evolcore 0.0.13 → 0.0.14

package/dist/agents/codex-runner.js

@@ -13,15 +13,17 @@ import { CodexAppServerClient } from './codex-app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
+import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { isRetryableError } from '../utils/error-utils.js';
 import { renderActionAsText } from '../core/interaction-router.js';
 import { buildEnvelope, sendInteractionPayload } from '../core/message/message-utils.js';
 import { resolveCodexCapabilityThreadConfigForProject } from '../core/capability/capability-manager.js';
 import { AGENT_DELEGATION_TOKEN_ENV, hashDelegatedCommandArgv } from '../core/auth/agent-delegation.js';
 import { sanitizeShellExecutionEnvironment } from '../core/permission/shell-environment.js';
-import { classifyEvolcoreShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv } from '../core/permission/ec-command-parser.js';
+import { classifyEvolcoreShellCommand, containsLiteralManagedTmpDirOutsideSendContent, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from '../core/permission/ec-command-parser.js';
 import { compareVersions } from '../utils/npm-ops.js';
 import { resolvePaths, resolveRoot } from '../paths.js';
+import { ensureProcessManagedTempDir } from '../cli/task-context.js';
 import { buildSessionTurnList } from '../core/session/session-turns.js';
 import { execFileSync } from 'child_process';
 import { execCodexCliSync, resolveCodexCliPath } from '../utils/codex-cli.js';
@@ -151,7 +153,7 @@ const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
 let codexCatalogCache = null;
 // The permission bridge is version-locked to the audited approval schema and
 // managed PreToolUse hook behavior used by proactive first-tool enforcement.
-export const MIN_CODEX_CLI_VERSION = '0.145.0';
+export const MIN_CODEX_CLI_VERSION = '0.144.1';
 export function parseCodexCliVersion(output) {
     const match = output.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/);
     return match?.[1] ?? null;
@@ -326,7 +328,7 @@ export class CodexRunner {
             allowManagedTmpDir: true,
             ...(managedTempDir ? { managedTempDir } : {}),
         });
-        if (argv?.some(value => value.includes('$TMPDIR')))
+        if (argv && containsLiteralManagedTmpDirOutsideSendContent(argv))
             return undefined;
         return argv?.[0] === 'ec' ? argv : undefined;
     }
@@ -335,8 +337,12 @@ export class CodexRunner {
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
             : undefined;
-        if (explicitArgv?.[0] === 'ec')
-            return explicitArgv;
+        if (explicitArgv?.[0] === 'ec') {
+            return explicitArgv.some(value => value.includes('\0'))
+                || containsLiteralManagedTmpDirOutsideSendContent(explicitArgv)
+                ? undefined
+                : explicitArgv;
+        }
         const explicitWrappedCommand = explicitArgv
             ? unwrapCodexShellCommandArgv(explicitArgv)
             : undefined;
@@ -358,17 +364,34 @@ export class CodexRunner {
             ? undefined
             : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand, managedTempDir);
     }
-    armApprovedDelegationCommand(sessionId, toolInput) {
+    isManagedEvolcoreCommandIntent(toolInput) {
+        if (Array.isArray(toolInput.commandArgv)) {
+            const rawArgv = toolInput.commandArgv;
+            if (rawArgv[0] === 'ec')
+                return true;
+            if (!rawArgv.every(value => typeof value === 'string'))
+                return false;
+            const wrappedCommand = unwrapCodexShellCommandArgv(rawArgv);
+            return wrappedCommand !== undefined
+                && classifyEvolcoreShellCommand(wrappedCommand).kind !== 'none';
+        }
+        const command = typeof toolInput.command === 'string' ? toolInput.command : '';
+        return classifyEvolcoreShellCommand(command).kind !== 'none';
+    }
+    armApprovedDelegationCommand(sessionId, argv) {
         const threadId = this.activeSessions.get(sessionId);
         const carrierToken = threadId ? this.threadDelegationCarriers.get(threadId) : undefined;
-        const argv = this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionId));
-        if (!carrierToken || !argv)
-            return false;
         const commandHash = hashDelegatedCommandArgv(argv);
         const arm = this.permissionContexts.get(sessionId)?.armApprovedDelegationCommand;
-        if (!commandHash || !arm)
+        if (!carrierToken || !commandHash || !arm)
+            return false;
+        try {
+            return arm(carrierToken, commandHash);
+        }
+        catch (error) {
+            logger.warn(`[CodexRunner] delegation arm callback failed: session=${sessionId} error=${error instanceof Error ? error.message : String(error)}`);
             return false;
