evolcore 0.0.13 → 0.0.14

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.14 (2026-08-24)
+
+### Codex 受管运行与安全
+
+- 强化 Codex proactive 模式的受管 PreToolUse 校验，Linux 使用隔离运行时，Windows 支持受管 Hook 安装、加载检查和 fail-closed 启动。
+- 隔离会话临时目录并统一运行时锁管理，收紧 Shell、文件访问和受控 EC 命令解析，扩展群文件 ACL 操作及权限校验。
+- 完善工具审批、委派票据和工具结果关联审计，避免未成功发送或未完成授权的操作推进主动模式状态。
+- 为 Claude、Codex、ecagent 的工具预检拒绝补充统一结构化授权审计，记录策略码、请求/任务及会话上下文，便于跨 Runner 追踪拦截原因。
+- 规范 Codex EC 审批命令与委派校验，拒绝无法规范化的命令、复合命令和空字节输入；允许触发器正文安全使用受管临时目录标记。
+
+### AUN 消息与授权
+
+- 贯通 AUN 消息路由、会话上下文和授权审计关联信息，补齐请求、工具调用和结果之间的 correlation ID。
+- 统一结构化日志字段，改进异常、策略拦截和拒绝结果的可追踪性。
+
 ## 0.0.13 (2026-08-20)
 
 ### AUN 消息与文件

package/bin/codex-managed-hook.mjs

@@ -45,7 +45,10 @@ function queryDaemon(socketPath, payload) {
 }
 
 async function main() {
-  const socketPath = process.argv[2];
+  // Windows managed requirements use one machine-wide command. Resolve the
+  // per-daemon named pipe from the inherited environment so multiple EvolCore
+  // homes can share the installed hook without rewriting requirements.toml.
+  const socketPath = process.argv[2] || process.env.EVOLCORE_INSTANCE_SOCKET;
   let input;
   try {
     input = JSON.parse(fs.readFileSync(0, 'utf8'));

