evolcore 0.0.12 → 0.0.14

package/dist/core/permission/ec-command-parser.js

@@ -14,6 +14,66 @@ const EVOLCORE_COMMAND_POSITION_RE = /(?:^|[;&|()`])\s*ec(?=\s|[;&|()<>`]|$)/i;
 function trimShellSpacing(value) {
     return value.replace(/^[ \t]+|[ \t]+$/g, '');
 }
+const MANAGED_TMPDIR_TOKEN = '__EC_MANAGED_TMPDIR__';
+/**
+ * Preserve the one environment reference allowed in managed EC paths.
+ * The regular literal parser still rejects all expansion by default. The
+ * privileged EC classifier opts into this token only after the surrounding
+ * policy has validated the path against the session-owned TMPDIR.
+ */
+function substituteManagedTmpDirToken(value) {
+    let result = '';
+    let quote = null;
+    for (let index = 0; index < value.length; index++) {
+        const char = value[index];
+        if (quote === 'single') {
+            result += char;
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '\\') {
+                result += char;
+                if (index + 1 < value.length)
+                    result += value[++index];
+                continue;
+            }
+            if (char === '"') {
+                quote = null;
+                result += char;
+                continue;
+            }
+        }
+        else if (char === "'") {
+            quote = 'single';
+            result += char;
+            continue;
+        }
+        else if (char === '\\') {
+            result += char;
+            if (index + 1 < value.length)
+                result += value[++index];
+            continue;
+        }
+        if (value.startsWith('${TMPDIR}', index)) {
+            result += MANAGED_TMPDIR_TOKEN;
+            index += '${TMPDIR}'.length - 1;
+        }
+        else if (value.startsWith('$TMPDIR', index)
+            && !/[A-Za-z0-9_]/.test(value[index + '$TMPDIR'.length] ?? '')) {
+            result += MANAGED_TMPDIR_TOKEN;
+            index += '$TMPDIR'.length - 1;
+        }
+        else {
+            result += char;
+        }
+    }
+    return result;
+}
+function restoreManagedTmpDirToken(value, managedTempDir) {
+    return value.replaceAll(MANAGED_TMPDIR_TOKEN, managedTempDir ?? '$TMPDIR');
+}
 function isShellSpacing(value) {
     return value === ' ' || value === '\t';
 }
@@ -41,8 +101,10 @@ function doubleQuotedIssueAt(input, index) {
  * expansion, glob, pipeline, command substitution, redirection, or comment.
  * Anything outside this subset is never granted the privileged EC path.
  */
-export function parseLiteralShellCommand(command) {
-    const input = trimShellSpacing(command);
+export function parseLiteralShellCommand(command, options = {}) {
+    const input = trimShellSpacing(options.allowManagedTmpDir
+        ? substituteManagedTmpDirToken(command)
+        : command);
     if (!input)
         return { ok: false, issue: 'empty-command' };
     if (input.includes('\0'))
@@ -135,11 +197,16 @@ export function parseLiteralShellCommand(command) {
         return { ok: false, issue: 'invalid-quote' };
     finishToken();
     return argv.length > 0
-        ? { ok: true, argv }
+        ? {
+            ok: true,
+            argv: options.allowManagedTmpDir
+                ? argv.map(value => restoreManagedTmpDirToken(value, options.managedTempDir))
+                : argv,
+        }
         : { ok: false, issue: 'empty-command' };
 }
-export function parseLiteralShellArgv(command) {
-    const result = parseLiteralShellCommand(command);
+export function parseLiteralShellArgv(command, options = {}) {
+    const result = parseLiteralShellCommand(command, options);
     return result.ok ? result.argv : null;
 }
 /**
@@ -157,12 +224,12 @@ export function unwrapCodexShellCommandArgv(argv) {
  * Codex app-server. This does not make shell composition safe: the nested
  * command still has to pass `parseLiteralShellCommand`.