-        return arm(carrierToken, commandHash);
+        }
     }
     async readThreadDelegationCarrier(appServer, threadId) {
         try {
@@ -792,6 +815,8 @@ export class CodexRunner {
                         ...(mode !== 'readonly' && managedTempDir ? {
                             [managedTempDir]: 'write',
                             [path.join(managedTempDir, '**')]: 'write',
+                            [path.join(path.dirname(managedTempDir), 'evolcore-locks')]: 'write',
+                            [path.join(path.dirname(managedTempDir), 'evolcore-locks', '**')]: 'write',
                         } : {}),
                     },
                     network,
@@ -831,6 +856,17 @@ export class CodexRunner {
     }
     setSendPrompt(fn) { this.sendPromptFn = fn; }
     setPermissionContext(sessionId, context) { this.permissionContexts.set(sessionId, context); }
+    async assertProactiveHookAvailability(sessionId, appServer) {
+        if (this.permissionContexts.get(sessionId)?.chatmode !== 'proactive')
+            return;
+        if (process.platform === 'win32') {
+            await appServer.assertManagedHooksAvailable();
+            return;
+        }
+        if (process.platform !== 'linux') {
+            throw new Error('Codex proactive managed PreToolUse enforcement requires Linux or an installed Windows managed hook');
+        }
+    }
     async evaluatePreToolUse(threadId, toolName, toolInput) {
         const sessionKey = this.findSessionKeyByThread(threadId);
         const activeThread = this.activeSessions.get(sessionKey);
@@ -995,9 +1031,6 @@ export class CodexRunner {
     }
     async runQueryLocked(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
         let agentSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
-        if (this.permissionContexts.get(sessionId)?.chatmode === 'proactive' && process.platform !== 'linux') {
-            throw new Error('Codex proactive managed PreToolUse enforcement currently requires Linux');
-        }
         const resumingThread = !!agentSessionId;
         const callModel = modelOverride?.model || this.model;
         const callEffort = modelOverride?.effortMode === 'model_default'
@@ -1017,6 +1050,7 @@ export class CodexRunner {
         const effectiveApprovalPolicy = callApprovalPolicy;
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
         const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, callMode);
+        await this.assertProactiveHookAvailability(sessionId, appServer);
         const managedTempInstruction = this.managedTempInstruction(sessionId);
         const developerInstructions = [systemPromptAppend, managedTempInstruction].filter(Boolean).join('\n\n') || undefined;
         let knownDelegationCarrier = agentSessionId
@@ -1086,7 +1120,7 @@ export class CodexRunner {
         const controller = new AbortController();
         this.activeAbortControllers.set(sessionId, controller);
         const tempFiles = [];
-        const input = this.buildAppServerInput(prompt, images, tempFiles);
+        const input = this.buildAppServerInput(prompt, images, tempFiles, sessionId, runtimeEnv);
         const queue = new AsyncEventQueue();
         controller.signal.addEventListener('abort', () => queue.end(), { once: true });
         const state = {
@@ -1301,6 +1335,7 @@ export class CodexRunner {
                 const executionSandbox = this.buildExecutionSandboxOptions(_sessionId, compactMode, _projectPath);
                 const capabilityConfig = await this.resolveCapabilityThreadConfig(_projectPath);
                 const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, _projectPath, capabilityConfig, compactMode);
+                await this.assertProactiveHookAvailability(_sessionId, appServer);
                 const compactDelegationCarrier = this.threadDelegationCarriers.get(agentSessionId)
                     ?? this.createDelegationCarrier();
                 await appServer.threadResume(agentSessionId, _projectPath, {
@@ -1464,6 +1499,8 @@ export class CodexRunner {
         const capabilityConfig = await this.resolveCapabilityThreadConfig(projectPath);
         const appServer = this.getAppServerClient();
         const externalToolConfig = await this.resolveExternalToolApprovalConfig(appServer, projectPath, capabilityConfig, mode);
+        if (sessionKey)
+            await this.assertProactiveHookAvailability(sessionKey, appServer);
         const delegationCarrier = this.createDelegationCarrier();
         const response = await appServer.threadFork(agentSessionId, projectPath, title, {
             model: this.model,
@@ -1656,31 +1693,77 @@ export class CodexRunner {
             catch (error) {
                 logger.warn(`[CodexRunner] failed to record policy-hook denial: session=${sessionKey} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