package/bin/install-codex-managed-hooks.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+const markerStart = '# BEGIN EVOLCORE MANAGED CODEX HOOK';
+const markerEnd = '# END EVOLCORE MANAGED CODEX HOOK';
+
+function argument(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function fail(message) {
+  process.stderr.write(`[evolcore] ${message}\n`);
+  process.exit(1);
+}
+
+function tomlString(value) {
+  return JSON.stringify(value);
+}
+
+function windowsCommandArg(value) {
+  // Keep filesystem separators intact; tomlString() performs the required
+  // TOML escaping after this Windows command-line quoting step.
+  return `"${value.replaceAll('"', '\\"')}"`;
+}
+
+function removeManagedBlock(source) {
+  const expression = new RegExp(`\\n?${markerStart}[\\s\\S]*?${markerEnd}\\n?`, 'g');
+  return source.replace(expression, '\n').replace(/\n{3,}/g, '\n\n');
+}
+
+function tableBounds(lines, table) {
+  const header = table ? `[${table}]` : null;
+  const start = header
+    ? lines.findIndex(line => line.trim() === header)
+    : -1;
+  if (table && start < 0) return null;
+  const from = table ? start + 1 : 0;
+  let to = lines.length;
+  for (let index = from; index < lines.length; index += 1) {
+    if (/^\s*\[\[?[^\]]+\]\]?\s*(?:#.*)?$/.test(lines[index])) {
+      to = index;
+      break;
+    }
+  }
+  return { start, from, to };
+}
+
+function setTomlKey(source, table, key, value) {
+  const lines = source.split('\n');
+  let bounds = tableBounds(lines, table);
+  if (!bounds) {
+    if (table) {
+      if (lines.length && lines.at(-1) !== '') lines.push('');
+      lines.push(`[${table}]`, `${key} = ${value}`);
+    } else {
+      let insertAt = lines.findIndex(line => /^\s*\[/.test(line));
+      if (insertAt < 0) insertAt = lines.length;
+      lines.splice(insertAt, 0, `${key} = ${value}`);
+    }
+    return lines.join('\n');
+  }
+  const keyExpression = new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}\\s*=`);
+  const existing = lines.slice(bounds.from, bounds.to).findIndex(line => keyExpression.test(line));
+  if (existing >= 0) {
+    lines[bounds.from + existing] = `${key} = ${value}`;
+  } else {
+    lines.splice(bounds.from, 0, `${key} = ${value}`);
+  }
+  return lines.join('\n');
+}
+
+function atomicReplace(file, temporary) {
+  try {
+    fs.renameSync(temporary, file);
+    return;
+  } catch (error) {
+    if (error?.code !== 'EEXIST' && error?.code !== 'EPERM') throw error;
+  }
+  const backup = `${file}.evolcore-backup-${process.pid}-${Date.now()}`;
+  fs.renameSync(file, backup);
+  try {
+    fs.renameSync(temporary, file);
+  } catch (error) {
+    try { fs.renameSync(backup, file); } catch {}
+    throw error;
+  }
+  try { fs.rmSync(backup, { force: true }); } catch {}
+}
+
+function atomicWrite(file, content) {
+  const temporary = `${file}.evolcore-${process.pid}-${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(temporary, content, { encoding: 'utf8', mode: 0o440, flag: 'wx' });
+    atomicReplace(file, temporary);
+  } finally {
+    try { fs.rmSync(temporary, { force: true }); } catch {}
+  }
+}
+
+function restrictWindowsAcl(target) {
+  if (process.platform !== 'win32') return;
+  // Keep the hook and requirements administrator-owned while allowing the
+  // daemon's normal user token to read and execute them.
+  execFileSync('icacls.exe', [
+    target,
+    '/inheritance:r',
+    '/grant:r',
+    '*S-1-5-18:(OI)(CI)F',
+    '*S-1-5-32-544:(OI)(CI)F',
+    '*S-1-5-32-545:(OI)(CI)RX',
+  ], { stdio: 'ignore' });
+}
+
+function managedHookLauncher(packageRoot) {