  */
-export function parseCodexShellCommandArgv(command) {
-    const outer = parseLiteralShellArgv(command);
+export function parseCodexShellCommandArgv(command, options = {}) {
+    const outer = parseLiteralShellArgv(command, options);
     if (!outer)
         return null;
     const wrapped = unwrapCodexShellCommandArgv(outer);
-    return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped);
+    return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped, options);
 }
 /**
  * Resolve a Codex command input while preserving the raw `commandArgv` form
@@ -173,10 +240,504 @@ export function parseCodexToolCommandArgv(input) {
     if (Array.isArray(input.commandArgv) && input.commandArgv.every(value => typeof value === 'string')) {
         const outer = input.commandArgv;
         const wrapped = unwrapCodexShellCommandArgv(outer);
-        return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped);
+        return wrapped === undefined
+            ? outer
+            : parseLiteralShellArgv(wrapped, { allowManagedTmpDir: true });
     }
     const command = typeof input.command === 'string' ? input.command : '';
-    return parseCodexShellCommandArgv(command);
+    return parseCodexShellCommandArgv(command, { allowManagedTmpDir: true });
+}
+function isSimpleExecStringLiteral(value) {
+    const quote = value[0];
+    if ((quote !== '"' && quote !== "'") || value.at(-1) !== quote)
+        return false;
+    let escaped = false;
+    for (let index = 1; index < value.length - 1; index++) {
+        const char = value[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === '\r' || char === '\n')
+            return false;
+    }
+    return !escaped;
+}
+function splitTopLevelExecObjectProperties(body) {
+    const properties = [];
+    let start = 0;
+    let curlyDepth = 0;
+    let squareDepth = 0;
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < body.length; index++) {
+        const char = body[index];
+        if (quote) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (char === '\\') {
+                escaped = true;
+            }
+            else if (char === quote) {
+                quote = null;
+            }
+            else if (char === '\r' || char === '\n') {
+                return null;
+            }
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`') {
+            quote = char;
+            continue;
+        }
+        if (char === '{')
+            curlyDepth++;
+        else if (char === '}') {
+            if (curlyDepth === 0)
+                return null;
+            curlyDepth--;
+        }
+        else if (char === '[')
+            squareDepth++;
+        else if (char === ']') {
+            if (squareDepth === 0)
+                return null;
+            squareDepth--;
+        }
+        else if (char === ',' && curlyDepth === 0 && squareDepth === 0) {
+            properties.push(body.slice(start, index));
+            start = index + 1;
+        }
+    }
+    if (quote || curlyDepth !== 0 || squareDepth !== 0 || escaped)
+        return null;
+    properties.push(body.slice(start));
+    return properties;
+}
+function topLevelExecPropertyColon(property) {
+    let curlyDepth = 0;
+    let squareDepth = 0;
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < property.length; index++) {
+        const char = property[index];
+        if (quote) {
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`') {
+            quote = char;
+            continue;
+        }
+        if (char === '{')
+            curlyDepth++;
+        else if (char === '}')
+            curlyDepth--;
+        else if (char === '[')
+            squareDepth++;
+        else if (char === ']')
+            squareDepth--;
+        else if (char === ':' && curlyDepth === 0 && squareDepth === 0)
+            return index;
+    }
+    return -1;
+}
+function parseSimpleExecPropertyKey(raw) {
+    const value = raw.trim();
+    if (/^[A-Za-z_$][\w$]*$/.test(value))
+        return value;
+    if (value.startsWith('"') && value.endsWith('"')) {
+        try {
+            const parsed = JSON.parse(value);
+            return typeof parsed === 'string' ? parsed : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    if (value.startsWith("'") && value.endsWith("'") && /^'[A-Za-z_$][\w$]*'$/.test(value)) {
+        return value.slice(1, -1);
+    }
+    return null;
+}
+function validateSimpleExecCarrierObject(source, objectStart, objectEnd) {
+    const properties = splitTopLevelExecObjectProperties(source.slice(objectStart + 1, objectEnd - 1));
+    if (!properties)
+        return false;
+    const seen = new Set();
+    for (const property of properties) {
+        if (!property.trim())
+            continue;
+        const colon = topLevelExecPropertyColon(property);
+        if (colon < 0)
+            return false;
+        const key = parseSimpleExecPropertyKey(property.slice(0, colon));
+        const value = property.slice(colon + 1).trim();
+        if (!key || seen.has(key) || !value)
+            return false;
+        seen.add(key);
+        // The command and all carrier options must be inert literals. In
+        // particular, reject calls, member expressions, template literals, and
+        // nested objects that could execute while the real tool is invoked.