             }
-            return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'policy', policyResult.policyCode ?? 'session_policy_hook');
+            return response;
         }
         const summary = this.summarizeAppServerRequest(request.method, params);
         const reason = params.reason || params.decisionReason || undefined;
         const workspacePath = this.resolvePermissionWorkspacePath(params);
         if (!workspacePath) {
             logger.warn(`[CodexRunner] approval denied because thread workspace is unknown: method=${request.method} thread=${params.threadId ?? params.conversationId ?? '<missing>'}`);
-            return this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', 'approval_workspace_unknown');
+            return response;
         }
         const operationCwd = this.resolvePermissionOperationCwd(params, workspacePath, toolName);
         const sessionMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         logger.info(`[CodexRunner] app-server approval request id=${request.id} method=${request.method} session=${sessionKey} mode=${sessionMode} tool=${toolName} summary=${summary}`);
+        const isCommandApproval = request.method === 'item/commandExecution/requestApproval'
+            || request.method === 'execCommandApproval';
+        const managedEcIntent = isCommandApproval && this.isManagedEvolcoreCommandIntent(toolInput);
+        const approvedCommand = isCommandApproval
+            ? this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionKey))
+            : undefined;
+        const denyInfrastructure = async (policyCode, message) => {
+            logger.warn(`[CodexRunner] ${message}: session=${sessionKey} requestId=${request.id ?? '<missing>'}`);
+            try {
+                await permissionContext?.recordExecutionAnomaly?.({
+                    code: 'operation_blocked',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName,
+                    ...(request.id !== undefined ? { requestId: String(request.id) } : {}),
+                    policyCode,
+                    decisionSource: 'infrastructure',
+                    agentAid: permissionContext?.selfAid,
+                    sessionId: sessionKey,
+                    permissionMode: normalizePermissionMode(sessionMode).mode,
+                    summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+            }
+            catch (error) {
+                logger.warn(`[CodexRunner] failed to record infrastructure approval denial: session=${sessionKey} code=${policyCode} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+            const response = this.toAppServerApprovalResponse(request.method, 'deny', toolInput, unattended);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, 'deny', 'infrastructure', policyCode);
+            return response;
+        };
+        if (managedEcIntent && !approvedCommand) {
+            return await denyInfrastructure('ec_command_not_canonical', 'EC command approval denied because no canonical argv could be derived');
+        }
         try {
             const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
-            if (decision !== 'deny'
-                && (request.method === 'item/commandExecution/requestApproval' || request.method === 'execCommandApproval')
-                && this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionKey))) {
-                if (!this.armApprovedDelegationCommand(sessionKey, toolInput)) {
-                    // Approval policy and delegation authority are separate boundaries.
-                    // If no ticket can be armed, the CLI still fails closed at IPC token
-                    // validation instead of changing an otherwise valid tool decision.
-                    logger.warn(`[CodexRunner] EC command approved without a task-bound delegation ticket: session=${sessionKey}`);
+            if (decision !== 'deny' && managedEcIntent && approvedCommand) {
+                const carrierThreadIds = [
+                    this.activeSessions.get(sessionKey),
+                    typeof params.threadId === 'string' ? params.threadId : undefined,
+                    typeof params.conversationId === 'string' ? params.conversationId : undefined,
+                ];
+                const hasDelegationCarrier = carrierThreadIds.some(threadId => !!threadId && this.threadDelegationCarriers.has(threadId));
+                const canArmDelegation = typeof permissionContext?.armApprovedDelegationCommand === 'function';
+                // A carrier-bearing thread is managed even if its permission context
+                // was not wired with an arm callback; it must fail closed here rather
+                // than reaching daemon IPC with an unarmed carrier.