+  // Keep the machine-wide entrypoint stable across npm upgrades. The app
+  // npm upgrades replace the package contents at this stable global path, so
+  // this file never needs to be rewritten just because the hook changed.
+  const trustedPackageRoot = path.resolve(packageRoot);
+  return `#!/usr/bin/env node
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+// EVOLCORE_MANAGED_HOOK_LAUNCHER
+const packageRoot = ${JSON.stringify(trustedPackageRoot)};
+
+try {
+  await import(pathToFileURL(path.join(packageRoot, 'bin', 'codex-managed-hook.mjs')).href);
+} catch (error) {
+  process.stderr.write('[evolcore] failed to load the current managed hook: '
+    + (error instanceof Error ? error.message : String(error)) + '\\n');
+  process.exit(2);
+}
+`;
+}
+
+function main() {
+  if (process.platform !== 'win32' && !argument('--requirements')) {
+    fail('Codex managed hook provisioning is only supported on Windows.');
+  }
+  const packageRoot = argument('--package-root');
+  const nodePath = argument('--node-path') || process.execPath;
+  const requirements = argument('--requirements')
+    || path.join(process.env.ProgramData || path.join(os.homedir(), 'ProgramData'), 'OpenAI', 'Codex', 'requirements.toml');
+  if (!packageRoot) fail('--package-root is required.');
+  const existingRequirements = fs.existsSync(requirements) ? fs.readFileSync(requirements, 'utf8') : '';
+  const targetDirectory = argument('--managed-dir')
+    || path.join(path.dirname(requirements), 'EvolCore', 'hooks');
+  const sourceHook = path.join(packageRoot, 'bin', 'codex-managed-hook.mjs');
+  if (!fs.statSync(sourceHook).isFile()) fail(`Managed hook source was not found: ${sourceHook}`);
+
+  fs.mkdirSync(targetDirectory, { recursive: true, mode: 0o700 });
+  const hookPath = path.join(targetDirectory, 'pre-tool-use.mjs');
+  const temporaryHook = `${hookPath}.evolcore-${process.pid}-${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(temporaryHook, managedHookLauncher(packageRoot), { encoding: 'utf8', mode: 0o500, flag: 'wx' });
+    fs.chmodSync(temporaryHook, 0o500);
+    atomicReplace(hookPath, temporaryHook);
+  } finally {
+    try { fs.rmSync(temporaryHook, { force: true }); } catch {}
+  }
+
+  let content = existingRequirements;
+  content = removeManagedBlock(content);
+  content = setTomlKey(content, null, 'allow_managed_hooks_only', 'true');
+  content = setTomlKey(content, 'features', 'hooks', 'true');
+  content = setTomlKey(content, 'hooks', 'windows_managed_dir', tomlString(path.resolve(targetDirectory)));
+  if (!content.endsWith('\n')) content += '\n';
+  const command = `${windowsCommandArg(nodePath)} ${windowsCommandArg(hookPath)}`;
+  content += [
+    markerStart,
+    '[[hooks.PreToolUse]]',
+    'matcher = "*"',
+    '',
+    '[[hooks.PreToolUse.hooks]]',
+    'type = "command"',
+    `command = ${tomlString(command)}`,
+    `command_windows = ${tomlString(command)}`,
+    'timeout = 3',
+    'statusMessage = "Checking EvolCore session policy"',
+    markerEnd,
+    '',
+  ].join('\n');
+  fs.mkdirSync(path.dirname(requirements), { recursive: true });
+  atomicWrite(requirements, content);
+  try { fs.chmodSync(requirements, 0o440); } catch {}
+  restrictWindowsAcl(targetDirectory);
+  restrictWindowsAcl(hookPath);
+  restrictWindowsAcl(requirements);
+  process.stdout.write(`${JSON.stringify({ requirements, managedDir: path.resolve(targetDirectory), hookPath })}\n`);
+}
+
+try {
+  main();
+} catch (error) {
+  fail(error instanceof Error ? error.message : String(error));
+}