+        if (key === 'cmd') {
+            if (!isSimpleExecStringLiteral(value))
+                return false;
+        }
+        else if (!isSimpleExecStringLiteral(value)
+            && !/^(?:true|false|null)$/.test(value)
+            && !/^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(value)) {
+            return false;
+        }
+    }
+    return seen.has('cmd');
+}
+/**
+ * Extract the one literal command carried by Codex's custom `exec` tool.
+ *
+ * The desktop Codex tool is a JavaScript carrier around `tools.exec_command`.
+ * Treating the carrier as a send command is safe only when it contains one
+ * direct command call; a script containing a send plus any other command must
+ * remain blocked because its execution order cannot satisfy the gate.
+ */
+export function parseCodexExecToolCommand(input) {
+    const source = typeof input.input === 'string' ? input.input : '';
+    if (!source)
+        return null;
+    // Count only source-level calls. A command body is itself a string literal,
+    // so a message such as `"mention tools.foo("` must not look like a second
+    // tool invocation. Comments are ignored for the same reason.
+    const toolCalls = [];
+    let sourceQuote = null;
+    let sourceEscaped = false;
+    let lineComment = false;
+    let blockComment = false;
+    for (let index = 0; index < source.length;) {
+        const char = source[index];
+        const next = source[index + 1];
+        if (lineComment) {
+            if (char === '\n' || char === '\r')
+                lineComment = false;
+            index++;
+            continue;
+        }
+        if (blockComment) {
+            if (char === '*' && next === '/') {
+                blockComment = false;
+                index += 2;
+            }
+            else {
+                index++;
+            }
+            continue;
+        }
+        if (sourceQuote) {
+            if (sourceEscaped) {
+                sourceEscaped = false;
+            }
+            else if (char === '\\') {
+                sourceEscaped = true;
+            }
+            else if (char === sourceQuote) {
+                sourceQuote = null;
+            }
+            index++;
+            continue;
+        }
+        if (char === '/' && next === '/') {
+            lineComment = true;
+            index += 2;
+            continue;
+        }
+        if (char === '/' && next === '*') {
+            blockComment = true;
+            index += 2;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`') {
+            sourceQuote = char;
+            index++;
+            continue;
+        }
+        if (source.startsWith('tools.', index)
+            && (index === 0 || !/[A-Za-z0-9_$]/.test(source[index - 1]))) {
+            let nameEnd = index + 'tools.'.length;
+            const nameMatch = source.slice(nameEnd).match(/^[A-Za-z_$][\w$]*/);
+            if (nameMatch) {
+                nameEnd += nameMatch[0].length;
+                while (nameEnd < source.length && /\s/u.test(source[nameEnd]))
+                    nameEnd++;
+                if (source[nameEnd] === '(') {
+                    toolCalls.push({ name: nameMatch[0], start: index, openParen: nameEnd });
+                    index = nameEnd + 1;
+                    continue;
+                }
+            }
+        }
+        index++;
+    }
+    const calls = toolCalls.filter(call => call.name === 'exec_command');
+    if (toolCalls.length !== 1 || calls.length !== 1)
+        return null;
+    const callStart = calls[0].start;
+    const callOpenParen = calls[0].openParen;
+    const prefix = source.slice(0, callStart);
+    const binding = prefix.match(/^\s*(?:(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*await\s*|await\s*)$/);
+    if (!binding)
+        return null;
+    const outputBinding = binding[1];
+    let objectStart = callOpenParen + 1;
+    while (objectStart < source.length && /\s/u.test(source[objectStart]))
+        objectStart++;
+    if (source[objectStart] !== '{')
+        return null;
+    // Desktop Codex serializes the carrier object as JSON (`{"cmd":"..."}`),
+    // while hand-written calls may use a JavaScript identifier (`{ cmd: "..." }`).
+    // Walk the carrier object so a nested `{ cmd: ... }` or a string containing
+    // `cmd:` cannot be mistaken for the direct command property.