+                if ((hasDelegationCarrier || canArmDelegation)
+                    && !this.armApprovedDelegationCommand(sessionKey, approvedCommand)) {
+                    return await denyInfrastructure('delegation_not_armed', 'EC command approval failed to arm delegation');
                 }
             }
             const response = this.toAppServerApprovalResponse(request.method, decision, toolInput, unattended);
+            this.logAppServerApprovalAudit(request, sessionKey, toolName, decision === 'deny' ? 'deny' : 'allow', decision === 'deny' ? (sessionMode === 'auto' || sessionMode === 'readonly' ? 'policy' : 'approval') : 'approval');
             logger.info(`[CodexRunner] app-server approval response id=${request.id} method=${request.method} decision=${decision} response=${JSON.stringify(response)}`);
             return response;
         }
@@ -1690,6 +1773,18 @@ export class CodexRunner {
             throw error;
         }
     }
+    logAppServerApprovalAudit(request, sessionKey, toolName, decision, decisionSource, policyCode) {
+        logger.info(`[CodexRunner] app-server approval audit ${JSON.stringify({
+            requestId: request.id !== undefined ? String(request.id) : undefined,
+            method: request.method,
+            sessionId: sessionKey,
+            toolName,
+            decision,
+            decisionSource,
+            ...(policyCode ? { policyCode } : {}),
+            executed: false,
+        })}`);
+    }
     classifyMcpApprovalLabel(label) {
         const normalized = label.trim().toLowerCase().replace(/[\s_-]+/g, ' ');
         const negative = /\b(decline|deny|reject|cancel|no|block|stop)\b|do not|don't|not\s+(?:accept|approve|allow)|拒绝|不同意|不允许|取消|否|停止/i.test(normalized);
@@ -2221,6 +2316,22 @@ export class CodexRunner {
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const mode = normalizePermissionMode(rawMode).mode;
         const recordBlockedOperation = async (policyCode, operationInput = toolInput) => {
+            const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
+            auditToolPreflightDenial({
+                toolName,
+                policyCode,
+                reason: 'policy denied',
+                summary,
+                sessionId: sessionKey,
+                agentAid: permissionContext?.selfAid,
+                permissionMode: mode,
+                channel: permissionContext?.channel,
+                actorId: permissionContext?.userId,
+                role: permissionContext?.role,
+                selfAid: permissionContext?.selfAid,
+                requestId: typeof requestId === 'string' || typeof requestId === 'number' ? String(requestId) : undefined,
+                taskId: permissionContext?.taskId,
+            });
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
                     code: 'operation_blocked',
@@ -2233,7 +2344,7 @@ export class CodexRunner {
                     decisionSource: 'policy',
                     agentAid: permissionContext?.selfAid,
                     permissionMode: mode,
-                    summary: summarizeToolInputForAudit(toolName, operationInput).slice(0, 512),
+                    summary,
                     effect: 'operation_skipped',
                 });
             }
@@ -2525,11 +2636,15 @@ export class CodexRunner {
         this.onCompactStart = callback;
     }
     // ── Event stream transformation ──
-    buildAppServerInput(prompt, images, tempFiles) {
+    buildAppServerInput(prompt, images, tempFiles, sessionId, runtimeEnv) {
         const input = [{ type: 'text', text: prompt, text_elements: [] }];
         if (!images?.length)
             return input;
-        const tmpDir = os.tmpdir();
+        const tmpDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR
+            ?? (sessionId ? this.getManagedTempDir(sessionId) : undefined)
+            ?? process.env.TMPDIR;
+        if (!tmpDir || !path.isAbsolute(tmpDir))
+            throw new Error('managed TMPDIR is unset or not absolute');
         for (let i = 0; i < images.length; i++) {
             const img = images[i];
             const ext = MIME_EXT[img.mimeType || ''] || '.jpg';
@@ -3018,7 +3133,8 @@ export class CodexRunner {
     }
     managedTempParent() {
         const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
-        return path.join(resolveProtectedCandidate(os.tmpdir()), `evolcore-codex-${uid}`);
+        const base = ensureProcessManagedTempDir();
+        return path.join(resolveProtectedCandidate(base), `evolcore-codex-${uid}`);
     }
     ensurePrivateDirectory(directory) {
         try {
@@ -3055,6 +3171,7 @@ export class CodexRunner {
         try {
             const parent = this.managedTempParent();
             this.ensurePrivateDirectory(parent);
+            this.ensurePrivateDirectory(path.join(parent, 'evolcore-locks'));
             // Include a per-runner nonce so a daemon restart never reuses contents
             // left behind by an unclean shutdown for the same EvolCore session id.
