evolcore 0.0.12 → 0.0.14

package/dist/core/permission/index.js

@@ -2,6 +2,6 @@ export * from './tool-policy.js';
 export * from './ec-command-parser.js';
 export * from './readonly-shell-query.js';
 export * from './approval-gateway.js';
-export * from './execution-sandbox.js';
+export * from './mode.js';
 // Tool summaries live in utils; keep the historical permission import path compatible.
 export { summarizeToolInput } from '../../utils/tool-summary.js';

package/dist/core/permission/mode.js

@@ -22,3 +22,18 @@ export function normalizePermissionMode(value) {
         return { mode: 'readonly', workflow: 'plan', migratedFrom: 'plan' };
     return { mode: 'readonly' };
 }
+/**
+ * Phase one only disables the task execution sandbox for an authenticated
+ * owner running in bypass mode. Every other combination remains fail-closed.
+ */
+export function resolvePhaseOneExecutionSandbox(permissionMode, role) {
+    const normalizedMode = normalizePermissionMode(permissionMode).mode;
+    const normalizedRole = role ?? undefined;
+    const sandboxOff = normalizedMode === 'bypass' && normalizedRole === 'owner';
+    return {
+        permissionMode: normalizedMode,
+        role: normalizedRole,
+        state: sandboxOff ? 'off' : 'active',
+        reason: sandboxOff ? 'owner-bypass' : 'phase-one-required',
+    };
+}