package/dist/agents/claude-runner.js

@@ -21,9 +21,10 @@ import { resolveEffective } from '../config/config-manager.js';
 import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
 import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
-import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, resolveProtectedCandidate, } from '../core/protected-paths.js';
+import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, isSameOrDescendant, resolveProtectedCandidate, } from '../core/protected-paths.js';
 import { buildHClassGuardCommand, createSandboxInitializationError, isSandboxInitializationFailure, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
+import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
 // Built-in tools execute inside the Claude runtime and are covered by the
@@ -216,6 +217,32 @@ function buildClaudeManagedLockdownSettings(capabilityOptions) {
     };
 }
 const CLAUDE_SANDBOX_GLOB_MAGIC = /[*?[\]]/;
+function trustedRuntimeWritePaths(runtimeEnv) {
+    const tmp = process.env.TMPDIR?.trim();
+    if (!tmp || !path.isAbsolute(tmp))
+        return [];
+    const root = resolveProtectedCandidate(tmp);
+    const candidates = [runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR, runtimeEnv?.EVOLCORE_RUNTIME_LOCK_DIR]
+        .filter((value) => typeof value === 'string' && path.isAbsolute(value));
+    const paths = [];
+    for (const candidate of candidates) {
+        const resolved = resolveProtectedCandidate(candidate);
+        if (!isSameOrDescendant(resolved, root))
+            continue;
+        try {
+            const stat = fs.lstatSync(resolved);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                continue;
+            if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        paths.push(resolved, path.join(resolved, '**'));
+    }
+    return [...new Set(paths)];
+}
 async function assertClaudeSettingSourcesHaveLiteralSandboxPaths(cwd, settingSources, managedSettings) {
     if (process.platform !== 'linux' || settingSources.length === 0)
         return;
@@ -1879,8 +1906,25 @@ export class AgentRunner {
             const code = policyCode ?? (preflight?.behavior === 'deny' ? preflight.policyCode : undefined);
             if (!code)
                 return;
+            const ctx = this.permissionContexts.get(sessionId);
+            const summary = summarizeToolInputForAudit(toolName, toolInput).slice(0, 512);
+            auditToolPreflightDenial({
+                toolName,
+                policyCode: code,
+                reason: preflight?.behavior === 'deny' ? (preflight.message ?? 'policy denied') : 'policy denied',
+                summary,
+                sessionId,
+                agentAid: ctx?.selfAid,
+                permissionMode: callPermissionMode,
+                channel: ctx?.channel,
+                actorId: ctx?.userId,
+                role: ctx?.role,
+                selfAid: ctx?.selfAid,
+                requestId: typeof requestId === 'string' ? requestId : undefined,
+                taskId: ctx?.taskId,
+            });
             try {
-                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                await ctx?.recordExecutionAnomaly?.({
                     code: 'operation_blocked',
                     severity: 'warning',
                     phase: 'execution',
@@ -1889,9 +1933,9 @@ export class AgentRunner {
                     ...(typeof requestId === 'string' && requestId ? { requestId } : {}),
                     policyCode: code,
                     decisionSource: 'policy',
-                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
+                    agentAid: ctx?.selfAid,
                     permissionMode: callPermissionMode,
-                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    summary,
                     effect: 'operation_skipped',
                 });
             }
@@ -2243,6 +2287,7 @@ export class AgentRunner {
                 const sandboxUnixSockets = buildClaudeUnixSocketAllowlist(projectPath, {
                     role: runPermissionContext?.role,
                 });
+                const runtimeWritePaths = trustedRuntimeWritePaths(runtimeEnv);
                 await assertClaudeSettingSourcesHaveLiteralSandboxPaths(projectPath, [...settingSources], managedSettings);
                 const sandboxProjectionDurationMs = Date.now() - sandboxProjectionStartedAt;
                 if (sandboxProjectionDurationMs > 2_000) {
@@ -2259,7 +2304,10 @@ export class AgentRunner {
                         allowAllUnixSockets: false,
                         allowLocalBinding: false,
                     },
-                    filesystem: sandboxFilesystem,
+                    filesystem: {
+                        ...sandboxFilesystem,
+                        ...(runtimeWritePaths.length > 0 ? { allowWrite: runtimeWritePaths } : {}),
+                    },
                 };
             })();
         if (executionSandbox.state === 'off') {