             const digest = createHash('sha256')
@@ -3078,7 +3195,7 @@ export class CodexRunner {
         return isTrustedManagedTempDirectory(directory, this.managedTempParent());
     }
     getManagedTempDir(sessionId) {
-        const directory = this.sessionTempDirs.get(sessionId);
+        const directory = this.ensureSessionTempDir(sessionId);
         if (!directory || !this.isTrustedSessionTempDir(directory))
             return undefined;
         return resolveProtectedCandidate(directory);
@@ -3117,6 +3234,8 @@ export class CodexRunner {
                 set: {
                     EVOLCORE_SESSION_ID: sessionId,
                     EVOLCORE_HOME: resolveRoot(),
+                    ...(managedTempDir ? { EVOLCORE_SESSION_RUNTIME_DIR: managedTempDir } : {}),
+                    ...(managedTempDir ? { EVOLCORE_RUNTIME_LOCK_DIR: path.join(path.dirname(managedTempDir), 'evolcore-locks') } : {}),
                     ...(delegationCarrier ? { [AGENT_DELEGATION_TOKEN_ENV]: delegationCarrier } : {}),
                     ...(managedTempDir ? { TMPDIR: managedTempDir } : {}),
                 },

package/dist/agents/ecagent-runner.js

@@ -10,6 +10,7 @@ import { normalizePermissionMode } from '../core/permission/mode.js';
 import { checkDangerousCommand, checkReadonly, evaluateToolPreflight } from '../core/permission/tool-policy.js';
 import { logger } from '../utils/logger.js';
 import { summarizeToolInputForAudit } from '../utils/tool-summary.js';
+import { auditToolPreflightDenial } from '../core/auth/authorization-audit.js';
 import { resolveEcagentConfig } from './baseagent.js';
 import { buildModelRequestHeaders } from './request-identity.js';
 const PROVIDER_ID = 'evolcore-gateway';
@@ -959,6 +960,21 @@ export class EcagentRunner {
     async authorizeTool(sessionId, projectPath, mode, toolName, input) {
         const permissionContext = this.permissionContexts.get(sessionId);
         const recordBlockedOperation = async (policyCode, operationInput = input) => {
+            const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
+            auditToolPreflightDenial({
+                toolName,
+                policyCode,
+                reason: 'policy denied',
+                summary,
+                sessionId,
+                agentAid: permissionContext?.selfAid,
+                permissionMode: mode,
+                channel: permissionContext?.channel,
+                actorId: permissionContext?.userId,
+                role: permissionContext?.role,
+                selfAid: permissionContext?.selfAid,
+                taskId: permissionContext?.taskId,
+            });
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
                     code: 'operation_blocked',
@@ -970,7 +986,7 @@ export class EcagentRunner {
                     decisionSource: 'policy',
                     agentAid: permissionContext?.selfAid,
                     permissionMode: mode,
-                    summary: summarizeToolInputForAudit(toolName, operationInput).slice(0, 512),
+                    summary,
                     effect: 'operation_skipped',
                 });
             }

package/dist/agents/gemini-runner.js

@@ -279,11 +279,16 @@ export class GeminiRunner {
         const requestedPermissionMode = modelOverride?.permissionMode || this.currentMode;
         const permissionProfile = resolveGeminiPermissionProfile(requestedPermissionMode);
         const callModel = modelOverride?.model || this.model;
+        const runtimeDir = runtimeEnv?.EVOLCORE_SESSION_RUNTIME_DIR;
+        const managedTmpDir = runtimeDir ?? process.env.TMPDIR;
+        if (!managedTmpDir || !path.isAbsolute(managedTmpDir))
+            throw new Error('managed TMPDIR is unset or not absolute');
+        const runtimeLockDir = runtimeEnv?.EVOLCORE_RUNTIME_LOCK_DIR;
         const geminiHome = path.join(os.homedir(), '.gemini');
         fs.mkdirSync(geminiHome, { recursive: true, mode: 0o700 });
         const sandboxProbe = buildBubblewrapCommand(this.resolved.cliPath, [], {
             projectPath,
-            writablePaths: [geminiHome],
+            writablePaths: [geminiHome, ...(runtimeDir ? [runtimeDir] : []), ...(runtimeLockDir ? [runtimeLockDir] : [])],