+    let curlyDepth = 0;
+    let squareDepth = 0;
+    let propertyStart = false;
+    let scanQuote = null;
+    let scanEscaped = false;
+    let valueStart = -1;
+    let objectEnd = -1;
+    for (let index = objectStart; index < source.length; index++) {
+        const char = source[index];
+        if (!scanQuote && curlyDepth === 1 && squareDepth === 0 && propertyStart) {
+            let keyStart = index;
+            while (keyStart < source.length && /\s/u.test(source[keyStart]))
+                keyStart++;
+            let key;
+            let keyEnd = keyStart;
+            const keyQuote = source[keyStart];
+            if (keyQuote === '"' || keyQuote === "'") {
+                keyEnd++;
+                let keyEscaped = false;
+                for (; keyEnd < source.length; keyEnd++) {
+                    const keyChar = source[keyEnd];
+                    if (keyEscaped) {
+                        keyEscaped = false;
+                        continue;
+                    }
+                    if (keyChar === '\\') {
+                        keyEscaped = true;
+                        continue;
+                    }
+                    if (keyChar === keyQuote)
+                        break;
+                }
+                if (keyEnd >= source.length)
+                    return null;
+                key = source.slice(keyStart + 1, keyEnd);
+                keyEnd++;
+            }
+            else {
+                const keyMatch = source.slice(keyStart).match(/^[A-Za-z_$][\w$]*/);
+                if (!keyMatch) {
+                    propertyStart = false;
+                    continue;
+                }
+                key = keyMatch[0];
+                keyEnd += key.length;
+            }
+            while (keyEnd < source.length && /\s/u.test(source[keyEnd]))
+                keyEnd++;
+            if (source[keyEnd] !== ':') {
+                propertyStart = false;
+                continue;
+            }
+            keyEnd++;
+            while (keyEnd < source.length && /\s/u.test(source[keyEnd]))
+                keyEnd++;
+            propertyStart = false;
+            if (key === 'cmd') {
+                const valueQuote = source[keyEnd];
+                if (valueQuote !== '"' && valueQuote !== "'")
+                    return null;
+                if (valueStart >= 0)
+                    return null;
+                valueStart = keyEnd;
+                index = keyEnd - 1;
+                continue;
+            }
+            index = keyEnd - 1;
+            continue;
+        }
+        if (scanQuote) {
+            if (scanEscaped) {
+                scanEscaped = false;
+                continue;
+            }
+            if (char === '\\') {
+                scanEscaped = true;
+                continue;
+            }
+            if (char === scanQuote)
+                scanQuote = null;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`') {
+            scanQuote = char;
+            continue;
+        }
+        if (char === '{') {
+            curlyDepth++;
+            if (curlyDepth === 1)
+                propertyStart = true;
+            continue;
+        }
+        if (char === '}') {
+            if (curlyDepth === 1) {
+                objectEnd = index + 1;
+                break;
+            }
+            curlyDepth--;
+            continue;
+        }
+        if (char === '[') {
+            squareDepth++;
+            continue;
+        }
+        if (char === ']') {
+            squareDepth = Math.max(0, squareDepth - 1);
+            continue;
+        }
+        if (curlyDepth !== 1 || squareDepth !== 0)
+            continue;
+        if (char === ',') {
+            propertyStart = true;
+            continue;
+        }
+    }
+    if (valueStart < 0 || objectEnd < 0)
+        return null;
+    if (!validateSimpleExecCarrierObject(source, objectStart, objectEnd))
+        return null;
+    let callEnd = objectEnd;
+    while (callEnd < source.length && /\s/u.test(source[callEnd]))
+        callEnd++;
+    if (source[callEnd] !== ')')
+        return null;
+    callEnd++;
+    // The carrier is intentionally restricted to one top-level await. This
+    // rejects loops/conditionals that could invoke the same source call more
+    // than once, and prevents additional arguments from hiding another action.
+    const tail = source.slice(callEnd).replace(/\/\/[^\r\n]*|\/\*[\s\S]*?\*\//g, '');
+    const tailPattern = outputBinding
+        ? new RegExp(`^\\s*;?\\s*(?:text\\(\\s*${outputBinding}\\.output\\s*\\)\\s*;?)?\\s*$`)
+        : /^\s*;?\s*$/;
+    if (!tailPattern.test(tail))
+        return null;
+    const valueQuote = source[valueStart];
+    const quoteForValue = valueQuote === '"' || valueQuote === "'" ? valueQuote : null;
+    if (!quoteForValue)
+        return null;
+    const quote = quoteForValue;
+    let end = valueStart + 1;
+    let escaped = false;
+    for (; end < source.length; end++) {
+        const char = source[end];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === quote)
+            break;
+    }
+    if (end >= source.length)
+        return null;
+    const raw = source.slice(valueStart, end + 1);
+    if (quote === '"') {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    // Decode the JS string escapes needed for command literals without
+    // evaluating model-provided source code. Unknown escapes are rejected:
+    // silently dropping the backslash could make the parsed command differ
+    // from the string that JavaScript will actually execute (for example
+    // `\x26` becoming `&`).