package/dist/core/permission/readonly-shell-query.js

@@ -3,7 +3,7 @@ import { parseLiteralShellArgv } from './ec-command-parser.js';
 const MAX_QUERY_LISTS = 8;
 const MAX_PIPELINE_STAGES = 3;
 const SUPPORTED_EXECUTABLES = new Set([
-    'echo', 'pwd', 'ls', 'cat', 'grep', 'rg', 'find', 'sed', 'head', 'sort',
+    'echo', 'pwd', 'ls', 'cat', 'grep', 'rg', 'find', 'sed', 'head', 'sort', 'git', 'wc', 'stat', 'lstat',
 ]);
 const FIND_MUTATING_PRIMARY_RE = /^-(?:delete|exec|execdir|ok|okdir|fprint|fprint0|fprintf|fls)$/;
 const RG_PROCESS_SPAWNING_OPTION_RE = /^(?:--pre|--hostname-bin|--pre-glob|--search-zip)(?:=|$)/;
@@ -71,8 +71,17 @@ function splitQueryStructure(command) {
             segment += char;
             continue;
         }
-        if (char === '\0' || char === '\r' || char === '\n' || char === '&' || char === '<')
+        if (char === '\0' || char === '\r' || char === '\n' || char === '<')
             return null;
+        if (char === '&') {
+            // A bounded sequence of independently proven read-only commands is
+            // safe to run in order. A single ampersand would background execution;
+            // `||` remains rejected because it introduces conditional control flow.
+            if (command[index + 1] !== '&' || !finishPipeline())
+                return null;
+            index++;
+            continue;
+        }
         if (char === '|') {
             if (command[index + 1] === '|' || !finishStage())
                 return null;
@@ -89,12 +98,14 @@ function splitQueryStructure(command) {
         return null;
     return pipelines;
 }
-function parseStageArgv(segment) {
+function parseStageArgv(segment, options) {
     const redirectMatch = segment.match(STDERR_DEV_NULL_RE);
     const withoutRedirect = redirectMatch?.[1] ?? segment;
     if (withoutRedirect.includes('>'))
         return null;
-    return parseLiteralShellArgv(withoutRedirect.trim());
+    return parseLiteralShellArgv(withoutRedirect.trim(), options.managedTempDir
+        ? { allowManagedTmpDir: true, managedTempDir: options.managedTempDir }
+        : undefined);
 }
 function exact(value) {
     return { value, access: 'exact' };
@@ -458,12 +469,118 @@ function analyzeSort(args) {
     }
     return paths;
 }
+/**
+ * Git metadata queries do not expose file contents and their output paths are
+ * controlled by the repository, not by arbitrary shell operands. Keep this
+ * deliberately small: status and read-only diff summaries are the patterns
+ * used for workspace diagnostics. Mutating subcommands and pathspecs remain
+ * unproven so the normal H-class checks still apply.
+ */
+function analyzeGit(args) {
+    if (args.length === 0)
+        return null;
+    const subcommand = args[0];
+    if (subcommand === 'status') {
+        // Keep the allow-list explicit; callers should request a bounded metadata
+        // view such as `--short` or `--branch`, rather than inheriting Git's full
+        // default output and any future options.
+        if (args.length === 1)
+            return null;
+        const allowed = new Set([
+            '--short', '--porcelain', '--porcelain=v1', '--porcelain=v2', '--branch',
+            '--untracked-files=no', '--untracked-files=normal', '--ignored=no',
+            '--ignore-submodules', '--renames', '--no-renames', '--ahead-behind',
+            '--no-ahead-behind', '--show-stash', '--no-optional-locks',
+        ]);
+        for (const arg of args.slice(1)) {
+            if (arg === '--')
+                return null;
+            if (!allowed.has(arg))
+                return null;
+        }
+        return [];
+    }
+    if (subcommand === 'diff') {
+        let sawSummary = false;
+        let optionsEnded = false;
+        const paths = [];
+        const allowedFlags = new Set([
+            '--stat', '--shortstat', '--numstat', '--name-only', '--name-status',
+            '--no-ext-diff', '--no-renames', '--no-textconv', '--no-index',
+            '--cached', '--staged', '--merge-base', '--no-color', '--color=never',
+        ]);
+        for (const arg of args.slice(1)) {
+            if (!optionsEnded && arg === '--') {
+                optionsEnded = true;
+                continue;
+            }
+            if (!optionsEnded && arg.startsWith('-')) {
+                if (arg === '--stat' || arg === '--shortstat' || arg === '--numstat'
+                    || arg === '--name-only' || arg === '--name-status')
+                    sawSummary = true;
+                if (!allowedFlags.has(arg) && !/^[0-9a-f]{7,64}$/.test(arg))
+                    return null;
+                continue;
+            }
+            // Revisions are safe literals; pathspecs after -- are bounded exact reads.
+            if (optionsEnded)
+                paths.push({ value: arg, access: 'exact' });
+            else if (!/^[0-9A-Za-z._~^/:-]+$/.test(arg))
+                return null;
+        }
+        return sawSummary ? paths : null;
+    }
+    return null;
+}
+function analyzeWc(args) {
+    const allowed = new Set(['-l', '-w', '-c', '-m', '-L', '--lines', '--words', '--bytes', '--chars', '--max-line-length']);
+    const paths = [];
+    for (const arg of args) {
+        if (arg.startsWith('-')) {
+            if (!allowed.has(arg))
+                return null;
+        }
+        else if (arg !== '-') {
+            paths.push(exact(arg));
+        }
+    }
+    return paths;
+}
+function analyzeStat(args) {
+    // GNU stat defaults to lstat semantics. Following a final symlink would
+    // let a metadata-only query reach a protected target through an alias.
+    if (args.some(argument => argument === '-L' || argument === '--dereference'))
+        return null;
+    const valueOptions = new Set(['-c', '--format', '--printf']);
+    const paths = [];
+    let optionsEnded = false;
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (!optionsEnded && argument === '--') {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && argument.startsWith('-') && argument !== '-') {
+            const option = argument.split('=', 1)[0];
+            if (valueOptions.has(option) && !argument.includes('=') && ++index >= args.length)
+                return null;
+            if (!valueOptions.has(option) && !new Set(['-f', '--file-system', '-t', '--terse', '--cached']).has(option)) {
+                return null;
+            }
+            continue;
+        }
+        if (argument !== '-')
+            paths.push(exact(argument));
+    }
+    return paths.length > 0 ? paths : null;
+}
 function analyzeCommand(argv) {
     const executable = normalizeExecutable(argv[0]);
     if (!executable)
         return null;
     const args = argv.slice(1);
     let pathOperands = null;
+    let accessKind = 'content';
     switch (executable) {
         case 'echo':
             pathOperands = [];
@@ -495,12 +612,35 @@ function analyzeCommand(argv) {
         case 'sort':
             pathOperands = analyzeSort(args);
             break;
+        case 'git':
+            pathOperands = analyzeGit(args);
+            break;
+        case 'wc':
+            pathOperands = analyzeWc(args);
+            break;
+        case 'stat':
+        case 'lstat':
+            pathOperands = analyzeStat(args);
+            accessKind = 'metadata';
+            break;
     }
     if (!pathOperands)
         return null;
-    return { command: { executable, argv, pathOperands } };
+    if (['ls', 'find'].includes(executable))
+        accessKind = 'enumerate';
+    return {
+        command: {
+            executable,
+            argv,
+            pathOperands,
+            // Keep the established IR shape for ordinary queries. Only metadata
+            // commands need an explicit action marker; content/enumeration are
+            // derived from their operands by policy consumers.
+            ...(accessKind === 'metadata' ? { accessKind } : {}),
+        },
+    };
 }
-export function analyzeReadonlyShellQuery(command) {
+export function analyzeReadonlyShellQuery(command, options = {}) {
     const structure = splitQueryStructure(command);
     if (!structure)
         return { kind: 'unproven', reason: 'unsupported-shell-structure' };
@@ -509,14 +649,14 @@ export function analyzeReadonlyShellQuery(command) {
     for (const stages of structure) {
         const pipeline = [];
         for (let index = 0; index < stages.length; index++) {
-            const argv = parseStageArgv(stages[index]);
+            const argv = parseStageArgv(stages[index], options);
             if (!argv)
                 return { kind: 'unproven', reason: 'non-literal-command' };
             const analyzed = analyzeCommand(argv);
             if (!analyzed)
                 return { kind: 'unproven', reason: 'unsupported-command-or-option' };
             if (index > 0) {
-                if (!['head', 'sort'].includes(analyzed.command.executable)) {
+                if (!['head', 'sort', 'grep', 'wc'].includes(analyzed.command.executable)) {
                     return { kind: 'unproven', reason: 'unsupported-pipeline-filter' };
                 }
                 if (analyzed.command.pathOperands.length > 0) {