         });
         if (!sandboxProbe && workspaceContainsHClassPaths(projectPath)) {
             throw new Error('Gemini 缺少可用的路径级隔离运行时，且项目覆盖 EvolCore 受保护根；已拒绝启动本轮任务');
@@ -303,13 +308,13 @@ export class GeminiRunner {
             if (hasStandardGeminiAdminPolicy()) {
                 throw new Error('Gemini 系统级 admin policy 会忽略 EvolCore 的临时安全策略，已拒绝启动本轮任务');
             }
-            const policyPath = path.join(os.tmpdir(), `evolcore-gemini-permission-${crypto.randomUUID()}.toml`);
+            const policyPath = path.join(managedTmpDir, `evolcore-gemini-permission-${crypto.randomUUID()}.toml`);
             fs.writeFileSync(policyPath, buildGeminiAdminPolicy(permissionProfile), { mode: 0o600, flag: 'wx' });
             tempFiles.push(policyPath);
             args.push(...buildGeminiPermissionArgs(permissionProfile, policyPath, !!sandboxProbe));
         }
         if (images?.length) {
-            const tmpDir = os.tmpdir();
+            const tmpDir = managedTmpDir;
             const fileParts = [];
             for (let i = 0; i < images.length; i++) {
                 const img = images[i];
@@ -337,7 +342,7 @@ export class GeminiRunner {
         const env = this.buildAgentEnv(sessionId, runtimeEnv);
         const sandboxedCommand = buildBubblewrapCommand(this.resolved.cliPath, args, {
             projectPath,
-            writablePaths: [geminiHome],
+            writablePaths: [geminiHome, ...(runtimeDir ? [runtimeDir] : []), ...(runtimeLockDir ? [runtimeLockDir] : [])],
             readonlyPaths: tempFiles,
         });
         const child = spawn(sandboxedCommand?.command ?? this.resolved.cliPath, sandboxedCommand?.args ?? args, {

package/dist/aun/msg/managed-operation.js

@@ -561,7 +561,7 @@ export class ManagedFsOperationError extends Error {
 }
 const FS_VALUE_FLAGS = new Set([
     '--as', '--format', '--max-bytes', '--head-bytes', '--name', '--pattern', '--type', '--node-type',
-    '--size', '--mtime', '--page', '--page-size',
+    '--size', '--mtime', '--page', '--page-size', '-m', '-x',
 ]);
 const FS_BOOLEAN_FLAGS = new Set(['-p', '--parents', '-r', '--recursive', '-f', '--force', '--overwrite']);
 function failFs(code, reason) {
@@ -599,7 +599,7 @@ function parseRemote(value, allowEmpty) {
 export function resolveManagedFsOperation(argv) {
     const raw = argv[0] === 'fs' ? argv.slice(1) : argv;
     const rawKind = raw[0];
-    if (!rawKind || !['ls', 'stat', 'lstat', 'cat', 'find', 'df', 'mkdir', 'cp', 'mv', 'rm'].includes(rawKind)) {
+    if (!rawKind || !['ls', 'stat', 'lstat', 'cat', 'find', 'df', 'getfacl', 'setfacl', 'mkdir', 'cp', 'mv', 'rm'].includes(rawKind)) {
         return failFs('NOT_ALLOWED', `unsupported managed fs command: ${rawKind || '<missing>'}`);
     }
     const values = new Map();
@@ -652,9 +652,10 @@ export function resolveManagedFsOperation(argv) {
         find: new Set(['--as', '--format', '--name', '--pattern', '--type', '--node-type', '--size', '--mtime', '--page', '--page-size']),
         df: new Set(['--as', '--format']), mkdir: new Set(['--as', '--format']), cp: new Set(['--as', '--format']),
         mv: new Set(['--as', '--format']), rm: new Set(['--as', '--format']),
+        getfacl: new Set(['--as', '--format']), setfacl: new Set(['--as', '--format', '-m', '-x']),
     };
     const allowedBoolean = {
-        ls: new Set(), stat: new Set(), lstat: new Set(), cat: new Set(), find: new Set(), df: new Set(),
+        ls: new Set(), stat: new Set(), lstat: new Set(), cat: new Set(), find: new Set(), df: new Set(), getfacl: new Set(), setfacl: new Set(),
         mkdir: new Set(['-p', '--parents']), cp: new Set(['-r', '--recursive', '-f', '--force', '--overwrite']),
         mv: new Set(['-f', '--force', '--overwrite']), rm: new Set(['-r', '--recursive', '-f', '--force', '--overwrite']),
     };
@@ -667,6 +668,35 @@ export function resolveManagedFsOperation(argv) {
     const overwrite = booleanFlags.has('-f') || booleanFlags.has('--force') || booleanFlags.has('--overwrite');
     const recursive = booleanFlags.has('-r') || booleanFlags.has('--recursive');
     const remoteOrError = (value, allowEmpty = false) => parseRemote(value, allowEmpty);
+    if (rawKind === 'getfacl') {
+        if (values.has('-m') || values.has('-x'))
