evolcore 0.0.13 → 0.0.14

package/dist/core/permission/ec-command-parser.js

@@ -247,6 +247,498 @@ export function parseCodexToolCommandArgv(input) {
     const command = typeof input.command === 'string' ? input.command : '';
     return parseCodexShellCommandArgv(command, { allowManagedTmpDir: true });
 }
+function isSimpleExecStringLiteral(value) {
+    const quote = value[0];
+    if ((quote !== '"' && quote !== "'") || value.at(-1) !== quote)
+        return false;
+    let escaped = false;
+    for (let index = 1; index < value.length - 1; index++) {
+        const char = value[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === '\r' || char === '\n')
+            return false;
+    }
+    return !escaped;
+}
+function splitTopLevelExecObjectProperties(body) {
+    const properties = [];
+    let start = 0;
+    let curlyDepth = 0;
+    let squareDepth = 0;
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < body.length; index++) {
+        const char = body[index];
+        if (quote) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (char === '\\') {
+                escaped = true;
+            }
+            else if (char === quote) {
+                quote = null;
+            }
+            else if (char === '\r' || char === '\n') {
+                return null;
+            }
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`') {
+            quote = char;
+            continue;
+        }
+        if (char === '{')
+            curlyDepth++;
+        else if (char === '}') {
+            if (curlyDepth === 0)
+                return null;
+            curlyDepth--;
+        }
+        else if (char === '[')
+            squareDepth++;
+        else if (char === ']') {
+            if (squareDepth === 0)
+                return null;
+            squareDepth--;
+        }
+        else if (char === ',' && curlyDepth === 0 && squareDepth === 0) {
+            properties.push(body.slice(start, index));
+            start = index + 1;
+        }
+    }
+    if (quote || curlyDepth !== 0 || squareDepth !== 0 || escaped)
+        return null;
+    properties.push(body.slice(start));
+    return properties;
+}
+function topLevelExecPropertyColon(property) {
+    let curlyDepth = 0;
+    let squareDepth = 0;
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < property.length; index++) {
+        const char = property[index];
+        if (quote) {
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`') {
+            quote = char;
+            continue;
+        }
+        if (char === '{')
+            curlyDepth++;
+        else if (char === '}')
+            curlyDepth--;
+        else if (char === '[')
+            squareDepth++;
+        else if (char === ']')
+            squareDepth--;
+        else if (char === ':' && curlyDepth === 0 && squareDepth === 0)
+            return index;
+    }
+    return -1;
+}
+function parseSimpleExecPropertyKey(raw) {
+    const value = raw.trim();
+    if (/^[A-Za-z_$][\w$]*$/.test(value))
+        return value;
+    if (value.startsWith('"') && value.endsWith('"')) {
+        try {
+            const parsed = JSON.parse(value);
+            return typeof parsed === 'string' ? parsed : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    if (value.startsWith("'") && value.endsWith("'") && /^'[A-Za-z_$][\w$]*'$/.test(value)) {
+        return value.slice(1, -1);
+    }
+    return null;
+}
+function validateSimpleExecCarrierObject(source, objectStart, objectEnd) {
+    const properties = splitTopLevelExecObjectProperties(source.slice(objectStart + 1, objectEnd - 1));
+    if (!properties)
+        return false;
+    const seen = new Set();
+    for (const property of properties) {
+        if (!property.trim())
+            continue;
+        const colon = topLevelExecPropertyColon(property);
+        if (colon < 0)
+            return false;
+        const key = parseSimpleExecPropertyKey(property.slice(0, colon));
+        const value = property.slice(colon + 1).trim();
+        if (!key || seen.has(key) || !value)
+            return false;
+        seen.add(key);
+        // The command and all carrier options must be inert literals. In
+        // particular, reject calls, member expressions, template literals, and
+        // nested objects that could execute while the real tool is invoked.
+        if (key === 'cmd') {
+            if (!isSimpleExecStringLiteral(value))
+                return false;
+        }
+        else if (!isSimpleExecStringLiteral(value)
+            && !/^(?:true|false|null)$/.test(value)
+            && !/^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(value)) {
+            return false;
+        }
+    }
+    return seen.has('cmd');
+}
+/**
+ * Extract the one literal command carried by Codex's custom `exec` tool.
