=') && ++index >= args.length)
+                return null;
+            if (!valueOptions.has(option) && !new Set(['-f', '--file-system', '-t', '--terse', '--cached']).has(option)) {
+                return null;
+            }
+            continue;
+        }
+        if (argument !== '-')
+            paths.push(exact(argument));
+    }
+    return paths.length > 0 ? paths : null;
+}
 function analyzeCommand(argv) {
     const executable = normalizeExecutable(argv[0]);
     if (!executable)
         return null;
     const args = argv.slice(1);
     let pathOperands = null;
+    let accessKind = 'content';
     switch (executable) {
         case 'echo':
             pathOperands = [];
@@ -495,12 +612,35 @@ function analyzeCommand(argv) {
         case 'sort':
             pathOperands = analyzeSort(args);
             break;
+        case 'git':
+            pathOperands = analyzeGit(args);
+            break;
+        case 'wc':
+            pathOperands = analyzeWc(args);
+            break;
+        case 'stat':
+        case 'lstat':
+            pathOperands = analyzeStat(args);
+            accessKind = 'metadata';
+            break;
     }
     if (!pathOperands)
         return null;
-    return { command: { executable, argv, pathOperands } };
+    if (['ls', 'find'].includes(executable))
+        accessKind = 'enumerate';
+    return {
+        command: {
+            executable,
+            argv,
+            pathOperands,
+            // Keep the established IR shape for ordinary queries. Only metadata
+            // commands need an explicit action marker; content/enumeration are
+            // derived from their operands by policy consumers.
+            ...(accessKind === 'metadata' ? { accessKind } : {}),
+        },
+    };
 }
-export function analyzeReadonlyShellQuery(command) {
+export function analyzeReadonlyShellQuery(command, options = {}) {
     const structure = splitQueryStructure(command);
     if (!structure)
         return { kind: 'unproven', reason: 'unsupported-shell-structure' };
@@ -509,14 +649,14 @@ export function analyzeReadonlyShellQuery(command) {
     for (const stages of structure) {
         const pipeline = [];
         for (let index = 0; index < stages.length; index++) {
-            const argv = parseStageArgv(stages[index]);
+            const argv = parseStageArgv(stages[index], options);
             if (!argv)
                 return { kind: 'unproven', reason: 'non-literal-command' };
             const analyzed = analyzeCommand(argv);
             if (!analyzed)
                 return { kind: 'unproven', reason: 'unsupported-command-or-option' };
             if (index > 0) {
-                if (!['head', 'sort'].includes(analyzed.command.executable)) {
+                if (!['head', 'sort', 'grep', 'wc'].includes(analyzed.command.executable)) {
                     return { kind: 'unproven', reason: 'unsupported-pipeline-filter' };
                 }
                 if (analyzed.command.pathOperands.length > 0) {

package/dist/core/permission/sandbox-runtime.js

@@ -4,6 +4,27 @@ import { resolveCommandPath } from '../../utils/cross-platform.js';
 import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from '../protected-paths.js';
 import { resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
+export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
+/** Recognize sandbox bootstrap failures independently of localized stderr. */
+export function isSandboxInitializationFailure(error, stderr = []) {
+    const text = [error instanceof Error ? error.message : String(error ?? ''), ...stderr]
+        .join('\n')
+        .toLowerCase();
+    return text.includes(SANDBOX_INITIALIZATION_FAILED)
+        || /(?:apply-seccomp|seccomp)[\s\S]*(?:uid_map|gid_map|operation not permitted)/.test(text)
+        || /(?:uid_map|gid_map)[\s\S]*(?:operation not permitted|permission denied)/.test(text)
+        || /user namespace[\s\S]*(?:not permitted|unavailable|failed)/.test(text)
+        || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text);
+}
+export function createSandboxInitializationError(error, stderr = []) {
+    const detail = error instanceof Error ? error.message : String(error ?? 'sandbox bootstrap failed');
+    const wrapped = new Error(`${SANDBOX_INITIALIZATION_FAILED}: ${detail}`);
+    wrapped.name = 'SandboxInitializationError';
+    wrapped.code = SANDBOX_INITIALIZATION_FAILED;
+    if (stderr.length > 0)
+        wrapped.stderr = [...stderr].slice(-20);
+    return wrapped;
+}
 /**
  * Claude Agent SDK's native sandbox is unavailable on Windows. WSL2 reports
  * itself as Linux, so it remains fail-closed there together with macOS/Linux.