package/dist/core/permission/sandbox-runtime.js

@@ -4,6 +4,27 @@ import { resolveCommandPath } from '../../utils/cross-platform.js';
 import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from '../protected-paths.js';
 import { resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
+export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
+/** Recognize sandbox bootstrap failures independently of localized stderr. */
+export function isSandboxInitializationFailure(error, stderr = []) {
+    const text = [error instanceof Error ? error.message : String(error ?? ''), ...stderr]
+        .join('\n')
+        .toLowerCase();
+    return text.includes(SANDBOX_INITIALIZATION_FAILED)
+        || /(?:apply-seccomp|seccomp)[\s\S]*(?:uid_map|gid_map|operation not permitted)/.test(text)
+        || /(?:uid_map|gid_map)[\s\S]*(?:operation not permitted|permission denied)/.test(text)
+        || /user namespace[\s\S]*(?:not permitted|unavailable|failed)/.test(text)
+        || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text);
+}
+export function createSandboxInitializationError(error, stderr = []) {
+    const detail = error instanceof Error ? error.message : String(error ?? 'sandbox bootstrap failed');
+    const wrapped = new Error(`${SANDBOX_INITIALIZATION_FAILED}: ${detail}`);
+    wrapped.name = 'SandboxInitializationError';
+    wrapped.code = SANDBOX_INITIALIZATION_FAILED;
+    if (stderr.length > 0)
+        wrapped.stderr = [...stderr].slice(-20);
+    return wrapped;
+}
 /**
  * Claude Agent SDK's native sandbox is unavailable on Windows. WSL2 reports
  * itself as Linux, so it remains fail-closed there together with macOS/Linux.