+ *
+ * The desktop Codex tool is a JavaScript carrier around `tools.exec_command`.
+ * Treating the carrier as a send command is safe only when it contains one
+ * direct command call; a script containing a send plus any other command must
+ * remain blocked because its execution order cannot satisfy the gate.
+ */
+export function parseCodexExecToolCommand(input) {
+    const source = typeof input.input === 'string' ? input.input : '';
+    if (!source)
+        return null;
+    // Count only source-level calls. A command body is itself a string literal,
+    // so a message such as `"mention tools.foo("` must not look like a second
+    // tool invocation. Comments are ignored for the same reason.
+    const toolCalls = [];
+    let sourceQuote = null;
+    let sourceEscaped = false;
+    let lineComment = false;
+    let blockComment = false;
+    for (let index = 0; index < source.length;) {
+        const char = source[index];
+        const next = source[index + 1];
+        if (lineComment) {
+            if (char === '\n' || char === '\r')
+                lineComment = false;
+            index++;
+            continue;
+        }
+        if (blockComment) {
+            if (char === '*' && next === '/') {
+                blockComment = false;
+                index += 2;
+            }
+            else {
+                index++;
+            }
+            continue;
+        }
+        if (sourceQuote) {
+            if (sourceEscaped) {
+                sourceEscaped = false;
+            }
+            else if (char === '\\') {
+                sourceEscaped = true;
+            }
+            else if (char === sourceQuote) {
+                sourceQuote = null;
+            }
+            index++;
+            continue;
+        }
+        if (char === '/' && next === '/') {
+            lineComment = true;
+            index += 2;
+            continue;
+        }
+        if (char === '/' && next === '*') {
+            blockComment = true;
+            index += 2;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`') {
+            sourceQuote = char;
+            index++;
+            continue;
+        }
+        if (source.startsWith('tools.', index)
+            && (index === 0 || !/[A-Za-z0-9_$]/.test(source[index - 1]))) {
+            let nameEnd = index + 'tools.'.length;
+            const nameMatch = source.slice(nameEnd).match(/^[A-Za-z_$][\w$]*/);
+            if (nameMatch) {
+                nameEnd += nameMatch[0].length;
+                while (nameEnd < source.length && /\s/u.test(source[nameEnd]))
+                    nameEnd++;
+                if (source[nameEnd] === '(') {
+                    toolCalls.push({ name: nameMatch[0], start: index, openParen: nameEnd });
+                    index = nameEnd + 1;
+                    continue;
+                }
+            }
+        }
+        index++;
+    }
+    const calls = toolCalls.filter(call => call.name === 'exec_command');
+    if (toolCalls.length !== 1 || calls.length !== 1)
+        return null;
+    const callStart = calls[0].start;
+    const callOpenParen = calls[0].openParen;
+    const prefix = source.slice(0, callStart);
+    const binding = prefix.match(/^\s*(?:(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*await\s*|await\s*)$/);
+    if (!binding)
+        return null;
+    const outputBinding = binding[1];
+    let objectStart = callOpenParen + 1;
+    while (objectStart < source.length && /\s/u.test(source[objectStart]))
+        objectStart++;
+    if (source[objectStart] !== '{')
+        return null;
+    // Desktop Codex serializes the carrier object as JSON (`{"cmd":"..."}`),
+    // while hand-written calls may use a JavaScript identifier (`{ cmd: "..." }`).
+    // Walk the carrier object so a nested `{ cmd: ... }` or a string containing
+    // `cmd:` cannot be mistaken for the direct command property.