package/dist/agents/codex-app-server-client.js

@@ -6,8 +6,8 @@ import { resolveCodexLaunchCommand } from '../utils/codex-cli.js';
 import { createHash } from 'crypto';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
 import fs from 'fs';
-import os from 'os';
 import path from 'path';
+import { ensureProcessManagedTempDir } from '../cli/task-context.js';
 import { getPackageRoot, resolvePaths } from '../paths.js';
 import { registerCodexAppServerProcess, unregisterCodexAppServerProcess, } from '../utils/codex-app-server-registry.js';
 const BUILT_IN_CODEX_PROVIDER_IDS = new Set(['openai']);
@@ -298,6 +298,9 @@ export class CodexAppServerClient {
             includeLayers: false,
         });
     }
+    async configRequirementsRead() {
+        return this.request('configRequirements/read');
+    }
     async pluginInstalled(cwd) {
         return this.request('plugin/installed', {
             ...(cwd ? { cwds: [cwd] } : {}),
@@ -379,7 +382,25 @@ export class CodexAppServerClient {
             this.initializing = null;
         }
     }
+    async assertManagedHooksAvailable() {
+        await this.ensureStarted();
+        if (process.platform !== 'win32')
+            return;
+        try {
+            await this.verifyWindowsManagedHooks();
+        }
+        catch (error) {
+            // Do not leave an unverified app-server alive after a fail-closed check.
+            await this.close();
+            throw error;
+        }
+    }
     startProcess() {
+        // Linux managed hooks need a private runtime even when the daemon was
+        // launched by a service manager that did not export TMPDIR.
+        if (process.platform === 'linux' && !process.env.TMPDIR?.trim()) {
+            ensureProcessManagedTempDir();
+        }
         const env = this.buildProcessEnvironment();
         const args = this.buildProcessArgs();
         const launchCommand = resolveCodexLaunchCommand(args);
@@ -448,7 +469,8 @@ export class CodexAppServerClient {
         if (this.managedHookRuntimeDir) {
             return path.join(this.managedHookRuntimeDir, 'requirements.toml');
         }
-        const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'evolcore-codex-hooks-'));
+        const tmpDir = ensureProcessManagedTempDir();
+        const directory = fs.mkdtempSync(path.join(tmpDir, 'evolcore-codex-hooks-'));
         try {
             fs.chmodSync(directory, 0o700);
             const hookPath = path.join(directory, 'pre-tool-use.mjs');
@@ -505,7 +527,39 @@ export class CodexAppServerClient {
             ...process.env,
             ...this.options.env,
         });
+        // The app-server is shared by multiple EvolCore sessions. Its process
+        // environment must therefore use the daemon's trusted private root;
+        // per-thread session roots are injected later through thread config.
+        const managedTmpDir = ensureProcessManagedTempDir();
+        env.TMPDIR = managedTmpDir;
+        delete env.EVOLCORE_RUNTIME_LOCK_DIR;
+        if (managedTmpDir) {
+            const runtimeLockDir = path.join(managedTmpDir, 'evolcore-locks');
+            try {
+                // The parent is the already-validated process root, so only create
+                // and validate the final component. Never follow a pre-existing
+                // symlink supplied through the inherited environment.
+                try {
+                    fs.mkdirSync(runtimeLockDir, { mode: 0o700 });
+                }
+                catch (error) {
+                    if (error?.code !== 'EEXIST')
+                        throw error;
+                }
+                const stat = fs.lstatSync(runtimeLockDir);
+                if (!stat.isDirectory() || stat.isSymbolicLink()
+                    || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                    || (stat.mode & 0o077) !== 0) {
+                    throw new Error('runtime lock directory is not private');
+                }
+                env.EVOLCORE_RUNTIME_LOCK_DIR = runtimeLockDir;
+            }
+            catch {
+                logger.warn(`[CodexAppServer] managed runtime lock directory unavailable: ${runtimeLockDir}`);
+            }
+        }
         env.CODEX_API_KEY = this.options.apiKey;
+        env.EVOLCORE_INSTANCE_SOCKET = resolvePaths().instanceSocket;
         for (const [name, value] of Object.entries(this.options.headers ?? {})) {
             env[codexHeaderEnvName(name)] = value;
         }
@@ -514,6 +568,73 @@ export class CodexAppServerClient {
         }
         return env;
     }
+    async verifyWindowsManagedHooks() {
+        const response = await this.configRequirementsRead();
+        const requirements = response.requirements;
+        const hooks = requirements?.hooks;
+        const featureRequirements = requirements?.featureRequirements ?? requirements?.feature_requirements;
+        const managedDir = hooks?.windowsManagedDir ?? hooks?.windows_managed_dir;
+        const preToolUse = hooks?.PreToolUse;
+        const expectedHookPath = typeof managedDir === 'string'
+            ? path.join(managedDir, 'pre-tool-use.mjs')
+            : undefined;
+        const currentHookLauncher = !!expectedHookPath && (() => {
+            try {
+                const source = fs.readFileSync(expectedHookPath, 'utf8');
+                const expectedPackageRoot = JSON.stringify(path.resolve(getPackageRoot()));
+                return source.includes('EVOLCORE_MANAGED_HOOK_LAUNCHER')
+                    && (source.includes(expectedPackageRoot)
+                        || (process.platform === 'win32' && source.toLowerCase().includes(expectedPackageRoot.toLowerCase())));
+            }
+            catch {
+                return false;
+            }
+        })();
+        const normalizeManagedPath = (value) => path.normalize(value).toLowerCase();
+        const commandTargetsHook = (value) => {
+            const command = normalizeManagedPath(value).trim();
+            const hook = normalizeManagedPath(expectedHookPath ?? '');
+            // The managed command is intentionally a single executable invocation.
+            // Reject shell operators and trailing arguments so a modified
+            // requirements file cannot retain the expected path while running a
+            // second command or changing the hook's behavior.
+            if (!command || !hook || /[\r\n;&|<>]/.test(command))
+                return false;
+            return command.replace(/["']+$/, '').endsWith(hook);
+        };
+        const managedHookLoaded = Array.isArray(preToolUse)
+            && preToolUse.some(group => {
+                if (!group || typeof group !== 'object' || Array.isArray(group))
+                    return false;
+                if (group.matcher !== '*')
+                    return false;
+                const handlers = group.hooks;
+                return Array.isArray(handlers) && handlers.some(handler => {
+                    if (!handler || typeof handler !== 'object' || Array.isArray(handler))
+                        return false;
+                    const entry = handler;
+                    const command = entry.commandWindows ?? entry.command_windows;
+                    return entry.type === 'command'
+                        && entry.async !== true
+                        && typeof entry.command === 'string'
+                        && entry.command.length > 0
+                        && typeof command === 'string'
+                        && command.length > 0
+                        && !!expectedHookPath
+                        && fs.existsSync(expectedHookPath)
+                        && fs.statSync(expectedHookPath).isFile()
+                        && currentHookLauncher
+                        && commandTargetsHook(command);
+                });
+            });
+        const lockdownEnabled = (requirements?.allowManagedHooksOnly ?? requirements?.allow_managed_hooks_only) === true;
+        const hooksEnabled = featureRequirements?.hooks === true;
+        if (typeof managedDir !== 'string' || !path.isAbsolute(managedDir)
+            || !fs.existsSync(managedDir) || !managedHookLoaded || !lockdownEnabled || !hooksEnabled) {
+            throw new Error('Codex Windows proactive requires an installed and loaded EvolCore managed PreToolUse hook. '
+                + 'Run the elevated Windows installer again to provision %ProgramData%\\OpenAI\\Codex\\requirements.toml.');
+        }
+    }
     buildProcessArgs() {
         const args = ['app-server', '--listen', 'stdio://'];
         if (this.options.enableRequestUserInput !== false) {