+    let decoded = '';
+    for (let index = 1; index < raw.length - 1; index++) {
+        const char = raw[index];
+        if (char !== '\\') {
+            decoded += char;
+            continue;
+        }
+        const next = raw[++index];
+        if (next === undefined)
+            return null;
+        if (next === 'n')
+            decoded += '\n';
+        else if (next === 'r')
+            decoded += '\r';
+        else if (next === 't')
+            decoded += '\t';
+        else if (next === 'b')
+            decoded += '\b';
+        else if (next === 'f')
+            decoded += '\f';
+        else if (next === 'v')
+            decoded += '\v';
+        else if (next === '0') {
+            if (/^[0-9]/.test(raw[index + 1] ?? ''))
+                return null;
+            decoded += '\0';
+        }
+        else if (next === 'x') {
+            const hex = raw.slice(index + 1, index + 3);
+            if (!/^[0-9a-fA-F]{2}$/.test(hex))
+                return null;
+            decoded += String.fromCharCode(parseInt(hex, 16));
+            index += 2;
+        }
+        else if (next === 'u') {
+            const hex = raw.slice(index + 1, index + 5);
+            if (!/^[0-9a-fA-F]{4}$/.test(hex))
+                return null;
+            decoded += String.fromCharCode(parseInt(hex, 16));
+            index += 4;
+        }
+        else if (next === '\n') {
+            // JavaScript line continuations contribute no command character.
+        }
+        else if (next === '\r') {
+            if (raw[index + 1] === '\n')
+                index++;
+        }
+        else if (next === '\\' || next === "'" || next === '"' || next === '`' || next === '/') {
+            decoded += next;
+        }
+        else {
+            return null;
+        }
+    }
+    return decoded;
+}
+function parseProactiveToolCommandArgv(toolName, input) {
+    if (toolName === 'Bash' || toolName === 'Shell')
+        return parseCodexToolCommandArgv(input);
+    if (toolName !== 'exec')
+        return null;
+    const command = parseCodexExecToolCommand(input);
+    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true }) : null;
 }
 function scanBoundedOutputOperators(command) {
     const operators = [];
@@ -290,7 +851,7 @@ function parseStdinOnlyHeadArgs(segment) {
  * optional stderr merge, one bounded `head`, and one create-only output path.
  */
 export function parseBoundedOutputShellCommand(command) {
-    const input = trimShellSpacing(command);
+    const input = trimShellSpacing(substituteManagedTmpDirToken(command));
     if (!input)
         return null;
     const operators = scanBoundedOutputOperators(input);
@@ -311,6 +872,10 @@ export function parseBoundedOutputShellCommand(command) {
     const argv = parseLiteralShellArgv(sourceText);
     if (!argv)
         return null;
+    // `$TMPDIR` is a transport-level path reference, never an argument
+    // expansion for the privileged command itself.
+    if (argv.some(value => value.includes(MANAGED_TMPDIR_TOKEN)))
+        return null;
     let mergeStderr = false;
     let pipe;
     let redirect;
@@ -345,7 +910,12 @@ export function parseBoundedOutputShellCommand(command) {
         const outputArgv = parseLiteralShellArgv(trimShellSpacing(input.slice(redirect.end)));
         if (!outputArgv || outputArgv.length !== 1)
             return null;
-        outputPath = outputArgv[0];
+        // A single-quoted or escaped `$TMPDIR` is literal shell text, not the
+        // managed directory reference. Do not reinterpret it as a route to the
+        // session temp root.
+        if (outputArgv[0].includes('$') && !outputArgv[0].includes(MANAGED_TMPDIR_TOKEN))
+            return null;
+        outputPath = restoreManagedTmpDirToken(outputArgv[0]);
     }
     return { argv, mergeStderr, ...(headArgs ? { headArgs } : {}), ...(outputPath ? { outputPath } : {}) };
 }
@@ -355,13 +925,14 @@ export function parseBoundedOutputShellCommand(command) {
  * invocation may leave the sandbox, while shell composition may not.