+    let curlyDepth = 0;
+    let squareDepth = 0;
+    let propertyStart = false;
+    let scanQuote = null;
+    let scanEscaped = false;
+    let valueStart = -1;
+    let objectEnd = -1;
+    for (let index = objectStart; index < source.length; index++) {
+        const char = source[index];
+        if (!scanQuote && curlyDepth === 1 && squareDepth === 0 && propertyStart) {
+            let keyStart = index;
+            while (keyStart < source.length && /\s/u.test(source[keyStart]))
+                keyStart++;
+            let key;
+            let keyEnd = keyStart;
+            const keyQuote = source[keyStart];
+            if (keyQuote === '"' || keyQuote === "'") {
+                keyEnd++;
+                let keyEscaped = false;
+                for (; keyEnd < source.length; keyEnd++) {
+                    const keyChar = source[keyEnd];
+                    if (keyEscaped) {
+                        keyEscaped = false;
+                        continue;
+                    }
+                    if (keyChar === '\\') {
+                        keyEscaped = true;
+                        continue;
+                    }
+                    if (keyChar === keyQuote)
+                        break;
+                }
+                if (keyEnd >= source.length)
+                    return null;
+                key = source.slice(keyStart + 1, keyEnd);
+                keyEnd++;
+            }
+            else {
+                const keyMatch = source.slice(keyStart).match(/^[A-Za-z_$][\w$]*/);
+                if (!keyMatch) {
+                    propertyStart = false;
+                    continue;
+                }
+                key = keyMatch[0];
+                keyEnd += key.length;
+            }
+            while (keyEnd < source.length && /\s/u.test(source[keyEnd]))
+                keyEnd++;
+            if (source[keyEnd] !== ':') {
+                propertyStart = false;
+                continue;
+            }
+            keyEnd++;
+            while (keyEnd < source.length && /\s/u.test(source[keyEnd]))
+                keyEnd++;
+            propertyStart = false;
+            if (key === 'cmd') {
+                const valueQuote = source[keyEnd];
+                if (valueQuote !== '"' && valueQuote !== "'")
+                    return null;
+                if (valueStart >= 0)
+                    return null;
+                valueStart = keyEnd;
+                index = keyEnd - 1;
+                continue;
+            }
+            index = keyEnd - 1;
+            continue;
+        }
+        if (scanQuote) {
+            if (scanEscaped) {
+                scanEscaped = false;
+                continue;
+            }
+            if (char === '\\') {
+                scanEscaped = true;
+                continue;
+            }
+            if (char === scanQuote)
+                scanQuote = null;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`') {
+            scanQuote = char;
+            continue;
+        }
+        if (char === '{') {
+            curlyDepth++;
+            if (curlyDepth === 1)
+                propertyStart = true;
+            continue;
+        }
+        if (char === '}') {
+            if (curlyDepth === 1) {
+                objectEnd = index + 1;
+                break;
+            }
+            curlyDepth--;
+            continue;
+        }
+        if (char === '[') {
+            squareDepth++;
+            continue;
+        }
+        if (char === ']') {
+            squareDepth = Math.max(0, squareDepth - 1);
+            continue;
+        }
+        if (curlyDepth !== 1 || squareDepth !== 0)
+            continue;
+        if (char === ',') {
+            propertyStart = true;
+            continue;
+        }
+    }
+    if (valueStart < 0 || objectEnd < 0)
+        return null;
+    if (!validateSimpleExecCarrierObject(source, objectStart, objectEnd))
+        return null;
+    let callEnd = objectEnd;
+    while (callEnd < source.length && /\s/u.test(source[callEnd]))
+        callEnd++;
+    if (source[callEnd] !== ')')
+        return null;
+    callEnd++;
+    // The carrier is intentionally restricted to one top-level await. This
+    // rejects loops/conditionals that could invoke the same source call more
+    // than once, and prevents additional arguments from hiding another action.
+    const tail = source.slice(callEnd).replace(/\/\/[^\r\n]*|\/\*[\s\S]*?\*\//g, '');
+    const tailPattern = outputBinding
+        ? new RegExp(`^\\s*;?\\s*(?:text\\(\\s*${outputBinding}\\.output\\s*\\)\\s*;?)?\\s*$`)
+        : /^\s*;?\s*$/;
+    if (!tailPattern.test(tail))
+        return null;
+    const valueQuote = source[valueStart];
+    const quoteForValue = valueQuote === '"' || valueQuote === "'" ? valueQuote : null;
+    if (!quoteForValue)
+        return null;
+    const quote = quoteForValue;
+    let end = valueStart + 1;
+    let escaped = false;
+    for (; end < source.length; end++) {
+        const char = source[end];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === quote)
+            break;
+    }
+    if (end >= source.length)
+        return null;
+    const raw = source.slice(valueStart, end + 1);
+    if (quote === '"') {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    // Decode the JS string escapes needed for command literals without
+    // evaluating model-provided source code. Unknown escapes are rejected:
+    // silently dropping the backslash could make the parsed command differ
+    // from the string that JavaScript will actually execute (for example
+    // `\x26` becoming `&`).