+            return failFs('NOT_ALLOWED', 'getfacl does not accept ACL mutation flags');
+        const remote = remoteOrError(positionals[0]);
+        if (!('groupId' in remote))
+            return remote;
+        return { ok: true, command: {
+                kind: 'getfacl', operationId: 'ec.fs.getfacl', canonicalArgv: ['fs', 'getfacl', positionals[0], ...(actorAid ? ['--as', actorAid] : [])],
+                actorAid, groupId: remote.groupId, remotePath: remote.remotePath,
+            } };
+    }
+    if (rawKind === 'setfacl') {
+        const modify = values.get('-m');
+        const remove = values.get('-x');
+        if (!!modify === !!remove)
+            return failFs('INVALID_ARGUMENT', 'setfacl requires exactly one of -m or -x');
+        const spec = modify ?? remove ?? '';
+        const parsedAcl = parseManagedGroupAclSpec(spec, modify !== undefined);
+        if (!('grantee' in parsedAcl))
+            return parsedAcl;
+        const remote = remoteOrError(positionals[0]);
+        if (!('groupId' in remote))
+            return remote;
+        return { ok: true, command: {
+                kind: 'setfacl', operationId: 'ec.fs.setfacl', canonicalArgv: ['fs', 'setfacl', positionals[0], modify !== undefined ? '-m' : '-x', spec, ...(actorAid ? ['--as', actorAid] : [])],
+                actorAid, groupId: remote.groupId, remotePath: remote.remotePath,
+                aclGrantee: parsedAcl.grantee, ...(parsedAcl.perms ? { aclPerms: parsedAcl.perms } : {}), aclRemove: remove !== undefined,
+            } };
+    }
     if (rawKind === 'cp') {
         const destination = remoteOrError(positionals[1]);
         if (!('groupId' in destination))
@@ -735,6 +765,26 @@ export function resolveManagedFsOperation(argv) {
             name: values.get('--name') ?? values.get('--pattern'), nodeType, size: values.get('--size'), mtime: values.get('--mtime'), page, pageSize,
         } };
 }
+function parseManagedGroupAclSpec(value, requirePerms) {
+    const parts = value.split(':');
+    if (parts[0] !== 'role' || !parts[1] || parts.length !== (requirePerms ? 3 : 2)) {
+        return failFs('INVALID_ARGUMENT', 'group ACL entry must use role:member:<perms>, role:admin:<perms>, or role:<role>');
+    }
+    const grantee = `role:${parts[1]}`;
+    if (grantee !== 'role:member' && grantee !== 'role:admin') {
+        return failFs('INVALID_ARGUMENT', 'group ACL only supports role:member or role:admin');
+    }
+    if (!requirePerms)
+        return { grantee };
+    const perms = parts[2];
+    if (!perms || !/^(?:r|rw|rwx)$/.test(perms)) {
+        return failFs('INVALID_ARGUMENT', 'group ACL permissions must be r, rw, or rwx');
+    }
+    if (grantee === 'role:member' && perms !== 'rw') {
+        return failFs('INVALID_ARGUMENT', 'role:member may only receive rw group ACL permissions');
+    }
+    return { grantee, perms };
+}
 function numberFrom(value, keys) {
     for (const key of keys) {
         const number = Number(value?.[key]);
@@ -823,6 +873,16 @@ export async function executeManagedFsOperation(command) {
                 }
                 case 'df':
                     return { ok: true, command: 'df', path: `${command.groupId}:`, usage: await client.group.fs.df(`${command.groupId}:`) };
+                case 'getfacl':
+                    return { ok: true, command: 'getfacl', path: ref, result: await client.group.fs.getAcl(ref) };
+                case 'setfacl': {
+                    if (!command.aclGrantee)
+                        throw new ManagedFsOperationError('INVALID_ACL', 'group ACL grantee is required');
+                    const result = command.aclRemove
+                        ? await client.group.fs.removeAcl(ref, { granteeAid: command.aclGrantee })
+                        : await client.group.fs.setAcl(ref, { granteeAid: command.aclGrantee, perms: command.aclPerms });
+                    return { ok: true, command: 'setfacl', path: ref, grantee: command.aclGrantee, removed: !!command.aclRemove, result };
+                }
                 case 'cat': {
                     const node = await client.group.fs.stat(ref);
                     const size = numberFrom(node, ['size', 'size_bytes', 'bytes']);