  */
 export function classifyEvolcoreShellCommand(command) {
-    const literal = parseLiteralShellCommand(command);
+    const parseOptions = { allowManagedTmpDir: true };
+    const literal = parseLiteralShellCommand(command, parseOptions);
     if (literal.ok) {
         if (literal.argv[0] === 'ec')
             return { kind: 'literal' };
         const wrapped = unwrapCodexShellCommandArgv(literal.argv);
         if (wrapped !== undefined) {
-            const nested = parseLiteralShellCommand(wrapped);
+            const nested = parseLiteralShellCommand(wrapped, parseOptions);
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
             if (!nested.ok && EVOLCORE_COMMAND_POSITION_RE.test(wrapped)) {
@@ -410,6 +981,66 @@ const PROACTIVE_SEND_VALUE_FLAGS = new Set([
 const PROACTIVE_SEND_BOOLEAN_FLAGS = new Set([
     '--encrypt', '--no-encrypt', '--mention-all',
 ]);
+const SEND_CONTENT_VALUE_FLAGS = new Set([
+    '--payload', '--title', '--description', '--text', '--transcript',
+]);
+const TRIGGER_CONTENT_VALUE_FLAGS = new Set(['--prompt']);
+/**
+ * A shell-escaped `$TMPDIR` in a msg/group text body or trigger prompt is
+ * ordinary content, not a path reference. Keep every other unresolved
+ * occurrence fail-closed so file and control arguments cannot bypass
+ * managed-path checks.
+ */
+export function containsLiteralManagedTmpDirOutsideSendContent(argv) {
+    const literalIndexes = argv
+        .map((value, index) => value.includes('$TMPDIR') ? index : -1)
+        .filter(index => index >= 0);
+    if (literalIndexes.length === 0)
+        return false;
+    const isSendCommand = argv[0] === 'ec'
+        && (argv[1] === 'msg' || argv[1] === 'group')
+        && argv[2] === 'send';
+    const isTriggerCommand = argv[0] === 'ec' && argv[1] === 'trigger';
+    if (!isSendCommand && !isTriggerCommand)
+        return true;
+    const textIndexes = new Set();
+    if (isTriggerCommand) {
+        for (let index = 2; index < argv.length; index++) {
+            if (!TRIGGER_CONTENT_VALUE_FLAGS.has(argv[index]))
+                continue;
+            if (argv[index + 1] !== undefined)
+                textIndexes.add(index + 1);
+            index++;
+        }
+    }
+    if (!isSendCommand)
+        return literalIndexes.some(index => !textIndexes.has(index));
+    let endOfOptions = false;
+    for (let index = 5; index < argv.length; index++) {
+        const value = argv[index];
+        if (endOfOptions) {
+            textIndexes.add(index);
+            continue;
+        }
+        if (value === '--') {
+            endOfOptions = true;
+            continue;
+        }
+        if (PROACTIVE_SEND_BOOLEAN_FLAGS.has(value))
+            continue;
+        if (PROACTIVE_SEND_VALUE_FLAGS.has(value)) {
+            const operandIndex = ++index;
+            if (SEND_CONTENT_VALUE_FLAGS.has(value) && argv[operandIndex] !== undefined) {
+                textIndexes.add(operandIndex);
+            }
+            continue;
+        }
+        textIndexes.add(index);
+    }
+    if (textIndexes.size === 0)
+        return true;
+    return literalIndexes.some(index => !textIndexes.has(index));
+}
 function hasExecutableProactiveSendPayload(argv, scope) {
     if (!argv || argv[0] !== 'ec' || argv[1] !== scope || argv[2] !== 'send')
         return false;
@@ -531,11 +1162,11 @@ export function isEvolcoreSendCommandForSession(toolName, input, channelId) {
 }
 /** Proactive first-send guard: exact channel kind and current target only. */
 export function isExactEvolcoreSendCommandForSession(toolName, input, channelId, chatType, selfAid) {
-    // Codex hooks use the canonical name `Bash`; the app-server event adapter
-    // exposes the same commandExecution items as `Shell` to the renderer.
-    if ((toolName !== 'Bash' && toolName !== 'Shell') || !selfAid)
+    // Codex app-server exposes shell items as `Shell`; the desktop custom tool
+    // is represented as `exec` and is handled only for one literal inner call.
+    if (!selfAid)
         return false;
-    const argv = parseCodexToolCommandArgv(input);
+    const argv = parseProactiveToolCommandArgv(toolName, input);
     const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed || parsed.action !== 'send')
         return false;