+    let decoded = '';
+    for (let index = 1; index < raw.length - 1; index++) {
+        const char = raw[index];
+        if (char !== '\\') {
+            decoded += char;
+            continue;
+        }
+        const next = raw[++index];
+        if (next === undefined)
+            return null;
+        if (next === 'n')
+            decoded += '\n';
+        else if (next === 'r')
+            decoded += '\r';
+        else if (next === 't')
+            decoded += '\t';
+        else if (next === 'b')
+            decoded += '\b';
+        else if (next === 'f')
+            decoded += '\f';
+        else if (next === 'v')
+            decoded += '\v';
+        else if (next === '0') {
+            if (/^[0-9]/.test(raw[index + 1] ?? ''))
+                return null;
+            decoded += '\0';
+        }
+        else if (next === 'x') {
+            const hex = raw.slice(index + 1, index + 3);
+            if (!/^[0-9a-fA-F]{2}$/.test(hex))
+                return null;
+            decoded += String.fromCharCode(parseInt(hex, 16));
+            index += 2;
+        }
+        else if (next === 'u') {
+            const hex = raw.slice(index + 1, index + 5);
+            if (!/^[0-9a-fA-F]{4}$/.test(hex))
+                return null;
+            decoded += String.fromCharCode(parseInt(hex, 16));
+            index += 4;
+        }
+        else if (next === '\n') {
+            // JavaScript line continuations contribute no command character.
+        }
+        else if (next === '\r') {
+            if (raw[index + 1] === '\n')
+                index++;
+        }
+        else if (next === '\\' || next === "'" || next === '"' || next === '`' || next === '/') {
+            decoded += next;
+        }
+        else {
+            return null;
+        }
+    }
+    return decoded;
+}
+function parseProactiveToolCommandArgv(toolName, input) {
+    if (toolName === 'Bash' || toolName === 'Shell')
+        return parseCodexToolCommandArgv(input);
+    if (toolName !== 'exec')
+        return null;
+    const command = parseCodexExecToolCommand(input);
+    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true }) : null;
+}
 function scanBoundedOutputOperators(command) {
     const operators = [];
     let quote = null;
@@ -489,6 +981,66 @@ const PROACTIVE_SEND_VALUE_FLAGS = new Set([
 const PROACTIVE_SEND_BOOLEAN_FLAGS = new Set([
     '--encrypt', '--no-encrypt', '--mention-all',
 ]);
+const SEND_CONTENT_VALUE_FLAGS = new Set([
+    '--payload', '--title', '--description', '--text', '--transcript',
+]);
+const TRIGGER_CONTENT_VALUE_FLAGS = new Set(['--prompt']);
+/**
+ * A shell-escaped `$TMPDIR` in a msg/group text body or trigger prompt is
+ * ordinary content, not a path reference. Keep every other unresolved
+ * occurrence fail-closed so file and control arguments cannot bypass
+ * managed-path checks.
+ */
+export function containsLiteralManagedTmpDirOutsideSendContent(argv) {
+    const literalIndexes = argv
+        .map((value, index) => value.includes('$TMPDIR') ? index : -1)
+        .filter(index => index >= 0);
+    if (literalIndexes.length === 0)
+        return false;
+    const isSendCommand = argv[0] === 'ec'
+        && (argv[1] === 'msg' || argv[1] === 'group')
+        && argv[2] === 'send';
+    const isTriggerCommand = argv[0] === 'ec' && argv[1] === 'trigger';
+    if (!isSendCommand && !isTriggerCommand)
+        return true;
+    const textIndexes = new Set();
+    if (isTriggerCommand) {
+        for (let index = 2; index < argv.length; index++) {
+            if (!TRIGGER_CONTENT_VALUE_FLAGS.has(argv[index]))
+                continue;
+            if (argv[index + 1] !== undefined)
+                textIndexes.add(index + 1);
+            index++;
+        }
+    }
+    if (!isSendCommand)
+        return literalIndexes.some(index => !textIndexes.has(index));
+    let endOfOptions = false;
+    for (let index = 5; index < argv.length; index++) {
+        const value = argv[index];
+        if (endOfOptions) {
+            textIndexes.add(index);
+            continue;
+        }
+        if (value === '--') {
+            endOfOptions = true;
+            continue;
+        }
+        if (PROACTIVE_SEND_BOOLEAN_FLAGS.has(value))
+            continue;
+        if (PROACTIVE_SEND_VALUE_FLAGS.has(value)) {
+            const operandIndex = ++index;
+            if (SEND_CONTENT_VALUE_FLAGS.has(value) && argv[operandIndex] !== undefined) {
+                textIndexes.add(operandIndex);
+            }
+            continue;
+        }
+        textIndexes.add(index);
+    }
+    if (textIndexes.size === 0)
+        return true;
+    return literalIndexes.some(index => !textIndexes.has(index));
+}
 function hasExecutableProactiveSendPayload(argv, scope) {
     if (!argv || argv[0] !== 'ec' || argv[1] !== scope || argv[2] !== 'send')
         return false;
@@ -610,11 +1162,11 @@ export function isEvolcoreSendCommandForSession(toolName, input, channelId) {
 }
 /** Proactive first-send guard: exact channel kind and current target only. */
 export function isExactEvolcoreSendCommandForSession(toolName, input, channelId, chatType, selfAid) {
-    // Codex hooks use the canonical name `Bash`; the app-server event adapter
-    // exposes the same commandExecution items as `Shell` to the renderer.
-    if ((toolName !== 'Bash' && toolName !== 'Shell') || !selfAid)
+    // Codex app-server exposes shell items as `Shell`; the desktop custom tool
+    // is represented as `exec` and is handled only for one literal inner call.
+    if (!selfAid)
         return false;
-    const argv = parseCodexToolCommandArgv(input);
+    const argv = parseProactiveToolCommandArgv(toolName, input);
     const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed || parsed.action !== 'send')
         return false;

package/dist/core/permission/tool-policy.js

@@ -1348,40 +1348,28 @@ export function evaluateToolPreflight(toolName, input, context) {
             return prepareBoundedOutputInput(input, ecCommand.command, 'ec', context);
         }
         if (ecCommand.kind === 'composite') {
-            // Older app-server approval callbacks may provide only the rendered
-            // `/bin/bash -lc ...` command string.  A composite inside that carrier
-            // is not eligible for a delegation ticket, but owner bypass still
-            // handles it as an ordinary shell request.  Structured `commandArgv`
-            // callbacks remain fail-closed below because their command boundary is
-            // authoritative.
-            const legacyRenderedCarrier = !explicitCommandArgv && wrappedCommand !== undefined;
-            const allowLegacyBypassComposition = legacyRenderedCarrier
-                && context.permissionMode === 'bypass'
-                && ecCommand.issue === 'shell-composition';
-            if (!allowLegacyBypassComposition) {
-                if (ecCommand.issue === 'unsafe-expansion') {
-                    return {
-                        behavior: 'deny',
-                        input,
-                        message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
-                        policyCode: 'ec_shell_unsafe_expansion',
-                    };
-                }
-                if (ecCommand.issue === 'invalid-quote') {
-                    return {
-                        behavior: 'deny',
-                        input,
-                        message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
-                        policyCode: 'ec_shell_invalid_quote',
-                    };
-                }
+            if (ecCommand.issue === 'unsafe-expansion') {
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
-                    policyCode: 'ec_shell_composite_command',
+                    message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
+                    policyCode: 'ec_shell_unsafe_expansion',
                 };
             }
+            if (ecCommand.issue === 'invalid-quote') {
+                return {
+                    behavior: 'deny',
+                    input,
+                    message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
+                    policyCode: 'ec_shell_invalid_quote',
+                };
+            }
+            return {
+                behavior: 'deny',
+                input,
+                message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
+                policyCode: 'ec_shell_composite_command',
+            };
         }
         const boundedOutput = parseBoundedOutputShellCommand(command);
         const hostProcessCommand = boundedOutput